Dark's Security

 Enumeration: Nmap scan: There is an interesting port 873 running rsync. Rsync enumeration: Reference:  https://book.hacktricks.xyz/pentesting/873-pentesting-rsync Rsync is a most commonly used command for copying and synchronizing files and directories remotely as well as locally in Linux/Unix systems. First I will try to list the files or folders inside it and dump all the files. rsync -av rsync://unbalanced.htb/conf_bakcups ./rsync There is an .encfs6.xml  file in this folder which tells that encfs utility is used to encrypt all the files and folders. Let us decrypt all the files John: There is script in john to extract the hash from .encfs6.xml. Cracking the .encfs6.xml file  $ locate ecnfs2john $ sudo /usr/share/john/encfs2john.py ./rsync/ > encfs_hash $ sudo john -wordlist=/usr/share/wordlists/rockyou.txt encfs_hash Decrypt the rsync files and copy to other folder: $ encfs ~/hackthebox/unbalanced/rsync/ ~/hackthebox/unbalanced/rsync_decrypted/...

 NMAP SCAN Launching a nmap scan against our target machine to find open ports. WEB ANALYSIS On visiting port 8080 we get to know that the website is made using Gym Management Software 1.0. On googling about the software and its version we get to know about a related exploit from exploit-db. https://www.exploit-db.com/exploits/48506 We can now download and run the exploit in order to gain a reverse shell. Now we have a reverse shell but we are unable to run many commands on it. So lets try to put nc.exe here. We will do so using the python server and "curl" command. So now we have nc.exe here and we can use it to gain a new reverse shell where we will be able to run more commands. Now we can grab the user flag which is located inside C:\Users\shaun\Desktop PRIVILEGE ESCALATION Time to explore all the directories and files inside them. The CloudMe Version 1.11.2 is vulnerable to Buffer overflow. An exploit for the same can be found on exploit-db. https://www.exploit-db.com/exp...

 Starting with NMAP scan: Checking the website I got a lot of emails and since the box name is SneakyMailer I think that will be useful. Hence I used CEWL to scrap all the emails from the website. $ cewl -d 5 -e --email_file emails.txt http://sneakycorp.htb/  After that I started to look for valid emails , we can do this by VRFY command of SMTP and also there are many tools to do it like iSMTP, metasploit module smtp_enum. But at this point for me none of them worked so I thought may be here it is something related to phishing attack... like there must be some bot in the backend which may click on any link provided in the email but question is which email. Here I made a simple script to send mail to each them with a link to my listening socket. First let me show you how to do this manually.. but it is time taking Now automatic:      And from the script we got password in response. Now I think I need to view all the emails sent or received by this user and for th...

ENUMERATION  As always let start with basic port scan. Lets visit port 80. And take a look at its source code. There is nothing worthy of our attention here. GOBUSTER Running gobuster against the target with hope of finding some hidden directories. gobuster dir -u http://admirer.htb/ -w /usr/share/wordlists/dirb/common.txt -t 50 Taking a look at robots.txt: So now we have found a username "waldo" and a hidden directory /admin-dir that contains interesting files. We are going to access this directory now The directory is forbidden. But we shouldn't lose hope this soon. Lets try to access the possible folders inside it (as mentioned in /robots.txt). http://10.10.10.187/admin-dir/contacts.txt http://10.10.10.187/admin-dir/credentials.txt FTP Using the ftp credentials try connecting to  port 21. The user and password was valid and we were able to successfully login to ftp even find some files worth looking at so we transfered it into our systems. Dump.sql doesn't contain ...

Gathering information Let’s start with a  nmap scan to establish the open ports in the host. Website Analysis Now we should start enumerating port 80. So lets check out the source code of the homepage and see if we are able to find any additional clues. We found this /about directory  There doesn't seem to be anything useful in this directory. Lets fireup a GoBuster scan gobuster dir -u http://10.10.10.191 -w /usr/share/ wordlists/dirb/common.txt -t 50 The /admin directory looks like: Just a little bit of google search about "BLUDIT" reveals that it is a CMS. Now we have a login panel, all we need is a username and a password. GoBuster extension Its always good to perform some further enumeration of the webapp using custom file extensions to find out any hidden backup files or some notes :) $ gobuster dir -u http://10.10.10.191 -w /usr/share/wordlists/dirb/common.txt -x txt,zip -t 50 Using the -x flag to look for some specific extensions such as txt,zip we get a /todo.txt...