# Gofer
## Gaining Access
Nmap scan:
```
$ nmap -p- --min-rate 4000 10.129.53.84
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-30 20:51 +08
Nmap scan report for 10.129.53.84
Host is up (0.17s latency).
Not shown: 65530 closed tcp ports (conn-refused)
PORT STATE SERVICE
22/tcp open ssh
25/tcp filtered smtp
80/tcp open http
139/tcp open netbios-ssn
445/tcp open microsoft-ds
```
Did a detailed scan as well:
```
$ nmap -p 80,139,445 -sC -sV --min-rate 3000 10.129.53.84
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-30 20:52 +08
Nmap scan report for 10.129.53.84
Host is up (0.17s latency).
PORT STATE SERVICE VERSION
80/tcp open http Apache httpd 2.4.56
|_http-server-header: Apache/2.4.56 (Debian)
|_http-title: Did not follow redirect to http://gofer.htb/
139/tcp open netbios-ssn Samba smbd 4.6.2
445/tcp open netbios-ssn Samba smbd 4.6.2
Service Info: Host: gofer.htb
```
We can add this domain to our `/etc/hosts` file.
### Web Enumeration -> LFI
Port 80 hosted a typical corporate site:
Within the site, there wasn't much apart from a few names like Jocelyn Hudson and stuff.
`gobuster` scans reveal nothing much, but a `wfuzz` scan shows one subdomain has been returned.
```
$ wfuzz -c -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt --hc 400,301 -H 'Host:FUZZ.gofer.htb' http://gofer.htb
********************************************************
* Wfuzz 3.1.0 - The Web Fuzzer *
********************************************************
Target: http://gofer.htb/
Total requests: 220560
=====================================================================
ID Response Lines Word Chars Payload
=====================================================================
000001171: 401 14 L 54 W 462 Ch "proxy"
```
Visiting this subdomain requires credentials:
Weak credentials don't work at all. I tested a few common directories with different requests, and found that `index.php` accepted POST requests without credentials:
```
$ curl -X POST http://proxy.gofer.htb/index.php
