vegeta1
Port Scanning
nmap -sV -sC -T4 -p- -oN vegeta1 192.168.188.73# Nmap 7.94SVN scan initiated Mon Apr 15 00:15:34 2024 as: nmap -sV -sC -T4 -p- -oN vegeta1 192.168.188.73
Warning: 192.168.188.73 giving up on port because retransmission cap hit (6).
Nmap scan report for 192.168.188.73
Host is up (0.20s latency).
Not shown: 65298 closed tcp ports (conn-refused), 235 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey:
| 2048 1f:31:30:67:3f:08:30:2e:6d:ae:e3:20:9e:bd:6b:ba (RSA)
| 256 7d:88:55:a8:6f:56:c8:05:a4:73:82:dc:d8:db:47:59 (ECDSA)
|_ 256 cc:de:de:4e:84:a8:91:f5:1a:d6:d2:a6:2e:9e:1c:e0 (ED25519)
80/tcp open http Apache httpd 2.4.38 ((Debian))
|_http-title: Site doesn't have a title (text/html).
|_http-server-header: Apache/2.4.38 (Debian)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Mon Apr 15 00:41:29 2024 -- 1 IP address (1 host up) scanned in 1555.54 seconds
port 80 enumeration
On using dirsearch we find the following folder present
dirsearch -u http://192.168.188.73http://192.168.188.73/admin -> REDIRECTS TO: http://192.168.188.73/admin/
http://192.168.188.73/admin/
http://192.168.188.73/admin/admin.php
http://192.168.188.73/image -> REDIRECTS TO: http://192.168.188.73/image/
http://192.168.188.73/img -> REDIRECTS TO: http://192.168.188.73/img/
http://192.168.188.73/login.php
http://192.168.188.73/manual -> REDIRECTS TO: http://192.168.188.73/manual/
http://192.168.188.73/manual/index.html
http://192.168.188.73/robots.txt
http://192.168.188.73/server-status/
http://192.168.188.73/server-status
When we check the the robots.txt we see the content below
When you open the find_me.html file it takes us to the site.
i decided to check it source code, where at the bottom i saw a base64 hashed value and decided to decode it.
echo "hashed-value" | base4 -d
On decoding we get a second hash which is i thought what if i also decode it again
Decoding the second hash gives has a binary which start with PNG assuming this could be a png file. i saved this hash in a png.txt file and went to convert.io and uploaded the png.txt and it returned a QR code.
using cyberchef to see what data is inside the QRcode we see that it has a password topshellv .
After all the information gathered i was just in the rabbit hole so i decided to do the post 80 enumeration again with other tools.
Nkito
With nikto i received the same files us before
I decided to use gobuster with a common wordlist, and this is where i used chatGPT to generate it for me.
Gobuster
gobuster dir -u http://192.168.250.73 -w wordlist.txt -x .html,.txt,.php,.sh,.aspwe found another path /bulma which we didn't see before,
We see that in this path we have a audio file hahahaha.wav and on downloading and playing it sounds to be like a Morse code . checking online i came across this site which can decode the message for me and we see that we found a user and password.
USER : TRUNKS PASSWORD : U$3RGaining access to the server
ssh trunk@192.168.250.73
Typing in our password U$3R it fails to login so i decided to try typing it in lowercase and see if it will work and it was successful.
Listing all the directory contents(ls -al) we get our first flag in local.txt
cat local.txt
7bd0a8cf12c184c604506daa0f1889d6Privilege Escalation
This user contains the .bash_history file present and on checking it, it contain useful data
References
https://morsecode.world/international/decoder/audio-decoder-adaptive.html
Last updated