Htb

This is an easy-difficulty mobile challenge - and here is the description: This app has stored my credentials and I can only login automatically. I tried to intercept the login request and restore my password, but this seems to be a secure connection. Can you help bypass this security restriction and intercept the password in plaintext?

As always we start with a port scan: ╰─ nmap -sC -sV 10.129.230.179 Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-05-29 17:54 CDT Nmap scan report for 10.129.230.179 Host is up (0.030s latency). Not shown: 987 closed tcp ports (conn-refused) PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 80/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2024-05-29 22:55:04Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: analysis.htb0., Site: Default-First-Site-Name) 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: analysis.htb0., Site: Default-First-Site-Name) 3269/tcp open tcpwrapped 3306/tcp open mysql MySQL (unauthorized) Service Info: Host: DC-ANALYSIS; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: |_clock-skew: 1s | smb2-time: | date: 2024-05-29T22:55:07 |_ start_date: N/A | smb2-security-mode: | 3:1:1: |_ Message signing enabled and required Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 25.61 seconds The first thing that catches my eye is analysis.htb being used for LDAP and we can add it to our /etc/hosts file to see the site:

In this challenge we are greeted with a web page:

We run a port scan and see that something is running on port 80:

As always, we can begin with a port scan: ╰─ nmap -sC -sV 10.129.75.158 Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-01-07 22:32 CST Nmap scan report for 10.129.75.158 Host is up (0.031s latency). Not shown: 997 closed tcp ports (conn-refused) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.4p1 Debian 5+deb11u3 (protocol 2.0) | ssh-hostkey: | 3072 3e:21:d5:dc:2e:61:eb:8f:a6:3b:24:2a:b7:1c:05:d3 (RSA) | 256 39:11:42:3f:0c:25:00:08:d7:2f:1b:51:e0:43:9d:85 (ECDSA) |_ 256 b0:6f:a0:0a:9e:df:b1:7a:49:78:86:b2:35:40:ec:95 (ED25519) 80/tcp open http nginx 1.18.0 |_http-server-header: nginx/1.18.0 |_http-title: Did not follow redirect to https://bizness.htb/ 443/tcp open ssl/http nginx 1.18.0 | tls-nextprotoneg: |_ http/1.1 |_ssl-date: TLS randomness does not represent time | tls-alpn: |_ http/1.1 |_http-server-header: nginx/1.18.0 | ssl-cert: Subject: organizationName=Internet Widgits Pty Ltd/stateOrProvinceName=Some-State/countryName=UK | Not valid before: 2023-12-14T20:03:40 |_Not valid after: 2328-11-10T20:03:40 |_http-title: Did not follow redirect to https://bizness.htb/ Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 18.46 seconds Let’s go ahead and add bizness.htb to our /etc/hosts file and look at the site.

We can start with a port scan: ╰─ nmap -sC -sV 10.129.55.122 Starting Nmap 7.94SVN ( https://nmap.org ) at 2023-11-26 15:03 CST Nmap scan report for 10.129.55.122 Host is up (0.031s latency). Not shown: 998 closed tcp ports (conn-refused) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.9 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 3072 48:ad:d5:b8:3a:9f:bc:be:f7:e8:20:1e:f6:bf:de:ae (RSA) | 256 b7:89:6c:0b:20:ed:49:b2:c1:86:7c:29:92:74:1c:1f (ECDSA) |_ 256 18:cd:9d:08:a6:21:a8:b8:b6:f7:9f:8d:40:51:54:fb (ED25519) 80/tcp open http nginx 1.18.0 (Ubuntu) |_http-title: Did not follow redirect to http://devvortex.htb/ |_http-server-header: nginx/1.18.0 (Ubuntu) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 8.01 seconds We can add devvortex.htb to our hosts file but we don’t see much of anything interesting even after some directory enumeration.

We can start with a port scan as we always do: ╰─ nmap -sC -sV 10.129.83.21 Starting Nmap 7.94 ( https://nmap.org ) at 2023-11-05 20:25 CST Nmap scan report for 10.129.83.21 Host is up (0.031s latency). Not shown: 997 closed tcp ports (conn-refused) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.4 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 256 96:07:1c:c6:77:3e:07:a0:cc:6f:24:19:74:4d:57:0b (ECDSA) |_ 256 0b:a4:c0:cf:e2:3b:95:ae:f6:f5:df:7d:0c:88:d6:ce (ED25519) 80/tcp open http Apache httpd 2.4.52 |_http-title: Did not follow redirect to http://codify.htb/ |_http-server-header: Apache/2.4.52 (Ubuntu) 3000/tcp open http Node.js Express framework |_http-title: Codify Service Info: Host: codify.htb; OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 10.37 seconds We can add codify.htb to our hosts file and take a look:

As always, we will start off with a port scan: ╰─ nmap -sC -sV 10.129.59.198 Starting Nmap 7.94SVN ( https://nmap.org ) at 2023-12-06 18:42 CST Nmap scan report for 10.129.59.198 Host is up (0.031s latency). Not shown: 987 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 80/tcp open http Microsoft IIS httpd 10.0 |_http-server-header: Microsoft-IIS/10.0 |_http-title: Manager | http-methods: |_ Potentially risky methods: TRACE 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2023-12-07 07:42:34Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: manager.htb0., Site: Default-First-Site-Name) | ssl-cert: Subject: commonName=dc01.manager.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc01.manager.htb | Not valid before: 2023-07-30T13:51:28 |_Not valid after: 2024-07-29T13:51:28 |_ssl-date: 2023-12-07T07:43:54+00:00; +7h00m00s from scanner time. 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: manager.htb0., Site: Default-First-Site-Name) |_ssl-date: 2023-12-07T07:43:55+00:00; +7h00m00s from scanner time. | ssl-cert: Subject: commonName=dc01.manager.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc01.manager.htb | Not valid before: 2023-07-30T13:51:28 |_Not valid after: 2024-07-29T13:51:28 1433/tcp open ms-sql-s Microsoft SQL Server 2019 15.00.2000.00; RTM | ms-sql-ntlm-info: | 10.129.59.198:1433: | Target_Name: MANAGER | NetBIOS_Domain_Name: MANAGER | NetBIOS_Computer_Name: DC01 | DNS_Domain_Name: manager.htb | DNS_Computer_Name: dc01.manager.htb | DNS_Tree_Name: manager.htb |_ Product_Version: 10.0.17763 |_ssl-date: 2023-12-07T07:43:54+00:00; +7h00m00s from scanner time. | ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback | Not valid before: 2023-12-07T07:41:33 |_Not valid after: 2053-12-07T07:41:33 | ms-sql-info: | 10.129.59.198:1433: | Version: | name: Microsoft SQL Server 2019 RTM | number: 15.00.2000.00 | Product: Microsoft SQL Server 2019 | Service pack level: RTM | Post-SP patches applied: false |_ TCP port: 1433 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: manager.htb0., Site: Default-First-Site-Name) | ssl-cert: Subject: commonName=dc01.manager.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc01.manager.htb | Not valid before: 2023-07-30T13:51:28 |_Not valid after: 2024-07-29T13:51:28 |_ssl-date: 2023-12-07T07:43:54+00:00; +7h00m00s from scanner time. 3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: manager.htb0., Site: Default-First-Site-Name) | ssl-cert: Subject: commonName=dc01.manager.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc01.manager.htb | Not valid before: 2023-07-30T13:51:28 |_Not valid after: 2024-07-29T13:51:28 |_ssl-date: 2023-12-07T07:43:55+00:00; +7h00m00s from scanner time. Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb2-security-mode: | 3:1:1: |_ Message signing enabled and required |_clock-skew: mean: 6h59m59s, deviation: 0s, median: 6h59m59s | smb2-time: | date: 2023-12-07T07:43:18 |_ start_date: N/A Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 91.34 seconds Alright, we’ve got a few things to look into:

To read this post, enter the root user’s password hash ("$6…k1"). We start off with a port scan:

We start by scanning for open ports: ╰─ nmap -sC -sV 10.129.187.65 Starting Nmap 7.94 ( https://nmap.org ) at 2023-11-05 19:24 CST Nmap scan report for 10.129.187.65 Host is up (0.030s latency). Not shown: 999 closed tcp ports (conn-refused) PORT STATE SERVICE VERSION 80/tcp open http nginx 1.18.0 (Ubuntu) |_http-server-header: nginx/1.18.0 (Ubuntu) |_http-title: Did not follow redirect to http://analytical.htb/ Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 7.65 seconds We can analytical.htb to our hosts file and look at the web application.

We start with a port scan: ╰─ nmap -sC -sV 10.129.86.90 Starting Nmap 7.94 ( https://nmap.org ) at 2023-10-14 20:03 EDT Nmap scan report for 10.129.86.90 Host is up (0.033s latency). Not shown: 999 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 80/tcp open http Apache httpd 2.4.56 ((Win64) OpenSSL/1.1.1t PHP/8.1.17) |_http-server-header: Apache/2.4.56 (Win64) OpenSSL/1.1.1t PHP/8.1.17 |_http-title: Visual - Revolutionizing Visual Studio Builds Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 16.14 seconds It looks like there is just one port open on HTTP, let’s give it a look:

Enumeration # We can get started with a port scan:

We can begin with a port scan as usual: ╰─ nmap -sC -sV 10.129.110.213 Starting Nmap 7.94 ( https://nmap.org ) at 2023-09-04 10:17 EDT Nmap scan report for 10.129.110.213 Host is up (0.030s latency). Not shown: 998 closed tcp ports (conn-refused) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.3 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 256 43:56:bc:a7:f2:ec:46:dd:c1:0f:83:30:4c:2c:aa:a8 (ECDSA) |_ 256 6f:7a:6c:3f:a6:8d:e2:75:95:d4:7b:71:ac:4f:7e:42 (ED25519) 80/tcp open http nginx 1.18.0 (Ubuntu) |_http-title: Did not follow redirect to http://cozyhosting.htb |_http-server-header: nginx/1.18.0 (Ubuntu) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 8.03 seconds We can add cozyhosting.htb to our /etc/hosts file and take a look at the site.

We can begin with a port scan: ╰─ nmap -sC -sV 10.129.171.3 Starting Nmap 7.94 ( https://nmap.org ) at 2023-08-27 18:12 EDT Nmap scan report for 10.129.171.3 Host is up (0.030s latency). Not shown: 998 closed tcp ports (conn-refused) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 9.0p1 Ubuntu 1ubuntu7.3 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 256 9d:6e:ec:02:2d:0f:6a:38:60:c6:aa:ac:1e:e0:c2:84 (ECDSA) |_ 256 eb:95:11:c7:a6:fa:ad:74:ab:a2:c5:f6:a4:02:18:41 (ED25519) 80/tcp open http Apache httpd 2.4.54 ((Ubuntu)) |_http-server-header: Apache/2.4.54 (Ubuntu) |_http-title: Zipping | Watch store Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 8.28 seconds If you look around on the page and look at the products tab in the shop, you’ll see a juicy potential for LFI in the URL:

We can start out with a port scan: ╰─ nmap -sC -sV 10.129.121.185 Starting Nmap 7.94 ( https://nmap.org ) at 2023-08-18 15:25 EDT Nmap scan report for 10.129.121.185 Host is up (0.030s latency). Not shown: 998 closed tcp ports (conn-refused) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.3 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 256 35:39:d4:39:40:4b:1f:61:86:dd:7c:37:bb:4b:98:9e (ECDSA) |_ 256 1a:e9:72:be:8b:b1:05:d5:ef:fe:dd:80:d8:ef:c0:66 (ED25519) 80/tcp open http nginx 1.18.0 (Ubuntu) |_http-title: Site doesn't have a title (text/html). |_http-server-header: nginx/1.18.0 (Ubuntu) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 8.00 seconds We see open ports for SSH and HTTP, let’s curl the site and see what is there:

We begin with a port scan: ╰─ nmap -sC -sV 10.129.140.87 Starting Nmap 7.94 ( https://nmap.org ) at 2023-08-08 20:59 EDT Nmap scan report for 10.129.140.87 Host is up (0.030s latency). Not shown: 998 closed tcp ports (conn-refused) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.8 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 3072 cc:f1:63:46:e6:7a:0a:b8:ac:83:be:29:0f:d6:3f:09 (RSA) | 256 2c:99:b4:b1:97:7a:8b:86:6d:37:c9:13:61:9f:bc:ff (ECDSA) |_ 256 e6:ff:77:94:12:40:7b:06:a2:97:7a:de:14:94:5b:ae (ED25519) 80/tcp open http nginx 1.18.0 (Ubuntu) |_http-server-header: nginx/1.18.0 (Ubuntu) |_http-title: Did not follow redirect to http://download.htb Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 9.04 seconds We see that we are being redirected to download.htb on port 80, so let’s add that to our hosts file and look at the site in our browser:

As always, we can begin with a port scan: ╰─ nmap -sC -sV 10.129.145.189 Starting Nmap 7.94 ( https://nmap.org ) at 2023-07-31 18:37 EDT Nmap scan report for 10.129.145.189 Host is up (0.027s latency). Not shown: 995 closed tcp ports (conn-refused) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.4p1 Debian 5+deb11u1 (protocol 2.0) | ssh-hostkey: | 3072 aa:25:82:6e:b8:04:b6:a9:a9:5e:1a:91:f0:94:51:dd (RSA) | 256 18:21:ba:a7:dc:e4:4f:60:d7:81:03:9a:5d:c2:e5:96 (ECDSA) |_ 256 a4:2d:0d:45:13:2a:9e:7f:86:7a:f6:f7:78:bc:42:d9 (ED25519) 25/tcp filtered smtp 80/tcp open http Apache httpd 2.4.56 |_http-server-header: Apache/2.4.56 (Debian) |_http-title: Did not follow redirect to http://gofer.htb/ 139/tcp open netbios-ssn Samba smbd 4.6.2 445/tcp open netbios-ssn Samba smbd 4.6.2 Service Info: Host: gofer.htb; OS: Linux; CPE: cpe:/o:linux:linux_kernel Host script results: |_clock-skew: 13s | smb2-security-mode: | 3:1:1: |_ Message signing enabled but not required | smb2-time: | date: 2023-07-31T22:37:37 |_ start_date: N/A |_nbstat: NetBIOS name: GOFER, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown) Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 14.17 seconds So, we see SSH, a mail server, HTTP on port 80, and some samba shares. We can add gofer.htb to our /etc/hosts file and look around at the site.

We can begin with a port scan as usual: ╰─ nmap -sC -sV 10.129.158.17 Starting Nmap 7.94 ( https://nmap.org ) at 2023-07-17 16:21 EDT Nmap scan report for 10.129.158.17 Host is up (0.030s latency). Not shown: 987 closed tcp ports (conn-refused) PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 80/tcp open http Microsoft IIS httpd 10.0 | http-methods: |_ Potentially risky methods: TRACE |_http-title: IIS Windows Server |_http-server-header: Microsoft-IIS/10.0 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2023-07-18 00:22:09Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: authority.htb, Site: Default-First-Site-Name) | ssl-cert: Subject: | Subject Alternative Name: othername: UPN::AUTHORITY$@htb.corp, DNS:authority.htb.corp, DNS:htb.corp, DNS:HTB | Not valid before: 2022-08-09T23:03:21 |_Not valid after: 2024-08-09T23:13:21 |_ssl-date: 2023-07-18T00:22:59+00:00; +4h00m01s from scanner time. 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: authority.htb, Site: Default-First-Site-Name) | ssl-cert: Subject: | Subject Alternative Name: othername: UPN::AUTHORITY$@htb.corp, DNS:authority.htb.corp, DNS:htb.corp, DNS:HTB | Not valid before: 2022-08-09T23:03:21 |_Not valid after: 2024-08-09T23:13:21 |_ssl-date: 2023-07-18T00:22:58+00:00; +4h00m00s from scanner time. 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: authority.htb, Site: Default-First-Site-Name) |_ssl-date: 2023-07-18T00:22:59+00:00; +4h00m01s from scanner time. | ssl-cert: Subject: | Subject Alternative Name: othername: UPN::AUTHORITY$@htb.corp, DNS:authority.htb.corp, DNS:htb.corp, DNS:HTB | Not valid before: 2022-08-09T23:03:21 |_Not valid after: 2024-08-09T23:13:21 3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: authority.htb, Site: Default-First-Site-Name) | ssl-cert: Subject: | Subject Alternative Name: othername: UPN::AUTHORITY$@htb.corp, DNS:authority.htb.corp, DNS:htb.corp, DNS:HTB | Not valid before: 2022-08-09T23:03:21 |_Not valid after: 2024-08-09T23:13:21 |_ssl-date: 2023-07-18T00:22:58+00:00; +4h00m00s from scanner time. 8443/tcp open ssl/https-alt |_ssl-date: TLS randomness does not represent time |_http-title: Site doesnt have a title (text/html;charset=ISO-8859-1). | ssl-cert: Subject: commonName=172.16.2.118 | Not valid before: 2023-07-15T23:33:09 |_Not valid after: 2025-07-17T11:11:33 | fingerprint-strings: | FourOhFourRequest, GetRequest: | HTTP/1.1 200 | Content-Type: text/html;charset=ISO-8859-1 | Content-Length: 82 | Date: Tue, 18 Jul 2023 00:22:16 GMT | Connection: close | <html><head><meta http-equiv="refresh" content="0;URL='/pwm'"/></head></html> | HTTPOptions: | HTTP/1.1 200 | Allow: GET, HEAD, POST, OPTIONS | Content-Length: 0 | Date: Tue, 18 Jul 2023 00:22:16 GMT | Connection: close | RTSPRequest: | HTTP/1.1 400 | Content-Type: text/html;charset=utf-8 | Content-Language: en | Content-Length: 1936 | Date: Tue, 18 Jul 2023 00:22:21 GMT | Connection: close | <!doctype html><html lang="en"><head><title>HTTP Status 400 ---SNIP--- Service Info: Host: AUTHORITY; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb2-security-mode: | 3:1:1: |_ Message signing enabled and required | smb2-time: | date: 2023-07-18T00:22:49 |_ start_date: N/A |_clock-skew: mean: 4h00m00s, deviation: 0s, median: 3h59m59s Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 61.98 seconds So we see some LDAP, SMB, RPC, and some more seemingly standard stuff like DNS and Kerberos. We do see a few ports for HTTP on 80 and 8443.

As always, we begin with a port scan: ╰─ nmap -sC -sV 10.129.186.83 Starting Nmap 7.94 ( https://nmap.org ) at 2023-07-09 19:33 EDT Nmap scan report for 10.129.186.83 Host is up (0.029s latency). Not shown: 997 closed tcp ports (conn-refused) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.7 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 3072 aa:88:67:d7:13:3d:08:3a:8a:ce:9d:c4:dd:f3:e1:ed (RSA) | 256 ec:2e:b1:05:87:2a:0c:7d:b1:49:87:64:95:dc:8a:21 (ECDSA) |_ 256 b3:0c:47:fb:a2:f2:12:cc:ce:0b:58:82:0e:50:43:36 (ED25519) 80/tcp filtered http 55555/tcp open unknown | fingerprint-strings: | FourOhFourRequest: | HTTP/1.0 400 Bad Request | Content-Type: text/plain; charset=utf-8 | X-Content-Type-Options: nosniff | Date: Sun, 09 Jul 2023 23:33:58 GMT | Content-Length: 75 | invalid basket name; the name does not match pattern: ^[wd-_\.]{1,250}$ | GenericLines, Help, Kerberos, LDAPSearchReq, LPDString, RTSPRequest, SSLSessionReq, TLSSessionReq, TerminalServerCookie: | HTTP/1.1 400 Bad Request | Content-Type: text/plain; charset=utf-8 | Connection: close | Request | GetRequest: | HTTP/1.0 302 Found | Content-Type: text/html; charset=utf-8 | Location: /web | Date: Sun, 09 Jul 2023 23:33:32 GMT | Content-Length: 27 | href="/web">Found</a>. | HTTPOptions: | HTTP/1.0 200 OK | Allow: GET, OPTIONS | Date: Sun, 09 Jul 2023 23:33:32 GMT |_ Content-Length: 0 ---SNIP--- Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 91.74 seconds We see that SSH is running and that there is a web server running on port 55555. Let’s take a look at the site:

Enumeration # As always, we can begin with a port scan using nmap:

Sandworm is a medium difficulty Linux machine that kicks off the start of the second competitive season on HTB.

Enumeration # As always, we begin with a port scan:

We start with a port scan as we normally do: ╰─ nmap -sC -sV 10.129.49.213 Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-01-16 20:24 CST Nmap scan report for 10.129.49.213 Host is up (0.031s latency). Not shown: 998 closed tcp ports (conn-refused) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.9 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 3072 81:1d:22:35:dd:21:15:64:4a:1f:dc:5c:9c:66:e5:e2 (RSA) | 256 01:f9:0d:3c:22:1d:94:83:06:a4:96:7a:01:1c:9e:a1 (ECDSA) |_ 256 64:7d:17:17:91:79:f6:d7:c4:87:74:f8:a2:16:f7:cf (ED25519) 80/tcp open http nginx 1.18.0 (Ubuntu) |_http-title: Did not follow redirect to http://bookworm.htb |_http-server-header: nginx/1.18.0 (Ubuntu) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 9.32 seconds We can add bookworm.htb to our hosts file and take a look at the site. It appears to be a website where we can buy books, so let’s make an account and see what we can do.

We begin with a port scan: └─ nmap -sC -sV 10.129.189.160 Starting Nmap 7.93 ( https://nmap.org ) at 2023-05-09 21:50 EDT Nmap scan report for 10.129.189.160 Host is up (0.040s latency). Not shown: 997 closed tcp ports (conn-refused) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.1 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 256 ee6bcec5b6e3fa1b97c03d5fe3f1a16e (ECDSA) |_ 256 545941e1719a1a879c1e995059bfe5ba (ED25519) 53/tcp open domain ISC BIND 9.18.12-0ubuntu0.22.04.1 (Ubuntu Linux) | dns-nsid: |_ bind.version: 9.18.12-0ubuntu0.22.04.1-Ubuntu 80/tcp open http nginx 1.18.0 (Ubuntu) |_http-server-header: nginx/1.18.0 (Ubuntu) |_http-title: SnoopySec Bootstrap Template - Index Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 15.31 seconds

Begin with a port scan: └─$ nmap -sC -sV -Pn 10.129.69.238 Starting Nmap 7.93 ( https://nmap.org ) at 2023-04-06 13:46 EDT Nmap scan report for 10.129.69.238 Host is up (0.039s latency). Not shown: 987 closed tcp ports (conn-refused) PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 80/tcp open http Microsoft IIS httpd 10.0 | http-methods: |_ Potentially risky methods: TRACE |_http-title: IIS Windows Server |_http-server-header: Microsoft-IIS/10.0 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2023-04-07 01:46:13Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: coder.htb0., Site: Default-First-Site-Name) | ssl-cert: Subject: commonName=dc01.coder.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc01.coder.htb | Not valid before: 2022-06-30T04:24:26 |_Not valid after: 2023-06-30T04:24:26 |_ssl-date: 2023-04-07T01:46:59+00:00; +7h59m34s from scanner time. 443/tcp open ssl/http Microsoft IIS httpd 10.0 | http-methods: |_ Potentially risky methods: TRACE |_ssl-date: 2023-04-07T01:47:00+00:00; +7h59m35s from scanner time. |_http-title: IIS Windows Server |_http-server-header: Microsoft-IIS/10.0 | ssl-cert: Subject: commonName=default-ssl/organizationName=HTB/stateOrProvinceName=CA/countryName=US | Not valid before: 2022-11-04T17:25:43 |_Not valid after: 2032-11-01T17:25:43 | tls-alpn: |_ http/1.1 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open ssl/ldap |_ssl-date: 2023-04-07T01:46:59+00:00; +7h59m34s from scanner time. | ssl-cert: Subject: commonName=dc01.coder.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc01.coder.htb | Not valid before: 2022-06-30T04:24:26 |_Not valid after: 2023-06-30T04:24:26 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: coder.htb0., Site: Default-First-Site-Name) |_ssl-date: 2023-04-07T01:47:00+00:00; +7h59m35s from scanner time. | ssl-cert: Subject: commonName=dc01.coder.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc01.coder.htb | Not valid before: 2022-06-30T04:24:26 |_Not valid after: 2023-06-30T04:24:26 3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: coder.htb0., Site: Default-First-Site-Name) |_ssl-date: 2023-04-07T01:46:59+00:00; +7h59m34s from scanner time. | ssl-cert: Subject: commonName=dc01.coder.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc01.coder.htb | Not valid before: 2022-06-30T04:24:26 |_Not valid after: 2023-06-30T04:24:26 Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb2-security-mode: | 311: |_ Message signing enabled and required |_clock-skew: mean: 7h59m34s, deviation: 0s, median: 7h59m33s | smb2-time: | date: 2023-04-07T01:46:51 |_ start_date: N/A Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 64.60 seconds From here, go ahead and add dc01.coder.htb and coder.htb to your hosts file.

We begin with a port scan: └─$ sudo nmap -sV -Pn 10.129.25.141 Starting Nmap 7.93 ( https://nmap.org ) at 2023-02-26 17:36 EST Nmap scan report for 10.129.25.141 Host is up (0.039s latency). Not shown: 988 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2023-02-27 06:36:48Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name) 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name) 1433/tcp open ms-sql-s Microsoft SQL Server 2019 15.00.2000 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name) 3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name) Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 51.26 seconds We’ve got a lot of options here, I want to try listing the SMB (Port 139 and 445) shares using smbclient. I will see what is available without giving a password:

We can begin with an nmap scan: └─$ nmap -sC -sV 10.129.9.176 Starting Nmap 7.93 ( https://nmap.org ) at 2023-01-21 14:00 EST Nmap scan report for 10.129.9.176 Host is up (0.038s latency). Not shown: 998 closed tcp ports (conn-refused) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 3072 2f1e6306aa6ebbcc0d19d4152674c6d9 (RSA) | 256 274520add2faa73a8373d97c79abf30b (ECDSA) |_ 256 4245eb916e21020617b2748bc5834fe0 (ED25519) 80/tcp open http Apache httpd 2.4.41 |_http-server-header: Apache/2.4.41 (Ubuntu) |_http-title: Did not follow redirect to http://eforenzics.htb/ Service Info: Host: eforenzics.htb; OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 9.90 seconds Add http://eforenzics.htb/ to our /etc/hosts folder. Then we can go take a look at the website: