kali@kali:~/htb/starting point$ ports=$(nmap -p- –min-rate=1000 -T4 10.10.10.27 | grep ^[0-9] | cut -d ‘/’ -f 1 | tr ‘\n’ ‘,’ | sed s/,$//) kali@kali:~/htb/starting point$ echo $ports kali@kali:~/htb/starting point$ nmap -sC -sV -p$ports 10.10.10.27 Ports 445 and 1433 are open -> file sharing (SMB) i SQL Server. kali@kali:~/htb/starting point$ smbclient -N -L \\\\10.10.10.27\\ kali@kali:~/htb/starting point$ smbclient -N \\\\10.10.10.27\\backups dtsConfig file: ruben@kali:~/tools/impacket/examples$ mssqlclient.py ARCHETYPE/sql_svc@10.10.10.27 -windows-auth Create a new file and save it
CTFs
abril 19, 2020
IOLI Crackme 0x05 solution
Hello, This is another IOLI crackme challenge solution. root@kali:~/IOLI-crackme/bin-linux# r2 crackme0x05 pop 4 bytes from esp and jump there. Pop 4 bytes from esp and jump there. Apparently this levels so similar to the past one, so let’s try the same method with 16 as cmp operand. root@kali:~/IOLI-crackme/bin-linux# ./crackme0x05
abril 19, 2020
IOLI Crackme 0x04 solution
Hello, This is another IOLI crackme challenge solution. root@kali:~/IOLI-crackme/bin-linux# r2 crackme0x04 Pay attention to these instructions: These section is where a number is compared to something and if true the password will be valid.Something is compared against 15 (0xf). Let’s find out which is the other operand. These section reminds me a loop. What is being compared to 15 is the parameter of the app, in other words the password.
abril 19, 2020
IOLI Crackme 0x02 solution
This is another IOLI crackme challenge solution. root@kali:~/IOLI-crackme/bin-linux# r2 crackme0x02 root@kali:~/IOLI-crackme/bin-linux# cp crackme0x02 crackme0x02_patchroot@kali:~/IOLI-crackme/bin-linux# r2 -w crackme0x02_patch root@kali:~/IOLI-crackme/bin-linux# ./crackme0x02_patch
abril 19, 2020
IOLI Crackme 0x01 solution
Let’s continue our IOLI’s journey with level 0x01 root@kali:~/IOLI-crackme/bin-linux# r2 crackme0x01 Analize the binary: Show function list: Disassembled function main:
abril 19, 2020
IOLI Crackme 0x00 solution
Hi, Today I’m starting a new series of post to explain how IOLI crackme\’s can be solved using Radare 2. Let’s start with level 0x00 root@kali:~/IOLI-crackme/bin-linux# r2 crackme0x00 [0x08048360]> ! ./crackme0x00