search

Footprinting Lab - Hard

Hello everyone, today we're diving into the Hard-level Footprinting Walkthrough lab in the HTB Academy Penetration Testing Course. Our goal? Obtain the password for the user "HTB."

hashtag
Now Let’s Begin 🚀

hashtag
Reconnaissance

Initially, we'll conduct reconnaissance to detect open ports. This involves performing TCP and UDP port scans to identify all available open ports.

hashtag
TCP Port Scan

nmap -A ip_address
┌─[root@parrot]─[/home/z3tssu/HTB]
└──╼ #nmap -A 10.129.242.114
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-03-13 20:27 +04
Nmap scan report for 10.129.242.114
Host is up (0.31s latency).
Not shown: 995 closed tcp ports (reset)
PORT    STATE SERVICE  VERSION
22/tcp  open  ssh      OpenSSH 8.2p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 3f:4c:8f:10:f1:ae:be:cd:31:24:7c:a1:4e:ab:84:6d (RSA)
|   256 7b:30:37:67:50:b9:ad:91:c0:8f:f7:02:78:3b:7c:02 (ECDSA)
|_  256 88:9e:0e:07:fe:ca:d0:5c:60:ab:cf:10:99:cd:6c:a7 (ED25519)
110/tcp open  pop3     Dovecot pop3d
|_pop3-capabilities: UIDL CAPA AUTH-RESP-CODE PIPELINING TOP SASL(PLAIN) STLS RESP-CODES USER
| ssl-cert: Subject: commonName=NIXHARD
| Subject Alternative Name: DNS:NIXHARD
| Not valid before: 2021-11-10T01:30:25
|_Not valid after:  2031-11-08T01:30:25
143/tcp open  imap     Dovecot imapd (Ubuntu)
|_imap-capabilities: more listed ID SASL-IR LOGIN-REFERRALS STARTTLS IMAP4rev1 post-login OK capabilities IDLE Pre-login LITERAL+ AUTH=PLAINA0001 have ENABLE
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=NIXHARD
| Subject Alternative Name: DNS:NIXHARD
| Not valid before: 2021-11-10T01:30:25
|_Not valid after:  2031-11-08T01:30:25
993/tcp open  ssl/imap Dovecot imapd (Ubuntu)
| ssl-cert: Subject: commonName=NIXHARD
| Subject Alternative Name: DNS:NIXHARD
| Not valid before: 2021-11-10T01:30:25
|_Not valid after:  2031-11-08T01:30:25
|_imap-capabilities: listed more SASL-IR LOGIN-REFERRALS LITERAL+ IMAP4rev1 ID OK post-login IDLE capabilities Pre-login AUTH=PLAINA0001 have ENABLE
|_ssl-date: TLS randomness does not represent time
995/tcp open  ssl/pop3 Dovecot pop3d
|_ssl-date: TLS randomness does not represent time
|_pop3-capabilities: UIDL PIPELINING TOP SASL(PLAIN) USER CAPA RESP-CODES AUTH-RESP-CODE
| ssl-cert: Subject: commonName=NIXHARD
| Subject Alternative Name: DNS:NIXHARD
| Not valid before: 2021-11-10T01:30:25
|_Not valid after:  2031-11-08T01:30:25
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.94SVN%E=4%D=3/13%OT=22%CT=1%CU=43285%PV=Y%DS=2%DC=T%G=Y%TM=67D3
OS:078E%P=x86_64-pc-linux-gnu)SEQ(SP=101%GCD=1%ISR=105%TI=Z%CI=Z%II=I%TS=A)
OS:SEQ(SP=107%GCD=1%ISR=109%TI=Z%CI=Z%II=I%TS=A)OPS(O1=M53CST11NW7%O2=M53CS
OS:T11NW7%O3=M53CNNT11NW7%O4=M53CST11NW7%O5=M53CST11NW7%O6=M53CST11)WIN(W1=
OS:FE88%W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6=FE88)ECN(R=Y%DF=Y%T=40%W=FAF0%O=
OS:M53CNNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)
OS:T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S
OS:+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T7(R=Y%DF=
OS:Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=N)U1(R=Y%DF=N%T=40%IPL=164%UN=0
OS:%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD=S)

Network Distance: 2 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using port 53/tcp)
HOP RTT       ADDRESS
1   306.98 ms 10.10.14.1
2   307.08 ms 10.129.242.114

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 54.52 seconds

hashtag
UDP Port Scan

  • Port 161 (SNMP) is open

  • We can proceed by enumerating that service

SNMP - Simple Network Management Protocol is a protocol used to monitor different devices in the network (like routers, switches, printers, IoTs...).

For footprinting SNMP, we can use tools like snmpwalk, onesixtyone, and braa. Snmpwalk is used to query the OIDs with their information. Onesixtyone can be used to brute-force the names of the community strings since they can be named arbitrarily by the administrator. Since these community strings can be bound to any source, identifying the existing community strings can take quite some time.

hashtag
SNMPwalk

I tried using snmp walk but had no success

hashtag
onesixtyone

Now I don't know the community string, so I used onesixtyonetool and Seclistswordlists to identify these community strings.

In order to access the information saved on the MIB you need to know the community string on versions 1 and 2/2c and the credentials on version 3.

The are 2 types of community strings:

  • public mainly read only functions

  • private Read/Write in general

hashtag
snmpwalk with community string

After I found the community string with onesixtyone, i used snmpwalk tool again with the identified communitity strong to gather more information

chevron-rightCommandhashtag

hashtag
Identified password

  • With the use of snmpwalk i was able to identify a login credential

hashtag
Connecting to IMAP

I then connected to the IMAP server using the below command

then perform IMAP queries

  1. Logged in with the commandLOGIN username password

  2. Listed all directories usingLIST "" *

  3. Selected the 'INBOX' mailbox with SELECT "INBOX"

  5. Checked for available messages with 1 STATUS INBOX (MESSAGES) and found one

  6. Retrieved the entire message with 1 FETCH 1 all

  7. Obtained the message content using 1 FETCH 1 BODY[]

chevron-rightcodehashtag

hashtag
Connecting with SSH

  1. In the IMAP we identified an SSH private key

  2. We need to copy and save this private key to our machine

  3. We need to make the private key executable

  1. Then we need to connect to SSH using the username tom and the private key that we have gathered

hashtag
Identifying MySQL

  1. I see that there isa .bash_history, so I concatenated it to identify the previously used bash commands

  2. In the history there is a presense of MySQL being utilized

  1. I will try that exact command

  • The password, I will try the one that I identified previously

hashtag
Interactive with MYSQL

PreviousFootprinting Lab - MediumNextNessus Skills Assessment

Last updated