# Nmap 7.94SVN scan initiated Mon Apr 15 00:15:34 2024 as: nmap -sV -sC -T4 -p- -oN vegeta1 192.168.188.73
Warning: 192.168.188.73 giving up on port because retransmission cap hit (6).
Nmap scan report for 192.168.188.73
Host is up (0.20s latency).
Not shown: 65298 closed tcp ports (conn-refused), 235 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey:
| 2048 1f:31:30:67:3f:08:30:2e:6d:ae:e3:20:9e:bd:6b:ba (RSA)
| 256 7d:88:55:a8:6f:56:c8:05:a4:73:82:dc:d8:db:47:59 (ECDSA)
|_ 256 cc:de:de:4e:84:a8:91:f5:1a:d6:d2:a6:2e:9e:1c:e0 (ED25519)
80/tcp open http Apache httpd 2.4.38 ((Debian))
|_http-title: Site doesn't have a title (text/html).
|_http-server-header: Apache/2.4.38 (Debian)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Mon Apr 15 00:41:29 2024 -- 1 IP address (1 host up) scanned in 1555.54 seconds
port 80 enumeration
On using dirsearch we find the following folder present
When we check the the robots.txt we see the content below
When you open the find_me.html file it takes us to the site.
i decided to check it source code, where at the bottom i saw a base64 hashed value and decided to decode it.
On decoding we get a second hash which is i thought what if i also decode it again
Decoding the second hash gives has a binary which start with PNG assuming this could be a png file. i saved this hash in a png.txt file and went to convert.io and uploaded the png.txt and it returned a QR code.
using cyberchef to see what data is inside the QRcode we see that it has a password topshellv .
After all the information gathered i was just in the rabbit hole so i decided to do the post 80 enumeration again with other tools.
Nkito
With nikto i received the same files us before
I decided to use gobuster with a common wordlist, and this is where i used chatGPT to generate it for me.
Gobuster
we found another path /bulma which we didn't see before,
We see that in this path we have a audio file hahahaha.wav and on downloading and playing it sounds to be like a Morse code . checking online i came across this site which can decode the message for me and we see that we found a user and password.
Gaining access to the server
Typing in our password U$3R it fails to login so i decided to try typing it in lowercase and see if it will work and it was successful.
Listing all the directory contents(ls -al) we get our first flag in local.txt
Privilege Escalation
This user contains the .bash_history file present and on checking it, it contain useful data
