Posts: 3
Threads: 0
Joined: Feb 2024
(Feb 06, 2025, 10:39 AM)Pierluigi2497 Wrote: (Feb 06, 2025, 03:05 AM)dknosmo Wrote: How did you connect to port 33333 as in what is the service and what are the creds for it. I have found the monitoring tool subdomain but the page just loads the exact copy of the main site?
To use the service on port 33333, u can use netcat.
The creds are in http://subdomain.solarsystem.htb:8080 in the configuration section and then services.
Awesome thanks, been able to login and enumerate the internal network found some hr creds but no idea where to now any suggestions?
Posts: 57
Threads: 1
Joined: Apr 2024
(Feb 07, 2025, 03:12 AM)dknosmo Wrote: (Feb 06, 2025, 10:39 AM)Pierluigi2497 Wrote: (Feb 06, 2025, 03:05 AM)dknosmo Wrote: How did you connect to port 33333 as in what is the service and what are the creds for it. I have found the monitoring tool subdomain but the page just loads the exact copy of the main site?
To use the service on port 33333, u can use netcat.
The creds are in http://subdomain.solarsystem.htb:8080 in the configuration section and then services.
Awesome thanks, been able to login and enumerate the internal network found some hr creds but no idea where to now any suggestions?
Look into zfs snapshots
You will find the binary running on 33333.
Overflow the password into the port to get access (somewhat) to the filemanager service you find in the backups and get the 2nd flag.
Does anybody know the next step?
Posts: 44
Threads: 1
Joined: Oct 2023
(Feb 05, 2025, 09:58 PM)Kazukisora Wrote: (Feb 04, 2025, 10:42 AM)BFischer Wrote: (Feb 03, 2025, 09:12 PM)Kazukisora Wrote: (Feb 01, 2025, 11:17 PM)BFischer Wrote: (Jan 31, 2025, 04:59 PM)Kazukisora Wrote: Decrypt it is encrypted with a paraphrase and you will used it to log in ssh port 2222
What passphrase? the same password? is poohbear and algorithme is aes-256-ebc i guess
There's no algorithm called aes-256-ebc do you mean ecb or cbc + pass the cyberchef link decryption Got it now ?
Yeah, but where did you got this passphrase ? 
Posts: 9
Threads: 0
Joined: Jun 2024
(Feb 07, 2025, 07:40 AM)ritualist Wrote: (Feb 07, 2025, 03:12 AM)dknosmo Wrote: (Feb 06, 2025, 10:39 AM)Pierluigi2497 Wrote: (Feb 06, 2025, 03:05 AM)dknosmo Wrote: How did you connect to port 33333 as in what is the service and what are the creds for it. I have found the monitoring tool subdomain but the page just loads the exact copy of the main site?
To use the service on port 33333, u can use netcat.
The creds are in http://subdomain.solarsystem.htb:8080 in the configuration section and then services.
Awesome thanks, been able to login and enumerate the internal network found some hr creds but no idea where to now any suggestions?
Look into zfs snapshots
You will find the binary running on 33333.
Overflow the password into the port to get access (somewhat) to the filemanager service you find in the backups and get the 2nd flag.
Does anybody know the next step?
I'm struggling all the day on that, i've seen that fileserver program is making an fetchURL on an another machine but i tried a lot of stuff and cant determinate on which machine and port is making that :C
Posts: 27
Threads: 0
Joined: Oct 2024
Feb 07, 2025, 09:05 PM
(This post was last modified: Feb 07, 2025, 09:07 PM by Kazukisora.)
(Feb 07, 2025, 10:43 AM)BFischer Wrote: (Feb 05, 2025, 09:58 PM)Kazukisora Wrote: (Feb 04, 2025, 10:42 AM)BFischer Wrote: (Feb 03, 2025, 09:12 PM)Kazukisora Wrote: (Feb 01, 2025, 11:17 PM)BFischer Wrote: What passphrase? the same password? is poohbear and algorithme is aes-256-ebc i guess
There's no algorithm called aes-256-ebc do you mean ecb or cbc + pass the cyberchef link decryption Got it now ? it's on rockyou.txt
Yeah, but where did you got this passphrase ?
(Feb 07, 2025, 04:29 PM)Pierluigi2497 Wrote: (Feb 07, 2025, 07:40 AM)ritualist Wrote: (Feb 07, 2025, 03:12 AM)dknosmo Wrote: (Feb 06, 2025, 10:39 AM)Pierluigi2497 Wrote: (Feb 06, 2025, 03:05 AM)dknosmo Wrote: How did you connect to port 33333 as in what is the service and what are the creds for it. I have found the monitoring tool subdomain but the page just loads the exact copy of the main site?
To use the service on port 33333, u can use netcat.
The creds are in http://subdomain.solarsystem.htb:8080 in the configuration section and then services.
Awesome thanks, been able to login and enumerate the internal network found some hr creds but no idea where to now any suggestions?
Look into zfs snapshots
You will find the binary running on 33333.
Overflow the password into the port to get access (somewhat) to the filemanager service you find in the backups and get the 2nd flag.
Does anybody know the next step?
I'm struggling all the day on that, i've seen that fileserver program is making an fetchURL on an another machine but i tried a lot of stuff and cant determinate on which machine and port is making that :C is alot confusing the only things that am thinking about is how to break that jail This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching.
|
