As always, we start with the enumeration phase, in which we try to scan the machine looking for open ports and finding out services and versions of those opened ports.
The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:
-sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.
--min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.
-p- scanning the entire port range, from 1 to 65535.
-T5insane mode, it is the fastest mode of the nmap time template.
-Pn assume the host is online.
-n scan without reverse DNS resolution.
-oNsave the scan result into a file, in this case the allports file.
Starting Nmap 7.93 ( https://nmap.org ) at 2022-11-21 18:47 CET
Nmap scan report for 10.10.10.91
Host is up (0.058s latency).
Not shown: 65533 closed tcp ports (reset)
PORT STATE SERVICE
22/tcp open ssh
5000/tcp open upnp
Nmap done: 1 IP address (1 host up) scanned in 14.02 seconds
Now that we know which ports are open, let's try to obtain the services and versions running on these ports. The following command will scan these ports more in depth and save the result into a file:
nmap -sC -sV -p22,5000 10.10.10.91 -oN targeted
-sC performs the scan using the default set of scripts.
-sV enables version detection.
-oNsave the scan result into file, in this case the targeted file.
Starting Nmap 7.93 ( https://nmap.org ) at 2022-11-21 18:49 CET
Nmap scan report for 10.10.10.91
Host is up (0.045s latency).
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.4 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 4290e335318d8b86172afb3890dac495 (RSA)
| 256 b7b6dcc44c879b752a008983edb28031 (ECDSA)
|_ 256 d52f1953b28e3a4bb3dd3c1fc0370d00 (ED25519)
5000/tcp open http Gunicorn 19.7.1
|_http-title: Site doesn't have a title (text/html; charset=utf-8).
|_http-server-header: gunicorn/19.7.1
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 11.76 seconds
Website on port 5000 shows an Under construction! page.
Let's try to see if there are any subdirectories or hidden files.
The file was uploaded successfully. As the values of the attributes are shown in the page, we could try to exploit an XXE to get an LFI. The following code will create an XML Entity which will load the /etc/passwd file, then show the content in the Author attribute.
