Posts for: #Juicy-Potato

HTB: Bounty

#htb  #easy  #windows  #iis  #web-config-upload  #seimpersonate  #juicy-potato 
ターゲット // Bounty
PlatformHTB
OSWindows
DifficultyEasy
IP10.129.x.x

Enumeration

Nmap

▶ Nmap output
PORT   STATE SERVICE VERSION
80/tcp open  http    Microsoft IIS httpd 7.5
|_http-title: Bounty
|_http-server-header: Microsoft-IIS/7.5
| http-methods:
|   Supported Methods: OPTIONS TRACE GET HEAD POST
|_  Potentially risky methods: TRACE
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Port 80 - IIS 7.5

Directory fuzzing reveals two interesting hits:

[]

PG: AuthBy

#offsec  #proving-grounds  #medium  #windows  #ftp-anonymous  #htpasswd-crack  #php-webshell  #juicy-potato  #seimpersonate 
ターゲット // AuthBy
PlatformOffSec Proving Grounds
OSWindows
DifficultyMedium
IP192.168.100.46

Enumeration

Nmap

▶ Nmap output
PORT     STATE SERVICE            VERSION
21/tcp   open  ftp                zFTPServer 6.0 build 2011-10-17
242/tcp  open  http               Apache httpd 2.2.21 ((Win32) PHP/5.3.8)
3145/tcp open  zftp-admin         zFTPServer admin
3389/tcp open  ssl/ms-wbt-server?

Windows Server 2008 box. An ancient zFTPServer on 21, an HTTP app on the non-standard port 242 sitting behind HTTP Basic auth, the zFTPServer admin interface on 3145, and RDP on 3389. The name of the box is the hint: authentication is the whole game here.

[]