[jsvensson]

winrm_svc pass

from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
from cryptography.hazmat.primitives import serialization
from cryptography.hazmat.backends import default_backend
import base64

def decrypt_string(key: str, cipher_text: str) -> str:
    key_bytes = key.encode('utf-8')
    cipher_bytes = base64.b64decode(cipher_text)

    if len(key_bytes) not in {16, 24, 32}:
        raise ValueError("Key must be 16, 24, or 32 bytes long")

    cipher = Cipher(algorithms.AES(key_bytes), modes.CBC(b'\x00' * 16), backend=default_backend())
    decryptor = cipher.decryptor()

    decrypted_bytes = decryptor.update(cipher_bytes) + decryptor.finalize()

    return decrypted_bytes.decode('utf-8')

key = 'b14ca5898a4e4133bbce2ea2315a1916'
cipher_text = 'TGlu22oo8GIHRkJBBpZ1nQ/x6l36MVj3Ukv4Hw86qGE='

print(decrypt_string(key,decrypt_string(key, cipher_text)))

well nice that you shared it but from where did you got:
key = 'b14ca5898a4e4133bbce2ea2315a1916'
cipher_text = 'TGlu22oo8GIHRkJBBpZ1nQ/x6l36MVj3Ukv4Hw86qGE='

From OutputMessenger , you should open it from a windows machine with m.harris credentials . Then you will find a UserExplorer.exe . dnSpy will give you this informations

Damm i thought so, so i should install application and then connect but on which port as i tried on 14123 and it didn't worked?

[osamy7593]

now i opened k.turner messanger acc but no thing useful

---

IT SEEMS WE can perform phising attack

[HTBcracker]

winrm_svc pass

from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
from cryptography.hazmat.primitives import serialization
from cryptography.hazmat.backends import default_backend
import base64

def decrypt_string(key: str, cipher_text: str) -> str:
    key_bytes = key.encode('utf-8')
    cipher_bytes = base64.b64decode(cipher_text)

    if len(key_bytes) not in {16, 24, 32}:
        raise ValueError("Key must be 16, 24, or 32 bytes long")

    cipher = Cipher(algorithms.AES(key_bytes), modes.CBC(b'\x00' * 16), backend=default_backend())
    decryptor = cipher.decryptor()

    decrypted_bytes = decryptor.update(cipher_bytes) + decryptor.finalize()

    return decrypted_bytes.decode('utf-8')

key = 'b14ca5898a4e4133bbce2ea2315a1916'
cipher_text = 'TGlu22oo8GIHRkJBBpZ1nQ/x6l36MVj3Ukv4Hw86qGE='

print(decrypt_string(key,decrypt_string(key, cipher_text)))

well nice that you shared it but from where did you got:
key = 'b14ca5898a4e4133bbce2ea2315a1916'
cipher_text = 'TGlu22oo8GIHRkJBBpZ1nQ/x6l36MVj3Ukv4Hw86qGE='

From OutputMessenger , you should open it from a windows machine with m.harris credentials . Then you will find a UserExplorer.exe . dnSpy will give you this informations

from the winrm_svc user, i saw something about the Chiefs_Marketing_chat group, have you found anyway to get access to this group?

edit: seem like O.martinez is the only one have access to this chat group

[HTBcracker]

now i opened k.turner messanger acc but no thing useful

---

IT SEEMS WE can perform phising attack

not sure if you will help you but you can also login to Output Messenger as M.harris, winrm_svc and probably O.martinez but i don't have this user cred yet

[osamy7593]

Ok u found something?

[HTBcracker]

creds of the 2 first user has been posted here so no i didn't found anything new

[a44857437]

winrm_svc pass

from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
from cryptography.hazmat.primitives import serialization
from cryptography.hazmat.backends import default_backend
import base64

def decrypt_string(key: str, cipher_text: str) -> str:
    key_bytes = key.encode('utf-8')
    cipher_bytes = base64.b64decode(cipher_text)

    if len(key_bytes) not in {16, 24, 32}:
        raise ValueError("Key must be 16, 24, or 32 bytes long")

    cipher = Cipher(algorithms.AES(key_bytes), modes.CBC(b'\x00' * 16), backend=default_backend())
    decryptor = cipher.decryptor()

    decrypted_bytes = decryptor.update(cipher_bytes) + decryptor.finalize()

    return decrypted_bytes.decode('utf-8')

key = 'b14ca5898a4e4133bbce2ea2315a1916'
cipher_text = 'TGlu22oo8GIHRkJBBpZ1nQ/x6l36MVj3Ukv4Hw86qGE='

print(decrypt_string(key,decrypt_string(key, cipher_text)))

well nice that you shared it but from where did you got:
key = 'b14ca5898a4e4133bbce2ea2315a1916'
cipher_text = 'TGlu22oo8GIHRkJBBpZ1nQ/x6l36MVj3Ukv4Hw86qGE='

From OutputMessenger , you should open it from a windows machine with m.harris credentials . Then you will find a UserExplorer.exe . dnSpy will give you this informations

Damm i thought so, so i should install application and then connect but on which port as i tried on 14123 and it didn't worked?

Try 14121

[osamy7593]

winrm_svc pass

from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
from cryptography.hazmat.primitives import serialization
from cryptography.hazmat.backends import default_backend
import base64

def decrypt_string(key: str, cipher_text: str) -> str:
    key_bytes = key.encode('utf-8')
    cipher_bytes = base64.b64decode(cipher_text)

    if len(key_bytes) not in {16, 24, 32}:
        raise ValueError("Key must be 16, 24, or 32 bytes long")

    cipher = Cipher(algorithms.AES(key_bytes), modes.CBC(b'\x00' * 16), backend=default_backend())
    decryptor = cipher.decryptor()

    decrypted_bytes = decryptor.update(cipher_bytes) + decryptor.finalize()

    return decrypted_bytes.decode('utf-8')

key = 'b14ca5898a4e4133bbce2ea2315a1916'
cipher_text = 'TGlu22oo8GIHRkJBBpZ1nQ/x6l36MVj3Ukv4Hw86qGE='

print(decrypt_string(key,decrypt_string(key, cipher_text)))

well nice that you shared it but from where did you got:
key = 'b14ca5898a4e4133bbce2ea2315a1916'
cipher_text = 'TGlu22oo8GIHRkJBBpZ1nQ/x6l36MVj3Ukv4Hw86qGE='

From OutputMessenger , you should open it from a windows machine with m.harris credentials . Then you will find a UserExplorer.exe . dnSpy will give you this informations

Damm i thought so, so i should install application and then connect but on which port as i tried on 14123 and it didn't worked?

Try 14121

now i'm in but no thing usefull u found ??

[a44857437]

well nice that you shared it but from where did you got:
key = 'b14ca5898a4e4133bbce2ea2315a1916'
cipher_text = 'TGlu22oo8GIHRkJBBpZ1nQ/x6l36MVj3Ukv4Hw86qGE='

From OutputMessenger , you should open it from a windows machine with m.harris credentials . Then you will find a UserExplorer.exe . dnSpy will give you this informations

Damm i thought so, so i should install application and then connect but on which port as i tried on 14123 and it didn't worked?

Try 14121

now i'm in but no thing usefull u found ??

No... there are 2 databases in the Output Messenger directory, but as far as I can see, nothing interesting so far

[ipfi]

can anyone give me a hint on how to connect with the output messenger?
I've downloaded the unix client and try to connect with user k.turner@infiltrator.htb and his pw in the AD description but the client stays on sing in...

Also how do you get the port forwarding to work?