Crocodile (Tier 1)
Last updated
Was this helpful?
Last updated
Was this helpful?
Tier -> 1
Difficult -> Very Easy
OS -> Linux
Tags -> Custom Applications / Protocols / Apache / FTP / Reconnaissance / Web Site Structure Discovery / Clear Text Credentials / Anonymous-Guest Access
With some research, I started answering the first question
Answer: -sC
Then I did an exhaustive scan to get information about the services running on the open ports
With this, I answered the next question
Answer: vsftpd 3.0.3
I found the FTP protocol running on its default port, so I tried connecting to it. As I didn't have any credentials I tried using the anonymous user and it let me in successfully
With that and a little research, I answered the next questions
Answer: 230
Answer: anonymous
Answer: get
Once I had access, I listed the contents being shared on the server and found 2 files that seemed to be users' data. So I downloaded both of the files and then closed the connection
I checked the content of both files and found what seemed to be a list of usernames and a list of related passwords
With this, a little research, and the previous information obtained from the scans, I answered the next questions
Answer: admin
Answer: apache httpd 2.4.41
Answer: -x
With this information, I could check if these credentials work on the FTP service. But after trying all the usernames it notified me that it only allows anonymous connections
So I decided to check the other running service. It was an HTTP on port 80, so I went to the browser to look at the content being deployed. I found a dashboard for the services of a company where any of the buttons seemed to work
The fuzz gave me some interesting directions, being one of those the /login.php page, so I visited this direction and found a simple login page
With that, I answered the next question
Answer: login.php
Once there, I tried using again the credentials found in the previous lists, combining the usernames with the passwords, and by using the username root and the password rKXM59ESxesUFHAd I gained access to an administration panel where a message with the flag was displayed
With this, I got the root flag and pwned the machine
Answer: c7110277ac44d78b6a9fff2232434d16
After this, I did an initial port scan using
To learn more about the FTP protocol you can go
To learn more about the HTTP protocol you can go
After exploring the sections of the page I noticed the unique different thing was a form in the contact section which didn't seem to be working properly. To get some extra information about the components of the website, I used the extension but didn't give me anything relevant
As I didn't find anything interesting in the first instance, I tried to fuzz the page using and a dictionary. Also as I knew the page was written on PHP thanks to Wappalyzer I specified this on the fuzzing options
