Attacking Common Services - DNS

HTB Content Academy
1

**

Find all available DNS records for the “inlanefreight.htb” domain on the target name server and submit the flag found as a DNS record as the answer.

**

I’ve been stuck on this one for a few days now.
Here are my dns configs
dns_configs

Subbrute

sbbrute
sbbrute781×242 51.8 KB

Dig - Response is the same for every subdomain

dig
dig796×179 42.1 KB

ANY help would be greatly appreciated!

2

Hi, try adding an /etc/hosts entry with each subdomain you want to use.

E.g. ns1.inlanefreight.htb

Hope this helps, Mika

5

Yup! Got it later the same day!

6

I’ve seen the same thing on the .com domain, but this is a flag from something else.
So dont stray into other domains, the question specifically asks for the “inlanefreight.HTB” domain.

You were supplied with a IP address, what does this host do? Hint: As MikolasCage said before, use the /etc/hosts file for EACH subdomain.

The rest is up to you, good luck :wink:

1 Like
7

Yup! Got it the same day. This is my subbrute command. SPOILERS

Summary

./subbrute.py inlanefreight.htb -s ./names.txt -r ./resolvers.txt

8

Thank you! I got it the same day, felt so dumb afterwards, but hey, that’s the learning experience!

9

I feel dumber. I have tried EVERYTHING on these forums, yet I keep getting a connection timeout. I get all the subdomains, I modified the /etc/hosts file, tried like hundreds of combinations of dig (dig axfr/AXFR/ANY/TXT) and nothing, I want to believe there’s something wrong with my pwnbox because honestly it has been like 2 days and nothing shows up what do I do :frowning:

10

It’s just because, this is proably the worst skill assessment ever made by this platform, I just lose less than an hour to solve it, but it has nothing to do with learning

11

I am still looking for a solution, where can we be going wrong?

12

Brute forcing is the worst part of HTB Academy.
It takes too much time.

echo  "ns1.inlanefreight.htb" > ./resolvers.txt
./subbrute.py inlanefreight.htb -s ./names.txt -r ./resolvers.txt
#Then
dig axfr @<IP> xx.inlanefreight.htb
1 Like
13

This was it, thank you

14

my subbrute.py is taking too long.Is that normal?

15

hi, i tried to use this command but it keep sending an code errors:
/home/xman/subbrute/./subbrute.py:462: SyntaxWarning: invalid escape sequence ‘.’
permute_filter = re.compile(“[1]{” + str(self.permute_len) + “}.”)
Warning: Fewer than 16 resolvers per process, consider adding more nameservers to resolvers.txt.
Warning: No nameservers found, trying fallback list.
Process lookup-3:
Traceback (most recent call last):
File “/usr/lib/python3.12/multiprocessing/process.py”, line 314, in _bootstrap
self.run()
File “/home/xman/subbrute/./subbrute.py”, line 422, in run
response = self.check(hostname, query_type, timeout_retries)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File “/home/xman/subbrute/./subbrute.py”, line 342, in check
resp = self.resolver.query(host)
^^^^^^^^^^^^^^^^^^^^^^^^^
File “/home/xman/subbrute/./subbrute.py”, line 57, in query
name_server = self.get_ns()
^^^^^^^^^^^^^
File “/home/xman/subbrute/./subbrute.py”, line 107, in get_ns
ret = self.nameservers[self.pos]
~~~~~~~~~~~~~~~~^^^^^^^^^^
IndexError: list index out of range
^Zzsh: killed ./subbrute.py inlanefreight.htb -s ./names.txt -r ./resolvers.txt
can any one help?

  1. a-zA-Z0-9 ↩︎

16

For those who are stuck on this problem

  • Add domain to /etc/hosts
  • Add it to new resolve file
  • python3 subbrute.py -p inlanefreight.htb -s names.txt -r resolver
  • Then DIG for AXFR zone transfer

Then you’ll get a flag