Insider

Name	Insider
Hint	A potential insider threat has been reported, and we need to find out what they accessed. Can you help?
Base Points	Easy - Retired [0]
Rated Difficulty
	HTB-Bot
Creator	felamos

Download and unzip the challenge archive. It contains 113 files inside a Mozilla folder.

Inside Mozilla/Firefox/Profiles/2542z9mo.default-release, the first Firefox profile, we find a logins.json file containing an encrypted username and password. Some simple Google-Fu leads to firefox_decrypt. Clone the repository and run it against that profile.

┌──(kali㉿kali)-[~/Desktop/HTB/Insider/firefox_decrypt]
└─$ python3 firefox_decrypt.py -f json /2542z9mo.default-release
2022-01-29 12:24:16,199 - WARNING - profile.ini not found in /2542z9mo.default-release
2022-01-29 12:24:16,199 - WARNING - Continuing and assuming '/2542z9mo.default-release' is a profile location
[
  {
    "url": "http://acc01:8080",
    "user": "admin",
    "password": "HTB{ur_8RoW53R_H157Ory}"
  }
]

Well, that was easy.