https://ioctl.lol/tags/ssh-key/Recent content in Ssh-Key on ioctlHugoenioctlFri, 05 Apr 2024 00:00:00 +0000https://ioctl.lol/ctf/offsec/boolean/Fri, 05 Apr 2024 00:00:00 +0000https://ioctl.lol/ctf/offsec/boolean/<div class="box-info"> <table> <tr><th colspan="2">ターゲット // Boolean</th></tr> <tr><td>Platform</td><td>OffSec Proving Grounds</td></tr> <tr><td>OS</td><td>Linux</td></tr> <tr><td>Difficulty</td><td>Medium</td></tr> <tr><td>IP</td><td><code>192.168.159.231</code></td></tr> </table> </div> <style> .box-info table { max-width: 400px; margin: 1.5em 0; } .box-info th { text-align: center; font-size: 1.1em; letter-spacing: 0.08em; } </style> <hr> <h2 id="enumeration">Enumeration</h2> <h3 id="nmap">Nmap</h3> <details class="collapse-section"> <summary>▶ Nmap output</summary> <div class="collapse-content"> <pre tabindex="0"><code>PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0) 80/tcp open http (Boolean web app) 33017/tcp open http Apache httpd 2.4.38 ((Debian)) </code></pre> </div> </details> <style> .collapse-section { border: 1px dashed var(--accent-alpha-20); padding: 0.5em 1em; margin: 1em 0; cursor: pointer; } .collapse-section[open] summary { margin-bottom: 0.8em; border-bottom: 1px dashed var(--accent-alpha-20); padding-bottom: 0.5em; } .collapse-section summary { font-weight: 700; color: var(--accent); outline: none; } .collapse-content { padding-top: 0.5em; } </style> <p>SSH is a dead end without creds. Two HTTP surfaces: the main <strong>Boolean</strong> app on port 80 and a separate Apache &ldquo;Development&rdquo; vhost on port 33017.</p>https://ioctl.lol/ctf/offsec/hunit/Tue, 07 Mar 2023 00:00:00 +0000https://ioctl.lol/ctf/offsec/hunit/<div class="box-info"> <table> <tr><th colspan="2">ターゲット // Hunit</th></tr> <tr><td>Platform</td><td>OffSec Proving Grounds</td></tr> <tr><td>OS</td><td>Linux</td></tr> <tr><td>Difficulty</td><td>Medium</td></tr> <tr><td>IP</td><td><code>192.168.142.125</code></td></tr> </table> </div> <style> .box-info table { max-width: 400px; margin: 1.5em 0; } .box-info th { text-align: center; font-size: 1.1em; letter-spacing: 0.08em; } </style> <hr> <h2 id="enumeration">Enumeration</h2> <h3 id="nmap">Nmap</h3> <details class="collapse-section"> <summary>▶ Nmap output</summary> <div class="collapse-content"> <pre tabindex="0"><code>PORT STATE SERVICE VERSION 8080/tcp open http-proxy (custom web app + REST API) 12445/tcp open netbios-ssn Samba smbd 4.6.2 18030/tcp open http Apache httpd 2.4.46 ((Unix)) 43022/tcp open ssh OpenSSH 8.4 (protocol 2.0) </code></pre> </div> </details> <style> .collapse-section { border: 1px dashed var(--accent-alpha-20); padding: 0.5em 1em; margin: 1em 0; cursor: pointer; } .collapse-section[open] summary { margin-bottom: 0.8em; border-bottom: 1px dashed var(--accent-alpha-20); padding-bottom: 0.5em; } .collapse-section summary { font-weight: 700; color: var(--accent); outline: none; } .collapse-content { padding-top: 0.5em; } </style> <p>Everything is on non-standard ports. SMB (12445) and the Apache instance on 18030 turn out to be dead ends — the static site on 18030 is just a landing page, and Samba exposes nothing interesting. SSH sits on 43022, so keep that port in mind: any creds we find get tried there.</p>