Posts tagged with

john

HackTheBox - MonitorsTwo Writeup

MonitorsTwo is an easy Hack The Box Linux machine featuring pre-auth RCE via a malicious X-Forwarded-For header, leading to a Docker container shell. A misconfigured SUID capsh binary grants root in the container. Cracked MySQL credentials allow SSH access to the host. Privilege escalation is achieved by exploiting Docker CVE-2021-41091 to access container-mounted files and reuse a SUID Bash binary.

S SH∆FIQ∆IM∆N
September 3, 2023
1 min read

CVE-2022-46169 CVE-2021-41091 upgrade-shell-using-script rce GTFOBins capsh mysql john docker
HackTheBox - Sunday Writeup

Sunday is an easy Hack The Box Linux machine with unusual services. Enumeration of the finger service reveals valid usernames, and default credentials provide SSH access. A leaked shadow.backup file exposes a crackable password hash, leading to a second user. With full sudo rights, privilege escalation is achieved by exploiting wget to modify the sudoers file and gain root access.

S SH∆FIQ∆IM∆N
December 3, 2022
1 min read

finger finger-user-enum john privesc-wget
HackTheBox - Timelapse Writeup

Timelapse is an easy Hack The Box Windows machine that begins with accessing an open SMB share containing a password-protected ZIP file. The ZIP and a contained .pfx file are cracked using John the Ripper, allowing extraction of a certificate and private key. These are used to authenticate via WinRM. Further enumeration reveals stored PowerShell history with credentials for the svc_deploy user, who is a member of the LAPS_Readers group. This group can retrieve local admin passwords managed by LAPS, which is leveraged to obtain the domain Administrator's credentials and gain full access to the machine.

S SH∆FIQ∆IM∆N
August 21, 2022
1 min read

crackmapexec-smb smbclient zip2john pfx-file pfx2john john evil-winrm powershell-history ldap ldapsearch laps_readers-group
HackTheBox - Pathfinder Writeup

Starting Point Machine

S SH∆FIQ∆IM∆N
July 21, 2021
1 min read

ldap ldapsearch ldapdomaindump kerberos ASREPRoast GetNPUsers.py DCSync-attack secretsdump.py john evil-winrm psexec.py
HackTheBox - Vaccine Writeup

Starting Point Machine

S SH∆FIQ∆IM∆N
July 21, 2021
1 min read

sqlmap sql-union sqli GTFOBins ftp rce zip2john john crackstation python PostgreSQL