ターゲット // Shifty
PlatformOffSec Proving Grounds
OSLinux
DifficultyHard
IP192.168.244.59

Enumeration

Nmap

▶ Nmap output
PORT      STATE SERVICE   VERSION
22/tcp    open  ssh       OpenSSH 7.4p1 Debian 10+deb9u7 (protocol 2.0)
80/tcp    open  http      nginx 1.10.3
5000/tcp  open  http      Werkzeug httpd 1.0.1 (Python 3.5.3)
11211/tcp open  memcached Memcached 1.4.33 (uptime 388 seconds)

Four ports, but two of them talk to each other. Port 5000 is a Flask app (Werkzeug/Python), and port 11211 is memcached — sitting wide open with no auth. That pairing is the whole box.