Footprinting
Host Based Enumeration
-FTP
Question: Which version of the FTP server is running on the target system? Submit the entire banner as the answer.
Answer: just connecting to the ftp server and the ftp version printed
Question : Enumerate the FTP server and find the “flag.txt” file. Submit the contents of it as the answer.
Answer : login as anonymous, flag was easy to capture
-SMB
Question: What version of the SMB server is running on the target system? Submit the entire banner as the answer.
Answer:
first tried login to smbclient as anonymous via “-N” nothing there,
then i the saw word banner in the question, i remember i can do a scan on the target.
Question: What is the name of the accessible share on the target?
Answer: listing shares “-L” after login anonymously “-N”
if you do a smbmap you’ll confirm which one is accessible
Question: Connect to the discovered share and find the “flag.txt” file. Submit the contents as the answer.
Answer: navigate to contents your flag is there.
Question: Find out which domain the server belongs to.
Answer:
first i tried “crackmap” wasn’t usefull
so i went back to the module, so i can understand what am not seeing,
i found that i can enumerate domains using “Remote Procedure Call” or “rpc”
Question: Find additional information about the specific share we found previously and submit the customized version of that specific share as the answer.
Answer: that one got me, i was seeing the answer all the time but i didn’t saw it xD
Question: What is the full system path of that specific share? (format: “/directory/names”)
Answer:
login to rpcclient enumerate share found the path (they want it for linux , linux does have a C: drive) so “/home/sambauser”
NFS
sudo mount -t nfs 10.129.34.148:/ ./Test-NFS/
# -t : specify filesystem type in this case is nfs
# ./Test-NFS/ : target where you want to mount the nfs export
Question: Enumerate the NFS service and submit the contents of the “flag.txt” in the “nfs” share as the answer.
Question: Enumerate the NFS service and submit the contents of the “flag.txt” in the “nfsshare” share as the answer.
Answers:
DNS
Question 1: Interact with the target DNS using its IP address and enumerate the FQDN of it for the “inlanefreight.htb” domain.
Answer: we already have the target ip so we gonna directly “dig” to enumerate the domain.
Question 2: Identify if its possible to perform a zone transfer and submit the TXT record as the answer. (Format: HTB{…})
Answer: check for any zone transfer using “dig” and “axfr (Asynchronous Full Transfer Zone)”
as you can see transfer “app ”and “dev” records has failed, but it worked with “internal” record.
Question 3: What is the IPv4 address of the hostname DC1?
Answer: you’ll also find the “ip” of “dc1” in the “internal” record.
Question 4: What is the FQDN of the host where the last octet ends with “x.x.x.203”?
Answer: NS query failed with “app” sub-domain,
so start working on “dev” and after a hell of tries i found the right wordlist “fierce-hostlist.txt”
SMTP
Question: Enumerate the “SMTP” service and submit the banner, including its version as the answer.
Answer: tcp connect to the “smtp” server using telnet
Question: Enumerate the SMTP service even further and find the username that exists on the system. Submit it as the answer.
Answer:
smtp-user-enum -M VRFY -U footprinting-wordlist.txt -t 10.129.58.169
# -M : method using
# -U : path for the wordlist
# -t : ip of the target serveri did my enumeration using the command above but it didn’t work (timeout by default is 5s)
So i did increase the timeout to 10s and no results, tried with 20s
IMAP / POP3
Question: Figure out the exact organization name from the IMAP/POP3 service and submit it as the answer.
Answer:
Question: What is the FQDN that the IMAP and POP3 servers are assigned to?
Answer: scan the server using nmap
ports 110,995 for “pop3”
ports 143,993 for “imap”
Question: Enumerate the IMAP service and submit the flag as the answer. (Format: HTB{…})
Answer: just connecting to the “imap” server using “openssl”
openssl s_client -connect 10.129.59.42:imapsQuestion: What is the customized version of the POP3 server?
Answer: connect to “pop3” server
openssl s_client -connect 10.129.59.42:pop3s
Question: Try to access the emails on the IMAP server and submit the flag as the answer. (Format: HTB{…})
Answer:
first connect via openssl to the imap server
then login as robin (password also robin) the previous credentials from the SMTP
then list all mail boxes
as we can see there is two mails we can check (dev.departement.int,
inbox)
i selected the first one and we can see there a message there (* 1 EXISTS)
so we gonna retrieve data from that message using fetch
nothing there so i we gonna check the message its self (body) and the flag was there.
Question: What is the admin email address?
Answer: check the header of the subject
SNMP
Question: Enumerate the SNMP service and obtain the email address of the admin. Submit it as the answer.
Question: What is the customized version of the SNMP server?
Question: Enumerate the custom script that is running on the system and submit its output as the answer.
Answer:
To enumerate the SNMP service we gonna use the tool “snmpwalk” to query “OIDs” with there informations.
An OID or -Object Identifier Registry- represents a node in a hierarchical namespace, a sequence of numbers uniquely identifies each node, allowing the node’s position in the tree to be determined. The longer the chain, the more specific the information.
snmpwalk -v2c -c public 10.129.42.195
# -v2c : the version of SNMPv2, c means community-based SNMP 
scroll down until you find the script the flag is the answer
MySQL
Question: Enumerate the MySQL server and determine the version in use. (Format: MySQL X.X.XX)
Answer: enumerate the server en port 3306 using nmap
Question: During our penetration test, we found weak credentials “robin:robin”. We should try these against the MySQL server. What is the email address of the customer “Otto Lang”?
Answer:
connect to the mySQL server using the credentials provided
but mysql is rejecting the connection because the target uses a self-signed TLS certificate that isn’t trusted, i tried ssl mode disabled but the flag wasn’t available
So skip the ssl and i did connect to the server
we need the customers database because “Otto Lang” is a customer
there was one table in the database customers, select it in content all info
find the one that belongs to “Otto Lang”
MSSQL
Question: Enumerate the target using the concepts taught in this section. List the hostname of MSSQL server.
Get Abdelhamid Houari’s stories in your inbox
Join Medium for free to get updates from this writer.
Answer: we can list the hostname of MSSQL server using two methods:
nmap: mssql runs on port 1433
metaspoilt framework: to use the auxiliary scanner “mssql_ping”
Question: Connect to the MSSQL instance running on the target using the account (backdoor:Password1), then list the non-default database present on the server.
Answer: using mssqlclient script we can connect to the mssql server but for that we need credentials (provided in this question, backdoor:Password1)
python3 mssqlclient.py backdoor@10.129.230.249 -windows-auth
# -windows-auth : means do authentication using windows authenticator ..
# .. instead of sql server authenticator
we can see the non-standard db is employees
Oracle TNS
Question: Enumerate the target Oracle database and submit the password hash of the user DBSNMP as the answer.
Answer:
Do an enumeration using ODAT (Oracle Database Attacking Tool)
./odat.py all -s 10.129.205.19and we found valid credentials “scott/tiger”
and with that credentials we gonna connect to the oracle db using “sqlplus” tool
IPMI
Question: What username is configured for accessing the host via IPMI?
Question:
Answer: scan using metasploit framework
using the “ipmi_dumphashes” module, after setting the rhost and run the exploit the found the user the user, but the password is not in plain-text.
so i tried a diffrent password wordlist (rockyou wordlist)
after downloading the wordlist, set the pass file to the new wordlist and exploit.
Footprinting Lab — Easy
Question : Enumerate the server carefully and find the flag.txt file. Submit the contents of this file as the answer.
Answer :
enumerate the target using nmap, found ports tcp/21,2121 open , ftp server
try to connect to the server using port 21, and nothing was there.
tried with port 2121, found some interesting files and dir.
download the file for later use and navigate to .ssh directory
found the ssh key. download the key we gonna need it
try to ssh using the key, we can’t bc of the key permissions 0644 (rw-r — r — ) we can see the “group/others” can read thats the problem only the owner can read/write.
so we gonna change file permissions to only the owner and try again, and it worked, we are in
list all file and directories including the hidden ones, found the bash_history again, so printed it content to see recent commands used,
as we can see a file created and named flag.txt, moved to flag directory, we need to find that directory.
and here what we are looking for. flag captured
Footprinting Lab — Medium
Question : Enumerate the server carefully and find the username “HTB” and its password. Then, submit this user’s password as the answer.
Answer :
enumerate all ports to see what we can do
we can see some open ports related to nfs, smb, rpc, rdp …
we gonna check them one by one.
NFS on port 2049
enumerate the port
list available exports
showmount -e 10.129.40.63
Export list for 10.129.40.63:
/TechSupport (everyone)mount the NFS share :
mkdir nfs_share
mount -t nfs 10.129.40.63:/TechSupport nfs_share -o nolock
list all content of the nfs share file including hidden ones:
ls -la nfs_share
all file are empty except that one as we can see from the size of the file
print the content of the text file.
found some credentials:
user="alex"
password="lol123!mD"enumerate the smtp on port 25 and it is closed
SMB on port 445
connect and list the shares of the smb sever using smbclient and the credentials we already have
check the “devshare ”, and found interesting file, some credentials in it save it for later.
open and rdp session, testing with credentials we have :
once you run the ms sql server managment studio, you will find that the login user is “sa” we have the password of that account, but as you can see we can not connect idk why .
so we gonna try run the ms sql as admin and see what we can do.
test the password of the “sa” account and it worked
so i execute a new query
Footprinting Lab — Hard
Question: Enumerate the server carefully and find the username “HTB” and its password. Then, submit HTB’s password as the answer.
Answer :
start with basic enumeration of the tcp ports of the target
what about udp ports.
ssh, imap, pop3 are useless for now because we need credentials that we don’t have.
Lets start with SNMP and see what we can do
we can use “snmpwalk ”to extract info but we need community string for that so we use “onesixtyone ”first to discover valid community strings for authentication.
onesixtyone -c onesixtyone -c /opt/useful/seclists/Discovery/SNMP/snmp.txt 10.129.29.55
now that we have it lets try to connect using snmpwalk,
snmpwalk -c backup -v2c 10.129.29.55
and we found some credentials.
we can test it on the imap server, and it worked there is some mail boxes we gonna check them
telnet 10.129.29.55 143
2 list "" "*"
checking “inbox” mail box, good for us found private key.
3 select inbox
4 fetch 1:* (flags body[])
so we gonna create a file so we can use that private key
nano ~/id_rsa
paste our private key .
change permissions so we can use the private key. only owner can read/write the private key.
then ssh to the target. and as you can see we are in
chmod 600 ~/id_rsa
6 : -rw- (owner)
0 : --- (no permissions for group)
0 : --- (no permissions for other)
ssh -i ~/id_rsa tom@10.129.29.55
after working around for sometime found a hidden file for recent commands used, as we can see there is a mysql server we can connect to and see what we can do.
ls -la
cat .bash_history
connecting using previous credentials.
mysql -u tom -pNMds732Js2761
show databases;
use users;
show tables;
select * from users;
and flag captured;
