Hack The Box: Dante Pro Lab Writeup

Overview

The Dante Pro Lab is an enterprise network simulation consisting of 14 machines. This writeup documents my approach to intelligence gathering and initial enumeration.

Steps Taken

1. Intelligence Gathering

Scanned the network to identify open ports
Several ports responded as filtered/no response
Discovered server 10.10.110.100 with SSH (port 22) and FTP (port 21) open
Found a todo.txt file with hints about the infrastructure
Server names suggested multiple web servers on non-standard ports
DNS changes indicated on port 53

Network Information

Subnet: 10.10.110.0/24
Firewall: 10.10.110.2

Host Discovery

Create a file with full listing of hosts:

echo 10.10.110.{1.255} | tr ' ' '\012' > hosts.txt

Ping sweep in bash:

for i in {1..254} ;do (ping -c 1 10.10.110.$i | grep "bytes of data" &) ;done

Target Machines (14 total)

Hostname	IP	Notes
DANTE-FW01	10.10.110.100:22	BSD
DANTE-ADMIN-DC02	-	Domain Controller
DANTE-ADMIN-NIX05	-	Linux Admin
DANTE-ADMIN-NIX06	-	Linux Admin
DANTE-DC01	-	Domain Controller
DANTE-NIX02	-	Linux
DANTE-NIX03	-	Linux
DANTE-NIX04	-	Linux
DANTE-NIX07	-	Linux
DANTE-SQL01	-	SQL Server
DANTE-WS01	-	Workstation
DANTE-WS02	-	Workstation
DANTE-WS03	-	Workstation
DANTE-WEB-NIX01	-	Web Server

Nmap Enumeration

Initial Network Scan

# -n Do not do reverse DNS
# -T4 faster execution
nmap -sT -vv -n -p1-1000 -T4 10.10.110.1-254 --exclude 10.10.110.2 -Pn -oA dante_subnet_1

# Probe service/version detection on open ports
nmap -v -sV 10.10.110.1-254 --exclude 10.10.110.2 -oA dante_subnet_1

# Scan the network with no port scan
nmap -sn 10.10.110.1-254 --exclude 10.10.110.2

# Scan for SSH port 22 with a SYN/ACK command (-sT)
nmap -sT -vv -n -p22 -T4 10.10.110.1-254 --exclude 10.10.110.2 -Pn -oA dante_ssh_hosts

# Display the content of *.gnmap and grep for `22/open`
cat dante_ssh_hosts.gnmap | grep 22/open | awk '{print $2}'

UNIX Server Discovery (Ports 21, 22, 65000)

nmap -sT -vv -n -T4 10.10.110.100 -Pn

Results:

PORT      STATE SERVICE REASON
21/tcp    open  ftp     syn-ack
22/tcp    open  ssh     syn-ack
65000/tcp open  unknown syn-ack

Service Version Detection

nmap -vv -n -sV -sT -p21,22,65000 10.10.110.100 -Pn

Results:

PORT      STATE SERVICE VERSION
21/tcp    open  ftp     vsftpd 3.0.3
22/tcp    open  ssh     OpenSSH 8.2p1 Ubuntu 4
65000/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))

FTP Anonymous Access

Accessed the server anonymously with user anonymous and no password.

Found file at Transfer/Incoming/todo.txt:

- Finalize Wordpress permission changes - PENDING
- Update links to utilize DNS Name prior to changing to port 80 - PENDING
- Remove LFI vuln from the other site - PENDING
- Reset James' password to something more secure - PENDING
- Harden the system prior to the Junior Pen Tester assessment - IN PROGRESS

Key Findings

WordPress site active - Running on non-standard port
DNS changes pending - Port 80 migration planned
LFI vulnerability - Exists on another website
Weak credentials - User “James” has insecure password
System hardening incomplete - Assessment in progress

Metasploit Scanning

SSH Version Scanner

msf6 > use auxiliary/scanner/ssh/ssh_version
msf6 > set RHOSTS 10.10.110.3-254
msf6 > set THREADS 15
msf6 > run

SMB Version Scanner

msf6 > use auxiliary/scanner/smb/smb_version
msf6 > set RHOSTS 10.10.110.3-254
msf6 > set THREADS 11
msf6 > run

MySQL Version Scanner

msf6 > use auxiliary/scanner/mysql/mysql_version
msf6 > set RHOSTS 10.10.110.3-254
msf6 > set THREADS 20
msf6 > run

Lessons Learned

Always check for anonymous FTP access early in enumeration
Non-standard ports can hide valuable services
Todo files and notes left by administrators are goldmines
Systematic scanning with multiple tools provides complete coverage

This writeup is for educational purposes. Always obtain proper authorization before testing systems.