search

HTB | Flight

Machine - https://app.hackthebox.com/machines/Flightarrow-up-right

IP - 10.10.11.187

hashtag
NMAP

└─$ nmap -sC -sV -p 53,80,88,135,139,389,445,464,593,636,3268,3269,9389,49667,49673,49674,49694,49719 10.10.11.187 -Pn -oA nmap_port_details
Starting Nmap 7.95 ( <https://nmap.org> ) at 2025-08-19 14:12 IST
Nmap scan report for 10.10.11.187
Host is up (0.31s latency).

PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
80/tcp    open  http          Apache httpd 2.4.52 ((Win64) OpenSSL/1.1.1m PHP/8.1.1)
| http-methods: 
|_  Potentially risky methods: TRACE
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2025-08-19 15:42:59Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped
3268/tcp  open  ldap
3269/tcp  open  tcpwrapped
9389/tcp  open  mc-nmf        .NET Message Framing
49667/tcp open  msrpc         Microsoft Windows RPC
49673/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49674/tcp open  msrpc         Microsoft Windows RPC
49694/tcp open  msrpc         Microsoft Windows RPC
49719/tcp open  msrpc         Microsoft Windows RPC
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2025-08-19T15:44:03
|_  start_date: N/A
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
|_clock-skew: 7h00m02s

Service detection performed. Please report any incorrect results at <https://nmap.org/submit/> .
Nmap done: 1 IP address (1 host up) scanned in 137.69 seconds

hashtag
Port 53

hashtag
Port 80

For some reason i am unable to do directory enumeration

Let’s try to do subdomain enum

let’s add this to our hosts file and visit

Let’s do a directory enum

on visiting http://school.flight.htb/cgi-bin/printenv.pl we found

on looking at blogs, the URL was interesting

When trying to access files, we get this

Looks like some filtering

hashtag
Foothold/shell

hashtag
Shell as ?

hashtag
Auth as svc_apache

hashtag
LFI

When trying / instead of \\ We get the result

This confirms that LFI is there

hashtag
RFI test

Let’s see whether allow_url_include is enabled or not

Unfortunately, it was executed as a text file

hashtag
NTLM hash over SMB

We already know that we have a Windows host with SMB running on it. What if we tell the web server to connect to a share on our machine? Well, if everything goes fine, it should normally try to authenticate to our SMB server, and we must be able to capture its Net-NTLMv2 hash and then crack it.

Let’s start our responder

and force it to connect to our share

we can see the hash on our responder

let’s try to crack it

LDAP and smb both were able to authenticate

Let’s enum shares since LDAP was not possible

Users and Web looks interesting, let’s connect and see

USers Looks like C directory

nothing was there looks like empty directories

hashtag
Password spray

we found the username

let’s copy them and perform a password spray

hashtag
Auth as S.Moon

LDAP was not possible, let’s enum shares

We have Read and Write permission

hashtag
NTLM Theft File upload

We cannot upload a text file (maybe some filtering?)

But we can upload file

Let’s try to perform NTLM thefarrow-up-right via file upload

Now start the responder and upload

On responder, we get the hash

hashtag
Auth as C.Bum

Let’s crack the hash

We can use LDAP and SMB via C.BUM

Looks like we can read and write on Web

And it is the share for the website

Let’s try to upload a text file

hashtag
Shell as svc_apache

And we can upload php file, and it can execute

We can upload a PHP RevShell and get a shell

hashtag
Shell as C.Bum

Let’s upload RunasC and get the shell

And we get user.txt

hashtag
Privilege Escalation

hashtag
Shell as ?

hashtag
internal port 8000

we found that there is something running on internal port 8000

Let’s use chisel

Nice I can access port 8000 via localhost:8001

hashtag
port 8000

website was not functioning

hashtag
uploading Revshell (Auth as defaultapppool)

User C.Bum has Write access (not full control).

Let’s try to upload a test PHP file

Looks like we need to upload the ASP.NET file

Let’s upload a revshell

I will use this revshellarrow-up-right

and load http://127.0.0.1:8001/revshell.aspx

hashtag
SeImpersonatePrivilege

Since we have SeImpersonatePrivilege we can perform a Potato attack

I will use thisarrow-up-right

we can get shell or simply view root.txt

PreviousHTB | JABNextHTB | Cerberus

Last updated