[trevor69000]

Lets go 
https://app.hackthebox.com/machines/Freelancer

[adn]

PORT STATE SERVICE REASON
53/tcp open domain syn-ack ttl 127
80/tcp open http syn-ack ttl 127
88/tcp open kerberos-sec syn-ack ttl 127
135/tcp open msrpc syn-ack ttl 127
139/tcp open netbios-ssn syn-ack ttl 127
389/tcp open ldap syn-ack ttl 127
445/tcp open microsoft-ds syn-ack ttl 127
464/tcp open kpasswd5 syn-ack ttl 127
593/tcp open http-rpc-epmap syn-ack ttl 127
636/tcp open ldapssl syn-ack ttl 127
3268/tcp open globalcatLDAP syn-ack ttl 127
3269/tcp open globalcatLDAPssl syn-ack ttl 127
5985/tcp open wsman syn-ack ttl 127
9389/tcp open adws syn-ack ttl 127
49667/tcp open unknown syn-ack ttl 127
49670/tcp open unknown syn-ack ttl 127
49671/tcp open unknown syn-ack ttl 127
49672/tcp open unknown syn-ack ttl 127
63271/tcp open unknown syn-ack ttl 127
63275/tcp open unknown syn-ack ttl 127

[osamy7593]

any hint ?......

[maggi]

I got a domain SID?

[+] Domain SID: S-1-5-21-3542429192-2036945976-3483670807

idk?

[osamy7593]

i think we can use xss to steal a cookie .. but where idk

---

i think here we can make xss http://freelancer.htb/contact/

---

guys login as employer and activate the acc after that check qr code

[maggi]

I am logged in as user and been trying to figure that out,

[osamy7593]

make an acc as freelancer and go there freelancer.htb/accounts/recovery/ .. after that recover as employer and login as employer

[imassxck]

Users :

dthomas
jgreen
sdavis
taylor
jmartinez

[iroquois]

idor with qr code otp. only need to substitute b64 of admin user id

[osamy7593]

idor with qr code otp. only need to substitute b64 of admin user id

how to use it can u explain