Insider

Name: Insider
Hint: A potential insider threat has been reported, and we need to find out what they accessed. Can you help?
Base Points: Easy - Retired [0]
Rated Difficulty:
HTB-Bot
Creator: felamos

Download and unzip the file and check the hint:

 

Hint: A potential insider threat has been reported, and we need to find out what they accessed. Can you help?

 

Files: 113 files inside a Mozilla folder

 

If we look in the Mozilla/Firefox/Profiles/2542z9mo.default-release folder (it's the first profile), we find a logins.json file with an encrypted username and password. Some simple Google-Fu brings us to https://github.com/unode/firefox_decrypt. Clone into that and run it against that first 2542z9mo.default-release profile.

 

 

┌──(kali㉿kali)-[~/Desktop/HTB/Insider/firefox_decrypt]
└─$ python3 firefox_decrypt.py -f json ../2542z9mo.default-release 
2022-01-29 12:24:16,199 - WARNING - profile.ini not found in ../2542z9mo.default-release
2022-01-29 12:24:16,199 - WARNING - Continuing and assuming '../2542z9mo.default-release' is a profile location
[
  {
    "url": "http://acc01:8080",
    "user": "admin",
    "password": "HTB{ur_8RoW53R_H157Ory}"
  }
]
 

Well that was easy.