Footprinting v2
DNS
DNS Record
Description
A
Returns an IPv4 address of the requested domain as a result.
AAAA
Returns an IPv6 address of the requested domain.
MX
Returns the responsible mail servers as a result.
NS
Returns the DNS servers (nameservers) of the domain.
TXT
This record can contain various information. The all-rounder can be used, e.g., to validate the Google Search Console or validate SSL certificates. In addition, SPF and DMARC entries are set to validate mail traffic and protect it from spam.
CNAME
This record serves as an alias for another domain name. If you want the domain www.hackthebox.eu to point to the same IP as hackthebox.eu, you would create an A record for hackthebox.eu and a CNAME record for www.hackthebox.eu.
PTR
The PTR record works the other way around (reverse lookup). It converts IP addresses into valid domain names.
SOA
Provides information about the corresponding DNS zone and email address of the administrative contact.
The SOA record is located in a domain's zone file and specifies who is responsible for the operation of the domain and how DNS information for the domain is managed.
DIG - NS Query
DIG - Version Query
DIG - ANY Query
DIG - AXFR Zone Transfer
If the administrator used a subnet for the allow-transfer option for testing purposes or as a workaround solution or set it to any, everyone would query the entire zone file at the DNS server. In addition, other zones can be queried, which may even show internal IP addresses and hostnames.
DIG - AXFR Zone Transfer - Internal
The individual A records with the hostnames can also be found out with the help of a brute-force attack. To do this, we need a list of possible hostnames, which we use to send the requests in order. Such lists are provided, for example, by SecLists.
Subdomain Brute Forcing
Many different tools can be used for this, and most of them work in the same way. One of these tools is, for example DNSenum.
DNS
Lab - Questions
Interact with the target DNS using its IP address and enumerate the FQDN of it for the "inlanefreight.htb" domain.
First we must map the target IP to inlanefreight.htb via /etc/hosts
ns.inlanefreight.htb
Identify if its possible to perform a zone transfer and submit the TXT record as the answer. (Format: HTB{...})
Now enumerate all subdomians -->
Looks like there are a few records:
app.inlanefreight.htb
dev.inlanefreight.htb
internal.inlanefreight.htb
mail1.inlanefreight.htb
We can now try to transfer each record. Both app and dev failed; however, internal worked!
What is the IPv4 address of the hostname DC1?
In the axfr query with dig, we get it
What is the FQDN of the host where the last octet ends with "x.x.x.203"?
This one takes a bit of trial and error with the tool dnsenum. We need to enumerate the correct subdomain and use the right wordlist. The proper command is:
First I tried against the app subdomain and the NS query failed, so then I moved on to dev and started getting results; However, the first few lists I tried were not returning an IP with the last octet 203. Finally got there using fierce-hostlist.txt
SMTP
The Simple Mail Transfer Protocol (SMTP) is a protocol for sending emails in an IP network. It can be used between an email client and an outgoing mail server or between two SMTP servers. SMTP is often combined with the IMAP or POP3 protocols, which can fetch emails and send emails
Telnet - HELO/EHLO
The command VRFY can be used to enumerate existing users on the system. However, this does not always work. Depending on how the SMTP server is configured, the SMTP server may issue code 252 and confirm the existence of a user that does not exist on the system. A list of all SMTP response codes can be found here.
Telnet - VRFY
Therefore, one should never entirely rely on the results of automatic tools. After all, they execute pre-configured commands, but none of the functions explicitly state how the administrator configures the tested server.
Sometimes we may have to work through a web proxy. We can also make this web proxy connect to the SMTP server. The command that we would send would then look something like this:
CONNECT 10.129.14.128:25 HTTP/1.0
Send an Email
Nmap
However, we can also use the smtp-open-relay NSE script to identify the target SMTP server as an open relay using 16 different tests. If we also print out the output of the scan in detail, we will also be able to see which tests the script is running.
Nmap - Open Relay
Lab - Questions
Enumerate the SMTP service and submit the banner, including its version as the answer.
Enumerate the SMTP service even further and find the username that exists on the system. Submit it as the answer.
Note: We can user Metasploit smtp user enum or
smtp-user-enum
Before to execute dnsenum and found more subdomains, we save it into /etc/hosts -->
IMAP / POP3
With the help of the Internet Message Access Protocol (IMAP), access to emails from a mail server is possible. Unlike the Post Office Protocol (POP3), IMAP allows online management of emails directly on the server and supports folder structures.
IMAP Commands
Command
Description
1 LOGIN username password
User's login.
1 LIST "" *
Lists all directories.
1 CREATE "INBOX"
Creates a mailbox with a specified name.
1 DELETE "INBOX"
Deletes a mailbox.
1 RENAME "ToRead" "Important"
Renames a mailbox.
1 LSUB "" *
Returns a subset of names from the set of names that the User has declared as being active or subscribed.
1 SELECT INBOX
Selects a mailbox so that messages in the mailbox can be accessed.
1 UNSELECT INBOX
Exits the selected mailbox.
1 FETCH <ID> all
Retrieves data associated with a message in the mailbox.
1 CLOSE
Removes all messages with the Deleted flag set.
1 LOGOUT
Closes the connection with the IMAP server.
POP3 Commands
Command
Description
USER username
Identifies the user.
PASS password
Authentication of the user using its password.
STAT
Requests the number of saved emails from the server.
LIST
Requests from the server the number and size of all emails.
RETR id
Requests the server to deliver the requested email by ID.
DELE id
Requests the server to delete the requested email by ID.
CAPA
Requests the server to display the server capabilities.
RSET
Requests the server to reset the transmitted information.
QUIT
Closes the connection with the POP3 server.
Nmap
For example, from the output, we can see that the common name is mail1.inlanefreight.htb, and the email server belongs to the organization Inlanefreight, which is located in California. The displayed capabilities show us the commands available on the server and for the service on the corresponding port.
cURL
If we also use the verbose (-v) option, we will see how the connection is made. From this, we can see the version of TLS used for encryption, further details of the SSL certificate, and even the banner, which will often contain the version of the mail server.
To interact with the IMAP or POP3 server over SSL, we can use openssl, as well as ncat. The commands for this would look like this:
OpenSSL - TLS Encrypted Interaction POP3
OpenSSL - TLS Encrypted Interaction IMAP
In the SMTP section, we have found the user
robin. Another member of our team was able to find out that the user also uses his username as a password (robin:robin). We can use these credentials and try them to interact with the IMAP/POP3 services.
Lab - Questions
Figure out the exact organization name from the IMAP/POP3 service and submit it as the answer.
What is the FQDN that the IMAP and POP3 servers are assigned to?
There is we can get of the nmap capture --> dev.inlanefreight.htb
Enumerate the IMAP service and submit the flag as the answer. (Format: HTB{...})
What is the customized version of the POP3 server?
What is the admin email address?
Do do this one, I’ll first connect as robin to the IMAP server and list the shares:
Try to access the emails on the IMAP server and submit the flag as the answer. (Format: HTB{...})
Conecct via imaps with robin user
SNMP
Simple Network Management Protocol (SNMP) was created to monitor network devices. In addition, this protocol can also be used to handle configuration tasks and change settings remotely. SNMP-enabled hardware includes routers, switches, servers, IoT devices, and many other devices that can also be queried and controlled using this standard protocol.
SNMP also transmits control commands using agents over UDP port 161. SNMP also enables the use of so-called traps over UDP port 162.
SNMPwalk
In the case of a misconfiguration, we would get approximately the same results from snmpwalk as just shown above. Once we know the community string and the SNMP service that does not require authentication (versions 1, 2c), we can query internal system information like in the previous example.
Here we recognize some Python packages that have been installed on the system. If we do not know the community string, we can use onesixtyone and SecLists wordlists to identify these community strings.
OneSixtyOne
We can use the tool crunch to create custom wordlists. Creating custom wordlists is not an essential part of this module, but more details can be found in the module Cracking Passwords With Hashcat.
Once we know a community string, we can use it with braa to brute-force the individual OIDs and enumerate the information behind them.
Braa
Lab - Questions
Enumerate the SNMP service and obtain the email address of the admin. Submit it as the answer.
What is the customized version of the SNMP server?
We can optain it with the previus command (InFreight SNMP v0.91)
Enumerate the custom script that is running on the system and submit its output as the answer.
We can optain it with the previus commnad too!
Last updated