[Steward]

if we login roundcube as root we also can download sources
http://drip.darkcorp.htb/dashboard/apps/.../routes.py

in source code we find new host we can login and reset pass:
http://dev-a3f1-01.drip.htb/reset/{reset_token}

So we know mechanism to reset user password
But how to get the letter with reset_token for bcase? we only can login as our user and root user.

[kevindragonfly]

any privilege escalation tips / path already guys ???

[cutearmadillo]

if we login roundcube as root we also can download sources
http://drip.darkcorp.htb/dashboard/apps/.../routes.py

in source code we find new host we can login and reset pass:
http://dev-a3f1-01.drip.htb/reset/{reset_token}

So we know mechanism to reset user password
But how to get the letter with reset_token for bcase? we only can login as our user and root user.

You use the contact form to send an email with a XSS payload. This way you can exfiltrate the mails including the reset link. (Pretty sure the file download is unintended)

[arrogantoverlord]

The POST request to 172.16.20.2/status contains a json. I don't know if we can inject commands there, the request is done via python requests. Just start a listener with ligolo pointing to your http server and modify the port of the json

{"protocol":"http","host":"drip.darkcorp.htb","port":"xxxx"} GET / HTTP/1.1 Host: drip.darkcorp.htb:8080 User-Agent: python-requests/2.32.3 Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive

Edit: You can use ntlmrelay to obtain a shell from another account

I can't even make the requests pass through Burp, for some reason it gives me 401

[spamdegratis5]

The POST request to 172.16.20.2/status contains a json. I don't know if we can inject commands there, the request is done via python requests. Just start a listener with ligolo pointing to your http server and modify the port of the json

{"protocol":"http","host":"drip.darkcorp.htb","port":"xxxx"} GET / HTTP/1.1 Host: drip.darkcorp.htb:8080 User-Agent: python-requests/2.32.3 Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive

Edit: You can use ntlmrelay to obtain a shell from another account

I can't even make the requests pass through Burp, for some reason it gives me 401

Enable nltm auth in burp https://portswigger.net/support/configur...burp-suite

[nothing0112358]

http://172.16.20.2:5000/check this works with victor's creds.  I thought maybe i could snag a hash with responder, but I already had to jump through hoops to get access to the network, i can't just make it fetch my ip.

How did you find this ? please don't say dir fuzzing lol.
I think with ligolo you can tell him to forward one port only, that way you target the .3 machine and it is forwarded to you

[onetxguy]

http://172.16.20.2:5000/check this works with victor's creds.  I thought maybe i could snag a hash with responder, but I already had to jump through hoops to get access to the network, i can't just make it fetch my ip.

How did you find this ? please don't say dir fuzzing lol.
I think with ligolo you can tell him to forward one port only, that way you target the .3 machine and it is forwarded to you

Are you fucking dumb, you can do a full tunnel with ligolo

[0xbeef]

The POST request to 172.16.20.2/status contains a json. I don't know if we can inject commands there, the request is done via python requests. Just start a listener with ligolo pointing to your http server and modify the port of the json

{"protocol":"http","host":"drip.darkcorp.htb","port":"xxxx"} GET / HTTP/1.1 Host: drip.darkcorp.htb:8080 User-Agent: python-requests/2.32.3 Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive

Edit: You can use ntlmrelay to obtain a shell from another account

I can't even make the requests pass through Burp, for some reason it gives me 401

Enable nltm auth in burp https://portswigger.net/support/configur...burp-suite

I am been getting 500 error instead and also the format is NTLM v1

[Globules]

hydra -l taylor.b.adm -P /usr/share/wordlists/rockyou.txt -o test.log  -vV ldap3://172.16.20.1 [389][ldap3] host: 172.16.20.1  login: taylor.b.adm [STATUS] attack finished for 172.16.20.1 (waiting for children to complete tests) 1 of 1 target successfully completed, 1 valid password found Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2025-02-09 19:19:05

[Aditya]

anyone got anything ?