Writeups on

Administrator - HTB

Sun, 04 May 2025 00:00:00 +0000

Details

URL	Hack The Box :: Administrator
Difficulty	Medium
User Solves	U: 7241 ~ R: 7025
Release Date	09 Nov, 2024

Overview

This machine simulates a realistic internal Windows Active Directory environment. The initial access is granted with the following credentials:

Username: olivia
Password: ichliebedich

Reconnaissance

Rustscan + Nmap

A Rustscan quick sweep followed by Nmap revealed the following open ports:

PORT      STATE SERVICE      VERSION
21/tcp    open  ftp          Microsoft ftpd
53/tcp    open  domain       Simple DNS Plus
88/tcp    open  kerberos-sec Microsoft Windows Kerberos
135/tcp   open  msrpc        Microsoft Windows RPC
139/tcp   open  netbios-ssn  Microsoft Windows netbios-ssn
464/tcp   open  kpasswd5?
5985/tcp  open  http         Microsoft HTTPAPI httpd 2.0 (WinRM)
47001/tcp open  http         Microsoft HTTPAPI httpd 2.0
49666/tcp open  msrpc        
49854/tcp open  ncacn_http   Microsoft RPC over HTTP
49859/tcp open  msrpc
49914/tcp open  msrpc
62532/tcp open  msrpc

Key services: FTP (21), Kerberos (88), and WinRM (5985)

Blackfield - HTB

Mon, 28 Apr 2025 00:00:00 +0000

Details

URL	Hack The Box :: Blackfield
Difficulty	Hard
User Solves	153
Release Date	22 Aug, 2024

Recon

Rustscan & Nmap

Ran a quick Rustscan and fed the output into Nmap for a deeper scan.

└─$ python3 ./rs2nm.py 10.129.229.17
Just gonnae run a quick wee Rustscan test...
You selected: 10.129.229.17
Estimated Time Remaining: 1h 35m
Just kidding — only a few seconds!

OOoh, there are a few ports open:
(53, 88, 135, 389, 445, 5985)

Starting Nmap...

Nmap Results:

Lockpick 4.0 - HTB

Mon, 28 Apr 2025 00:00:00 +0000

Details

URL	Hack The Box :: Lockpick 4.0 Sherlock
Difficulty	Insane
User Solves	153
Release Date	22 Aug, 2024

Request to execute

1. Objective

The objective of this report is to analyse a malicious binary file suspected of being a trojan and to provide details regarding its behaviour, impact, and indicators of compromise (IOCs).

2. Triage

2.1 File Information

File Name: defenderscan.js
File Path: PWD
File Type: Javascript
File Hashes:
- MD5: 648C1A7E04B6260065115F93A760A354
- SHA256: 0fbb0dbcefd64bd68b73ac0cc347d4b8f684565c929c2005f660697dd3ea72ba
File Size: 126 KB
Timestamp Information:
- Creation Date: 02/07/2024
- Modification Date: 01/08/2024

2.2 VirusTotal Results

Link: VirusTotal - File - 0fbb0dbcefd64bd68b73ac0cc347d4b8f684565c929c2005f660697dd3ea72ba
Detection Ratio: 20/61
Common Classifications: Trojan | Ransomware | Downloader

2.3 Overview

The initial defenderscan.js file appears to leverage Windows ActiveX objects, specifically ADODB.Stream and WScript.Shell, to process binary data and execute a dynamically created PowerShell script.

Popcorn - HTB

Mon, 28 Apr 2025 00:00:00 +0000

Details

URL	Hack The Box :: Popcorn
Difficulty	Medium
User Solves	U: 12850 ~ R: 11863
Release Date	15 Mar, 2017

Introduction

Released on 15 March 2017, Popcorn is one of the earliest challenges on the Hack The Box platform. As a medium-difficulty Linux machine, it’s well-suited for users ready to transition from beginner boxes to more advanced, skill-testing scenarios.

First Steps

The first step is a comprehensive enumeration scan to quickly identify open ports and gather detailed service information. I use the following command: