root:$6$YIFGN9YscCV72BjFtx/tehbc7sQTJp09c5.:18277:0:99999:7::: So use the highlighted part as the password. So password = YIFGN9YscCV72BjFtx/
For Windows
Use ntlm hash
Example Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c:::
password = 31d6cfe0d16ae931b73c59d7e0c
Old methods
For linux
1- cat /etc/shadow 2-copy whole hash(root) root:$6$YIFGN9YscCV72BjFtx/tehbc7sQTJp09c5.:18277:0:99999:7::: 3-Then find it's MD5 sum and that's your password for writeup
For windows
1-Find root hash with hashdump.exe or any other tool. 2-Then convert that also into MD5 sum 3-That's your password for the Writeup
Brief It is a easy windows machine from hack the box.It’s easy but root part is little hard and more enumeration is required for it.But once you get it’s so easy. It has only a single port .And the walk through is around HFS exploits using metasploit.And then privilege escalation through a integer overflow. Steps…
Steps: Nmap Scan. Enumerating user names. Exploiting Kerberos Decryption of hash.txt. Login with Evil-winrm(user) Uploading Blood hound Adding User to group. Escalating the privilages. DCSync attack via secretsdump Login with wmiexec.py(root) Tools used Impacket(GetNPUsers.py,ntlmrelayx.py ,secretsdump.py) Evil-winrm Bloodhound. Commands used nmap -sC -sV -oV 10.10.10.161 enum4linux -a 10.10.10.161 GetNPUsers.py HTB.local/ -usersfile /root/Desktop/htb/forest/user.txt -format john -outputfile hashes.txt…
It is easy machine from hackthebox. Which includes little web directory enumeration which leads to password leaks. Then with the help of msfconsole we get initial shell . After some basic enumeration gets password for a ssh user. Followed by privilege escalation by abusing sudo rights in this it was
