Footprinting : HTB
Host Based Enumeration
-FTP
Question: Which version of the FTP server is running on the target system? Submit the entire banner as the answer.
Answer: just connecting to the ftp server and the ftp version printed
Question : Enumerate the FTP server and find the “flag.txt” file. Submit the contents of it as the answer.
Answer : login as anonymous, flag was easy to capture
Press enter or click to view image in full size
-SMB
Question: What version of the SMB server is running on the target system? Submit the entire banner as the answer.
Answer:
first tried login to smbclient as anonymous via “-N” nothing there,
Press enter or click to view image in full size
then i the saw word banner in the question, i remember i can do a scan on the target.
Press enter or click to view image in full size
Question: What is the name of the accessible share on the target?
Answer: listing shares “-L” after login anonymously “-N”
Press enter or click to view image in full size
if you do a smbmap you’ll confirm which one is accessible
Press enter or click to view image in full size
Question: Connect to the discovered share and find the “flag.txt” file. Submit the contents as the answer.
Answer: navigate to contents your flag is there.
Press enter or click to view image in full size
Question: Find out which domain the server belongs to.
Answer:
first i tried “crackmap” wasn’t usefull
Press enter or click to view image in full size
so i went back to the module, so i can understand what am not seeing,
i found that i can enumerate domains using “Remote Procedure Call” or “rpc”
Press enter or click to view image in full size
Question: Find additional information about the specific share we found previously and submit the customized version of that specific share as the answer.
Answer: that one got me, i was seeing the answer all the time but i didn’t saw it xD
Press enter or click to view image in full size
Press enter or click to view image in full size
Question: What is the full system path of that specific share? (format: “/directory/names”)
Answer:
login to rpcclient enumerate share found the path (they want it for linux , linux does have a C: drive) so “/home/sambauser”
NFS
sudo mount -t nfs 10.129.34.148:/ ./Test-NFS/# -t : specify filesystem type in this case is nfs
# ./Test-NFS/ : target where you want to mount the nfs exportPress enter or click to view image in full size
Question: Enumerate the NFS service and submit the contents of the “flag.txt” in the “nfs” share as the answer.
Question: Enumerate the NFS service and submit the contents of the “flag.txt” in the “nfsshare” share as the answer.
Answers:
Press enter or click to view image in full size
DNS
Question 1: Interact with the target DNS using its IP address and enumerate the FQDN of it for the “inlanefreight.htb” domain.
Answer: we already have the target ip so we gonna directly “dig” to enumerate the domain.
Press enter or click to view image in full size
Question 2: Identify if its possible to perform a zone transfer and submit the TXT record as the answer. (Format: HTB{…})
Answer: check for any zone transfer using “dig” and “axfr (Asynchronous Full Transfer Zone)”
Press enter or click to view image in full size
as you can see transfer “app ”and “dev” records has failed, but it worked with “internal” record.
Press enter or click to view image in full size
Question 3: What is the IPv4 address of the hostname DC1?
Answer: you’ll also find the “ip” of “dc1” in the “internal” record.
Question 4: What is the FQDN of the host where the last octet ends with “x.x.x.203”?
Answer: NS query failed with “app” sub-domain,
Press enter or click to view image in full size
so start working on “dev” and after a hell of tries i found the right wordlist “fierce-hostlist.txt”
Press enter or click to view image in full size
SMTP
Question: Enumerate the “SMTP” service and submit the banner, including its version as the answer.
Answer: tcp connect to the “smtp” server using telnet
Question: Enumerate the SMTP service even further and find the username that exists on the system. Submit it as the answer.
Answer:
smtp-user-enum -M VRFY -U footprinting-wordlist.txt -t 10.129.58.169# -M : method using
# -U : path for the wordlist
# -t : ip of the target serveri did my enumeration using the command above but it didn’t work (timeout by default is 5s)
Press enter or click to view image in full size
So i did increase the timeout to 10s and no results, tried with 20s
Press enter or click to view image in full size
IMAP / POP3
Question: Figure out the exact organization name from the IMAP/POP3 service and submit it as the answer.
Answer:
Press enter or click to view image in full size
Question: What is the FQDN that the IMAP and POP3 servers are assigned to?
Answer: scan the server using nmap
ports 110,995 for “pop3”
ports 143,993 for “imap”
Question: Enumerate the IMAP service and submit the flag as the answer. (Format: HTB{…})
Answer: just connecting to the “imap” server using “openssl”
openssl s_client -connect 10.129.59.42:imapsQuestion: What is the customized version of the POP3 server?
Answer: connect to “pop3” server
openssl s_client -connect 10.129.59.42:pop3s
Question: Try to access the emails on the IMAP server and submit the flag as the answer. (Format: HTB{…})
Answer:
first connect via openssl to the imap server
then login as robin (password also robin) the previous credentials from the SMTP
then list all mail boxes
as we can see there is two mails we can check (dev.departement.int,
inbox)
Press enter or click to view image in full size
i selected the first one and we can see there a message there (* 1 EXISTS)
so we gonna retrieve data from that message using fetch
Press enter or click to view image in full size
nothing there so i we gonna check the message its self (body) and the flag was there.
Press enter or click to view image in full size
Question: What is the admin email address?
Answer: check the header of the subject
SNMP
Question: Enumerate the SNMP service and obtain the email address of the admin. Submit it as the answer.
Question: What is the customized version of the SNMP server?
Question: Enumerate the custom script that is running on the system and submit its output as the answer.
Answer:
To enumerate the SNMP service we gonna use the tool “snmpwalk” to query “OIDs” with there informations.
An OID or -Object Identifier Registry- represents a node in a hierarchical namespace, a sequence of numbers uniquely identifies each node, allowing the node’s position in the tree to be determined. The longer the chain, the more specific the information.
snmpwalk -v2c -c public 10.129.42.195# -v2c : the version of SNMPv2, c means community-based SNMPPress enter or click to view image in full size
email address of the admin
Press enter or click to view image in full size
customised version of the SNMP server
scroll down until you find the script the flag is the answer
Press enter or click to view image in full size
custom script that is running on the system
MySQL
Question: Enumerate the MySQL server and determine the version in use. (Format: MySQL X.X.XX)
Answer: enumerate the server en port 3306 using nmap
Press enter or click to view image in full size
Question: During our penetration test, we found weak credentials “robin:robin”. We should try these against the MySQL server. What is the email address of the customer “Otto Lang”?
Answer:
connect to the mySQL server using the credentials provided
but mysql is rejecting the connection because the target uses a self-signed TLS certificate that isn’t trusted, i tried ssl mode disabled but the flag wasn’t available
So skip the ssl and i did connect to the server
Press enter or click to view image in full size
we need the customers database because “Otto Lang” is a customer
Press enter or click to view image in full size
there was one table in the database customers, select it in content all info
find the one that belongs to “Otto Lang”
Press enter or click to view image in full size
MSSQL
Question: Enumerate the target using the concepts taught in this section. List the hostname of MSSQL server.
Answer: we can list the hostname of MSSQL server using two methods:
nmap: mssql runs on port 1433
Press enter or click to view image in full size
metaspoilt framework: to use the auxiliary scanner “mssql_ping”
Press enter or click to view image in full size
Question: Connect to the MSSQL instance running on the target using the account (backdoor:Password1), then list the non-default database present on the server.
Get Onix.09’s stories in your inbox
Join Medium for free to get updates from this writer.
Answer: using mssqlclient script we can connect to the mssql server but for that we need credentials (provided in this question, backdoor:Password1)
python3 mssqlclient.py backdoor@10.129.230.249 -windows-auth# -windows-auth : means do authentication using windows authenticator ..
# .. instead of sql server authenticatorPress enter or click to view image in full size
we can see the non-standard db is employees
Oracle TNS
Question: Enumerate the target Oracle database and submit the password hash of the user DBSNMP as the answer.
Answer:
Do an enumeration using ODAT (Oracle Database Attacking Tool)
./odat.py all -s 10.129.205.19and we found valid credentials “scott/tiger”
Press enter or click to view image in full size
and with that credentials we gonna connect to the oracle db using “sqlplus” tool
Press enter or click to view image in full size
IPMI
Question: What username is configured for accessing the host via IPMI?
Question:
Answer: scan using metasploit framework
Press enter or click to view image in full size
using the “ipmi_dumphashes” module, after setting the rhost and run the exploit the found the user the user, but the password is not in plain-text.
Press enter or click to view image in full size
so i tried a diffrent password wordlist (rockyou wordlist)
after downloading the wordlist, set the pass file to the new wordlist and exploit.
Press enter or click to view image in full size
Press enter or click to view image in full size
Footprinting Lab — Easy
Press enter or click to view image in full size
Question : Enumerate the server carefully and find the flag.txt file. Submit the contents of this file as the answer.
Answer :
enumerate the target using nmap, found ports tcp/21,2121 open , ftp server
Press enter or click to view image in full size
try to connect to the server using port 21, and nothing was there.
Press enter or click to view image in full size
tried with port 2121, found some interesting files and dir.
Press enter or click to view image in full size
download the file for later use and navigate to .ssh directory
found the ssh key. download the key we gonna need it
Press enter or click to view image in full size
try to ssh using the key, we can’t bc of the key permissions 0644 (rw-r — r — ) we can see the “group/others” can read thats the problem only the owner can read/write.
Press enter or click to view image in full size
so we gonna change file permissions to only the owner and try again, and it worked, we are in
Press enter or click to view image in full size
list all file and directories including the hidden ones, found the bash_history again, so printed it content to see recent commands used,
as we can see a file created and named flag.txt, moved to flag directory, we need to find that directory.
Press enter or click to view image in full size
and here what we are looking for. flag captured
Footprinting Lab — Medium
Press enter or click to view image in full size
Question : Enumerate the server carefully and find the username “HTB” and its password. Then, submit this user’s password as the answer.
Answer :
enumerate all ports to see what we can do
Press enter or click to view image in full size
we can see some open ports related to nfs, smb, rpc, rdp …
we gonna check them one by one.
NFS on port 2049
enumerate the port
list available exports
showmount -e 10.129.40.63
Export list for 10.129.40.63:
/TechSupport (everyone)mount the NFS share :
mkdir nfs_share
mount -t nfs 10.129.40.63:/TechSupport nfs_share -o nolockPress enter or click to view image in full size
list all content of the nfs share file including hidden ones:
ls -la nfs_sharePress enter or click to view image in full size
all file are empty except that one as we can see from the size of the file
Press enter or click to view image in full size
print the content of the text file.
Press enter or click to view image in full size
found some credentials:
user="alex"
password="lol123!mD"enumerate the smtp on port 25 and it is closed
Press enter or click to view image in full size
SMB on port 445
connect and list the shares of the smb sever using smbclient and the credentials we already have
Press enter or click to view image in full size
check the “devshare ”, and found interesting file, some credentials in it save it for later.
Press enter or click to view image in full size
open and rdp session, testing with credentials we have :
Press enter or click to view image in full size
once you run the ms sql server managment studio, you will find that the login user is “sa” we have the password of that account, but as you can see we can not connect idk why .
Press enter or click to view image in full size
so we gonna try run the ms sql as admin and see what we can do.
Press enter or click to view image in full size
test the password of the “sa” account and it worked
Press enter or click to view image in full size
Press enter or click to view image in full size
so i execute a new query
Press enter or click to view image in full size
Footprinting Lab — Hard
Question: Enumerate the server carefully and find the username “HTB” and its password. Then, submit HTB’s password as the answer.
Answer :
start with basic enumeration of the tcp ports of the target
Press enter or click to view image in full size
what about udp ports.
Press enter or click to view image in full size
ssh, imap, pop3 are useless for now because we need credentials that we don’t have.
Lets start with SNMP and see what we can do
we can use “snmpwalk ”to extract info but we need community string for that so we use “onesixtyone ”first to discover valid community strings for authentication.
onesixtyone -c onesixtyone -c /opt/useful/seclists/Discovery/SNMP/snmp.txt 10.129.29.55Press enter or click to view image in full size
now that we have it lets try to connect using snmpwalk,
snmpwalk -c backup -v2c 10.129.29.55Press enter or click to view image in full size
and we found some credentials.
Press enter or click to view image in full size
we can test it on the imap server, and it worked there is some mail boxes we gonna check them
telnet 10.129.29.55 1432 list "" "*"Press enter or click to view image in full size
checking “inbox” mail box, good for us found private key.
3 select inbox
4 fetch 1:* (flags body[])Press enter or click to view image in full size
so we gonna create a file so we can use that private key
nano ~/id_rsaPress enter or click to view image in full size
paste our private key .
Press enter or click to view image in full size
change permissions so we can use the private key. only owner can read/write the private key.
then ssh to the target. and as you can see we are in
chmod 600 ~/id_rsa6 : -rw- (owner)
0 : --- (no permissions for group)
0 : --- (no permissions for other)ssh -i ~/id_rsa tom@10.129.29.55
Press enter or click to view image in full size
after working around for sometime found a hidden file for recent commands used, as we can see there is a mysql server we can connect to and see what we can do.
ls -lacat .bash_historyPress enter or click to view image in full size
connecting using previous credentials.
mysql -u tom -pNMds732Js2761show databases;use users;show tables;select * from users;
Press enter or click to view image in full size
and flag captured;
Press enter or click to view image in full size
![Advent of Cyber 1 [2019]- All Days](https://miro.medium.com/v2/resize:fit:1358/format:webp/0*Au_XecQhCbby8Qae.png)
