Catto
Gaining Access
Nmap scan:
$ nmap -p- --min-rate 3000 192.168.183.139
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-12 15:03 +08
Nmap scan report for 192.168.183.139
Host is up (0.17s latency).
Not shown: 65524 closed tcp ports (conn-refused)
PORT STATE SERVICE
2500/tcp filtered rtsserv
4907/tcp filtered unknown
8080/tcp open http-proxy
18080/tcp open unknown
30330/tcp open unknown
36123/tcp open unknown
38439/tcp open unknown
42022/tcp open unknown
42086/tcp filtered unknown
50400/tcp open unknown
56339/tcp filtered unknownLots of ports open. Did a detailed scan as well:
Web Enum -> GraphQL
Port 8080 shows a portfolio page:
It was rather static, so I moved to port 30330. This page had some book reviews:
This page looked more dynamic, so I ran a directory scan with feroxbuster, which found nothing of interest. Since we couldn't find anything with wordlists, I took a look through the local files:
There were a few interesting folders:
There wasn't much within the folders. On the 'Using Typescript' page, there was a link to documentation:
On the documentation page, there was mention of GraphQL being used, and sure enough /__graphql was a valid directory on the website as per the documentation:
The left had some queries already valid, so I checked those out. Using the allSitePage reveals all directories, including a hidden one:
Visiting it reveals a password:
This was a password to a Minecraft server. We didn't have a user, but the Minecraft page had some that we could try:
We can gather all the usernames into one wordlist:
I used hydra to brute force the creds:
We can then ssh in as marcus:
Privilege Escalation
.bash -> Base64key Root Creds
There was a weird folder .bash within the user's home directory:
This string looked like base64 but it wasn't. I looked at other binaries with base as part of their name:
base64key required a private key to decrypt, so I just tried the user's password and it worked:
We can then su to root:
Last updated