Telegram
Смотри на t.me/kiberdruzhinnik/509.
Разведка
Просканируем порты на машине с помощью rustscan
:
$ rustscan -a 10.129.124.118 -- -sCTV
.----. .-. .-. .----..---. .----. .---. .--. .-. .-.
| {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| |
| .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ |
`-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog :
: https://github.com/RustScan/RustScan :
--------------------------------------
To scan or not to scan? That is the question.
[~] The config file is expected to be at "/home/rustscan/.rustscan.toml"
[~] File limit higher than batch size. Can increase speed by increasing batch size '-b 1048476'.
Open 10.129.124.118:80
Open 10.129.124.118:22
[~] Starting Script(s)
[>] Running script "nmap -vvv -p {{port}} {{ip}} -sCTV" on ip 10.129.124.118
Depending on the complexity of the script, results may take some time to appear.
[~] Starting Nmap 7.94 ( https://nmap.org ) at 2024-10-06 06:58 UTC
NSE: Loaded 156 scripts for scanning.
NSE: Script Pre-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 06:58
Completed NSE at 06:58, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 06:58
Completed NSE at 06:58, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 06:58
Completed NSE at 06:58, 0.00s elapsed
Initiating Ping Scan at 06:58
Scanning 10.129.124.118 [2 ports]
Completed Ping Scan at 06:58, 0.14s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 06:58
Completed Parallel DNS resolution of 1 host. at 06:58, 0.01s elapsed
DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 2, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]
Initiating Connect Scan at 06:58
Scanning 10.129.124.118 [2 ports]
Discovered open port 22/tcp on 10.129.124.118
Discovered open port 80/tcp on 10.129.124.118
Completed Connect Scan at 06:58, 0.40s elapsed (2 total ports)
Initiating Service scan at 06:58
Scanning 2 services on 10.129.124.118
Completed Service scan at 06:58, 6.51s elapsed (2 services on 1 host)
NSE: Script scanning 10.129.124.118.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 06:58
Completed NSE at 06:58, 7.58s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 06:58
Completed NSE at 06:58, 1.48s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 06:58
Completed NSE at 06:58, 0.00s elapsed
Nmap scan report for 10.129.124.118
Host is up, received syn-ack (0.19s latency).
Scanned at 2024-10-06 06:58:30 UTC for 16s
PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack OpenSSH 9.6p1 Ubuntu 3ubuntu13.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 a2:ed:65:77:e9:c4:2f:13:49:19:b0:b8:09:eb:56:36 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNb9gG2HwsjMe4EUwFdFE9H8NguzJkfCboW4CveSS+cr2846RitFyzx3a9t4X7S3xE3OgLnmgj8PtKCcOnVh8nQ=
| 256 bc:df:25:35:5c:97:24:f2:69:b4:ce:60:17:50:3c:f0 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEZKWYurAF2kFS4bHCSCBvsQ+55/NxhAtZGCykcOx9b6
80/tcp open http syn-ack Caddy httpd
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-title: Did not follow redirect to http://yummy.htb/
|_http-server-header: Caddy
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
NSE: Script Post-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 06:58
Completed NSE at 06:58, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 06:58
Completed NSE at 06:58, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 06:58
Completed NSE at 06:58, 0.00s elapsed
Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 16.45 seconds
Из скана находим порты HTTP и SSH, а также домен, который и занесем в /etc/hosts
:
$ sudo nano /etc/hosts
10.129.124.118 yummy.htb
Доступ ограничен правилами HackTheBox
В открытом доступе можно публиковать решение задачи после после ее ухода на пенсию.
Непубличное решение задачи ищите в телеграм-канале.