Open the attached file, we see an email that was to a student. So what we have so far : The name of the student : Hans Deutshmeister The password is your personal zipcode A base64 string which is the PDF file First thing I did was decode the base64 […]
Clicking the Challenge link brought me to this website. We will have to provide a facial picture, A full name and a voice sample. At this point anything I tried did not work. I started digging further into the website source code. Time to try to log as Helena! I […]
What is the Cloud? On-Premises Information Systems Architecture WORKLOAD SERVICES VIRTUAL MACHINES VIRTUALIZATION PHYSICAL INFRASTRUCTURE PHYSICAL FACILITY Cloud Architecture WORKLOAD SERVICES VIRTUAL MACHINE MANAGEMENT PLANE(ex Azure Portal) VIRTUALIZATION(managed by provider) PHYSICAL INFRASTRUCTURE(managed by provider) PHYSICAL FACILITY(managed by provider) Types of Cloud Services SOFTWARE AS A SERVICE PLATFORM AS A SERVICE […]
Nmap reveals ssh on port 22 and a website on port 80. I found a nice exploit on GitHub that will provide a reverse shell. Let’s start a listener. Time for escalation. Enumeration didn’t take long 😉 This should be fairly easy! Done!!! Rooted!
Nmap reveals FTP, SSH and HTTP. I couldn’t log successfully on FTP so went to the website. The pcap had nothing really interesting. Going back to the website and looking at the URL http://10.10.10.245/data/1 I wondered what was at /data/0. It seems like an older report. I downloaded it. After […]
Nmap reveals telnet port which seems to be a remote management endpoint for JetDirect printer. Let’s try it! I’m gonna need to find the password for this… After a while I found this blog post showing how to exploit by “Getting a JetDirect password remotely using the SNMP vulnerability“. I’ll […]
Nmap reveals a lot of ports on this machine. My attention is brought to the SMB server. There is not possible NTLM relay since signing is required but I’ll give it a look if there is anything interesting. Unfortunately no guest login available. Let’s check the website running on port […]
The vulnerability I will exploit is known as Eternal Blue MS17-010. Let’s fire up metasploit!
So this is an easy task if you have some coding knowledge. You can’t complete this challenge without a code. It would be impossible to hash a message and send it within 2 seconds. I’m glad I learned python because even before the challenge started I already knew how I […]
I made a video of this room. Unfortunately my mic was muted. So here is the writeup version… I couldn’t find anything interesting with dirseach. I decided to beautify the source code of the website and found something interesting A little bit research led me to this exploit. To access […]