Posts

Introduction # I initially made a blog post called ‘Understanding Kerberoasting’ that I since removed because I feel it didn’t quite go into enough detail and cover everything I wanted it to.

Introduction # We have talked about CSRF and XSS before, but here we will focus on exploits in modern web applications that typically require the writing of custom payloads for accomplishing specific tasks. We also want to walk through the common security measures in web applications like Same-Origin Policy, Cross-Origin Resource Sharing, SameSite Cookies, and so on. The reason CSRF and XSS are often paired together in this context is because forging a request on another user’s behalf often involves multiple steps other than just clicking on a link, stored XSS (or in some cases reflected XSS) can be used to deliver a CSRF payload to a victim.

I am again making an applied review blog post series (and maybe video series) for the modules used to prepare for the CWEE exam. Each one will go over one of the modules from HTB Academy, then include some examples from vulnerable machines and CTF challenges.

Mobile Hacking Exams in 2025 # First, let’s go over some public information about the exam (and others like it) and why you might want to take it.

What is a WebView? # We know that android applications can interact with websites by using an intent with ACTION.VIEW and a URL which will start a browser and load a website. Sometimes just opening a website isn’t enough though and android provides WebViews and CustomTabs to try and make more complex interaction possible. WebViews are generally used when a website is embedded into an application, especially when there is a lot of crossover between the website’s JavaScript and the Java app code. In fact, in the past this interface was regarded as so insecure that you could achieve full arbitrary Java code execution - but this has not been an issue in modern android for quite some time. For CustomTabs, the website is not embedded within the app itself and the app communicates with a browser app (usually chrome) and renders the site in a overlay over the app. CustomTabs are also much more limited in the types of interaction which of course helps minimize the attack surface.

We will look at how android applications store files and further have access to the file system of the device. We will focus mostly around the internal storage, external storage, and the keychain. Internal storage also contains things we are already familiar with like shared preferences, the cache files, and databases - some of the things discussed here will tie back to Content Providers, so keep that in mind as we continue.

What is a Service? # A service is defined as an application component that can perform long-running operations in the background, not providing a user interface. They are typically used when an application wants to perform some long-running operation where user interaction isn’t needed or to provide functionality to some other application.

Overview # So far we have only examined whether or not apps are exported. For example, non-exported activities can’t be started and are used by the app internally - so we generally ignore these unless there is some intent redirect or pending intent we can see. So as a developer a very potent way to reduce the attack surface is to export as few components as possible - if it doesn’t need to be exported, don’t export it. There are however other cases where an app wants to export some activity, but only to some select applications and that is where the android permissions system comes into play.

What is a Broadcast Receiver? # Android applications can send and receive broadcast messages from both the operating system and other android applications. For example, the system automatically sends broadcasts when certain system events occur, like switching in and out of airplane mode - where each app who is subscribed to that event (through the process of registering a receiver) will receive those broadcasts.

What is a Content Provider? # A Content Provider presents data to external applications as one or more tables - where a row represents an instance of some type of data that the provider collects and a column in the row represents an individual piece of data collected for a given instance. So content providers coordinate access to your application’s data storage layer for multiple APIs and components such as:

Preface # Similar to the last few android pentesting blog posts - this is heavily based off of the Hextree.io course on the topic. I am documenting this simply to help myself practice and try to understand the topics on a deeper level.

What is Dynamic Instrumentation? # The more straight forward approach of understanding these android applications is by decompiling them and examining the code - after all the apk is just an archive. The issue is that some of these applications can be too large to understand, obfuscated or packed, or full of useless logic.

The Flow Chart # We need a bit more than just a proxy and a neat interception tool like Burp Suite in order to inspect the traffic of some android applications. Let’s examine this flow chart from hextree.io:

I think that because mobile application testing is somewhat of a niche, the security considerations for mobile devices are also less understood. Not to mention the lack of well-made learning materials and certifications - from what I am able to find out, most of these resources only really scratch the surface when there is a lot more to learn.

This is an easy-difficulty mobile challenge - and here is the description: This app has stored my credentials and I can only login automatically. I tried to intercept the login request and restore my password, but this seems to be a secure connection. Can you help bypass this security restriction and intercept the password in plaintext?

Introduction # We’ve already learned a decent amount about of introductory information about OS command injection when we were studying for the Burp Suite Certified Practitioner Exam. That blog post can be found here, but today I want to go through some topics and techniques showcased in the HTB Academy module focused around command injections.

This blog post is meant to provide a value assessment and a review of my experience going through the course material and taking the PNPT exam.

As always we start with a port scan: ╰─ nmap -sC -sV 10.129.230.179 Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-05-29 17:54 CDT Nmap scan report for 10.129.230.179 Host is up (0.030s latency). Not shown: 987 closed tcp ports (conn-refused) PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 80/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2024-05-29 22:55:04Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: analysis.htb0., Site: Default-First-Site-Name) 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: analysis.htb0., Site: Default-First-Site-Name) 3269/tcp open tcpwrapped 3306/tcp open mysql MySQL (unauthorized) Service Info: Host: DC-ANALYSIS; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: |_clock-skew: 1s | smb2-time: | date: 2024-05-29T22:55:07 |_ start_date: N/A | smb2-security-mode: | 3:1:1: |_ Message signing enabled and required Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 25.61 seconds The first thing that catches my eye is analysis.htb being used for LDAP and we can add it to our /etc/hosts file to see the site:

IPv6 DNS Takeover # Another internal attack vector we should keep in mind has to do with IPv6 and how it is configured with DHCP. Most of the time in enterprise networks we use IPv4 addresses because they are what most people are used to using and what many services are configured to use by default.

What is LLMNR? # LLMNR (Link-Local Multicast Name Resolution) is one of multiple local host resolution protocols. These protocols are based on the DNS packet format that allows both IPv4 and IPv6 hosts to perform name resolution for hosts on the same internal network.

In this challenge we are greeted with a web page:

Introduction # To preface this post, I want to briefly describe my level of experience to help others who might take this exam better benchmark how long it might take them to study.

What is Prototype Pollution? # This type of vulnerability allows attackers to add arbitrary properties to global object prototypes that can be inherited by user-defined objects.

We run a port scan and see that something is running on port 80:

What is a JWT? # JSON web tokens (JWTs) are a standardized way to send some kind of cryptographically signed JSON data between systems. They can really contain any kind of data but are often used to determine if a claim being sent by an application was sent by the real application.

What is the HTTP Host Header? # HTTP host headers are mandatory request headers that specify the domain name the client is trying to access. For example, when you visit https://vulnerable.com/blog, the browser makes a request like this:

What is OAuth? # If you’ve ever looked around the web and found a site that allows you to sign in with your social media account, chances are that the feature being used there was build on the OAuth 2.0 framework. OAuth is used to request limited access to a user’s account on some other application. More importantly, this allows the user to grant access to an application without exposing their login credentials.

What is HTTP Request Smuggling? # HTTP request smuggling is a technique that interferes with the way a web application will process sequences of HTTP requests received from one or more users.

What is Web Cache Poisoning? # This is a technique where we can get the target web server and its cache in order to serve a harmful HTTP response to other users. This typically involves two steps - we need to get the web server to respond with some dangerous payload, then verify that this response is cached and served to other users.

What is SSTi? # Server-Side Template Injection (SSTi) is when an attacker is able to inject some native template syntax into a template, which is exceed as code by the server.

As always, we can begin with a port scan: ╰─ nmap -sC -sV 10.129.75.158 Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-01-07 22:32 CST Nmap scan report for 10.129.75.158 Host is up (0.031s latency). Not shown: 997 closed tcp ports (conn-refused) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.4p1 Debian 5+deb11u3 (protocol 2.0) | ssh-hostkey: | 3072 3e:21:d5:dc:2e:61:eb:8f:a6:3b:24:2a:b7:1c:05:d3 (RSA) | 256 39:11:42:3f:0c:25:00:08:d7:2f:1b:51:e0:43:9d:85 (ECDSA) |_ 256 b0:6f:a0:0a:9e:df:b1:7a:49:78:86:b2:35:40:ec:95 (ED25519) 80/tcp open http nginx 1.18.0 |_http-server-header: nginx/1.18.0 |_http-title: Did not follow redirect to https://bizness.htb/ 443/tcp open ssl/http nginx 1.18.0 | tls-nextprotoneg: |_ http/1.1 |_ssl-date: TLS randomness does not represent time | tls-alpn: |_ http/1.1 |_http-server-header: nginx/1.18.0 | ssl-cert: Subject: organizationName=Internet Widgits Pty Ltd/stateOrProvinceName=Some-State/countryName=UK | Not valid before: 2023-12-14T20:03:40 |_Not valid after: 2328-11-10T20:03:40 |_http-title: Did not follow redirect to https://bizness.htb/ Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 18.46 seconds Let’s go ahead and add bizness.htb to our /etc/hosts file and look at the site.

What is GraphQL? # GraphQL is a query language designed to provide efficient communication between clients and servers by having the client specify exactly what data they want in the response. This helps avoid overly large responses that you might see with other queries.

What is Serialization? # As the name suggests, serialization is the process of converting complex data into a simpler format that can be send as a stream of bytes. This makes it easier to write complex data into memory, files, or databases. It also simplifies the process of sending complex data over a network connection that varies in which components need to be sent.

What is the DOM? # The document object model is a web browser’s representation of the elements on the page. Websites use JavaScript to manipulate nodes and objects in the DOM, and if an attacker controlled value is passed from a source into a dangerous function (or a sink), that is when a vulnerability would arise.

What is a Web Socket? # WS (WebSockets) are widely used in modern web applications because they can initiate long-lived sessions over HTTP with asynchronous communication in both directions.

What is an API? # Application Programming Interfaces (APIs) allow for different software systems and applications to share data. An example of this might be a weather application, the application logic doesn’t have the inherent ability to determine the weather but it rather makes calls to some weather forecast API that is responsible for returning accurate data based on the request.

What is CSRF? # Cross-site request forgery allows an attacker to perform any actions that a normal user is able to. These attacks, when performed properly, can cause an end user to execute unwanted actions on a web application that they are authenticated to.

Before we get into the content here I want to clarify that I wasn’t able to find any CTF-type examples of clickjacking, so if you know of one please let me know.

What is CORS? # Cross-origin resource sharing (CORS) is a browser mechanism that allows for controlled access to resources located outside the original domain. It is meant to add flexibility to the same-origin policy.

This is going to be a longer post, so I am leaving out some more intuitive pieces of information like explaining impact and testing strategies because I think if you understand everything here, the other things will come naturally. There will also only be one lab here because I wasn’t able to find that many diverse CTF examples.

We can start with a port scan: ╰─ nmap -sC -sV 10.129.55.122 Starting Nmap 7.94SVN ( https://nmap.org ) at 2023-11-26 15:03 CST Nmap scan report for 10.129.55.122 Host is up (0.031s latency). Not shown: 998 closed tcp ports (conn-refused) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.9 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 3072 48:ad:d5:b8:3a:9f:bc:be:f7:e8:20:1e:f6:bf:de:ae (RSA) | 256 b7:89:6c:0b:20:ed:49:b2:c1:86:7c:29:92:74:1c:1f (ECDSA) |_ 256 18:cd:9d:08:a6:21:a8:b8:b6:f7:9f:8d:40:51:54:fb (ED25519) 80/tcp open http nginx 1.18.0 (Ubuntu) |_http-title: Did not follow redirect to http://devvortex.htb/ |_http-server-header: nginx/1.18.0 (Ubuntu) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 8.01 seconds We can add devvortex.htb to our hosts file but we don’t see much of anything interesting even after some directory enumeration.

What is NoSQL Injection? # These types of attacks occur when attackers interfere with the queries that the web application sends to a NoSQL database. This could lead to authentication bypass, exfiltration of data, modification of data, denial of service, or possible code execution.

What is XML External Entity Injection (XXE)? # This vulnerability has to do with how certain web applications process XML data. If attackers are able to exploit this vulnerability, they can often view files on the application’s file system, and potentially run system commands or interact with other back-end systems.

What is Server Side Request Forgery? # SSRF is a vulnerability that allows attackers to cause the application to make requests to an unintended location from the server that the application is running on.

We can start with a port scan as we always do: ╰─ nmap -sC -sV 10.129.83.21 Starting Nmap 7.94 ( https://nmap.org ) at 2023-11-05 20:25 CST Nmap scan report for 10.129.83.21 Host is up (0.031s latency). Not shown: 997 closed tcp ports (conn-refused) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.4 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 256 96:07:1c:c6:77:3e:07:a0:cc:6f:24:19:74:4d:57:0b (ECDSA) |_ 256 0b:a4:c0:cf:e2:3b:95:ae:f6:f5:df:7d:0c:88:d6:ce (ED25519) 80/tcp open http Apache httpd 2.4.52 |_http-title: Did not follow redirect to http://codify.htb/ |_http-server-header: Apache/2.4.52 (Ubuntu) 3000/tcp open http Node.js Express framework |_http-title: Codify Service Info: Host: codify.htb; OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 10.37 seconds We can add codify.htb to our hosts file and take a look:

What Are Race Conditions? # Race conditions are relatively common and are closely related to business logic flaws.

What Are File Upload Vulnerabilities? # These vulnerabilities are often present when web applications contain file upload functionality that do not sufficiently validate things like the file’s name, type, contents, or size.

What is Access Control? # Access control is how we describe the constraints that we place on an authorized user in the context of accessing resources and performing actions.

As always, we will start off with a port scan: ╰─ nmap -sC -sV 10.129.59.198 Starting Nmap 7.94SVN ( https://nmap.org ) at 2023-12-06 18:42 CST Nmap scan report for 10.129.59.198 Host is up (0.031s latency). Not shown: 987 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 80/tcp open http Microsoft IIS httpd 10.0 |_http-server-header: Microsoft-IIS/10.0 |_http-title: Manager | http-methods: |_ Potentially risky methods: TRACE 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2023-12-07 07:42:34Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: manager.htb0., Site: Default-First-Site-Name) | ssl-cert: Subject: commonName=dc01.manager.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc01.manager.htb | Not valid before: 2023-07-30T13:51:28 |_Not valid after: 2024-07-29T13:51:28 |_ssl-date: 2023-12-07T07:43:54+00:00; +7h00m00s from scanner time. 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: manager.htb0., Site: Default-First-Site-Name) |_ssl-date: 2023-12-07T07:43:55+00:00; +7h00m00s from scanner time. | ssl-cert: Subject: commonName=dc01.manager.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc01.manager.htb | Not valid before: 2023-07-30T13:51:28 |_Not valid after: 2024-07-29T13:51:28 1433/tcp open ms-sql-s Microsoft SQL Server 2019 15.00.2000.00; RTM | ms-sql-ntlm-info: | 10.129.59.198:1433: | Target_Name: MANAGER | NetBIOS_Domain_Name: MANAGER | NetBIOS_Computer_Name: DC01 | DNS_Domain_Name: manager.htb | DNS_Computer_Name: dc01.manager.htb | DNS_Tree_Name: manager.htb |_ Product_Version: 10.0.17763 |_ssl-date: 2023-12-07T07:43:54+00:00; +7h00m00s from scanner time. | ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback | Not valid before: 2023-12-07T07:41:33 |_Not valid after: 2053-12-07T07:41:33 | ms-sql-info: | 10.129.59.198:1433: | Version: | name: Microsoft SQL Server 2019 RTM | number: 15.00.2000.00 | Product: Microsoft SQL Server 2019 | Service pack level: RTM | Post-SP patches applied: false |_ TCP port: 1433 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: manager.htb0., Site: Default-First-Site-Name) | ssl-cert: Subject: commonName=dc01.manager.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc01.manager.htb | Not valid before: 2023-07-30T13:51:28 |_Not valid after: 2024-07-29T13:51:28 |_ssl-date: 2023-12-07T07:43:54+00:00; +7h00m00s from scanner time. 3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: manager.htb0., Site: Default-First-Site-Name) | ssl-cert: Subject: commonName=dc01.manager.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc01.manager.htb | Not valid before: 2023-07-30T13:51:28 |_Not valid after: 2024-07-29T13:51:28 |_ssl-date: 2023-12-07T07:43:55+00:00; +7h00m00s from scanner time. Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb2-security-mode: | 3:1:1: |_ Message signing enabled and required |_clock-skew: mean: 6h59m59s, deviation: 0s, median: 6h59m59s | smb2-time: | date: 2023-12-07T07:43:18 |_ start_date: N/A Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 91.34 seconds Alright, we’ve got a few things to look into:

What Are Business Logic Vulnerabilities # Business logic vulnerabilities are flaws in the design or implementation of an application that let attackers produce unintended behavior.

To read this post, enter the root user’s password hash ("$6…k1"). We start off with a port scan:

Information disclosures seem to be highly contextual depending on where you find them and what kinds of protections are in place. Either way, we will go over some common areas to look for information disclosure and how you could exploit it.

What is OS Command Injection? # This type of command injection allows attackers to execute system commands on the server that is running the vulnerable application.

This will be one of the much shorter entries in the list of applied review sections because path traversal is pretty straight forward.

We start by scanning for open ports: ╰─ nmap -sC -sV 10.129.187.65 Starting Nmap 7.94 ( https://nmap.org ) at 2023-11-05 19:24 CST Nmap scan report for 10.129.187.65 Host is up (0.030s latency). Not shown: 999 closed tcp ports (conn-refused) PORT STATE SERVICE VERSION 80/tcp open http nginx 1.18.0 (Ubuntu) |_http-server-header: nginx/1.18.0 (Ubuntu) |_http-title: Did not follow redirect to http://analytical.htb/ Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 7.65 seconds We can analytical.htb to our hosts file and look at the web application.

For this applied review, we are going to go through authentication, which is an important part of securing your web applications.

The goal of this applied review is to review over SQL injection techniques taught in the PortSwigger labs and to apply those strategies to CTF challenges.

We start with a port scan: ╰─ nmap -sC -sV 10.129.86.90 Starting Nmap 7.94 ( https://nmap.org ) at 2023-10-14 20:03 EDT Nmap scan report for 10.129.86.90 Host is up (0.033s latency). Not shown: 999 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 80/tcp open http Apache httpd 2.4.56 ((Win64) OpenSSL/1.1.1t PHP/8.1.17) |_http-server-header: Apache/2.4.56 (Win64) OpenSSL/1.1.1t PHP/8.1.17 |_http-title: Visual - Revolutionizing Visual Studio Builds Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 16.14 seconds It looks like there is just one port open on HTTP, let’s give it a look:

Enumeration # We can get started with a port scan:

We can begin with a port scan as usual: ╰─ nmap -sC -sV 10.129.110.213 Starting Nmap 7.94 ( https://nmap.org ) at 2023-09-04 10:17 EDT Nmap scan report for 10.129.110.213 Host is up (0.030s latency). Not shown: 998 closed tcp ports (conn-refused) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.3 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 256 43:56:bc:a7:f2:ec:46:dd:c1:0f:83:30:4c:2c:aa:a8 (ECDSA) |_ 256 6f:7a:6c:3f:a6:8d:e2:75:95:d4:7b:71:ac:4f:7e:42 (ED25519) 80/tcp open http nginx 1.18.0 (Ubuntu) |_http-title: Did not follow redirect to http://cozyhosting.htb |_http-server-header: nginx/1.18.0 (Ubuntu) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 8.03 seconds We can add cozyhosting.htb to our /etc/hosts file and take a look at the site.

We can begin with a port scan: ╰─ nmap -sC -sV 10.129.171.3 Starting Nmap 7.94 ( https://nmap.org ) at 2023-08-27 18:12 EDT Nmap scan report for 10.129.171.3 Host is up (0.030s latency). Not shown: 998 closed tcp ports (conn-refused) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 9.0p1 Ubuntu 1ubuntu7.3 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 256 9d:6e:ec:02:2d:0f:6a:38:60:c6:aa:ac:1e:e0:c2:84 (ECDSA) |_ 256 eb:95:11:c7:a6:fa:ad:74:ab:a2:c5:f6:a4:02:18:41 (ED25519) 80/tcp open http Apache httpd 2.4.54 ((Ubuntu)) |_http-server-header: Apache/2.4.54 (Ubuntu) |_http-title: Zipping | Watch store Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 8.28 seconds If you look around on the page and look at the products tab in the shop, you’ll see a juicy potential for LFI in the URL:

We can start out with a port scan: ╰─ nmap -sC -sV 10.129.121.185 Starting Nmap 7.94 ( https://nmap.org ) at 2023-08-18 15:25 EDT Nmap scan report for 10.129.121.185 Host is up (0.030s latency). Not shown: 998 closed tcp ports (conn-refused) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.3 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 256 35:39:d4:39:40:4b:1f:61:86:dd:7c:37:bb:4b:98:9e (ECDSA) |_ 256 1a:e9:72:be:8b:b1:05:d5:ef:fe:dd:80:d8:ef:c0:66 (ED25519) 80/tcp open http nginx 1.18.0 (Ubuntu) |_http-title: Site doesn't have a title (text/html). |_http-server-header: nginx/1.18.0 (Ubuntu) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 8.00 seconds We see open ports for SSH and HTTP, let’s curl the site and see what is there:

We begin with a port scan: ╰─ nmap -sC -sV 10.129.140.87 Starting Nmap 7.94 ( https://nmap.org ) at 2023-08-08 20:59 EDT Nmap scan report for 10.129.140.87 Host is up (0.030s latency). Not shown: 998 closed tcp ports (conn-refused) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.8 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 3072 cc:f1:63:46:e6:7a:0a:b8:ac:83:be:29:0f:d6:3f:09 (RSA) | 256 2c:99:b4:b1:97:7a:8b:86:6d:37:c9:13:61:9f:bc:ff (ECDSA) |_ 256 e6:ff:77:94:12:40:7b:06:a2:97:7a:de:14:94:5b:ae (ED25519) 80/tcp open http nginx 1.18.0 (Ubuntu) |_http-server-header: nginx/1.18.0 (Ubuntu) |_http-title: Did not follow redirect to http://download.htb Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 9.04 seconds We see that we are being redirected to download.htb on port 80, so let’s add that to our hosts file and look at the site in our browser:

As always, we can begin with a port scan: ╰─ nmap -sC -sV 10.129.145.189 Starting Nmap 7.94 ( https://nmap.org ) at 2023-07-31 18:37 EDT Nmap scan report for 10.129.145.189 Host is up (0.027s latency). Not shown: 995 closed tcp ports (conn-refused) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.4p1 Debian 5+deb11u1 (protocol 2.0) | ssh-hostkey: | 3072 aa:25:82:6e:b8:04:b6:a9:a9:5e:1a:91:f0:94:51:dd (RSA) | 256 18:21:ba:a7:dc:e4:4f:60:d7:81:03:9a:5d:c2:e5:96 (ECDSA) |_ 256 a4:2d:0d:45:13:2a:9e:7f:86:7a:f6:f7:78:bc:42:d9 (ED25519) 25/tcp filtered smtp 80/tcp open http Apache httpd 2.4.56 |_http-server-header: Apache/2.4.56 (Debian) |_http-title: Did not follow redirect to http://gofer.htb/ 139/tcp open netbios-ssn Samba smbd 4.6.2 445/tcp open netbios-ssn Samba smbd 4.6.2 Service Info: Host: gofer.htb; OS: Linux; CPE: cpe:/o:linux:linux_kernel Host script results: |_clock-skew: 13s | smb2-security-mode: | 3:1:1: |_ Message signing enabled but not required | smb2-time: | date: 2023-07-31T22:37:37 |_ start_date: N/A |_nbstat: NetBIOS name: GOFER, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown) Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 14.17 seconds So, we see SSH, a mail server, HTTP on port 80, and some samba shares. We can add gofer.htb to our /etc/hosts file and look around at the site.

We can begin with a port scan as usual: ╰─ nmap -sC -sV 10.129.158.17 Starting Nmap 7.94 ( https://nmap.org ) at 2023-07-17 16:21 EDT Nmap scan report for 10.129.158.17 Host is up (0.030s latency). Not shown: 987 closed tcp ports (conn-refused) PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 80/tcp open http Microsoft IIS httpd 10.0 | http-methods: |_ Potentially risky methods: TRACE |_http-title: IIS Windows Server |_http-server-header: Microsoft-IIS/10.0 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2023-07-18 00:22:09Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: authority.htb, Site: Default-First-Site-Name) | ssl-cert: Subject: | Subject Alternative Name: othername: UPN::AUTHORITY$@htb.corp, DNS:authority.htb.corp, DNS:htb.corp, DNS:HTB | Not valid before: 2022-08-09T23:03:21 |_Not valid after: 2024-08-09T23:13:21 |_ssl-date: 2023-07-18T00:22:59+00:00; +4h00m01s from scanner time. 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: authority.htb, Site: Default-First-Site-Name) | ssl-cert: Subject: | Subject Alternative Name: othername: UPN::AUTHORITY$@htb.corp, DNS:authority.htb.corp, DNS:htb.corp, DNS:HTB | Not valid before: 2022-08-09T23:03:21 |_Not valid after: 2024-08-09T23:13:21 |_ssl-date: 2023-07-18T00:22:58+00:00; +4h00m00s from scanner time. 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: authority.htb, Site: Default-First-Site-Name) |_ssl-date: 2023-07-18T00:22:59+00:00; +4h00m01s from scanner time. | ssl-cert: Subject: | Subject Alternative Name: othername: UPN::AUTHORITY$@htb.corp, DNS:authority.htb.corp, DNS:htb.corp, DNS:HTB | Not valid before: 2022-08-09T23:03:21 |_Not valid after: 2024-08-09T23:13:21 3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: authority.htb, Site: Default-First-Site-Name) | ssl-cert: Subject: | Subject Alternative Name: othername: UPN::AUTHORITY$@htb.corp, DNS:authority.htb.corp, DNS:htb.corp, DNS:HTB | Not valid before: 2022-08-09T23:03:21 |_Not valid after: 2024-08-09T23:13:21 |_ssl-date: 2023-07-18T00:22:58+00:00; +4h00m00s from scanner time. 8443/tcp open ssl/https-alt |_ssl-date: TLS randomness does not represent time |_http-title: Site doesnt have a title (text/html;charset=ISO-8859-1). | ssl-cert: Subject: commonName=172.16.2.118 | Not valid before: 2023-07-15T23:33:09 |_Not valid after: 2025-07-17T11:11:33 | fingerprint-strings: | FourOhFourRequest, GetRequest: | HTTP/1.1 200 | Content-Type: text/html;charset=ISO-8859-1 | Content-Length: 82 | Date: Tue, 18 Jul 2023 00:22:16 GMT | Connection: close | <html><head><meta http-equiv="refresh" content="0;URL='/pwm'"/></head></html> | HTTPOptions: | HTTP/1.1 200 | Allow: GET, HEAD, POST, OPTIONS | Content-Length: 0 | Date: Tue, 18 Jul 2023 00:22:16 GMT | Connection: close | RTSPRequest: | HTTP/1.1 400 | Content-Type: text/html;charset=utf-8 | Content-Language: en | Content-Length: 1936 | Date: Tue, 18 Jul 2023 00:22:21 GMT | Connection: close | <!doctype html><html lang="en"><head><title>HTTP Status 400 ---SNIP--- Service Info: Host: AUTHORITY; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb2-security-mode: | 3:1:1: |_ Message signing enabled and required | smb2-time: | date: 2023-07-18T00:22:49 |_ start_date: N/A |_clock-skew: mean: 4h00m00s, deviation: 0s, median: 3h59m59s Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 61.98 seconds So we see some LDAP, SMB, RPC, and some more seemingly standard stuff like DNS and Kerberos. We do see a few ports for HTTP on 80 and 8443.

As always, we begin with a port scan: ╰─ nmap -sC -sV 10.129.186.83 Starting Nmap 7.94 ( https://nmap.org ) at 2023-07-09 19:33 EDT Nmap scan report for 10.129.186.83 Host is up (0.029s latency). Not shown: 997 closed tcp ports (conn-refused) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.7 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 3072 aa:88:67:d7:13:3d:08:3a:8a:ce:9d:c4:dd:f3:e1:ed (RSA) | 256 ec:2e:b1:05:87:2a:0c:7d:b1:49:87:64:95:dc:8a:21 (ECDSA) |_ 256 b3:0c:47:fb:a2:f2:12:cc:ce:0b:58:82:0e:50:43:36 (ED25519) 80/tcp filtered http 55555/tcp open unknown | fingerprint-strings: | FourOhFourRequest: | HTTP/1.0 400 Bad Request | Content-Type: text/plain; charset=utf-8 | X-Content-Type-Options: nosniff | Date: Sun, 09 Jul 2023 23:33:58 GMT | Content-Length: 75 | invalid basket name; the name does not match pattern: ^[wd-_\.]{1,250}$ | GenericLines, Help, Kerberos, LDAPSearchReq, LPDString, RTSPRequest, SSLSessionReq, TLSSessionReq, TerminalServerCookie: | HTTP/1.1 400 Bad Request | Content-Type: text/plain; charset=utf-8 | Connection: close | Request | GetRequest: | HTTP/1.0 302 Found | Content-Type: text/html; charset=utf-8 | Location: /web | Date: Sun, 09 Jul 2023 23:33:32 GMT | Content-Length: 27 | href="/web">Found</a>. | HTTPOptions: | HTTP/1.0 200 OK | Allow: GET, OPTIONS | Date: Sun, 09 Jul 2023 23:33:32 GMT |_ Content-Length: 0 ---SNIP--- Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 91.74 seconds We see that SSH is running and that there is a web server running on port 55555. Let’s take a look at the site:

Enumeration # As always, we can begin with a port scan using nmap:

Sandworm is a medium difficulty Linux machine that kicks off the start of the second competitive season on HTB.

Enumeration # As always, we begin with a port scan:

We start with a port scan as we normally do: ╰─ nmap -sC -sV 10.129.49.213 Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-01-16 20:24 CST Nmap scan report for 10.129.49.213 Host is up (0.031s latency). Not shown: 998 closed tcp ports (conn-refused) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.9 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 3072 81:1d:22:35:dd:21:15:64:4a:1f:dc:5c:9c:66:e5:e2 (RSA) | 256 01:f9:0d:3c:22:1d:94:83:06:a4:96:7a:01:1c:9e:a1 (ECDSA) |_ 256 64:7d:17:17:91:79:f6:d7:c4:87:74:f8:a2:16:f7:cf (ED25519) 80/tcp open http nginx 1.18.0 (Ubuntu) |_http-title: Did not follow redirect to http://bookworm.htb |_http-server-header: nginx/1.18.0 (Ubuntu) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 9.32 seconds We can add bookworm.htb to our hosts file and take a look at the site. It appears to be a website where we can buy books, so let’s make an account and see what we can do.

We begin with a port scan: └─ nmap -sC -sV 10.129.189.160 Starting Nmap 7.93 ( https://nmap.org ) at 2023-05-09 21:50 EDT Nmap scan report for 10.129.189.160 Host is up (0.040s latency). Not shown: 997 closed tcp ports (conn-refused) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.1 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 256 ee6bcec5b6e3fa1b97c03d5fe3f1a16e (ECDSA) |_ 256 545941e1719a1a879c1e995059bfe5ba (ED25519) 53/tcp open domain ISC BIND 9.18.12-0ubuntu0.22.04.1 (Ubuntu Linux) | dns-nsid: |_ bind.version: 9.18.12-0ubuntu0.22.04.1-Ubuntu 80/tcp open http nginx 1.18.0 (Ubuntu) |_http-server-header: nginx/1.18.0 (Ubuntu) |_http-title: SnoopySec Bootstrap Template - Index Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 15.31 seconds

Begin with a port scan: └─$ nmap -sC -sV -Pn 10.129.69.238 Starting Nmap 7.93 ( https://nmap.org ) at 2023-04-06 13:46 EDT Nmap scan report for 10.129.69.238 Host is up (0.039s latency). Not shown: 987 closed tcp ports (conn-refused) PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 80/tcp open http Microsoft IIS httpd 10.0 | http-methods: |_ Potentially risky methods: TRACE |_http-title: IIS Windows Server |_http-server-header: Microsoft-IIS/10.0 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2023-04-07 01:46:13Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: coder.htb0., Site: Default-First-Site-Name) | ssl-cert: Subject: commonName=dc01.coder.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc01.coder.htb | Not valid before: 2022-06-30T04:24:26 |_Not valid after: 2023-06-30T04:24:26 |_ssl-date: 2023-04-07T01:46:59+00:00; +7h59m34s from scanner time. 443/tcp open ssl/http Microsoft IIS httpd 10.0 | http-methods: |_ Potentially risky methods: TRACE |_ssl-date: 2023-04-07T01:47:00+00:00; +7h59m35s from scanner time. |_http-title: IIS Windows Server |_http-server-header: Microsoft-IIS/10.0 | ssl-cert: Subject: commonName=default-ssl/organizationName=HTB/stateOrProvinceName=CA/countryName=US | Not valid before: 2022-11-04T17:25:43 |_Not valid after: 2032-11-01T17:25:43 | tls-alpn: |_ http/1.1 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open ssl/ldap |_ssl-date: 2023-04-07T01:46:59+00:00; +7h59m34s from scanner time. | ssl-cert: Subject: commonName=dc01.coder.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc01.coder.htb | Not valid before: 2022-06-30T04:24:26 |_Not valid after: 2023-06-30T04:24:26 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: coder.htb0., Site: Default-First-Site-Name) |_ssl-date: 2023-04-07T01:47:00+00:00; +7h59m35s from scanner time. | ssl-cert: Subject: commonName=dc01.coder.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc01.coder.htb | Not valid before: 2022-06-30T04:24:26 |_Not valid after: 2023-06-30T04:24:26 3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: coder.htb0., Site: Default-First-Site-Name) |_ssl-date: 2023-04-07T01:46:59+00:00; +7h59m34s from scanner time. | ssl-cert: Subject: commonName=dc01.coder.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc01.coder.htb | Not valid before: 2022-06-30T04:24:26 |_Not valid after: 2023-06-30T04:24:26 Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb2-security-mode: | 311: |_ Message signing enabled and required |_clock-skew: mean: 7h59m34s, deviation: 0s, median: 7h59m33s | smb2-time: | date: 2023-04-07T01:46:51 |_ start_date: N/A Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 64.60 seconds From here, go ahead and add dc01.coder.htb and coder.htb to your hosts file.

We begin with a port scan: └─$ sudo nmap -sV -Pn 10.129.25.141 Starting Nmap 7.93 ( https://nmap.org ) at 2023-02-26 17:36 EST Nmap scan report for 10.129.25.141 Host is up (0.039s latency). Not shown: 988 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2023-02-27 06:36:48Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name) 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name) 1433/tcp open ms-sql-s Microsoft SQL Server 2019 15.00.2000 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name) 3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name) Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 51.26 seconds We’ve got a lot of options here, I want to try listing the SMB (Port 139 and 445) shares using smbclient. I will see what is available without giving a password:

We can begin with an nmap scan: └─$ nmap -sC -sV 10.129.9.176 Starting Nmap 7.93 ( https://nmap.org ) at 2023-01-21 14:00 EST Nmap scan report for 10.129.9.176 Host is up (0.038s latency). Not shown: 998 closed tcp ports (conn-refused) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 3072 2f1e6306aa6ebbcc0d19d4152674c6d9 (RSA) | 256 274520add2faa73a8373d97c79abf30b (ECDSA) |_ 256 4245eb916e21020617b2748bc5834fe0 (ED25519) 80/tcp open http Apache httpd 2.4.41 |_http-server-header: Apache/2.4.41 (Ubuntu) |_http-title: Did not follow redirect to http://eforenzics.htb/ Service Info: Host: eforenzics.htb; OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 9.90 seconds Add http://eforenzics.htb/ to our /etc/hosts folder. Then we can go take a look at the website: