Footprinting: Hack The Box Module 112

Footprinting: Link to challenge: https://academy.hackthebox.com/module/112 (log in required) Class: Tier II | Medium | Offensive Before we begin: throughout the module, in our disposal we will have a ‘Footprinting-wordlist’ provided for us as a resource by the module. It will be referred as the default wordlist throughout the module.Host Based Enumeration FTP: Question: Which version of the FTP server is running on the target system? Submit the entire banner as the answer. Answer: InFreight FTP v1.1 Method: we will run the command: nc -nv 21 to connect to the target machine on port 21 (FTP port), and received detailed information (‘-v’): Question: Enumerate the FTP server and find the flag.txt file. Submit the contents of it as the answer. Answer: HTB{b7skjr4c76zhsds7fzhd4k3ujg7nhdjre} Method: we will initiate anonymous login to the server, lets start by connection to the ftp server using the command: We are requested to enter credentials (which we do not have), so we will use anonymous login, a special login which doesn’t request credentials (like guest user in many gaming application). This anonymous login if often more restricted with user login. To anonymous login, we will enter ‘anonymous’ to the ‘Name’ field, and the password field we will leave blank:Once entered: We are in. lets run ‘ls’ on the ftp CLI to see the content of the server: Here is our flag, lets get it to our pwnbox attacking machine with: get flag.txt The flag is downloaded to the pwnbox from the ftp server. Now we exit the ftp server (using ‘exit’ command’, and in the pwnbox we cat the flag: cat flag.txtSMB: Question: What version of the SMB server is running on the target system? Answer: Samba smbd 4.6.2 Method: we will run nmap scan: nmap 10.129.192.238 -sV -p139,445 with enhanced inspection capabilities (-sV): We can observe the result under ‘VERSION’ column. Question: What is the name of the accessible share on the target? Answer: sambashare Method: we can run smbclient -N -L // To anonymously (-N) list all shares on the target smb server, but it doesn’t shows which one is out right accessible. We can manually inspect the shares one by one.