🎯Skills Assessment Scenarios

🎯 Skills Assessment - Attacking Common Services

🎯 Overview

This document covers the Skills Assessment (Easy) from HTB Academy's "Attacking Common Services" module. This practical exercise demonstrates a complete attack chain combining multiple service exploitation techniques to achieve the objective.

Target Domain: inlanefreight.htb Objective: "Assess the target server and obtain the contents of the flag.txt file" Skills Tested: Service enumeration, user enumeration, credential attacks, file system access, web shell deployment

🔍 Phase 1: Service Discovery & Enumeration

Initial Nmap Scan

# HTB Academy Skills Assessment - Initial reconnaissance
nmap -A 10.129.203.7

Starting Nmap 7.92 ( https://nmap.org ) at 2022-11-27 13:54 GMT
Nmap scan report for 10.129.203.7
Host is up (0.014s latency).
Not shown: 993 filtered tcp ports (no-response)
PORT     STATE SERVICE       VERSION
21/tcp   open  ftp
| fingerprint-strings: 
|   GenericLines: 
|     220 Core FTP Server Version 2.0, build 725, 64-bit Unregistered
|     Command unknown, not supported or not allowed...
|     Command unknown, not supported or not allowed...
|   NULL: 
|_    220 Core FTP Server Version 2.0, build 725, 64-bit Unregistered
|_ssl-date: 2022-11-27T13:56:03+00:00; 0s from scanner time.
25/tcp   open  smtp          hMailServer smtpd
| smtp-commands: WIN-EASY, SIZE 20480000, AUTH LOGIN PLAIN, HELP
|_ 211 DATA HELO EHLO MAIL NOOP QUIT RCPT RSET SAML TURN VRFY
80/tcp   open  http          Apache httpd 2.4.53 ((Win64) OpenSSL/1.1.1n PHP/7.4.29)
| http-title: Welcome to XAMPP
|_Requested resource was http://10.129.203.7/dashboard/
|_http-server-header: Apache/2.4.53 (Win64) OpenSSL/1.1.1n PHP/7.4.29
443/tcp  open  https         Core FTP HTTPS Server
| fingerprint-strings: 
|   LDAPSearchReq: 
|_    550 Too many connections, please try later...
|_ssl-date: 2022-11-27T13:56:03+00:00; +1s from scanner time.
| ssl-cert: Subject: commonName=Test/organizationName=Testing/stateOrProvinceName=FL/countryName=US
| Not valid before: 2022-04-21T19:27:17
|_Not valid after:  2032-04-18T19:27:17
|_http-server-header: Core FTP HTTPS Server
587/tcp  open  smtp          hMailServer smtpd
| smtp-commands: WIN-EASY, SIZE 20480000, AUTH LOGIN PLAIN, HELP
|_ 211 DATA HELO EHLO MAIL NOOP QUIT RCPT RSET SAML TURN VRFY
3306/tcp open  mysql         MySQL 5.5.5-10.4.24-MariaDB
| mysql-info: 
|   Protocol: 10
|   Version: 5.5.5-10.4.24-MariaDB
|   Thread ID: 10
|   Capabilities flags: 63486
|   Some Capabilities: IgnoreSigpipes, Support41Auth, Speaks41ProtocolOld, SupportsTransactions, ConnectWithDatabase, FoundRows, LongColumnFlag, Speaks41ProtocolNew, InteractiveClient, SupportsCompression, DontAllowDatabaseTableColumn, IgnoreSpaceBeforeParenthesis, ODBCClient, SupportsLoadDataLocal, SupportsAuthPlugins, SupportsMultipleStatments, SupportsMultipleResults
|   Status: Autocommit
|   Salt: s`gc>J7s`gdB\'M.>,`#
|_  Auth Plugin Name: mysql_native_password

Key Services Identified

👤 Phase 2: User Enumeration (SMTP)

Download User Wordlist

SMTP User Enumeration

Result: Valid user fiona@inlanefreight.htb discovered

🔐 Phase 3: Credential Attacks (FTP)

FTP Password Brute Force

Result: Valid credentials fiona:987654321 discovered

📂 Phase 4: FTP Intelligence Gathering

FTP Access & File Download

Critical Intelligence Analysis

Key Intelligence:

  • CoreFTP server running on ports 21 & 443

  • Apache web root at C:\xampp\htdocs\

  • Authentication methods available via HTTPS

🚀 Phase 5: Exploitation - Method 1 (CoreFTP Directory Traversal)

Vulnerability Research

Exploit Analysis

Web Shell Upload via Directory Traversal

🗄️ Phase 6: Exploitation - Method 2 (MySQL File Write)

MySQL Access

File Write Privilege Check

Result: Empty value = File read/write operations allowed

Web Shell Creation via MySQL

🎯 Phase 7: Flag Extraction

Web Shell Execution

📊 Attack Chain Summary

Complete Attack Flow

Services Utilized

Key Learning Points

🔧 Tools & Commands Reference

Complete Tool Chain Used

🔗 Related Documentation

🎯 Skills Assessment - Medium Difficulty

🎯 Overview - Medium Challenge

This document covers the Skills Assessment (Medium) from HTB Academy's "Attacking Common Services" module. This advanced exercise demonstrates a complex attack chain involving DNS enumeration, vHost discovery, anonymous FTP access, email exploitation, and SSH key-based authentication.

Target Domain: inlanefreight.htb Objective: "Assess the target server and find the flag.txt file" Skills Tested: DNS zone transfers, vHost enumeration, FTP intelligence gathering, POP3 attacks, SSH key extraction and usage

🔍 Phase 1: Service Discovery & DNS Enumeration

Initial Nmap Scan

Key Discovery: DNS server running on port 53 (BIND 9.16.1)

DNS Zone Transfer Attack

Critical Discovery: int-ftp.inlanefreight.htb points to 127.0.0.1 (localhost)

🌐 Phase 2: vHost Configuration & Internal Service Discovery

vHost Addition to Local Hosts

Internal FTP Service Discovery

Discovery: ProFTPD server on non-standard port 30021

📂 Phase 3: Anonymous FTP Access & Intelligence Gathering

Anonymous FTP Connection

File System Exploration

Intelligence Gathered: Password wordlist file mynotes.txt for user simon

🔐 Phase 4: POP3 Credential Attack

Password List Analysis

POP3 Password Brute Force

Result: Valid credentials simon:8Ns8j1b!23hs4921smHzwn discovered

📧 Phase 5: POP3 Email Access & SSH Key Extraction

POP3 Mail Access

Email Enumeration & Retrieval

Critical Discovery: SSH private key for user simon obtained from email

🔐 Phase 6: SSH Key Processing & Authentication

SSH Key Formatting

Formatted SSH Private Key

SSH Key Permissions & Access

🎯 Phase 7: Flag Extraction

Final Flag Retrieval

📊 Attack Chain Summary - Medium Difficulty

Complete Attack Flow

Services & Techniques Utilized

Advanced Learning Points

🔧 Complete Tool Chain - Medium Difficulty

Full Command Reference

🔗 Skills Assessment Comparison

Easy vs Medium Difficulty

Easy Skills Assessment

  • Attack Chain: 7 phases (Service Discovery → Web Shell → Flag)

  • Services: FTP, SMTP, HTTP, HTTPS, MySQL (5 services)

  • Key Techniques: User enumeration, credential attacks, directory traversal, file upload

  • Complexity: Medium - Multiple exploitation paths available

Medium Skills Assessment

  • Attack Chain: 10 phases (DNS → vHost → SSH Key → Flag)

  • Services: DNS, FTP, POP3, SSH (4 services + vHost discovery)

  • Key Techniques: Zone transfers, internal service discovery, email intelligence, SSH keys

  • Complexity: High - Linear attack chain with each phase dependent on previous

Practical CPTS Skills Demonstrated

🎯 Skills Assessment - Hard Difficulty

🎯 Overview - Hard Challenge

This document covers the Skills Assessment (Hard) from HTB Academy's "Attacking Common Services" module. This expert-level exercise demonstrates advanced Windows exploitation involving SMB share enumeration, custom wordlist attacks, RDP authentication, SQL Server user impersonation, and linked server exploitation.

Target Domain: Windows environment with multiple services Objective: "Retrieve user files and obtain administrator flag" Skills Tested: SMB enumeration, credential attacks, RDP access, SQL Server impersonation, linked server attacks, xp_cmdshell exploitation

🔍 Phase 1: Service Discovery & Windows Enumeration

Initial Nmap Scan

Key Services Identified

Target System: WIN-HARD (Windows 10.0 Build 17763)

📂 Phase 2: SMB Share Enumeration & File Collection

SMB Share Discovery

Discovery: Home share available for anonymous access

SMB Share Exploration

Discovery: Multiple department directories including IT department

User File Collection from IT Department

Files Retrieved:

  • From Simon: random.txt ✅ (Question 1 answer)

  • From Fiona: creds.txt

  • From John: information.txt, notes.txt, secrets.txt

🔐 Phase 3: Custom Wordlist Creation & Credential Attacks

Password Wordlist Compilation

Strategy: Combine all potential password files from different users

SMB Credential Attack

Result: Valid credentials fiona:48Ns72!bns74@S84NNNSl discovered ✅ (Question 2 answer)

🖥️ Phase 4: RDP Authentication & SQL Server Access

RDP Connection

Success: RDP session established as user fiona

SQL Server Connection via Windows Authentication

Access: SQLCMD connection established to local SQL Server instance

👤 Phase 5: SQL Server User Impersonation Discovery

Impersonation Privilege Enumeration

Discovery: Users john and simon can be impersonated ✅ (Question 3 answer: john)

🔗 Phase 6: Linked Server Discovery & Exploitation

Linked Server Enumeration

Discovery:

  • WINSRV02\SQLEXPRESS (remote server)

  • LOCAL.TEST.LINKED.SRV (linked server)

User Impersonation & Linked Server Access

Critical Discovery:

  • User john can access LOCAL.TEST.LINKED.SRV

  • On linked server, john has sysadmin privileges as testadmin

  • Target server: WINSRV02\SQLEXPRESS

💻 Phase 7: xp_cmdshell Enablement & Command Execution

xp_cmdshell Configuration

Success: xp_cmdshell enabled on linked server for command execution

Administrator Flag Extraction

📊 Attack Chain Summary - Hard Difficulty

Complete Attack Flow

Advanced Services & Techniques

Expert Learning Points

🔧 Complete Tool Chain - Hard Difficulty

Full Command Reference

🔗 Complete Skills Assessment Trilogy

Difficulty Progression Overview

Easy Skills Assessment

  • Attack Chain: 7 phases (Basic multi-service exploitation)

  • Services: FTP, SMTP, HTTP, HTTPS, MySQL (5 services)

  • Complexity: Medium - Multiple exploitation paths

  • Key Skills: Service enumeration, credential attacks, directory traversal

Medium Skills Assessment

  • Attack Chain: 10 phases (Advanced linear dependency chain)

  • Services: DNS, vHost, FTP, POP3, Email, SSH (6 services)

  • Complexity: High - Each phase enables next attack

  • Key Skills: Zone transfers, vHost discovery, SSH key extraction

Hard Skills Assessment

  • Attack Chain: 13 phases (Expert Windows enterprise exploitation)

  • Services: SMB, RDP, SQL Server, Linked Servers (4+ services)

  • Complexity: Expert - Cross-server privilege escalation

  • Key Skills: Windows authentication, SQL impersonation, linked server attacks

Complete CPTS Skills Matrix

This complete Skills Assessment trilogy provides comprehensive practical scenarios spanning beginner to expert levels, demonstrating the full spectrum of attack techniques covered in the "Attacking Common Services" module for thorough CPTS exam preparation.

PreviousEmail Services AttacksNextPivoting, Tunneling & Port Forwarding

Last updated