[cavour13]

started right now
i was able to trigger xss on cube but gave me server error

triying to reset password for that other subdomain

[jonklem]

Somehow I'm able to use ldap search but can't run bloodhound sshuttle seems to have helped.

[0xbeef]

Somehow I'm able to use ldap search but can't run bloodhound sshuttle seems to have helped.

ldapdomaindump also works but can't use that data in bloodhound...

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching.

[samuelballsiu1]

Yeah, its really annoying. I can't get the bloodhound-python to work either. windapsearch.py ain't working too

[jonklem]

http://172.16.20.2:5000/check this works with victor's creds. I thought maybe i could snag a hash with responder, but I already had to jump through hoops to get access to the network, i can't just make it fetch my ip.

[luckystars0612]

Somehow I'm able to use ldap search but can't run bloodhound sshuttle seems to have helped.

ldapdomaindump also works but can't use that data in bloodhound...

I think you can try rusthound-ce (not that rusthound-ce only works with bloodhound-ce

[fr34cker]

where the heck is Victor's passwd?

[luckystars0612]

http://172.16.20.2:5000/check this works with victor's creds.  I thought maybe i could snag a hash with responder, but I already had to jump through hoops to get access to the network, i can't just make it fetch my ip.

try ligolo listener, http-ntlm-auth

[samuelballsiu1]

Anyone was able to get the NTLM hash with responder?

[spamdegratis5]

The POST request to 172.16.20.2/status contains a json. I don't know if we can inject commands there, the request is done via python requests. Just start a listener with ligolo pointing to your http server and modify the port of the json

{"protocol":"http","host":"drip.darkcorp.htb","port":"xxxx"}


GET / HTTP/1.1
Host: drip.darkcorp.htb:8080
User-Agent: python-requests/2.32.3
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

Edit: You can use ntlmrelay to obtain a shell from another account