[cavour13]

started right now
i was able to trigger xss on cube but gave me server error

triying to reset password for that other subdomain

[jonklem]

Somehow I'm able to use ldap search but can't run bloodhound sshuttle seems to have helped.

[0xbeef]

Somehow I'm able to use ldap search but can't run bloodhound sshuttle seems to have helped.

ldapdomaindump also works but can't use that data in bloodhound...

[samuelballsiu1]

Yeah, its really annoying. I can't get the bloodhound-python to work either. windapsearch.py ain't working too

[jonklem]

http://172.16.20.2:5000/check this works with victor's creds. I thought maybe i could snag a hash with responder, but I already had to jump through hoops to get access to the network, i can't just make it fetch my ip.

[luckystars0612]

Somehow I'm able to use ldap search but can't run bloodhound sshuttle seems to have helped.

ldapdomaindump also works but can't use that data in bloodhound...

I think you can try rusthound-ce (not that rusthound-ce only works with bloodhound-ce

[fr34cker]

where the heck is Victor's passwd?

[luckystars0612]

http://172.16.20.2:5000/check this works with victor's creds.  I thought maybe i could snag a hash with responder, but I already had to jump through hoops to get access to the network, i can't just make it fetch my ip.

try ligolo listener, http-ntlm-auth

[samuelballsiu1]

Anyone was able to get the NTLM hash with responder?

[spamdegratis5]

The POST request to 172.16.20.2/status contains a json. I don't know if we can inject commands there, the request is done via python requests. Just start a listener with ligolo pointing to your http server and modify the port of the json

{"protocol":"http","host":"drip.darkcorp.htb","port":"xxxx"} GET / HTTP/1.1 Host: drip.darkcorp.htb:8080 User-Agent: python-requests/2.32.3 Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive

Edit: You can use ntlmrelay to obtain a shell from another account