StreamIO - HTB [Discussion]
by - Thursday, January 1, 1970 at 12:00 AM
PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
80/tcp    open  http          Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
| http-methods:
|_  Potentially risky methods: TRACE
|_http-title: IIS Windows Server
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2022-06-05 02:06:52Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: streamIO.htb0., Site: Default-First-Site-Name)
443/tcp   open  ssl/http      Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
| http-server-header:
|   Microsoft-HTTPAPI/2.0
|_  Microsoft-IIS/10.0
| tls-alpn:
|_  http/1.1
| http-cookie-flags:
|   /:
|     PHPSESSID:
|_      httponly flag not set
|_http-title: Streamio
| ssl-cert: Subject: commonName=streamIO/countryName=EU
| Subject Alternative Name: DNS:streamIO.htb, DNS:watch.streamIO.htb
| Not valid before: 2022-02-22T07:03:28
|_Not valid after:  2022-03-24T07:03:28
| http-methods:
|_  Potentially risky methods: TRACE
|_ssl-date: 2022-06-05T02:08:23+00:00; +6h59m52s from scanner time.
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: streamIO.htb0., Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp  open  mc-nmf        .NET Message Framing
49667/tcp open  msrpc         Microsoft Windows RPC
49669/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49670/tcp open  msrpc         Microsoft Windows RPC
49698/tcp open  msrpc         Microsoft Windows RPC
51066/tcp open  msrpc         Microsoft Windows RPC
Reply
streamIO.htb0 streamIO.htb watch.streamIO.htb

Maybe sqli? https://watch.streamio.htb/search.php

Got user martin with kerbrute, pswd spraying was false
Reply
The username param in login on streamio.htb is injectable
Reply
(June 4, 2022, 08:29 PM)ryzen Wrote: The username param in login on streamio.htb is injectable


I found that too. In my case, sqlmap found a time-based injection. So it takes a while...
Reply
(June 4, 2022, 08:51 PM)Exa Wrote:
(June 4, 2022, 08:29 PM)ryzen Wrote: The username param in login on streamio.htb is injectable


I found that too. In my case, sqlmap found a time-based injection. So it takes a while...


Same boat. There's 33 users  :s
Reply
user = yoshihide
pass = '66boysandgirls..'
Reply
Don't forget : https://watch.streamio.htb/
Reply
Any tips for dumping db info? sqlmap is taking forever
Reply
Also - https://streamio.htb/admin/
Reply
I was able to get the users NTLM hash with responder and xp_dirtree, but hascat can't crack it
Reply


 Users viewing this thread: StreamIO - HTB [Discussion]: No users currently viewing.