Posts for: #Medium

PG: Slort

#offsec  #proving-grounds  #medium  #windows  #lfi  #rfi  #php-wrapper  #scheduled-task  #xampp 
ターゲット // Slort
PlatformOffSec Proving Grounds
OSWindows
DifficultyMedium
IP192.168.105.53

Enumeration

Nmap

▶ Nmap output
PORT     STATE SERVICE VERSION
21/tcp   open  ftp     FileZilla ftpd 0.9.41 beta
135/tcp  open  msrpc   Microsoft Windows RPC
139/tcp  open  netbios-ssn
445/tcp  open  microsoft-ds
3306/tcp open  mysql   MariaDB (host not allowed)
4443/tcp open  http    Apache httpd 2.4.43 (XAMPP)
8080/tcp open  http    Apache httpd 2.4.43 (XAMPP)

Windows box running XAMPP on two HTTP ports (4443 and 8080); the vulnerable app lives on 8080, so 4443 stays untouched. FTP requires credentials, MySQL is localhost-only.

[]

HTB: Forge

#htb  #medium  #linux  #ssrf  #ssrf-redirect  #ftp  #python-pdb 
ターゲット // Forge
PlatformHTB
OSLinux
DifficultyMedium
IP10.129.106.197

Recon

Subdomain brute-force reveals admin.forge.htb, but it only responds to requests from localhost:

1
2

curl http://forge.htb -H 'Host: admin.forge.htb'
# Only localhost is allowed!

Enumeration

Nmap

▶ Nmap output
21/tcp filtered ftp
22/tcp open     ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.3
80/tcp open     http    Apache httpd 2.4.41

OS: Ubuntu 20.04 (Focal)

[]