View-Source

Search This Blog

Contact Me

Posted by Sagar Singh

Get link
Facebook
X
Pinterest
Email
Other Apps

For any query, suggestions or anything, leave a mail on sagar100rawat@gmail.com.

Get link
Facebook
X
Pinterest
Email
Other Apps

Comments

MONTEVERDE-HTB-WALKTHROUGH

Greetings to all, this is a walkthrough of "Monteverde" a medium rated windows machine. 1. PORTSCAN 2. USER As we can see AD ports are open so I performed a quick search of users through enum4linux. Now we have a list of users, so its time to find out that user which take us to the user flag. so for this purpose, I store all this user under users.txt file. I ran Metasploit module "smb_login" to brute force the username as password against the username. and we got a hit for SABatchJobs (lazy admin). options details: Password found: 1.2 SMB ENUMERATION: Till now we have the username and the password, so let's give a look under the smb shares. The file -"azure.xml" I found under mhope user is very interesting. It contains the creds of mhope. now we have a valid password. so, it's time to take the shell and grab user flag using our favourite tool-"evil-winrm"....

ServMon-HTB-walkthrough

Synopsis ServMon is an easy windows box. Through Nmap portscan, we found that the FTP anonymous login is allowed which take us to read the juicy information/conversation between two users. The web is monitored by NVMS-1000 which is vulnerable to Directory Traversal and through this, we are able to read the passwords stored on Desktop of one of the user. With the help of Metasploit smb_login module, we brute-force all the passwords against users. With the successful hit, we grab the user flag. NSClient++ is also installed with web Server enabled. This allows the low privilege user to gain an advantage. Tools/Scripts Used 1.nmap: https://nmap.org/download.html 2.Burpsuite: https://portswigger.net/burp/communitydownload 3.Metasploit(auxiliary/scanner/smb/smb_login): https://www.metasploit.com/download 4.NSClient++ API : https://docs.nsclient.org/api Let's get started. 1. Portscan nmap -sC -sV -oA ports 10...

Traceback Hackthebox walkthrough

Table of Content: 1. Portscan 2. User 2.1 WEB Enumeration 2.2 Initial Shell 2.3 User Flag 3. Priv Esc Scripts/Tools used: 1.nmap: https://nmap.org/download.html 2.ffuf: https://github.com/ffuf/ffuf 3.shells: https://github.com/Xh4H/Web-Shells 1. Portscan: The portscan result shows 2 ports are open. 2. User 2.1 WEB Enumeration On visiting the web, it shows the site has been compromised and there is a backdoor left by the creator of the box (Xh4H). Only thing I have till now is the name of the creator, So my next move is to google his name and the search gave me all that I need. He left a backdoor for us, so I looked all over his repositories and end up with Web-shells . I make a list of all the available web shells and with the tool ffuf I found the valid one. 2.1 Initial Shell smevk.php username: admin password: admin The shell gave me access to "webadmin" account. Then I tried ...

Powered by Blogger

Contact Me

Comments

Post a Comment