Hey, KEEP CALM and hack away…
Boxes HackTheBox Bounty Hunter Overview JS code, used XML as post parameter to retrieve data from some source. It used .val() attribute to get the value of user input. No sanitation was applied, thus highly vulnerable to XXE injection. Web Vulnerable Code function returnSecret(data) { return Promise.resolve($.ajax({ type: "POST", data: {"data":data}, url: "tracker_diRbPr00f314.php" })); }…
Windows Active Directory Port 88 (kerberos), 389 (ldap), 636 (ldap), 3268 (ldap) SYSVOL content found If SYSVOL content found. And if GPP (Group Policy Preferences) is applied, there will be a Groups.xml file that contains credentials in Policies directory somewhere. Find it use: find . -iname "groups.xml" GPP Password Hash found Use gpp-decrypt tools to…
References: Video Walkthroug Official Document
Overview Pretty simple box. Learn about Drupal exploits, ssh brute force, and snap privilege escalation. Solution Recon Nmap FIrst nmap the target. Got port 22 and 80 open. Try SSH to the box. SSH banner reveals no useful information. Websiite Checkout the website. I tried to use single quote in the login form to test…
Lab Intro You have been engaged in a Black-box Penetration Test (172.16.37.0/24 range). Your goal is to read the flag file on each machine. On some of them, you will be required to exploit a remote code execution vulnerability in order to read the flag. Some machines are exploitable instantly but some might require exploiting…
Lab Intro You have been engaged in a Black-box Penetration Test (172.16.64.0/24 range). Your goal is to read the flag file on each machine. On some of them, you will be required to exploit a remote code execution vulnerability in order to read the flag. Some machines are exploitable instantly but some might require exploiting…
Lab Intro You have been engaged in a Black-box Penetration Test (172.16.64.0/24 range). Your goal is to read the flag file on each machine. On some of them, you will be required to exploit a remote code execution vulnerability in order to read the flag. Some machines are exploitable instantly but some might require exploiting…
Lab Intro In this lab, you will have to use Metasploit and meterpreter against a real machine; this will help you become familiar with the Metasploit framework and its features. Solution I’m now in a 192.168.99.0/24 network. One host is alive. Finger-print the host with nmap. nmap -sC -sV -v 192.168.99.12 A lot of results….
Lab Intro In this lab you are connected to a switched network. Try to intercept network traffic and steal telnet credentials by performing an ARP poisoning attack. Identify the telnet server and the client machine Intercept traffic between the two Analyze the traffic and steal valid credentials Login into the telnet server Solution I’m in…
Lab Intro In this lab you can practice different techniques and tools against a machine vulnerable to null session! The final goal of the lab is retrieve information from the target machine such as shares, users, groups and so on! Moreover by navigating the remote machine, you should be able to find a file name…