search

Catto

hashtag
Gaining Access

Nmap scan:

$ nmap -p- --min-rate 3000 192.168.183.139
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-12 15:03 +08
Nmap scan report for 192.168.183.139
Host is up (0.17s latency).
Not shown: 65524 closed tcp ports (conn-refused)
PORT      STATE    SERVICE
2500/tcp  filtered rtsserv
4907/tcp  filtered unknown
8080/tcp  open     http-proxy
18080/tcp open     unknown
30330/tcp open     unknown
36123/tcp open     unknown
38439/tcp open     unknown
42022/tcp open     unknown
42086/tcp filtered unknown
50400/tcp open     unknown
56339/tcp filtered unknown

Lots of ports open. Did a detailed scan as well:

hashtag
Web Enum -> GraphQL

Port 8080 shows a portfolio page:

It was rather static, so I moved to port 30330. This page had some book reviews:

This page looked more dynamic, so I ran a directory scan with feroxbuster, which found nothing of interest. Since we couldn't find anything with wordlists, I took a look through the local files:

There were a few interesting folders:

There wasn't much within the folders. On the 'Using Typescript' page, there was a link to documentation:

LogoTypeScript and Gatsby | GatsbyGatsbychevron-right

On the documentation page, there was mention of GraphQL being used, and sure enough /__graphql was a valid directory on the website as per the documentation:

The left had some queries already valid, so I checked those out. Using the allSitePage reveals all directories, including a hidden one:

Visiting it reveals a password:

This was a password to a Minecraft server. We didn't have a user, but the Minecraft page had some that we could try:

We can gather all the usernames into one wordlist:

I used hydra to brute force the creds:

We can then ssh in as marcus:

hashtag
Privilege Escalation

hashtag
.bash -> Base64key Root Creds

There was a weird folder .bash within the user's home directory:

This string looked like base64 but it wasn't. I looked at other binaries with base as part of their name:

base64key required a private key to decrypt, so I just tried the user's password and it worked:

We can then su to root:

PreviousCassiosNextCharlotte

Last updated