search

Footprinting Lab - Hard

The third server is an MX and management server for the internal network. Subsequently, this server has the function of a backup server for the internal accounts in the domain. Accordingly, a user named HTB was also created here, whose credentials we need to access.

  • Enumerate the server carefully and find the username "HTB" and its password. Then, submit HTB's password as the answer.

Again, scan TCP and UDP ports with -D -->

nmap -p- --open -sS 10.129.202.20 -Pn -n --min-rate 1000 -D 5
PORT    STATE SERVICE
22/tcp  open  ssh
110/tcp open  pop3
143/tcp open  imap
993/tcp open  imaps
995/tcp open  pop3s
nmap --top-port 1000 --open -sU 10.129.202.20 -Pn -n --min-rate 1000 -D 5
PORT    STATE SERVICE
161/udp open  snmp

Now, scan his versions with -sCV -->

hashtag
TCP

nmap -p 22,110,143,993,995 -sS -sCV 10.129.202.20 -Pn -n --min-rate 1000 -D 5
PORT    STATE SERVICE  VERSION
22/tcp  open  ssh      OpenSSH 8.2p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 3f:4c:8f:10:f1:ae:be:cd:31:24:7c:a1:4e:ab:84:6d (RSA)
|   256 7b:30:37:67:50:b9:ad:91:c0:8f:f7:02:78:3b:7c:02 (ECDSA)
|_  256 88:9e:0e:07:fe:ca:d0:5c:60:ab:cf:10:99:cd:6c:a7 (ED25519)
110/tcp open  pop3     Dovecot pop3d
| ssl-cert: Subject: commonName=NIXHARD
| Subject Alternative Name: DNS:NIXHARD
| Not valid before: 2021-11-10T01:30:25
|_Not valid after:  2031-11-08T01:30:25
|_pop3-capabilities: USER CAPA UIDL RESP-CODES SASL(PLAIN) AUTH-RESP-CODE STLS PIPELINING TOP
143/tcp open  imap     Dovecot imapd (Ubuntu)
|_imap-capabilities: more AUTH=PLAINA0001 LITERAL+ OK STARTTLS have ID LOGIN-REFERRALS IDLE IMAP4rev1 SASL-IR listed Pre-login post-login ENABLE capabilities
| ssl-cert: Subject: commonName=NIXHARD
| Subject Alternative Name: DNS:NIXHARD
| Not valid before: 2021-11-10T01:30:25
|_Not valid after:  2031-11-08T01:30:25
|_ssl-date: TLS randomness does not represent time
993/tcp open  ssl/imap Dovecot imapd (Ubuntu)
|_imap-capabilities: AUTH=PLAINA0001 LITERAL+ OK have more ID LOGIN-REFERRALS IDLE IMAP4rev1 SASL-IR listed Pre-login post-login ENABLE capabilities
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=NIXHARD
| Subject Alternative Name: DNS:NIXHARD
| Not valid before: 2021-11-10T01:30:25
|_Not valid after:  2031-11-08T01:30:25
995/tcp open  ssl/pop3 Dovecot pop3d
|_ssl-date: TLS randomness does not represent time
|_pop3-capabilities: USER SASL(PLAIN) AUTH-RESP-CODE UIDL CAPA TOP PIPELINING RESP-CODES
| ssl-cert: Subject: commonName=NIXHARD
| Subject Alternative Name: DNS:NIXHARD
| Not valid before: 2021-11-10T01:30:25
|_Not valid after:  2031-11-08T01:30:25
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

hashtag
UDP

So... we can see the SNMP 161 UDP open... try to bruteforce community strings -->

backup exist! So... now analyze it -->

-v2c : Is the version, maybe in other labs exist v3 o simple v (v1)

Nice, we know exists the admin (tech) user into this company, now continue...

YOOO... WTF, try to login via SSH with this credentials -->

tom:NMds732Js2761

We cant... so... try to continue with the enumeration about IMAP/POP3 for example with its credentials:

They return his mailboxes, now connect -->

NICE! We can see they sends cleartext once private key with the subject: KEY, try to save it and login via SSH as tom user -->

Set: chmod 600 id_rsa

So... I sense that sql server is work

Its true!, Now connect -->

PreviousFootprinting Lab - MediumNextVulnerability Assessment

Last updated