PG: Hetemit

Tue, 07 Mar 2023 00:00:00 +0000

ターゲット // Hetemit
Platform	OffSec Proving Grounds
OS	Linux
Difficulty	Medium
IP	`192.168.149.117`

Enumeration

Nmap

▶ Nmap output

PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 3.0.3
22/tcp open ssh OpenSSH 8.0 (protocol 2.0)
80/tcp open http Apache httpd 2.4.37 ((centos))
139/tcp open netbios-ssn Samba smbd 4.6.2
445/tcp open netbios-ssn Samba smbd 4.6.2
50000/tcp open http Werkzeug httpd 1.0.1 (Python 3.6.8)

Six ports. FTP allows anonymous login but has nothing useful, port 80 is a stock Apache/CentOS test page, and SSH is a dead end. The two things worth chasing are SMB (for a username) and the Werkzeug dev server on 50000.

PG: Shifty

Tue, 07 Mar 2023 00:00:00 +0000

ターゲット // Shifty
Platform	OffSec Proving Grounds
OS	Linux
Difficulty	Hard
IP	`192.168.244.59`

Enumeration

Nmap

▶ Nmap output

PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.4p1 Debian 10+deb9u7 (protocol 2.0)
80/tcp open http nginx 1.10.3
5000/tcp open http Werkzeug httpd 1.0.1 (Python 3.5.3)
11211/tcp open memcached Memcached 1.4.33 (uptime 388 seconds)

Four ports, but two of them talk to each other. Port 5000 is a Flask app (Werkzeug/Python), and port 11211 is memcached — sitting wide open with no auth. That pairing is the whole box.

Flask on ioctl

PG: Hetemit

Enumeration

Nmap

PG: Shifty

Enumeration

Nmap