> ## Documentation Index
> Fetch the complete documentation index at: https://rootea.es/llms.txt
> Use this file to discover all available pages before exploring further.
# Anubis
> Writeups verificados de la máquina Anubis de Hack The Box
# Anubis
\$ tldr ASP SSTI → Chisel pivot → Software Portal abuse → AD
| · | · |
| ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Sistema operativo | Windows |
| Dificultad | Insano |
| Vector | Web |
| IP | `10.10.11.102` |
| Fecha de retirada | 2022-01-29 |
| Skills | SSL Certificate Inspection - OpenSSL XSS (Cross-Site Scripting) ASP SSTI (Server Side Template Injection) (HackingDream ASP Resource) \[RCE] InvokePowerShellTcp.ps1 - PowerShell Reverse Shell ConPtyShell (AntonioCoco Utility) - Shell Improvement Certificate Signing Request Inspection - OpenSSL Chisel + Remote Port Forwarding + Proxychains - Creating a SOCKS5 tunnel Abusing Software Portal Traffic inspection with Tcpdump and Tshark URL Host Manipulation Attack + Intercepting authentications with Netcat Playing with Responder to get a Net-NTLMv2 hash Cracking Hashes SMB enumeration with authenticated user Jamovi \<=1.6.18 Exploitation - Malicious OMV File (XSS Vulnerability - Cross-Site Scripting Attack) XSS + NodeJS Command Injection + InvokePowerShellTcp.ps1 (Nishang) Reverse Shell ConPtyShell (AntonioCoco Utility) - Shell Improvement Abusing Certificate Services Playing with Certify.exe to find vulnerable templates PowerView\.ps1 + ADCS.ps1 in order to generate a certificate request and get it approved by the CA ADCS.ps1 script manipulation (userprincipalname/samaccountname \[Substitution Applied]) Listing certificates with gci command Attempting to obtain credentials with Rubeus (asktgt mode) \[ERROR - No longer working] Exploiting CVE-2021-42278/CVE-2021-42287 (noPac.py) through Proxychains \[Alternative Exploitation] Synchronizing our time with DC time (rdate) - Headers Information Leakage Getting an interactive console as the administrator user on the DC (noPac.py) |
## Writeups
| Idioma | Autor | Formato | Enlace |
| ------- | ----------- | ------- | ---------------------------------------------------------- |
| 🇪🇸 ES | **S4vitar** | Vídeo | [Abrir](https://www.youtube.com/watch?v=oFBSn4iaLUo) |
| 🇬🇧 EN | **0xdf** | Texto | [Abrir](https://0xdf.gitlab.io/2022/01/29/htb-anubis.html) |
| 🇬🇧 EN | **IppSec** | Vídeo | [Abrir](https://www.youtube.com/watch?v=tEwH1FeH1mw) |
## Recursos por skill
Documentación curada para cada técnica que aparece en la columna *Skills* de arriba. Fuentes: HackTricks, GTFOBins, PortSwigger, etc.
| Skill | Fuente | Enlace |
| ------------------------------------- | ----------- | ---------------------------------------------------------------------------------------------- |
| SSTI (Server-Side Template Injection) | PortSwigger | [Abrir](https://portswigger.net/web-security/server-side-template-injection) |
| Cross-Site Scripting (XSS) | HackTricks | [Abrir](https://book.hacktricks.wiki/en/pentesting-web/xss-cross-site-scripting/index.html) |
| Cross-Site Scripting (XSS) | PortSwigger | [Abrir](https://portswigger.net/web-security/cross-site-scripting) |
| Information Leakage | HackTricks | [Abrir](https://book.hacktricks.wiki/en/pentesting-web/information-leak.html) |
| OS Command Injection | PortSwigger | [Abrir](https://portswigger.net/web-security/os-command-injection) |
| Cracking Hashes (hashcat / John) | HackTricks | [Abrir](https://book.hacktricks.wiki/en/generic-methodologies-and-resources/brute-force.html) |
| Port Forwarding / Pivoting | HackTricks | [Abrir](https://book.hacktricks.wiki/en/generic-hacking/tunneling-and-port-forwarding.html) |
| SMB (139/445) | HackTricks | [Abrir](https://book.hacktricks.wiki/en/network-services-pentesting/pentesting-smb/index.html) |
| Remote Code Execution (RCE) | HackTricks | [Abrir](https://book.hacktricks.wiki/en/pentesting-web/command-injection.html) |
## Skills relacionadas que conviene dominar
SQL Injection · Server-Side Request Forgery · Brute Force / Rate-Limit Bypass · EternalBlue (MS17-010) · MS08-067 (NetAPI) · Local File Inclusion (LFI) · Remote File Inclusion (RFI) · Shellshock (CVE-2014-6271)
## Si te gustó esta máquina, prueba
* [Nightmare](/htb/machines/linux/insano/nightmare) — Linux, Insano
* [Sniper](/htb/machines/windows/medio/sniper) — Windows, Medio
* [Unbalanced](/htb/machines/linux/dificil/unbalanced) — Linux, Difícil
* [CrossFit](/htb/machines/linux/insano/crossfit) — Linux, Insano
* [Acute](/htb/machines/windows/dificil/acute) — Windows, Difícil
***
## Comentarios y truquillos
¿Algo no funcionó del writeup oficial? ¿Has encontrado un truco mejor? Compártelo aquí — los comentarios viven en [GitHub Discussions](https://github.com/FFuson/HTB_Writeups/discussions).
*Última actualización: 2026-06-29*