Infiltrator HTB
by dogedofedoge - Saturday August 31, 2024 at 07:45 PM
(Sep 02, 2024, 05:42 AM)0bfusc8 Wrote: rooted thanks for the help guys

where can i find the db password ??,my 14406 is show this :Y���
5.5.5-10.1.19-MariaDB� ���dq..<!0k�яч�? ����������Ly=bWmA;AuLZ�mysql_native_password�!��я„#08S01Got packets out of order

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching | http://c66go4clkqodr7tdjfu76jztjs7w7d3fajdeypxn73v4ju3dt7g5yyyd.onion/Forum-Ban-Appeals if you feel this is incorrect.
Reply
(Sep 01, 2024, 11:37 PM)spamdegratis5 Wrote: Ok, the next step after getting martinez credentials is using the calendar, create an event and see the magic happens. (this should be done from the windows client Tongue)

something related with run application?
Reply
a better solution for date/time skew error is to use faketime

$ faketime -f "-30m" bloodyAD ......
replace "-30m" with "-2h" or whatever time you need

(Sep 02, 2024, 05:35 AM)ipfi Wrote:
(Sep 01, 2024, 11:37 PM)spamdegratis5 Wrote: Ok, the next step after getting martinez credentials is using the calendar, create an event and see the magic happens. (this should be done from the windows client Tongue)

What do you mean with from the Windows Client - i am still stuck at dc01 with evil winrm.
Everytime i try to Upload Chisel the Connection gets closed.

use meterpreter session to start the chisel client, evil-winrm with chisel is unstable.
Reply
(Sep 01, 2024, 06:31 PM)a44857437 Wrote:
(Sep 01, 2024, 04:12 PM)spamdegratis5 Wrote: O.martinez credentials can be found querying the API. You need the chatroom key (and obviously the api key, obtained after login using winrm_svc in the client) that can be found in the OM.db3 database, can be found in AppData folder of winrm_svc.

Found the creds, but they don't work? Did they work for you?

(Sep 01, 2024, 06:31 PM)orwell1984 Wrote:
(Sep 01, 2024, 04:12 PM)spamdegratis5 Wrote: O.martinez credentials can be found querying the API. You need the chatroom key (and obviously the api key, obtained after login using winrm_svc in the client) that can be found in the OM.db3 database, can be found in AppData folder of winrm_svc.

I've got both the API key and the chatroom key from the OM.db3 database, but every time request the logs endpoint i get "logs chatroom does not exists!". I'm following the API docs from the official website.

This worked for me:

```
curl -s -k -H 'API-KEY: 55...GG' -H 'Accept: application/json, text/javascript, */*' -H 'Host: infiltrator.htb:14125' 'http://127.0.0.1:14125/api/chatrooms/logs?roomkey=2..m&fromdate=2024/02/01&todate=2024/09/01' | jq '.logs'
```

You need the `fromdate` and `todate`, I skipped them first and got the same error...

I must be blind, I got chatroom key but don't see API key, where is it?
Reply
(Sep 02, 2024, 07:52 AM)jsvensson Wrote:
(Sep 01, 2024, 06:31 PM)a44857437 Wrote:
(Sep 01, 2024, 04:12 PM)spamdegratis5 Wrote: O.martinez credentials can be found querying the API. You need the chatroom key (and obviously the api key, obtained after login using winrm_svc in the client) that can be found in the OM.db3 database, can be found in AppData folder of winrm_svc.

Found the creds, but they don't work? Did they work for you?

(Sep 01, 2024, 06:31 PM)orwell1984 Wrote:
(Sep 01, 2024, 04:12 PM)spamdegratis5 Wrote: O.martinez credentials can be found querying the API. You need the chatroom key (and obviously the api key, obtained after login using winrm_svc in the client) that can be found in the OM.db3 database, can be found in AppData folder of winrm_svc.

I've got both the API key and the chatroom key from the OM.db3 database, but every time request the logs endpoint i get "logs chatroom does not exists!". I'm following the API docs from the official website.

This worked for me:

```
curl -s -k -H 'API-KEY: 55...GG' -H 'Accept: application/json, text/javascript, */*' -H 'Host: infiltrator.htb:14125' 'http://127.0.0.1:14125/api/chatrooms/logs?roomkey=2..m&fromdate=2024/02/01&todate=2024/09/01' | jq '.logs'
```

You need the `fromdate` and `todate`, I skipped them first and got the same error...

I must be blind, I got chatroom key but don't see API key, where is it?

You have to login as winrm_svc in the messenger app, there will be a note or something with it
Reply
(Sep 02, 2024, 07:56 AM)a44857437 Wrote:
(Sep 02, 2024, 07:52 AM)jsvensson Wrote:
(Sep 01, 2024, 06:31 PM)a44857437 Wrote:
(Sep 01, 2024, 04:12 PM)spamdegratis5 Wrote: O.martinez credentials can be found querying the API. You need the chatroom key (and obviously the api key, obtained after login using winrm_svc in the client) that can be found in the OM.db3 database, can be found in AppData folder of winrm_svc.

Found the creds, but they don't work? Did they work for you?

(Sep 01, 2024, 06:31 PM)orwell1984 Wrote:
(Sep 01, 2024, 04:12 PM)spamdegratis5 Wrote: O.martinez credentials can be found querying the API. You need the chatroom key (and obviously the api key, obtained after login using winrm_svc in the client) that can be found in the OM.db3 database, can be found in AppData folder of winrm_svc.

I've got both the API key and the chatroom key from the OM.db3 database, but every time request the logs endpoint i get "logs chatroom does not exists!". I'm following the API docs from the official website.

This worked for me:

```
curl -s -k -H 'API-KEY: 55...GG' -H 'Accept: application/json, text/javascript, */*' -H 'Host: infiltrator.htb:14125' 'http://127.0.0.1:14125/api/chatrooms/logs?roomkey=2..m&fromdate=2024/02/01&todate=2024/09/01' | jq '.logs'
```

You need the `fromdate` and `todate`, I skipped them first and got the same error...

I must be blind, I got chatroom key but don't see API key, where is it?

You have to login as winrm_svc in the messenger app, there will be a note or something with it

Thanks, i got root uninteded way but always wanna do intended as well Smile
Reply
(Sep 02, 2024, 07:58 AM)jsvensson Wrote:
(Sep 02, 2024, 07:56 AM)a44857437 Wrote:
(Sep 02, 2024, 07:52 AM)jsvensson Wrote:
(Sep 01, 2024, 06:31 PM)a44857437 Wrote:
(Sep 01, 2024, 04:12 PM)spamdegratis5 Wrote: O.martinez credentials can be found querying the API. You need the chatroom key (and obviously the api key, obtained after login using winrm_svc in the client) that can be found in the OM.db3 database, can be found in AppData folder of winrm_svc.

Found the creds, but they don't work? Did they work for you?

(Sep 01, 2024, 06:31 PM)orwell1984 Wrote: I've got both the API key and the chatroom key from the OM.db3 database, but every time request the logs endpoint i get "logs chatroom does not exists!". I'm following the API docs from the official website.

This worked for me:

```
curl -s -k -H 'API-KEY: 55...GG' -H 'Accept: application/json, text/javascript, */*' -H 'Host: infiltrator.htb:14125' 'http://127.0.0.1:14125/api/chatrooms/logs?roomkey=2..m&fromdate=2024/02/01&todate=2024/09/01' | jq '.logs'
```

You need the `fromdate` and `todate`, I skipped them first and got the same error...

I must be blind, I got chatroom key but don't see API key, where is it?

You have to login as winrm_svc in the messenger app, there will be a note or something with it

Thanks, i got root uninteded way but always wanna do intended as well Smile

Did you find the intended path?
Reply
Someone got intended path ? And mb someone got Administrator hash ?
Reply
(Sep 02, 2024, 08:04 AM)a44857437 Wrote:
(Sep 02, 2024, 07:58 AM)jsvensson Wrote:
(Sep 02, 2024, 07:56 AM)a44857437 Wrote:
(Sep 02, 2024, 07:52 AM)jsvensson Wrote:
(Sep 01, 2024, 06:31 PM)a44857437 Wrote: Found the creds, but they don't work? Did they work for you?


This worked for me:

```
curl -s -k -H 'API-KEY: 55...GG' -H 'Accept: application/json, text/javascript, */*' -H 'Host: infiltrator.htb:14125' 'http://127.0.0.1:14125/api/chatrooms/logs?roomkey=2..m&fromdate=2024/02/01&todate=2024/09/01' | jq '.logs'
```

You need the `fromdate` and `todate`, I skipped them first and got the same error...

I must be blind, I got chatroom key but don't see API key, where is it?

You have to login as winrm_svc in the messenger app, there will be a note or something with it

Thanks, i got root uninteded way but always wanna do intended as well Smile

Did you find the intended path?

Not yet, but i think this is related to o.martinez, maybe with calendar as someone wrote it.
Reply
malloc_consolidate(): unaligned fastbin chunk detected
zsh: IOT instruction (core dumped)  evil-winrm -i dc01.infiltrator.htb -r INFILTRATOR.HTB

anyone got this error ?

behaviour is 2 min stable shell then this crash
Reply


Possibly Related Threads…
Thread Author Replies Views Last Post
  [FREE] CPTS 12 FLAGS pulsebreaker 68 1,898 2 hours ago
Last Post: VictorPipeau
  [FREE] HackTheBox Dante - complete writeup written by Tamarisk Tamarisk 601 91,509 2 hours ago
Last Post: VictorPipeau
  [FREE] 300+ Writeups PDF HackTheBox/HTB premium retired Tamarisk 371 92,785 3 hours ago
Last Post: phannguyenbaouy1
  [FREE] HackTheBox Academy - CBBH CDSA CPTS All Modules Flags Techtom 21 2,599 7 hours ago
Last Post: popoler
  Hack the box Pro Labs, VIP, VIP+ 1 month free Method RedBlock 23 2,241 Yesterday, 02:10 PM
Last Post: kkkato

Forum Jump:


 Users browsing this forum: 1 Guest(s)