kami@kali:~$ journalctl

Three writeup

10.129.43.157

Task 1 – How many TCP ports are open?

Scanned the target.

A: 2

Task 2 – What is the domain of the email address provided in the “Contact” section of the website?

Navigated to the website and scrolled down a bit.

A: thetoppers.htb

Task 3 – In the absence of a DNS server, which Linux file can we use to resolve hostnames to IP addresses in order to be able to access the websites that point to those hostnames?

Common knowledge, you’ll have to use this a lot on boxes. Used nano to open the file and add the domain.

A: /etc/hosts

Task 4 – Which sub-domain is discovered during further enumeration?

Used ffuf to enumerate subdomains but that didn’t give me any good results.

Instead I tried to VHOST fuzz with domain name and IP but I didn’t get results here too. With the domain name I received all 200 status codes. I ended up trying to filter it as well but that didn’t make any change.

When researching this it appears that it is intended. Apparently if this happens, it means we are being redirected back to http://thetoppers.htb. Notice that the response statuses don’t have 404.

So I added the switch -mc 404 to give results that match the status code 404.

I also added s3.thetoppers.htb to /etc/hosts.

A: s3.thetoppers.htb

Task 5 – Which service is running on the discovered sub-domain?

Navigated to the new subdomain and this was all that was there.

Googled ‘s3 subdomain {“status”: “running”}’ and turns out this is an Amazon S3 bucket, which actually makes sense.

A: Amazon S3

Task 6 – Which command line utility can be used to interact with the service running on the discovered sub-domain?

Googled this and ended up on https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-bucket-intro.html. I originally thought it was s3api, but I tried aswcli and it worked.

A: awscli

Task 7 – Which command is used to set up the AWS CLI installation?

More research and came across this github https://github.com/aws/aws-cli. A bit further down I found aws configure

A: aws configure

Task 8 – What is the command used by the above utility to list all of the S3 buckets?

In the same github link.

A: aws s3 ls

Task 9 – This server is configured to run files written in what web scripting language?

Putting all that we learned into practice we find index.php so we can assume that is the web scripting language.

A: PHP

Submit: Flag

With our knowledge, we also seen images/. When adding that directory on the website it looks like the AWS service stores those files. It may be possible that we can drop a reverse or webshell.

Using nano lets create a PHP shell.

Using the cp command with aws we were able to upload it successfully.

Navigated to the shell in the URL and located the flag.txt using ‘locate’.

Then read it.

A: a980d99281a28d638ac68b9bf9453c2b

I ended up learning a lot on this and taking a bunch of notes since I was previously unfamiliar with how to interact with this service.
Responder writeup

10.129.42.212

Task 1 – When visiting the web service using the IP address, what is the domain that we are being redirected to?

Scanned the target with nmap.

A: unika.htb

Task 2 – Which scripting language is being used on the server to generate webpages?

Added unkiha.htb to my /etc/hosts. Wappalyzer showed us this answer.

A: php

Task 3 – What is the name of the URL parameter which is used to load different language versions of the webpage?

So I originally overcomplicating this and was thinking this had something to do with gobuster and URL knowledge but I’m hanging with my friend who had 0 penetration testing training and pointed out there was an actual language changer on the webpage while it was open.Sometimes things are in front of your face and you don’t realize.

A: page

Task 4 – Which of the following values for the page parameter would be an example of exploiting a Local File Include (LFI) vulnerability: “french.html”, “//10.10.14.6/somefile”, “../../../../../../../../windows/system32/drivers/etc/hosts”, “minikatz.exe”

This is a straightforward answer.

A: ../../../../../../../../windows/system32/drivers/etc/hosts

Task 5 – Which of the following values for the page parameter would be an example of exploiting a Remote File Include (RFI) vulnerability: “french.html”, “//10.10.14.6/somefile”, “../../../../../../../../windows/system32/drivers/etc/hosts”, “minikatz.exe”

A: “”//10.10.14.6/somefile””

Task 6 – What does NTLM stand for?

I had to google the answer. I understand NTLM as a concept but couldn’t recall what it stood for.

A: New Technology LAN Manager

Task 7 – Which flag do we use in the Responder utility to specify the network interface?

Know this from PNPT studying.

A: -I

Task 8 – There are several tools that take a NetNTLMv2 challenge/response and try millions of passwords to see if any of them generate the same response. One such tool is often referred to as john, but the full name is what?.

Just considering the question, I guessed that this is john the ripper.

A: john the ripper

Task 9 – What is the password for the administrator user?

I only had training so far with responder for SMB relay attacks and LLMNR poisoning but assuming that’s what we have to use here I started responder. I ended up resetting my box so new IP going on from here is 10.129.95.234.

I wasn’t getting any events so I wondered if I needed a way to force authentication so I could intercept the hash.I looked back at the previous questions and wondered if it had something to do with the LFI and RFI. The pwnbox seemed to not have http.server or SimpleHTTPServer installed. I downloaded an http-server with “”npm install –global http-server”” and just created a random text file called ‘kami.txt’.Tried to RFI this but didn’t get anything back.

I tried researching what I did wrong but I couldn’t comprehend. At this point I came to the conclusion I don’t understand responder enough. I decided to read the official walkthrough. Turns out I didn’t need to host a http server as responder acts as a SMB server. When removing 8080 and reloading the page I got a response. I will definitely need somemore responder practice before the PNPT exam.

Copied the hash to hash.txt on my pwnbox.

Cracked the hash with john.

A: badminton

Task 10 – We’ll use a Windows service (i.e. running on the box) to remotely access the Responder machine using the password we recovered. What port TCP does it listen on?

WinRMM can help us with this.

A: 5985

Submit Flag:

Connected to WinRMM using our new found credentials and Evil-winrm

Poked around in Administrator files, didn’t find anything. Found another user ‘mike’ and poked around there and found the flag.

A: ea81b7afddd03efaa0945333ed147fac
Crocodile writeup

10.129.1.15

Task 1 – What Nmap scanning switch employs the use of default scripts during a scan?

I use to use this command a lot but I ended up just switching to -A instead for nmap scans.

A: -sC

Task 2 – What service version is found to be running on port 21?

A: vsftpd 3.0.3

Task 3 – What FTP code is returned to us for the “Anonymous FTP login allowed” message?

FTP’d to the machine using anonymous.

A: 230

Task 4 – After connecting to the FTP server using the ftp client, what username do we provide when prompted to log in anonymously?

A: anonymous

Task 5 – After connecting to the FTP server anonymously, what command can we use to download the files we find on the FTP server?

A: get

Task 6 – What is one of the higher-privilege sounding usernames in ‘allowed.userlist’ that we download from the FTP server?

A: admin

Task 7 – What version of Apache HTTP Server is running on the target host?

From previous scan.

A: Apache httpd 2.4.41

Task 8 – What switch can we use with Gobuster to specify we are looking for specific filetypes?

I ran gobuster without the specific file type, but I know that is -x.

A: -x

Task 9 – Which PHP file can we identify with directory brute force that will provide the opportunity to authenticate to the web service?

I guess I actually needed to run the scan with -x. I ended up finding this anyway with the last scan at /dashboard as that redirected me here.

A: login.php

Submit root:

I ended up guessing each username and password we found earlier. There is a faster way if these lists were longer but since there was few passwords and we obviously needed to get into admin I just guessed manually.

A: c7110277ac44d78b6a9fff2232434d16

GG
Sequel writeup

10.129.42.195

Task 1 – During our scan, which port do we find serving MySQL?

Scanned the machine with nmap.

A: 3306

Task 2 – What community-developed MySQL version is the target running?

A: MariaDB

Task 3 – When using the MySQL command line client, what switch do we need to use in order to specify a login username?

I had previous notes “”Mysql -u {username} -h {hostname} -p””.

A: -u

Task 4 – Which username allows us to log into this MariaDB instance without providing a password?

Googled this.

A: root

Task 5 – In SQL, what symbol can we use to specify within the query that we want to display everything inside a table?

A: *

Task 6 – In SQL, what symbol do we need to end each query with?

Both questions are pretty common knowledge.

A: ;

Task 7 – There are three databases in this MySQL instance that are common across all MySQL instances. What is the name of the fourth that’s unique to this host?

A: htb

Submit Flag:

Moved into the database using “”USE htb””. Then listed the tables using “”SHOW TABLES;””. You can see I missed the ; at the end but it went to the next line and let me use it. I listed everything found in users. As there wasn’t any use to move forward with the back with that information I checked out the table config and we found it.

A: 7b4bec00d1a39e3dd4e021ec3d915da8

GG
Berserk

I have finished of what’s currently written of Berserk, and the creative genius found in this book is nothing less than astonishing.

I used to watch anime when I was younger and I enjoyed the art styles, action and some of the story line such as Dragon Ball, Naruto and the such but eventually I came across Berserk the anime. It attracted me further in than other animes as though it comes off as a intense fighting anime, there are a lot of deeper philosophical themes underlying. As we always will hear, the anime doesn’t do the books justice.

The themes of the story being brutally tragic, the growth and healing of character, the struggle of human condition in fate verse free will, supported by the fierce fighting scenes is all too good. I truly suggest this read, even if you aren’t entirely interested in manga like me.

“Dreams. Each man longs to pursue his dream. Each man is tortured by this dream, but the dream gives meaning to his life. Even if the dream ruins his life, man cannot allow himself to leave it behind. In this world, is man ever able to possess anything more solid, than a dream?”

RIP to Kentaro Miura
Appointment writeup

10.129.41.253

Task 1 – What does the acronym SQL stand for?

A: Structured Query Language

Task 2 – What is one of the most common type of SQL vulnerabilities?

Pretty beginner knowledge up until this point.

A: SQL injection

Task 3 – What is the 2021 OWASP Top 10 classification for this vulnerability?

Did some googling for this and found A03:2021-Injection

A: A03:2021-Injection

Task 4 – What does Nmap report as the service and version that are running on port 80 of the target?

Scanned the target with Nmap.

A: Apache httpd 2.4.38 ((Debian))

Task 5 – What is the standard port used for the HTTPS protocol?

Back to basic knowledge. If you don’t know these just google them.

A: 443

Task 6 – What is a folder called in web-application terminology?

A: directory

Task 5 – What is the HTTP response code is given for ‘Not Found’ errors?

I recall even remembering this as a child.

A: 404

Task 8 – Gobuster is one tool used to brute force directories on a webserver. What switch do we use with Gobuster to specify we’re looking to discover directories, and not subdomains?

Already have familiarity with Gobuster.

A: dir

Task 9 – What single character can be used to comment out the rest of a line in MySQL?

And familiarity with MySQL even though I don’t find it much interesting.

A: #

Task 10 – If user input is not handled carefully, it could be interpreted as a comment. Use a comment to login as admin without knowing the password. What is the first word on the webpage returned?

Here’s where it got confusing as web pentesting isn’t my strong suit. I opened up burp, captured a log on request and forwarded it to Repeated to do some testing.

I tried

username=admin&password=#

username=admin#&password=

But neither of those worked. I realized I had to close the first parameter.

A: Congratulations

Submit Flag:

A: e3d0796d002a446c0e622226f42e9672
Synced writeup

10.129.41.246

Task 1 – What is the default port for rsync?

Scanned the machine with “”nmap -A -p- 10.129.41.246”

Only port open was 873, so assumption is that is the default.

A: 873

Task 2 – How many TCP ports are open on the remote host?

Previous scan.

A: 1

Task 3 – What is the protocol version used by rsync on the remote machine?

Previous scan.

A: 31

Task 4 – What is the most common command name on Linux to interact with rsync?

Had notes on this from before, unsurprisingly it’s just rsync

A: rsync

Task 5 – What credentials do you have to pass to rsync in order to use anonymous authentication? anonymous:anonymous, anonymous, None, rsync:rsync

A: None

Task 6 – What is the option to only list shares and files on rsync? (No need to include the leading — characters)

I didn’t know this. As usual in my notes I keep how to get to the help menu of commands. Ran “”rsync -h”” and looked through the output.

A: list-only

Submit Flag:

With the previous knowledge I ran it on the ‘public’ directory.

I somehow needed to read or download this file so I reviewed the help command again. I couldn’t find anything through that, but it turns out I ended up having notes already. Looking back in the help menu I just missed it. This will download the file to my /kamigold directory.

A: 72eaf5344ebb84908ae543a719830519
Mongod writeup

10.129.41.66

Task 1 – How many TCP ports are open on the machine?

Ran “”nmap -A -p- 10.129.41.66””

A: 2

Task 2 – Which service is running on port 27017 of the remote host?

A: MongoDB 3.6.8

Task 3 – What type of database is MongoDB? (Choose: SQL or NoSQL)

I didn’t know this. I tried scanning the rest of the nmap scan but I don’t think it provided anything that could point toward it being NoSQL. Also not sure if any further nmap switch could reveal more. I ended up just googling this.

A: NoSQL

Task 4 – What command is used to launch the interactive MongoDB shell from the terminal?

Didn’t know any of this so looked up some pentesting notes. Found this https://hackviser.com/tactics/pentesting/services/MongoDB

Mongo wasnt on our attacker machine and mongosh doesnt work for that version. I went to install Mongo to see if that would connect and it did

“”wget https://fastdl.mongodb.org/linux/mongodb-linux-x86_64-3.6.23.tgz””

“”tar -xvzf mongodb-linux-x86_64-3.6.23.tgz””

Navigated to the folder and ran “”./mongo 10.129.41.66:27017””

That worked but looking at the answer ending in h, it must have been mongosh. Probably because the machine is older and mongosh has updated since then but it was intended we use that.

A: mongosh

Task 5 – What is the command used for listing all the databases present on the MongoDB server? (No need to include a trailing 😉

Following the notes on the site

A: dbs

Task 6 – What is the command used for listing out the collections in a database? (No need to include a trailing 😉

Still following those notes, these are great.

It didnt seem to return anything though.

A: show collections

Task 7 – What command is used to dump the content of all the documents within the collection named flag?

I then realised that I’m supposed to “”use {database}”” then show collections. Poked around and found ‘flag’ in the sensitive_information database.

I couldn’t find how to interact with ‘flag’ from the notes on that website. Ended up researching further and found myself in the actual documentation. https://www.mongodb.com/docs/manual/crud/#find-documents

A: db.flag.find()

Submit Flag: 1b6e6fb359e7c40241b6d431427ba6ea
Preignition writeup

10.129.40.89

Task 1 – Directory Brute-forcing is a technique used to check a lot of paths on a web server to find hidden pages. Which is another name for this? (i) Local File Inclusion, (ii) dir busting, (iii) hash cracking.

A: dir busting

Task 2 – What switch do we use for nmap’s scan to specify that we want to perform version detection

A: -sV

Task 3 – What does Nmap report is the service identified as running on port 80/tcp?

Ran nmap to scan the device, even though it is likely a webserver on http

A: http

Task 4 – What server name and version of service is running on port 80/tcp?

A: nginx 1.14.2

Task 5 – What switch do we use to specify to Gobuster we want to perform dir busting specifically?

Already used gobuster, so I know this

A: dir

Task 6 – When using gobuster to dir bust, what switch do we add to make sure it finds PHP pages?

A: -x php

Already had this in notes to, can remember this as x for extension

Task 7 – What page is found during our dir busting activities?

Ran

‘’gobuster dir -u 10.129.40.89 -w gobuster dir -u 10.129.40.89 -w /usr/share/wordlists/dirbuster/directory-list-1.0.txt’’

That returned nothing but that didn’t seem right. Even though its a smaller list I couldn’t imagine a easier box that had issue. Considering Task 6 I decided to add that switch

“gobuster dir -u 10.129.40.89 -w /usr/share/wordlists/dirbuster/directory-list-1.0.txt -x php”

This worked and found /admin.php right away

Task 8 – What is the HTTP status code reported by Gobuster for the discovered page?

In previous screenshot status is 200

A: 200

Submit Flag:

Navigated to the website at that newly found directory and it brought us to an Admin Console Login searching for a username and password. Considering they fastballs thrown at me, I attempted admin:admin and it worked.

A: 6483bee07c1c1d57f14e5b0717503c73
Explosion writeup

This is a very easy box so the first few tasks I just knew from previous experience.

Task 1: What does the 3-letter acronym RDP stand for?

A: Remote Desktop Protocol

Task 2: What is a 3-letter acronym that refers to interaction with the host through a command line interface?

A: CLI

Task 3: What about graphical user interface interactions?

A: GUI

Task 4: What is the name of an old remote access tool that came without encryption by default and listens on TCP port 23?

Task 5: What is the name of the service running on port 3389 TCP?

Couldn’t remember this off the top of my head and my machine has started by now.

10.129.39.161

Scanned the machine with nmap -p- 10.129.39.161 that shows 135, 139, 445,

3389, 5985, 47001, 49664, 49665, 49666, 49667, 49668,49669, 49670, 49671

Ran nmap -A -p135, 139, 445,

3389, 5985, 47001, 49664, 49665, 49666, 49667, 49668,49669, 49670, 49671 10.129.39.161

A: ms-wbt-server

Task 6: What is the switch used to specify the target host’s IP address when using xfreerdp?

Knew this from previous experience

“”xfreerdp /v:10.10.161.253 /u:thm /p:TryHackM3””

A: /v:

Task 7: What username successfully returns a desktop projection to us with a blank password?

Considering that this box looks RDP related I wanted to scan it. I kicked up metasploit to use auxiliary/scanner/rdp/rdp_scanner and it didnt work. Realize I mistakenly set RHOSTS to myself, so set it properly to 10.129.39.131 but got some errors.

If I’m thinking about this properly, our next step will be to find credentials to use against RDP. I’m going to move to poking at the SMB ports instead. I attempted to list any interesting shares.

When I did this I have to be completely overcomplicating things since this must be a Very Easy box. A bit of meta, but then actually reading the question I just guessed that the default Administrator may be enabled and turns out I was correct.

A: Administrator

Submit Flag: 951fa96d7830c451b536be5a6be008a0

GG

kami@kali:~$ journalctl

Categories