Newrouge CTF

Search Machine(10.10.11.129) Info: This was a hard windows box from HackTheBox which focused on windows Active Directory Pentesting, we will to enumerate valid users through kerberos then crack some passwords then find some certs then crack those certs then do privilege escalation by Reading password GMSA account password and reset admin account password through that and get root. This was yet another my faviourte box from htb learned so many things about pentesting Active Directory machines. How kerberosating, Kerberos, bloodhound, impacket and msrpc things work. Looking forward to doing more windows machine. Ps: I did this box after it retired and had access to ippsec video and 0xdf blog and I'm thankful to them for their work so that we can learn new stuffs. Recon: Starting with nmap port scan we get many multiple open ports as expected from windows Active Directory Machines. $ nmap -p- --min-rate 10000 10.10.11.129 Starting Nmap 7.80 ( https://nmap.org ) at 20...

Toby Machine (10.10.11.121) Info: As always hackthebox bring so much learninng with insane machines, i learned so many new things like how proxychains work, how different network tools like ifconfig and ip work and how http proxy is different from socks proxy. This box was a insane linux machine where user was already attacked and we had to follow the path of attacker to get foothold and root on machine. PS: I did this box after it retired and i read 0xdf blog and watched ippsec video before doing this. Recon: Starting with port scan we get 4 open ports rustscan -a 10.10.11.121 -u 5000 PORT STATE SERVICE REASON 22/tcp open ssh syn-ack 80/tcp open http syn-ack 10022/tcp open unknown syn-ack 10080/tcp open amanda syn-ack Although rustscan finds four open ports only 22 & 80 works. Rest gives connection reset error in browser. Anyway guessing at it 10080 is should be a webserver and 10022 a ssh server. Reading about port 10080 amanda . It is a...