JohnTheRipper on Chief Dennis' Blog

Runner HTB Walkthrough

Mon, 10 Jun 2024 13:07:16 +0100

The Runner HTB machine is a medium difficulty level HackTheBox Machine. The main techniques and tools used to crack this machine are:

- Subdirectory discovery with ffuf
- CVE-2024-27198
- Hash cracking with JohnTheRipper
- Docker escape
- CVE-2024-21626

Reconnaissance Link to heading

We start a broad Nmap scan by executing the following command:

sudo nmap -sS -T5 -vvv -p- 10.10.11.13 -Pn -oG nmap_inicial

Where the arguments mean:

Usage HTB Walkthrough

Wed, 29 May 2024 13:07:16 +0100

The Usage HTB machine is a madium difficulty level HackTheBox Machine. The main techniques and tools used to crack this machine are:

- Blind SQL injection with SQLmap
- Burpsuite
- Hash cracking with JohnTheRipper
- 7z Wildcard Spare exploitation

Reconnaissance Link to heading

We start a broad Nmap scan by executing the following command:

sudo nmap -sS -T5 -vvv -p- 10.10.11.18 -Pn -oG nmap_inicial

Where the arguments mean:

Monitored HTB Walkthrough

Sat, 17 Feb 2024 13:07:16 +0100

The Monitored HTB machine is a medium difficulty level HackTheBox Machine. The main tools and techniques used to crack this machine are:

 - Dirsearch
 - CVE-2023-40931
 - NMAP UDP scan
 - SNMP enumeration with SNMPwalk
 - JohnTheRipper
 - SQL injection with SQLmap

Reconnaissance Link to heading

We start a broad Nmap TCP scan by executing the following command:

sudo nmap -sS -T5 -vvv -p- 10.10.11.248 -Pn -oG nmap_inicial

Where the arguments mean:

Codify HTB Walkthrough

Wed, 13 Sep 2023 13:07:16 +0100

The Codify HTB machine is a easy difficulty level HackTheBox Linux Machine. The main techniques used to crack this machine are:

- Hash cracking with JohnTheRipper
- Sandbox escape
- Batch Script Analysis
- Python Scripting

Reconnaissance Link to heading

I started by running a NMAP scan to look for services and versions running on open ports;

We can see that the usual ports 22 and 80 are open. However, port 3000 is also open running node.js, which could be useful in the future since node.js has some known vulnerabilities in older versions.