<aside> 👉

IP de la machine HTB: 10.10.11.60

IP de l’attaquant : 10.10.14.92

</aside>

PARTIE 1

nmap 10.10.11.60 -A -T4

PORT     STATE SERVICE       VERSION
22/tcp   open  ssh           OpenSSH for_Windows_9.5 (protocol 2.0)
53/tcp   open  domain        Simple DNS Plus
80/tcp   open  http          Apache httpd 2.4.58 (OpenSSL/3.1.3 PHP/8.2.12)
|_http-title: Did not follow redirect to <http://frizzdc.frizz.htb/home/>
|_http-server-header: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2025-04-23 19:40:49Z)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: frizz.htb0., Site: Default-First-Site-Name)
445/tcp  open  microsoft-ds?
464/tcp  open  kpasswd5?
593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp  open  tcpwrapped
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: frizz.htb0., Site: Default-First-Site-Name)
3269/tcp open  tcpwrapped
Running (JUST GUESSING): Microsoft Windows 2016 (85%)
OS CPE: cpe:/o:microsoft:windows_server_2016
Aggressive OS guesses: Microsoft Windows Server 2016 (85%)
No exact OS matches for host (test conditions non-ideal).
Host script results:
| smb2-time:
|   date: 2025-04-23T19:40:57
|_  start_date: N/A
| smb2-security-mode:
|   311:
|_    Message signing enabled and required
|_clock-skew: 6h59m58s

Découverte intéressante sur TCP/80 ⇒ http://frizzdc.frizz.htb/home/

#Ajout du domaine au fichier hosts
echo "10.10.11.60 frizzdc.frizz.htb" >> /etc/hosts

http://frizzdc.frizz.htb/home/

image.png

Login => http://frizzdc.frizz.htb/Gibbon-LMS/ => Powered by Gibbon v25.0.00

image.png

searchsploit gibbon

image.png

=> 2 fausses pistes !!! (il faut un user/mdp ou Gibbon v26)

On cherche donc “CVE Gibbon v25” sur Google https://nvd.nist.gov/vuln/detail/CVE-2023-45879 => medium https://nvd.nist.gov/vuln/detail/CVE-2023-45880 => high mais requiert des privileges (CVSS PR:H) https://nvd.nist.gov/vuln/detail/CVE-2023-45878 => critical et CVSS PR:N (pas de privilèges)

On part sur la critical qui ne nécessite pas de privilege donc CVE-2023-45878

La documentation est ici: https://herolab.usd.de/security-advisories/usd-2023-0025/