-
HTB-Tier2- Unified
HTB-Tier2- Unified
Tags
Web
Vulnerability Assessment
Databases
Injection
Custom Applications
Outdated Software
MongoDB
Java
Penetration Tester Level 1
Reconaisance
Clear Text Credentials
Default Credentials
Code Injection
SOFT RESETReset Machine
OPEN
Walkthrough
ONNECT
Connect to Starting Point VPN before starting the machine
ONLINE
TARGET MACHINE IP ADDRESS
10.129.223.34
Learn how to connect to the machine
Task 1
Which are the first four open ports?
**,,,***3
22,6789,8080,8443
Hide Answer
Task 2
What is title of the software that is running running on port 8443?
***** ******k
unifi network
Hide Answer
Task 3
What is the version of the software that is running?
..*4
6.4.54
Hide Answer
Task 4
What is the CVE for the identified vulnerability?
-*-****8
Hide Answer
Task 5
What protocol does JNDI leverage in the injection?
***P
ldap
Hide Answer
Task 6
What tool do we use to intercept the traffic, indicating the attack was successful?
******p
tcpdump
Hide Answer
Task 7
What port do we need to inspect intercepted traffic for?
389
Hide Answer
Task 8
What port is the MongoDB service running on?
****7
27117
Hide Answer
Task 9
What is the default database name for UniFi applications?
ace
Hide Answer
Task 10
What is the function we use to enumerate users within the database in MongoDB?
.***.****()
db.admin.find()
Hide Answer
Task 11
What is the function we use to update users within the database in MongoDB?
..***()
db.admin.update()
Hide Answer
Task 12
What is the password for the root user?
**************************2
NotACrackablePassword4U2022
Hide Answer
Submit Flag
Submit user flag
6ced1a6a89e666c0620cdb10262ba127
Hide Answer
┌──(kwkl㉿kwkl)-[~/HODL/htb] └─$ sudo masscan -e tun0 -p- --max-rate 500 10.129.82.251 1 ⨯ [sudo] kwkl 的密码： Starting masscan 1.3.2 (http://bit.ly/14GZzcT) at 2022-11-18 14:06:02 GMT Initiating SYN Stealth Scan Scanning 1 hosts [65535 ports/host] Discovered open port 22/tcp on 10.129.11.70 Discovered open port 8843/tcp on 10.129.11.70 Discovered open port 8080/tcp on 10.129.11.70 Discovered open port 8443/tcp on 10.129.11.70 Discovered open port 6789/tcp on 10.129.11.70 Discovered open port 8880/tcp on 10.129.11.70 └─$ sudo nmap -sC -sV -v 10.129.78.40 [sudo] kwkl 的密码： Starting Nmap 7.93 ( https://nmap.org ) at 2022-11-20 19:36 HKT NSE: Loaded 155 scripts for scanning. NSE: Script Pre-scanning. Initiating NSE at 19:36 Completed NSE at 19:36, 0.00s elapsed Initiating NSE at 19:36 Completed NSE at 19:36, 0.00s elapsed Initiating NSE at 19:36 Completed NSE at 19:36, 0.00s elapsed Initiating Ping Scan at 19:36 Scanning 10.129.78.40 [4 ports] Completed Ping Scan at 19:36, 0.56s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 19:36 Completed Parallel DNS resolution of 1 host. at 19:36, 0.09s elapsed Initiating SYN Stealth Scan at 19:36 Scanning 10.129.78.40 [1000 ports] Discovered open port 8080/tcp on 10.129.78.40 Discovered open port 22/tcp on 10.129.78.40 Discovered open port 6789/tcp on 10.129.78.40 Discovered open port 8443/tcp on 10.129.78.40 Completed SYN Stealth Scan at 19:36, 8.71s elapsed (1000 total ports) Initiating Service scan at 19:36 Scanning 4 services on 10.129.78.40 Completed Service scan at 19:38, 82.42s elapsed (4 services on 1 host) NSE: Script scanning 10.129.78.40. Initiating NSE at 19:38 Completed NSE at 19:41, 214.65s elapsed Initiating NSE at 19:41 Completed NSE at 19:42, 10.69s elapsed Initiating NSE at 19:42 Completed NSE at 19:42, 0.00s elapsed Nmap scan report for 10.129.78.40 Host is up (1.6s latency). Not shown: 996 closed tcp ports (reset) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: |_ 256 18cd9d08a621a8b8b6f79f8d405154fb (ED25519) 6789/tcp open ibm-db2-admin? 8080/tcp open http-proxy | fingerprint-strings: | FourOhFourRequest: | HTTP/1.1 404 | Content-Type: text/html;charset=utf-8 | Content-Language: en | Content-Length: 431 | Date: Sun, 20 Nov 2022 11:37:09 GMT | Connection: close | <!doctype html><html lang="en"><head><title>HTTP Status 404 | Found</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}HTTP Status 404
| Found</h1></body></html> | GetRequest: | HTTP/1.1 302 | Location: http://localhost:8080/manage | Content-Length: 0 | Date: Sun, 20 Nov 2022 11:37:04 GMT | Connection: close | HTTPOptions: | HTTP/1.1 302 | Location: http://localhost:8080/manage | Content-Length: 0 | Date: Sun, 20 Nov 2022 11:37:06 GMT | Connection: close | RTSPRequest: | HTTP/1.1 400 | Content-Type: text/html;charset=utf-8 | Content-Language: en | Content-Length: 435 | Date: Sun, 20 Nov 2022 11:37:07 GMT | Connection: close | <!doctype html><html lang="en"><head><title>HTTP Status 400 | Request</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}HTTP Status 400
| Request</h1></body></html> | Socks5: | HTTP/1.1 400 | Content-Type: text/html;charset=utf-8 | Content-Language: en | Content-Length: 435 | Date: Sun, 20 Nov 2022 11:37:11 GMT | Connection: close | <!doctype html><html lang="en"><head><title>HTTP Status 400 | Request</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}HTTP Status 400
|_ Request</h1></body></html> 8443/tcp open ssl/nagios-nsca Nagios NSCA | ssl-cert: Subject: commonName=UniFi/organizationName=Ubiquiti Inc./stateOrProvinceName=New York/countryName=US | Subject Alternative Name: DNS:UniFi | Issuer: commonName=UniFi/organizationName=Ubiquiti Inc./stateOrProvinceName=New York/countryName=US | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2021-12-30T21:37:24 | Not valid after: 2024-04-03T21:37:24 | MD5: e6be8c035e126827d1fe612ddc76a919 |_SHA-1: 111baa119cca44017cec6e03dc455cfe65f6d829 1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service : SF-Port8080-TCP:V=7.93%I=7%D=11/20%Time=637A1161%P=x86_64-pc-linux-gnu%r(G SF:etRequest,84,"HTTP/1\.1\x20302\x20\r\nLocation:\x20http://localhost:808 SF:0/manage\r\nContent-Length:\x200\r\nDate:\x20Sun,\x2020\x20Nov\x202022\ SF:x2011:37:04\x20GMT\r\nConnection:\x20close\r\n\r\n")%r(HTTPOptions,84," SF:HTTP/1\.1\x20302\x20\r\nLocation:\x20http://localhost:8080/manage\r\nCo SF:ntent-Length:\x200\r\nDate:\x20Sun,\x2020\x20Nov\x202022\x2011:37:06\x2 SF:0GMT\r\nConnection:\x20close\r\n\r\n")%r(RTSPRequest,24E,"HTTP/1\.1\x20 SF:400\x20\r\nContent-Type:\x20text/html;charset=utf-8\r\nContent-Language SF::\x20en\r\nContent-Length:\x20435\r\nDate:\x20Sun,\x2020\x20Nov\x202022 SF:\x2011:37:07\x20GMT\r\nConnection:\x20close\r\n\r\n\x20html>\x20lang=\"en\"> HTTP<span class="token entity" title="\x20">\x20</span>Status<span class="token entity" title="\x20">\x20</span>400<span class="token entity" title="\x20">\x20</span><span class="token entity" title="\xe2">\xe2</span><span class="token entity" title="\x80">\x80</span><span class="token entity" title="\x93">\x93</span>\x SF:20Bad<span class="token entity" title="\x20">\x20</span>Request HTTP\x20Status\x20400\x20\xe2\x80\x93\x2 SF:0Bad\x20Request
")%r(FourOhFourRequest,24A,"HTTP/1\.1 SF:\x20404\x20\r\nContent-Type:\x20text/html;charset=utf-8\r\nContent-Lang SF:uage:\x20en\r\nContent-Length:\x20431\r\nDate:\x20Sun,\x2020\x20Nov\x20 SF:2022\x2011:37:09\x20GMT\r\nConnection:\x20close\r\n\r\n\x20htm SF:l>HTTP<span class="token entity" title="\x20">\x20</span>Status<span class="token entity" title="\x20">\x20</span>404<span class="token entity" title="\x20">\x20</span><span class="token entity" title="\xe2">\xe2</span><span class="token entity" title="\x80">\x80</span>\x SF:93<span class="token entity" title="\x20">\x20</span>Not<span class="token entity" title="\x20">\x20</span>Found HTTP\x20Status\x20404\x20\xe2\x80\x93\ SF:x20Not\x20Found