| ターゲット // Shifty | |
|---|---|
| Platform | OffSec Proving Grounds |
| OS | Linux |
| Difficulty | Hard |
| IP | 192.168.244.59 |
Enumeration
Nmap
▶ Nmap output
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.4p1 Debian 10+deb9u7 (protocol 2.0)
80/tcp open http nginx 1.10.3
5000/tcp open http Werkzeug httpd 1.0.1 (Python 3.5.3)
11211/tcp open memcached Memcached 1.4.33 (uptime 388 seconds)
Four ports, but two of them talk to each other. Port 5000 is a Flask app (Werkzeug/Python), and port 11211 is memcached — sitting wide open with no auth. That pairing is the whole box.