$ nmap -p- --min-rate 5000 10.129.85.96
Starting Nmap 7.93 ( https://nmap.org ) at 2023-05-02 07:48 EDT
Nmap scan report for 10.129.85.96
Host is up (0.0088s latency).
Not shown: 65533 filtered tcp ports (no-response)
PORT STATE SERVICE
80/tcp open http
443/tcp open https
2 ports that are open.
pfSense Creds + RCE
Visiting the IP address redirects us to port 443 where pfSense is running:
We can run a dirbuster scan to see what else is on the port because we have no credentials right now. We can include all the common extensions using -e php,html,txt to see all possible files on the machine.
One of them is called system-users.txt. The file contains this:
####Support ticket###
Please create the following user
username: Rohit
password: company defaults
So the username is Rohit and the password is the default password. In this case, the default password for this software is pfsense. We can then login and see the version running:
This is an outdated version of pfSense running, and it is vulnerable to an RCE exploit.
