HackTheBox - Sauna - WriteUP

My log from the attack on the Sauna machine on HackTheBox.
The beginning was long. All fun is enumeration. Start by enumerating employee accounts. The website turns out to be useful.

Turbo intruder sample code

def queueRequests(target, wordlists):
    engine = RequestEngine(endpoint=target.endpoint,
                           concurrentConnections=5,
                           requestsPerConnection=100,
                           pipeline=False
                           )

    for i in range(1000):
engine.queue(target.req)

    engine.start()

def handleResponse(req, interesting):
    if "cos" in req.response:
        table.add(req)

Przeszukiwanie plików z dostępem do odczytu na zasobach - powershell

$REMOTE_HOST = "172.21.56.235"

$FILE_TYPES = "*.pst, *.conf"

net view \\$REMOTE_HOST\ |
ForEach-Object {
    $path = [regex]::match($_, '(.*)       Dysk').Groups[1].Value.Trim()

    if ($path -ne "") {
        Write-Host ("### PATH: " + $path)
        Get-ChildItem -Path \\$REMOTE_HOST\$path -Include $FILE_TYPES -Recurse -ErrorAction Ignore |
        ForEach-Object {
            Try {
                [System.IO.File]::OpenRead($_.FullName).Close()
                Write-Host $_.FullName
            }
            Catch {
                #Write-Host ("Niet: " + $_.FullName)
            }
        }
    }    
}  

//Autor: hagier

XSS w praktyce - deanomizacja

Natrafiłem na ciekawy artykuł pokazujący w praktyce jak przebiega skuteczny atak XSS.  Artykuł pozakazuje kilka ciekawych technik (jak np wykradanie danych z auto uzupełnionych formularzy). Całość pokazuje w jaki sposób zwykły XSS zdeanonimizował administratora pewnej strony internetowej.

LINK: https://m417z.com/The-De-anonymization-of-the-Technion-Confessions-Admin/

How to upgrade LND - Lighnting Network [Linux]

Recently I asked how to update LND to the latest version. He gave me the answer. And I made a small blog post for others. This post is for people who build their LND from sources.

0. upgrade GO

$ sudo rm -rf /usr/local/go

$ sudo tar -C /usr/local -xzf /home/nikhita/Downloads/go1.8.1.linux-amd64.tar.gz

$ echo $PATH | grep "/usr/local/go/bin"

1.  stop LND from running

$ lncli stop

2.  cd $GOPATH/src/github.com/lightningnetwork/lnd

$ cd $GOPATH/src/github.com/lightningnetwork/lnd
$ git fetch
$ git checkout v0.8.0-beta
$ make && make install

3.  run LND

$ lnd --configfile=/home/w4cky/.lnd/lnd.conf

Obtaining an IPv6 address from FTP ipv4 using FXP (rfc2428)

One of the tasks from HackTheBox gave me such a puzzle to solve. It is possible. I
spent some time on this because I didn't issue the LIST command. See how it is done correctly :)

HackTheBox - Emdee five for life - WriteUp


import requests
import hashlib


s = requests.Session()
r = s.get("http://docker.hackthebox.eu:37358")
print(r.status_code)
print(r.text)
print('eeeeeeeeeeeeeee')


postString0 = r.text.split("\n",5)[5]
postString1 = postString0.split("<h1 align='center'>MD5 encrypt this string</h1><h3 align='center'>",1)[1]
kodzik = postString1.split("</h3>",1)[0]


print("kodzik from website:")
print(kodzik)


kodzikMd5 = hashlib.md5(kodzik.encode('utf-8')).hexdigest()

print("kodzik md5:")
print(kodzikMd5)


#p5={'hash': kodzikMd5}
p5='hash=kodzikMd5'

r5 = s.post("http://docker.hackthebox.eu:37358", p5)
print(r5.text)


OSINT links

https://github.com/jivoi/awesome-osint
https://start.me/p/rxRbpo/ti
https://www.osintdfir.com
https://www.faxvin.com/license-plate-lookup
https://knowem.com/
https://checkusernames.com/
https://stalkscan.com/
https://tineye.com/
https://www.genymotion.com/
Instagram search tool .. https://web.stagram.com/
http://onstrat.com/osint/
https://code.google.com/archive/p/theharvester/
https://docs.google.com/document/d/1BfLPJpRtyq4RFtHJoNpvWQjmGnyVkfE2HYoICKOGguA/edit#heading=h.kmtmtyoi48ch
https://github.com/Ph055a/awesome_osint
https://osintframework.com/