Footprinting:
Link to challenge: https://academy.hackthebox.com/module/112
(log in required)
Class: Tier II | Medium | Offensive
Before we begin: throughout the module, in our disposal we will have a
‘Footprinting-w
...
Footprinting:
Link to challenge: https://academy.hackthebox.com/module/112
(log in required)
Class: Tier II | Medium | Offensive
Before we begin: throughout the module, in our disposal we will have a
‘Footprinting-wordlist’ provided for us as a resource by the module.
It will be referred as the default wordlist throughout the module.Host Based Enumeration
FTP:
Question: Which version of the FTP server is running on the target system?
Submit the entire banner as the answer.
Answer: InFreight FTP v1.1
Method: we will run the command:
nc -nv 21
to connect to the target machine on port 21 (FTP port), and received detailed
information (‘-v’):
Question: Enumerate the FTP server and find the flag.txt file. Submit the
contents of it as the answer.
Answer: HTB{b7skjr4c76zhsds7fzhd4k3ujg7nhdjre}
Method: we will initiate anonymous login to the server, lets start by connection
to the ftp server using the command:
ftp
We are requested to enter credentials (which we do not have), so we will use
anonymous login, a special login which doesn’t request credentials (like guest
user in many gaming application). This anonymous login if often more
restricted with user login.
To anonymous login, we will enter ‘anonymous’ to the ‘Name’ field, and the
password field we will leave blank:Once entered:
We are in. lets run ‘ls’ on the ftp CLI to see the content of the server:
Here is our flag, lets get it to our pwnbox attacking machine with:
get flag.txt
The flag is downloaded to the pwnbox from the ftp server. Now we exit the ftp
server (using ‘exit’ command’, and in the pwnbox we cat the flag:
cat flag.txtSMB:
Question: What version of the SMB server is running on the target system?
Submit the entire banner as the answer.
Answer: Samba smbd 4.6.2
Method: we will run nmap scan:
nmap 10.129.192.238 -sV -p139,445
with enhanced inspection capabilities (-sV):
We can observe the result under ‘VERSION’ column.
Question: What is the name of the accessible share on the target?
Answer: sambashare
Method: we can run
smbclient -N -L //
To anonymously (-N) list all shares on the target smb server, but it doesn’t
shows which one is out right accessible. We can manually inspect the shares
one by one.
[Show More]