Usage — Credentials¶
| User | Password/Hash | Type | Source | Access Granted | Tested |
|---|---|---|---|---|---|
| admin | $2y$10$ohq2kLpBH/ri.P5wR0P3UOmc24Ydvl9DA9H1S6ooOMgH5xVfUPrL2 → password |
bcrypt (cracked, rockyou) | SQLi dump of usage_blog.admin_users via /forget-password |
admin.usage.htb (Laravel-admin panel) | ✅ |
| xander | 3nc0d3d_pa$$w0rd |
plaintext | Unknown — used successfully for su xander but discovery step not in terminal logs (likely found via browser during webshell phase) |
su xander from dash shell / SSH |
✅ |
| pepper | RSA private key (pepper.key, saved but not reviewed for validity) |
SSH private key | Unknown — captured before cmd.log tracking began, references a since-reset IP (10.129.229.137) | Untested against current instance | ❌ — needs re-verification |
Notes¶
admin/passwordcracked in ~24s at 68 H/s (position ~1600 in rockyou) — very early hit, low-effort password.xandercredential source is a documentation gap — go back and figure out exactly where3nc0d3d_pa$$w0rdwas found (browser history / webshell requests, not this terminal) so the writeup has a real evidence trail.pepper.keyis unverified against the current box instance (10.129.37.180) — box has redeployed at least 4 times since it was captured. Testssh -i pepper.key pepper@<current IP>before relying on it, and if it works, figure out how it was originally obtained.