Posts for: #Htb

HTB: Forest

ターゲット // Forest
PlatformHTB
OSWindows
DifficultyEasy
IP10.129.157.109

Recon

Standard AD box – DNS, Kerberos, LDAP, SMB all present. Domain: htb.local.


Enumeration

Nmap

▶ Nmap output
PORT      STATE SERVICE
53/tcp    open  domain
88/tcp    open  kerberos-sec
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
389/tcp   open  ldap
445/tcp   open  microsoft-ds
464/tcp   open  kpasswd5
593/tcp   open  http-rpc-epmap
636/tcp   open  ldapssl
3268/tcp  open  globalcatLDAP
3269/tcp  open  globalcatLDAPssl
5985/tcp  open  wsman
9389/tcp  open  adws
47001/tcp open  winrm

OS: Windows Server 2016 Standard 14393 x64

[]

HTB: Knife

ターゲット // Knife
PlatformHTB
OSLinux
DifficultyEasy
IP10.129.44.1

Recon

Nmap

1
nmap -sC -sV -oN nmap/initial 10.129.44.1
▶ Nmap output
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH
80/tcp open  http    Apache httpd 2.4.6

OS: Linux (Ubuntu, kernel 5.4.0-80-generic)

[]

HTB: Forge

ターゲット // Forge
PlatformHTB
OSLinux
DifficultyMedium
IP10.129.106.197

Recon

Subdomain brute-force reveals admin.forge.htb, but it only responds to requests from localhost:

1
2
curl http://forge.htb -H 'Host: admin.forge.htb'
# Only localhost is allowed!

Enumeration

Nmap

▶ Nmap output
21/tcp filtered ftp
22/tcp open     ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.3
80/tcp open     http    Apache httpd 2.4.41

OS: Ubuntu 20.04 (Focal)

[]