Crocodile (Tier 1)
Description
Tier -> 1
Difficult -> Very Easy
OS -> Linux
Tags -> Custom Applications / Protocols / Apache / FTP / Reconnaissance / Web Site Structure Discovery / Clear Text Credentials / Anonymous-Guest Access
Write-up
With some research, I started answering the first question
Answer: -sC
After this, I did an initial port scan using Nmap
nmap -p- -Pn --min-rate 2000 10.129.1.15
Then I did an exhaustive scan to get information about the services running on the open ports
nmap -p21,80 -sVC 10.129.1.15
With this, I answered the next question
Answer: vsftpd 3.0.3
I found the FTP protocol running on its default port, so I tried connecting to it. As I didn't have any credentials, I tried using the anonymous user and it let me in successfully
To learn more about the FTP protocol, you can go here
With that and a little research, I answered the next questions
Answer: 230
Answer: anonymous
Answer: get
Once I had access, I listed the contents being shared on the server and found 2 files that seemed to be users' data. So I downloaded both of the files and then closed the connection
ls
mget *
exit
I checked the content of both files and found what seemed to be a list of usernames and a list of related passwords
cat allowed.userlist allowed.userlist.passwd
With this, a little research, and the previous information obtained from the scans, I answered the next questions
Answer: admin
Answer: apache httpd 2.4.41
Answer: -x
With this information, I could check if these credentials work on the FTP service. But after trying all the usernames, it notified me that it only allows anonymous connections
So I decided to check the other running service. It was an HTTP on port 80, so I went to the browser to look at the content being deployed. I found a dashboard for the services of a company where any of the buttons seemed to work
To learn more about the HTTP protocol, you can go here
After exploring the sections of the page, the unique interesting thing was a form in the contact section, which didn't seem to be working properly. To get some extra information about the components of the website, I used the Wappalyzer extension, but it didn't give me anything relevant
As I didn't find anything interesting in the first instance, I tried to fuzz the page using Gobuster and a dictionary. Also, as I knew the page was written on PHP, thanks to Wappalyzer, I specified this on the fuzzing options
gobuster dir -u -w http://10.129.1.15/ -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-small.txt -x php,html
The fuzzing gave me some interesting directions, giving my attention to the /login.php route, so I visited this direction and found a simple login page
With that, I answered the next question
Answer: login.php
Once there, I tried using again the credentials found in the previous lists, combining the usernames with the passwords, and by using the username root and the password rKXM59ESxesUFHAd, I gained access to an administration panel where a message with the flag was displayed
With this, I got the root flag and pwned the machine
Answer: c7110277ac44d78b6a9fff2232434d16
Last updated