---
# System prepended metadata

title: InnoOpen in Information Security report

---

# InnoOpen in Information Security report
### Made by @BinaryCats
# 51.250.37.133
## Ports
```
PORT     STATE SERVICE         VERSION
22/tcp   open  ssh             OpenSSH 8.2p1 Ubuntu 4ubuntu0.4 (Ubuntu Linux; protocol 2.0)
53/tcp   open  domain          (generic dns response: NOTIMP)
139/tcp  open  netbios-ssn     Samba smbd 4.6.2
445/tcp  open  netbios-ssn     Samba smbd 4.6.2
8000/tcp open  http            Splunkd httpd
8089/tcp open  ssl/http        Splunkd httpd
8191/tcp open  limnerpressure? MongoDB
```

### UDP
```
Not shown: 994 closed udp ports (port-unreach)
PORT     STATE         SERVICE     VERSION
53/udp   open          domain      (generic dns response: NOTIMP)
67/udp   open|filtered dhcps
68/udp   open|filtered dhcpc
137/udp  open          netbios-ns  Samba nmbd netbios-ns (workgroup: WORKGROUP)
138/udp  open|filtered netbios-dgm
5353/udp open|filtered zeroconf

Service Info: Host: EF3OGOSSE1Q2RC9
```

## SMB share
![](https://i.imgur.com/YSlcNB2.png)
![](https://i.imgur.com/SjiNRnJ.png)
![](https://i.imgur.com/P0jFk6W.png)
`password found in email: 953a86dc62f77ff7e74aa0251a9452e3`

## Splunk (8.0.9)
User credentials:
login|password
--|--
research|953a86dc62f77ff7e74aa0251a9452e3

`Address: http://51.250.37.133:8000`
![](https://i.imgur.com/zEy2jyR.png)

### 2 token
Token found in events.
![](https://i.imgur.com/AL0GSoJ.png)
`Token: 1c6d4881d856019c42d2474bc5026626`
![](https://i.imgur.com/aE5RK2m.png)



Admin credentials given by hint (can be bruted from rockyou.txt)
login|password
--|--
admin|ashleyandtiger4ever

Using admin credentials malicious app was uploaded, that gave shell.
[Shell on GitHub](https://github.com/TBGSecurity/splunk_shells)

### 3 token
Token contained in file "secret" on machine.
![](https://i.imgur.com/DYEiYM6.png)
`Token: c5ee1c328efeae3dc37bcf1b2d07124b`

## Mongo
![](https://i.imgur.com/MUgDt9q.png)

## Hosts
![](https://i.imgur.com/nZVLRxz.png)

![](https://i.imgur.com/0Fbalt5.png)
## NodeBB
![](https://i.imgur.com/E1gZr6t.png)
user1:92b390585a2c5d09ee3418b89f142d35
## Splunk secret
On machine were found two files:
1. /opt/splunk/etc/apps/TA-gitlab-add-on/default/passwords.conf
2. /opt/splunk/etc/auth/splunk.secret

The first file's contents:
```
[credential:gitlab:user1:]
password = $7$cbu3H1NHALLW8w0ro7tRrchkqcujaWiRnZPs1KwsJ6cv+2DtY2YJDETQtOyI4uKQh/3tSbaphk60xxbBzFbV7A==
```

Second file:
```
QfsiRhCPABWWQclbW1tXkGUIe5oREvohiiWAAlvBOWp1iXWtaf.vC0Lsm9yxuHEfIyVpKMCzb.PyqBD9ORikCBA6J6Yul1m.EyE1a6/2IoTR3Gp.LBZ6t2meaEMZ4B0uyPwCeBtQIRP8gZW21aAusf.DR1JKn8c4C5z.SRozIYi5M4UnYFkEORokJ2PARf7VymIz5X45xSIRDD7rUwI1Ry8CHAab0aSqrmyQYN.La6GyeInbaUywh4To/u7XdTsplunk@ef3ogosse1q2rc9nrl74
```

The second file was used to decrypt the first file using [splunksecrets](https://github.com/HurricaneLabs/splunksecrets):
![](https://i.imgur.com/VmCWCOA.png)
login|password
--|--
user1|92b390585a2c5d09ee3418b89f142d35

### Root
![](https://i.imgur.com/nK7Aksg.png)
Read file /root/secret.
`Token: 466f6b49024f59cf4ee4c60fac11cfb1`

## NodeBB admin
admin:hAN3Eg8W
![](https://i.imgur.com/UV4EmHq.png)
