Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-05-29 06:14 EDT
Nmap scan report for 192.168.195.147
Host is up (0.00054s latency).
PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 3.0.3
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_-r-xr-xr-x 1 1000 1000 297 Feb 07 2021 chadinfo
| ftp-syst:
| STAT:
| FTP server status:
| Connected to ::ffff:192.168.195.128
| Logged in as ftp
| TYPE: ASCII
| No session bandwidth limit
| Session timeout in seconds is 300
| Control connection is plain text
| Data connections will be plain text
| At session startup, client count was 2
| vsFTPd 3.0.3 - secure, fast, stable
|_End of status
22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey:
| 2048 6a:fe:d6:17:23:cb:90:79:2b:b1:2d:37:53:97:46:58 (RSA)
| 256 5b:c4:68:d1:89:59:d7:48:b0:96:f3:11:87:1c:08:ac (ECDSA)
|_ 256 61:39:66:88:1d:8f:f1:d0:40:61:1e:99:c5:1a:1f:f4 (ED25519)
80/tcp open http Apache httpd 2.4.38 ((Debian))
|_http-server-header: Apache/2.4.38 (Debian)
|_http-title: Site doesn't have a title (text/html).
| http-robots.txt: 1 disallowed entry
|_/kingchad.html
MAC Address: 00:0C:29:77:A6:7A (VMware)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.8
Network Distance: 1 hop
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
TRACEROUTE
HOP RTT ADDRESS
1 0.54 ms 192.168.195.147
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 9.30 seconds
Puerto 80
Si inspeccionamos la pagina, veremos lo siguiente...
Using default input encoding: UTF-8
Loaded 2 password hashes with no different salts (Raw-SHA1 [SHA1 128/128 SSE2 4x])
Warning: no OpenMP support for this hash type, consider --fork=2
Press 'q' or Ctrl-C to abort, almost any other key for status
fuck you (?)
VIRGIN (?)
2g 0:00:00:00 DONE (2024-05-29 06:19) 100.0g/s 2568Kp/s 2568Kc/s 2915KC/s Willie..Trevor
Use the "--show --format=Raw-SHA1" options to display all of the cracked passwords reliably
Session completed.
No vemos que ponga nada interesante...
ftp
ftpanonymous@<IP>
getchadinfo
Dentro de ese archivo veremos lo siguiente...
PK
0
HRοΏ½οΏ½βΖchadinfoUT οΏ½j `Zj `ux
why yes,
#######################
username is chad
???????????????????????
password?
!!!!!!!!!!!!!!!!!!!!!!!
go to /drippinchad.png
PK
0
HRοΏ½οΏ½βΖβοΏ½οΏ½chadinfoUTοΏ½j `ux
PKNοΏ½
Si no sabemos que archivo es, hacemos lo siguiente...
filechadinfo
Info:
chadinfo: Zip archive data, at least v1.0 to extract, compression method=store
Vemos que es un .zip por lo que haremos lo siguiente...
mvchadinfochadinfo.zip
unzipchadinfo.zip
Nos extrae un archivo que si lo leemos, veremos lo siguiente...
why yes,
#######################
username is chad
???????????????????????
password?
!!!!!!!!!!!!!!!!!!!!!!!
go to /drippinchad.png
Nos da un usuario llamado chad y la password nos da una pista de que tenemos que ir a ese directorio /drippinchad.png...
URL = http://<IP>/drippinchad.png
Dentro vemos una imagen solamente, si buscamos por imagen en Google encontramos que la torre se llama Torre de la doncella que en ingles seria Maiden's Tower y lo transformamos en una posible contraseΓ±a maidenstower...
