# Crocodile (Tier 1)

## <mark style="color:blue;">Description</mark>

* **Tier&#x20;**<mark style="color:green;">**->**</mark> 1
* **Difficult** <mark style="color:green;">**->**</mark> Very Easy
* **OS** <mark style="color:green;">**->**</mark> Linux
* **Tags&#x20;**<mark style="color:green;">**->**</mark> Custom Applications / Protocols / Apache / FTP / Reconnaissance\
  &#x20;            / Web Site Structure Discovery / Clear Text Credentials / Anonymous-Guest Access

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FZgrenBzeOReNYVvkFVFF%2Fimage.png?alt=media&#x26;token=99244f25-c1d3-4b90-a181-e8dc77d398a3" alt=""><figcaption><p><a href="https://app.hackthebox.com/starting-point?tier=1">https://app.hackthebox.com/starting-point?tier=1</a></p></figcaption></figure>

## <mark style="color:blue;">Write-up</mark>

* With some research, I started answering the first question&#x20;

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FgH73uLB9ARZYw6w3c3yc%2Fimage.png?alt=media&#x26;token=bf4bfc76-80b8-488c-9c4b-1a4c7e0d89ae" alt=""><figcaption></figcaption></figure>

> Answer: _**-sC**_

***

* After this, I did an initial port scan using [_Nmap_](../../../networks/tools-and-utilities#nmap)

<pre class="language-bash" data-line-numbers><code class="lang-bash"><strong>nmap -p- -Pn --min-rate 2000 10.129.1.15
</strong></code></pre>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2F1vk5kqUwo8Gxb3u4pNZd%2Fimage.png?alt=media&#x26;token=5eef8222-45ca-4bd6-9d59-bda28d079584" alt=""><figcaption></figcaption></figure>

***

* Then I did an exhaustive scan to get information about the services running on the open ports

{% code lineNumbers="true" %}
```bash
nmap -p21,80 -sVC 10.129.1.15
```
{% endcode %}

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FZMFVkW37KCVr15EeZzFC%2Fimage.png?alt=media&#x26;token=44861a90-05b4-4e21-aeac-7e1f05d93311" alt=""><figcaption></figcaption></figure>

***

* With this, I answered the next question

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2F6TX10BiPX46hpHD7Nkki%2Fimage.png?alt=media&#x26;token=44d87d92-5ed2-44a3-ab32-59092a2cffed" alt=""><figcaption></figcaption></figure>

> Answer: _**vsftpd 3.0.3**_

***

* I found the FTP protocol running on its default port, so I tried connecting to it. As I didn't have any credentials, I tried using the _anonymous_ user and it let me in successfully

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FQyZYBulA1byir0KtQizE%2Fimage.png?alt=media&#x26;token=1a92a880-3911-4de7-8908-9f79a43354ca" alt=""><figcaption></figcaption></figure>

{% hint style="success" %}
To learn more about the FTP protocol, you can go [here](../../networks/protocols/ftp)
{% endhint %}

***

* With that and a little research, I answered the next questions

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FU8r031C5RV6H1sNYRR4f%2Fimage.png?alt=media&#x26;token=62fc0d9e-5c05-4ee2-9c5e-46e5c430548b" alt=""><figcaption></figcaption></figure>

> Answer: _**230**_

***

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2Fqr4Orp2FLtRWjZquhH0O%2Fimage.png?alt=media&#x26;token=a87f552d-4ec3-47dc-a04d-78b49f7a6621" alt=""><figcaption></figcaption></figure>

> Answer: _**anonymous**_

***

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FBvQOsOY0pEFkldQ4QmPO%2Fimage.png?alt=media&#x26;token=03ab4eae-7bd4-4788-8508-f660d290d31c" alt=""><figcaption></figcaption></figure>

> Answer: _**get**_

***

* Once I had access, I listed the contents being shared on the server and found 2 files that seemed to be users' data. So I downloaded both of the files and then closed the connection

{% code overflow="wrap" lineNumbers="true" %}
```bash
ls
mget *
exit
```
{% endcode %}

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FIoknKDK3LB5RNFH42CqO%2Fimage.png?alt=media&#x26;token=5cbedba3-d525-4745-9755-a2688a9b288c" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FikXaeuFnoGdxRS9RRlTs%2Fimage.png?alt=media&#x26;token=3b61f15d-00b8-4be3-8d8b-68e4c0a7530e" alt=""><figcaption></figcaption></figure>

***

* I checked the content of both files and found what seemed to be a list of usernames and a list of related passwords

{% code overflow="wrap" lineNumbers="true" %}
```bash
cat allowed.userlist allowed.userlist.passwd
```
{% endcode %}

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FboZqzl48UsL9FTnCmuot%2Fimage.png?alt=media&#x26;token=e68f219a-6331-4665-8460-331eaec474dc" alt=""><figcaption></figcaption></figure>

***

* With this, a little research, and the previous information obtained from the scans, I answered the next questions

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2F62GfEI49RwfXyVbq4yC5%2Fimage.png?alt=media&#x26;token=d62ca432-cc9c-4511-9d64-c35bf9d63143" alt=""><figcaption></figcaption></figure>

> Answer: _**admin**_

***

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FCjiJGtZx4HtKjargxqzG%2Fimage.png?alt=media&#x26;token=8910fa04-563f-4ec5-a089-4399e6fc41e3" alt=""><figcaption></figcaption></figure>

> Answer: _**apache httpd 2.4.41**_

***

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2Fsg19oarYBA4RsQiWKgbZ%2Fimage.png?alt=media&#x26;token=bc0fd8d5-291d-436a-882e-6918a9ffa009" alt=""><figcaption></figcaption></figure>

> Answer: _**-x**_

***

* With this information, I could check if these credentials work on the FTP service. But after trying all the usernames, it notified me that it only allows anonymous connections

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2F9dZDRXkFU2RU1Usi71P2%2Fimage.png?alt=media&#x26;token=16d3c3f2-f818-483f-bf73-38c1e6660add" alt=""><figcaption></figcaption></figure>

***

* So I decided to check the other running service. It was an HTTP on port 80, so I went to the browser to look at the content being deployed. I found a dashboard for the services of a company where any of the buttons seemed to work

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FGXytkFqZhYAzOHOTJAEI%2Fimage.png?alt=media&#x26;token=2f2f7d08-3a8b-495e-88bd-dd937ba0e007" alt=""><figcaption></figcaption></figure>

{% hint style="success" %}
To learn more about the HTTP protocol, you can go [here](../../networks/protocols/http)
{% endhint %}

***

* After exploring the sections of the page, the unique interesting thing was a form in the contact section, which didn't seem to be working properly. To get some extra information about the components of the website, I used the [_Wappalyzer_](../../../web-exploitation/tools-and-utilities#wappalyzer) extension, but it didn't give me anything relevant

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2Fd7cDqIJSm9X62tuXgHW8%2Fimage.png?alt=media&#x26;token=e216b355-4286-4195-b880-5d2d2540b8e7" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2F9CNUssBYThrDu3XpGdDQ%2Fimage.png?alt=media&#x26;token=d222d0cd-1470-4341-b284-c1c35fc102e9" alt=""><figcaption></figcaption></figure>

***

* As I didn't find anything interesting in the first instance, I tried to fuzz the page using [_Gobuster_](../../../web-exploitation/tools-and-utilities#gobuster) and a dictionary. Also, as I knew the page was written on _PHP,_ thanks to _Wappalyzer_, I specified this on the fuzzing options

{% code overflow="wrap" lineNumbers="true" %}
```bash
gobuster dir -u -w http://10.129.1.15/ -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-small.txt -x php,html
```
{% endcode %}

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FyC58CJhVGAPoojWo90qy%2Fimage.png?alt=media&#x26;token=2a275d53-e221-498a-aec1-7d32f55d1065" alt=""><figcaption></figcaption></figure>

***

* &#x20;The fuzzing gave me some interesting directions, giving my attention to the _/login.php_ route, so I visited this direction and found a simple login page

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FB9Cd1bW1Nh1Dr2gXZZVL%2Fimage.png?alt=media&#x26;token=70bfa0ff-eec6-4a15-8bf8-93ce9a7f56db" alt=""><figcaption></figcaption></figure>

***

* With that, I answered the next question

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2F0pSNPOQWEfJNwq3SJoIk%2Fimage.png?alt=media&#x26;token=8bc6daab-fda6-46d7-a156-cf58d05d1c87" alt=""><figcaption></figcaption></figure>

> Answer: _**login.php**_

***

* Once there, I tried using again the credentials found in the previous lists, combining the usernames with the passwords, and by using the username _root_ and the password _rKXM59ESxesUFHAd,_ I gained access to an administration panel where a message with the flag was displayed

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FtZVUUhecTiznxNCgxEH7%2Fimage.png?alt=media&#x26;token=b757021c-64fa-4e5e-a324-dee3220a381d" alt=""><figcaption></figcaption></figure>

***

* With this, I got the root flag and pwned the machine

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FiRa4uP83mEE1KVtqIsBo%2Fimage.png?alt=media&#x26;token=b0cab404-34a7-40f0-bc9b-ab02667bb564" alt=""><figcaption></figcaption></figure>

> Answer: _**c7110277ac44d78b6a9fff2232434d16**_
