Dark's Security

 Enumeration: Nmap scan: There is an interesting port 873 running rsync. Rsync enumeration: Reference:  https://book.hacktricks.xyz/pentesting/873-pentesting-rsync Rsync is a most commonly used command for copying and synchronizing files and directories remotely as well as locally in Linux/Unix systems. First I will try to list the files or folders inside it and dump all the files. rsync -av rsync://unbalanced.htb/conf_bakcups ./rsync There is an .encfs6.xml  file in this folder which tells that encfs utility is used to encrypt all the files and folders. Let us decrypt all the files John: There is script in john to extract the hash from .encfs6.xml. Cracking the .encfs6.xml file  $ locate ecnfs2john $ sudo /usr/share/john/encfs2john.py ./rsync/ > encfs_hash $ sudo john -wordlist=/usr/share/wordlists/rockyou.txt encfs_hash Decrypt the rsync files and copy to other folder: $ encfs ~/hackthebox/unbalanced/rsync/ ~/hackthebox/unbalanced/rsync_decrypted/...

 Starting with NMAP scan: Checking the website I got a lot of emails and since the box name is SneakyMailer I think that will be useful. Hence I used CEWL to scrap all the emails from the website. $ cewl -d 5 -e --email_file emails.txt http://sneakycorp.htb/  After that I started to look for valid emails , we can do this by VRFY command of SMTP and also there are many tools to do it like iSMTP, metasploit module smtp_enum. But at this point for me none of them worked so I thought may be here it is something related to phishing attack... like there must be some bot in the backend which may click on any link provided in the email but question is which email. Here I made a simple script to send mail to each them with a link to my listening socket. First let me show you how to do this manually.. but it is time taking Now automatic:      And from the script we got password in response. Now I think I need to view all the emails sent or received by this user and for th...

This is an easy level windows machine. So, let's start.. Enumeration First we will do the nmap scan to enumerate all the services We got our ports and we will start by enumerating the port 80. Just a simple lookup to the source code of the website gave us that the website is based upon Umbraco CMS and we can reach its login page using http://10.10.10.180/umbraco.  But wait, we don't have any credentials yet, I tried some defaul logins but no success. So, for now lets enumerate other services. FTP got nothing in it and the SMB serivce does not allow anonymous login. So, whats more? remember that Port 111 RPCbind. RPCbind: From the nmap scan's RPCinfo we can say that there are some Network File System(NFS) shares. Now we are going to enumerate further and try to list the NFS shares, if any. So here it is.. Little Explanation  First I used Showmount tool to extract all the publicly available shares from the box's IP. Then I mounted that share to my local /mnt directory usi...

Room:  Carpe - diem  Big shout out to the creator of this room:  4ndr34z Overview:   In this room we have retrieve the key which is used to encrypt a database file stored at /downloads/database.carpe. For me this room was too challenging and hence this writeup for all the coming folks. I have tried to explain everything so that the beginners could understand it easily. Enumeration: 1. A s usual we will start with NMAP scan From port scan we found there is nothing unique or interesting running except the port 80. So we should open the website and do some enumeration. 2. This website is asking us to send proof of our bitcoin address..and only after that you can retrieve the key..(I think thats what the theme of this room .. a perfect ransomware attack) 3. After that we review the source code of the webpage and always read those javascripts. Explanation:  first this code is checking that you don't copy the same address and send to proof and if you do that it pop up...

Here is the link of this great room:  Blog by Nameless0ne . L et's start guys.. Enumeration First I ran the nmap scan: 1.First lets check out the Blog itself running on the port 80. From little enumeration we can say that this is a simple blog running on the Wordpress. 2. The blog contains a single post by a user named Karen Wheeler for Billy joel. 3. To enumerate the users on the blog I will be using WPscan.           wpscan --url blog.thm -e u This command will list all the users on the Blog, bjoel & kwheel. 4. Let's try to find out the password of these users using the same tool again.          wpscan -U username --password <pass file> -t 30 --password-attack wp-login --url blog.thm 5. Try to run your own command. It won't take long before the password pops. (hint: try Mom name) 6. After login into the wordpress I saw the user had very limited capabilities so there must be some other way to the shell or some k...