search

Mailing Write-Up - HTB

hashtag
Recon

Starting off with an nmap scan:

Nmap scan report for 10.10.11.14
Host is up (0.047s latency).
Not shown: 65515 filtered tcp ports (no-response)
PORT      STATE SERVICE
25/tcp    open  smtp
80/tcp    open  http
110/tcp   open  pop3
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
143/tcp   open  imap
445/tcp   open  microsoft-ds
465/tcp   open  smtps
587/tcp   open  submission
993/tcp   open  imaps
5040/tcp  open  unknown
5985/tcp  open  wsman
7680/tcp  open  pando-pub
47001/tcp open  winrm
49664/tcp open  unknown
49665/tcp open  unknown
49666/tcp open  unknown
49667/tcp open  unknown
49668/tcp open  unknown
51866/tcp open  unknown

Let's get a vulnerability overview:

Interesting ports: 25 (SMTP), 80 (HTTP), 110 (POP3), 143 (IMAP), 445 (SMB), 587 (SMTP) and possible 5040 and 7680.

I tried some SMTP basic capability enumeration. Navigated to the webpage on 80:

Checked the instructions and tried to replicate, but this "user" doesn't exist!

The download function is interesting though. In the mean-time I ran feroxbuster too:

Let's see if we can do LFI through the download.php function!

From the ports opened we could see that this is a Windows box, so:

Sweet! We can LFI!

I managed to get them working on Thunderbird as administrator@mailing.htb.

Now I am sending a malicious exe crafted with msfvenom to support (maya).

Hitting send...

Now we wait...

Realizing that no one opens our attachments, so I tried with direct link in the mail:

Although nobody opens the powershell... Let's see, by elimination we need some phish e-mail that will either launch direct revshell through browser, either hmm..

No creds coming back :(

It turns out this works:

Using the same idea I could enumerate some ports on the box:

I realized this gets too much, it has to be something easier such as an outlook exploit.

Used:

Let's use this:

Cracked with hashcat:

PreviousLinkVortex Write-Up - HTBNextManager Write-Up - HTB

Last updated