Posts: 148
Threads: 2
Joined: Oct 2023
Let's go guys and let's do this.
PORT STATE SERVICE VERSION
80/tcp open http Microsoft IIS httpd 10.0
|_http-title: Did not follow redirect to https://app.napper.htb
|_http-server-header: Microsoft-IIS/10.0
443/tcp open ssl/http Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
| ssl-cert: Subject: commonName=app.napper.htb/organizationName=MLopsHub/stateOrProvinceName=California/countryName=US
| Subject Alternative Name: DNS:app.napper.htb
| http-methods:
| Supported Methods: OPTIONS TRACE GET HEAD POST
|_ Potentially risky methods: TRACE
|_http-generator: Hugo 0.112.3
|_http-title: Research Blog | Home
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
7680/tcp open pando-pub? syn-ack ttl 127
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Posts: 3
Threads: 1
Joined: Oct 2023
The cert is issued by L=San Fransisco,C=US,CN=ca.napper.htb
Posts: 7
Threads: 0
Joined: Oct 2023
Posts: 37
Threads: 1
Joined: Jul 2023
you can also find `internal.napper.htb`
Posts: 7
Threads: 0
Joined: Oct 2023
POST /ews/MsExgHealthCheckd/ HTTP/2
Host: napper.htb
User-Agent: curl/8.3.0
Accept: */*
Content-Length: 2350
Content-Type: application/x-www-form-ulrencoded
sdafwe3rwe23=test
you get a code 200
Posts: 148
Threads: 2
Joined: Oct 2023
Yes that seems to be the way, creating the payload towards that. Naplistener malware.
Posts: 20
Threads: 0
Joined: Jul 2023
(Nov 11, 2023, 08:13 PM)Akless Wrote: POST /ews/MsExgHealthCheckd/ HTTP/2
Host: napper.htb
User-Agent: curl/8.3.0
Accept: */*
Content-Length: 2350
Content-Type: application/x-www-form-ulrencoded
sdafwe3rwe23=test
you get a code 200
NAPLISTENER????
Posts: 7
Threads: 0
Joined: Oct 2023
(Nov 11, 2023, 08:17 PM)peRd1 Wrote: Yes that seems to be the way, creating the payload towards that. Naplistener malware.
have you managed to do it?
Posts: 20
Threads: 0
Joined: Jul 2023
(Nov 11, 2023, 08:17 PM)peRd1 Wrote: Yes that seems to be the way, creating the payload towards that. Naplistener malware.
sorry, I hadn't seen this post
Posts: 148
Threads: 2
Joined: Oct 2023
...trying all kinds of payloads, but struggling to get it going. ... http is okay on them, so yeah.
|
