Attacking Common Services - Medium

HTB Content Academy
28

Maybe you have to wait or restart lab to be able to use the 2 last services.

31

I can’t figure out how to enumerate the ftp service for more information. I found the p21xx but nothing seams to work. Neither looking for users. I already read that simon its a possible user but i could’t get a password for it, neither in pop3 or ftp… Could someone point some direction maybe in a direct message or something i cant figure it out…

32

If you use the dns service to enum the domain (axfr transfer) there’s a huge hint that the machine has a hidden service and therefore you should scan non-standard ports with nmap -p-:

int-ftp.inlanefreight.htb. 604800 IN A 127.0.0.1

I found that hint was cool, instead of starting with a blind -p- scan which would be blocked by many firewalls. Too bad the instance has to be restarted a couple of times to show the additional ports.

33

Respawn the machine a bunch of times, you should see another service with nmap -p-…

1 Like
34

I was also stock for more then 2 day.
Here is what I learn…

  1. Don’t panic
  2. Scan all port (must be 6)
  3. know the service running
  4. try default password
  5. you will get a file
  6. use the file and the name for further enum.
4 Likes
36

Hint: Pay close attention to the result of your nmap scan, specially after identifying all the ports (not just default ones) and read carefully the result of the parameter -sC before you continue.

37

Nmap -p- scan has been running for about an hour and is on 48 percent can someone help with the elusive port so I can see if it is actually up

38

45 minutes plus looking for a port that might not have been loaded is pretty bullish imo

39

Remember to use:
nmap -sS -n -Pn -p- --min-rate 5000 IP
With this the scanning will not be delayed and they will know all the ports that are open

40

Try use rustscan to identify the port you are seeking.

https://www.geeksforgeeks.org/rustscan-faster-nmap-scanning-with-rust/

41

what do u do after u have the mynotes.txt? i imagine combine it with ‘Simon’ to log in somewhere? i’ve tried everything

1 Like
42

apply with ssh

43

apply ssh

44

Is anyone able to give me a hint about what the default credentials are for FTP? I’ve tried many wordlists, manual testing, testing with hydra. Thank you!!

45

Dm me

46

Use the Nmap scan: nmap --min-rate 10000 -p- 10.129.203.7 to enumerate the target host. There is another port you can use to log in to the FTP server. Once you’re logged in to the FTP server change directory to the only one user. Download the file by using the command “get mynotes.txt” so you can bruteforce the password. You can use the Hydra command: hydra -l simon -P mynotes.txt ftp://10.129.230.7 -s 2121 to bruteforce the password for the user simon. Then use ssh to login as simon: ssh [email protected].

47

The Medium lab is easier then Easy lab !!

48

instead of -p- in nmap Use naabu for quick results

1 Like
49

I feel like the medium lab should have been the easy lab. Pretty straightforward. Do you scan across all ports and limit using a --min-rate value. Then you should gain access to m*****s.txt file, which will act as a password list for the user s****n.

50

dont use rustscan, and check all ports with nmap