Posts for: #File-Upload

PG: Boolean

#offsec  #proving-grounds  #medium  #linux  #mass-assignment  #path-traversal  #file-upload  #ssh-key 
ターゲット // Boolean
PlatformOffSec Proving Grounds
OSLinux
DifficultyMedium
IP192.168.159.231

Enumeration

Nmap

▶ Nmap output
PORT      STATE SERVICE VERSION
22/tcp    open  ssh     OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
80/tcp    open  http    (Boolean web app)
33017/tcp open  http    Apache httpd 2.4.38 ((Debian))

SSH is a dead end without creds. Two HTTP surfaces: the main Boolean app on port 80 and a separate Apache “Development” vhost on port 33017.

[]

PG: Zino

#offsec  #proving-grounds  #medium  #linux  #booked-scheduler  #rce  #file-upload  #cron  #python 
ターゲット // Zino
PlatformOffSec Proving Grounds
OSLinux
DifficultyMedium
IP192.168.206.64

Enumeration

Nmap

▶ Nmap output
PORT     STATE SERVICE VERSION
21/tcp   open  ftp     vsftpd 3.0.3
22/tcp   open  ssh     OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
139/tcp  open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp  open  netbios-ssn Samba smbd 4.9.5-Debian (workgroup: WORKGROUP)
3306/tcp open  mysql   MariaDB (host not allowed)
8003/tcp open  http    Apache httpd 2.4.38

A Debian box with a broad surface. FTP has no anonymous login, MySQL rejects remote connections (localhost-only MariaDB), and SSH is a dead end without creds. That leaves the web app on 8003 and the open SMB shares.

[]