Howlsec
HOWLSEC
offensive security
// notes/ Practice Boxes
🟩

FriendZone — HTB (10.10.10.123)

Linux box (HTB). Broad service surface (FTP, SSH, DNS, HTTP/HTTPS, SMB). Enumeration notes: DNS zone transfer + SMB shares reveal vhosts and credentials that…

#htb#htb#walkthrough#boxes#os:linux#tech:lfi#tech:rce#tech:file-upload

FriendZone — HTB (10.10.10.123)

Linux box (HTB). Broad service surface (FTP, SSH, DNS, HTTP/HTTPS, SMB). Enumeration notes: DNS zone transfer + SMB shares reveal vhosts and credentials that lead to an LFI/parameter-include foothold.

Enumeration

Nmap

🐺 howlsec@kali
$PORT    STATE SERVICE     VERSION
$21/tcp  open  ftp         vsftpd 3.0.3
$22/tcp  open  ssh         OpenSSH 7.6p1 Ubuntu 4 (Ubuntu Linux; protocol 2.0)
$53/tcp  open  domain      ISC BIND 9.11.3-1ubuntu1.2 (Ubuntu Linux)
$80/tcp  open  http        Apache httpd 2.4.29 ((Ubuntu))
$|_http-title: Friend Zone Escape software
$139/tcp open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
$443/tcp open  ssl/http    Apache httpd 2.4.29
$| ssl-cert: Subject: commonName=friendzone.red/organizationName=CODERED/...emailAddress=haha@friendzone.red
$445/tcp open  netbios-ssn Samba smbd 4.7.6-Ubuntu (workgroup: WORKGROUP)

The TLS cert on 443 leaks the domain friendzone.red (and email haha@friendzone.red). SMB message signing is disabled and guest access is allowed.

FTP (21)

Checklist run — anonymous login is denied, and the FTP-vuln NSE scripts return nothing:

🐺 howlsec@kali
$# nmap --script=ftp-anon,ftp-bounce,ftp-vsftpd-backdoor,ftp-vuln-cve2010-4221 -p 21 10.10.10.123
$21/tcp open  ftp
$# ftp 10.10.10.123 -> anonymous -> 530 Login incorrect.

Checklist: anonymous access ✗ · upload-to-webshell ✗ · backup files ✗ · version exploit ✗.

DNS (53)

ISC BIND is exposed — attempt a zone transfer against friendzone.red to enumerate subdomains/vhosts.

Web (80 & 443)

🐺 howlsec@kali
$80  -> "Friend Zone Escape software"
$443 -> 404 Not Found (cert CN friendzone.red)

Dirsearch on 443 only surfaces /server-status (403). Vhost fuzzing with ffuf against Host: FUZZ.friendzone.htb (filter size 324):

🐺 howlsec@kali
$ffuf -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-110000.txt \
$  -u http://10.10.10.123/ -H "Host: FUZZ.friendzone.htb" --fs 324

SMB (139/445)

Guest access is permitted — enumerate shares for readable/writable directories (the Development share on this box allows writes, which combines with the site's ?pagename include to reach RCE).

🐺 howlsec@kali
$| smb-security-mode: account_used: guest; message_signing: disabled