WhyHackMe
Port scan
PORT STATE SERVICE REASON VERSION
21/tcp open ftp syn-ack vsftpd 3.0.3
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_-rw-r--r-- 1 0 0 318 Mar 14 2023 update.txt
| ftp-syst:
| STAT:
| FTP server status:
| Connected to 10.9.227.162
| Logged in as ftp
| TYPE: ASCII
| No session bandwidth limit
| Session timeout in seconds is 300
| Control connection is plain text
| Data connections will be plain text
| At session startup, client count was 2
| vsFTPd 3.0.3 - secure, fast, stable
|_End of status
22/tcp open ssh syn-ack OpenSSH 8.2p1 Ubuntu 4ubuntu0.9 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 3072 47:71:2b:90:7d:89:b8:e9:b4:6a:76:c1:50:49:43:cf (RSA)
<<SNIPPED>>
80/tcp open http syn-ack Apache httpd 2.4.41 ((Ubuntu))
|_http-server-header: Apache/2.4.41 (Ubuntu)
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-title: Welcome!!
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
Ftp files
Since anonymous login was enabled we can go ahead and grab the file
File (update.txt)
After reading that we can clearly see a hint of SSRF.
Web page
After you read the blog, you can see it wants you to login first to comment down on the blog.
Dir scan
Found a register portal.
Web exploitation
After registering myself with test:test i tried exploiting XSS, CMD injection, SQLi but none worked, maybe username parameter is vulnerable.
After login, i can now comment on blog
Yessss, the username parameter was actually vulnerable to XSS.
Registering new user with XSS payload that will give us admin cookie.
We need to steal contents of a file from a server with XSS, upon google searching we can go on following link
Using that we get creds,
Last updated