[blurghadurgh]

Starting a thread to discuss tentacle (no progress yet). It has a squid proxy, a kerberos service running and a BIND server. Trying to use the squid proxy gives us a username '[email protected]'. 

DNS enumeration reveals ns.realcorp.htb (internal address), but we can't access it.

Using the squid proxy fails without a valid username/password. Maybe brute forcing kerberos is the starting point?

[Kali76]

Ok

Starting a thread to discuss tentacle (no progress yet). It has a squid proxy, a kerberos service running and a BIND server. Trying to use the squid proxy gives us a username '[email protected]'. 

DNS enumeration reveals ns.realcorp.htb (internal address), but we can't access it.

Using the squid proxy fails without a valid username/password. Maybe brute forcing kerberos is the starting point?

Kerberoasting thinks

[lingling40hrs]

wfuzz -t32 -z range,1-65535 -p '10.10.10.224:3128' --hc 503 http://localhost:FUZZ/
********************************************************
* Wfuzz 3.1.0 - The Web Fuzzer                         *
********************************************************

Target: http://localhost:FUZZ/
Total requests: 65535

=====================================================================
ID           Response   Lines    Word       Chars       Payload
=====================================================================

000000022:   200        2 L      5 W        57 Ch       "22"
000000088:   200        0 L      5 W        99 Ch       "88"
000000464:   200        0 L      4 W        96 Ch       "464"
000000953:   502        144 L    400 W      3676 Ch     "953"
000003128:   400        150 L    416 W      3546 Ch     "3128"
000000053:   502        142 L    387 W      3553 Ch     "53"

Total time: 0
Processed Requests: 13003
Filtered Requests: 12997
Requests/sec.: 0

This is when I use the squid as proxy in wfuzz to fuzz. Also, the vuln of request smuggling is here:
https://i.blackhat.com/USA-20/Wednesday/...lenges.pdf

plus, we can see that there is a user j.nakazawa which has no preauth.

GetNPUsers.py -dc-ip REALCORP.HTB REALCORP.HTB/j.nakazawa -no-pass -format hashcat

gave me an uncrackable hash

[0xvijay]

wfuzz -t32 -z range,1-65535 -p '10.10.10.224:3128' --hc 503 http://localhost:FUZZ/
********************************************************
* Wfuzz 3.1.0 - The Web Fuzzer                        *
********************************************************

Target: http://localhost:FUZZ/
Total requests: 65535

=====================================================================
ID          Response  Lines    Word      Chars      Payload
=====================================================================

000000022:  200        2 L      5 W        57 Ch      "22"
000000088:  200        0 L      5 W        99 Ch      "88"
000000464:  200        0 L      4 W        96 Ch      "464"
000000953:  502        144 L    400 W      3676 Ch    "953"
000003128:  400        150 L    416 W      3546 Ch    "3128"
000000053:  502        142 L    387 W      3553 Ch    "53"

Total time: 0
Processed Requests: 13003
Filtered Requests: 12997
Requests/sec.: 0

This is when I use the squid as proxy in wfuzz to fuzz. Also, the vuln of request smuggling is here:
https://i.blackhat.com/USA-20/Wednesday/...lenges.pdf

plus, we can see that there is a user j.nakazawa which has  no preauth.

GetNPUsers.py -dc-ip REALCORP.HTB REALCORP.HTB/j.nakazawa -no-pass -format hashcat

gave me an uncrackable hash

The hash is a rabbithole

[Buttmuncher]

Still only six users/roots on this box! It feels like we never see leaks/walkthroughs here until it hits about 100....

[Buttmuncher]

I see there is a spike in people hitting user but not root so it looks like something is being shared . . .

[JustMeAndYou]

I see there is a spike in people hitting user but not root so it looks like something is being shared . . .

chain3 proxies together from what I heard. Working on it now.

[thegrey1981]

Also struggling with the proxies... If I make progress I will share it.

[osmanardanan]

edit
edit
edit
edit
edit
edit
edit
post removed

[0xvijay]

edit
edit
edit
edit
edit
edit
edit
post removed

any updates

post it here


Bumpppppppppppppppppppppppppppppppppppppppppp

[Hum12sa]

FUZZ FUZZ FUZZ Gentlemen , Find The Sub :D

[JustMeAndYou]

FUZZ FUZZ FUZZ Gentlemen , Find The Sub :D

found it  and more internal addresses  just not quite sure as to what to do with them. Enumerate more it seems. I can help with the proxy chaining. When I get this part sorted.