Hi, within this next year, we're going to analyze the map, scan results, and we're going to try
and find a vulnerable service so that we can go into and hack this machine.
Right.
So here you go.
We have the 10 or 214 over here.
So we have many of the ports closed, but we have the 80 ports open.
So this is a Web server, obviously it in the Apache.
And of course, we're going to take a look at that as a normal human being.
Right.
We're going to write the IP address in our Mozilla and we can just see what it has inside of the Apache
server.
So it has the title of Vibranium Market.
I believe this has to do something with the movie itself or the Black Panther itself.
So over here we have the RPG buying service and we have some kind of like two and four, maybe just
kind of the version numbers.
And it's actually worth a shot to search for these exploits for the RPG by maybe it has to do something
with that, but we don't know it.
So let me just open a new tab over here and just search for it.
I'm going to search it, OK?
I'm going to use search it and I'm going to search everything regarding to our PC byte.
Here you go.
We have the exploit titles over here, but as you can see, it doesn't look promising.
It's all regarding to dos or denial-of-service dos, OK, rather than the Edo's its DOS.
And I don't think it's going to help us in this case.
Right.
So it's all dos.
So what happens if we just deny the service out of here?
Nothing.
Right.
So I'm going to just ignore that for a while.
I believe this is our PC binde will not be effective in order to gain access.
Maybe we can use it later.
OK, so great.
And as you can see, there is nothing regarding to like there's nothing helpful regarding to this aversion
numbers over here as well.
There are a lot of things going on in the PC bind, but I don't think it's going to help us at all.
So we're going to focus on the Port 80.
But right now, let me just see if we have something funny over here.
As you can see, we have DSH, but it resides on the report, Turkey, Turkey, Turkey, Turkey.
And it's it's a little bit weird.
OK, so, you know, the SFH port is 22 generally.
So maybe there is something wrong over there.
Maybe it's not a safe service or something like that.
We can always try to go into that server with SSA as a route if they don't have some kind of like a
password or we can just use Anonymous as a password or we can use a password or admin as a password,
try to make our way into that and see.
Maybe it will work, maybe it won't.
But it's worth a shot.
Right.
We we know that there is an SSA service on this part.
So maybe you can just come over here and try that in the other terminal as well.
If it doesn't work, it's obviously going to be some kind of Web servers or penetration testing.
But again, it's worth a shot.
So let me come over here and try that.
So I'm going to say it's this a true route into Tunnel 214 and for the port, I'm just going to say,
Treacher, to try and say yes.
And here you go.
It asks for a password.
So we definitely need a password.
So you can try anonymous, you can try password, you can try Wakanda or vibranium, I don't know.
But as you can see, the anonymous didn't work and the other ones, I believe, won't work as well.
So it's not that easy in this case.
So, again, we are not going to have a luck with this SSA thingy.
Of course, we can try brute forcing it, but since we have the other services, I believe we better
focus on that.
Right now we have the RBC, but again, we have looked at the IRP, see, and it's not going to do much
in this case.
So over here, we know that the target machine is Linux, which is very good.
And here you go.
I believe that's it.
So that leaves us with the Port 80.
So we're going to have to focus on the website of the things and we're going to do some web penetration
tests.
Right.
So we don't have anything over here like kernel thingy, like a colonel exploit something like that,
even that we had.
It would be helpful in the privileged escalation site rather than.
Gaining access sight.
So here you go.
We have this hat tricks that X, Y, Z, and I'm going to show you what this this is a book, OK, Hektor,
that X, Y, Z.
And I believe it's Buchdahl tactics that X, Y, Z.
So Carlos, pull up.
So some guy has written this as a guitar book and it's fantastic because it has I believe this guy was
prepping for the Okposo.
He took a lot of nice notes over here and he made it into a book.
So I actually overview or I actually read this book or just try to scan the related parts when I do
my penetration tests or when I do my seats.
OK.
So, for example, if I want to take a look at the privilege escalation that I can come over here and
I can see all the related commands, all the related different kind of methods over there.
So it helped me a lot.
So I'm just going to make you sure that you get this link in the resources of this lecture as well.
But if you don't get it, just go for book that Hedrick's, that X, Y, Z, and I actually will use
this in this lecture as well.
OK, so that's why I brought it up.
So far so good.
So these are helpful resources and I'm going to share some more resources at the end of this course
as well.
So let's go into 10 to 14.
Here you go.
This is our Web site.
As you can see that we bring you Murcutt and coming soon.
So we have the title.
We have kind of a menu over here, but it doesn't do anything it says that made by Mamadu.
And so here you go.
We don't have anything at all, I believe, in this website.
So we only have this made by Mamadu.
So it can be a hint.
OK, these are important things, especially in the seats.
It can be a hint, it can be a user, it can be the administrator user or something like that.
So it's worth taking a note over there.
So made by Mamadu.
And let me just try to go over here and inspect this element or just view the page source and see if
we had something hidden in the HTML code.
Let me zoom in a little bit.
And here you go, we have the HDMI code, we have the characters that we have the title, and we have
nothing fancy going on over here, I believe, right?
We have the bootstraps.
Yes.
So it's all related to success.
And we have a class we have another Heather over here.
This is just the things that make up this Heather over here.
And this is the way Britney marketed title, as you can see.
And we have all a main roll over here is kind of an inner cover.
So it says on coming soon.
And over here we have a comment.
So if you see this thing over here like this syntax in the HTML, it means that it's a comment.
It's not the actual code.
It's not going to get executed or it's not going to get interpreted by our browser.
But the developer has written this for some reason, like for writing clean code or maybe giving some
message, something like that.
And you can see a lot of hints in the CVS, even the Web penetration tests like in the form of comments.
So here we have something like that.
So now link active.
So this is a navigation link supposably.
And we have the aircraft, which is the link itself over here, and it's related to home.
So it's related to this button.
But rather than the rather then the link over here, we only have a hash tag, which is nothing, which
just makes us redirect to the page itself.
But at the bottom of this, OK, in the next slide we have another A.F., which is kind of weird because
it's been commented out.
And as you can see at the at Mamadu, we have this graph here as well and here as well.
So not no link works over here, actually right there, all hash tags, which doesn't which doesn't
do anything.
But in this case, we have an interest.
But it's commented out and the aircraft, the link itself, the questionmark language f r so I believe
this is an opportunity for us to test something.
So as you can see, this is a parameter.
Most probably it's going to change the language into French and it's worth a shot.
So I'm going to copy this and just delete this and pasted over here and hit enter.
And as you can see, our language has been changed to French.
Indeed.
And even though it didn't, it won't matter if you try with other languages like English, Turkish or
something like Italian.
It doesn't work.
It only works in French.
And so if you just try with the questionmark itself, nothing happens.
But this gives us an opportunity, because once you see something like that, like that, it takes in
a parameter and it can be some kind of vulnerability.
And I don't know about you, but when I see something like this, first thing came to my mind is the
directory traversal, which is a vulnerability that we leverage file inclusion vulnerabilities in order
to see the files that we are not allowed to see in that server.
So all you have to do is just write that data, dash that that slash that that slash and write the file
that you want to see like etsi password, for example.
And if you haven't heard about this vulnerability before, please just take a look at our complete web
penetration testing codes are complete at collecting cores because we do a lot of things over there
and as you can see, didn't work.
We didn't get any response in the HTML or in the browser over here, but it doesn't mean that it doesn't
have this kind of vulnerability because we don't know the depth yet.
So we don't know how many things that we should put over here.
Like maybe we should put eight of the dot dot slash things.
So we're going to have to try and see.
And this is not the only way to look for the directory traversal.
For example, we have dot, dot, lb.
So this is a tool that comes with colonics and it's a directory traversal foser.
OK, you can just give the URL that you want to test you and it can test it for you to see if it has
any kind of directory traversal vulnerabilities and it can just give you the kind of way to exploit
it as well.
Again, using some kind of manual, this kind of automated tools can lead to some false things as well.
So I'm just going to try and be manual over here, but you can try that upon yourselves as well.
So as you can see, we cannot find it with six deaths or any other deaths over here.
So what I'm going to do, I'm going to show you the pattern reversal portion of this book, that electric,
that X, Y, Z, because there are tons of ways to try and see if there is a director to of vulnerability
in a Web website.
OK, so you have to see it for yourself.
So if you scroll down a little bit, you can see it just starts with the exactly the same thing that
we have started.
And it just very it like it has a lot of variations over here, like we have to try this.
Of course, we started with this, OK, so we started with the dot dot slash XY password and it just
converts it with some kind of other representation of the slashes.
Maybe we can try this, OK, and we're not even sure how many datasets that we should use in this case,
but again, it doesn't work.
So you're going to have to try a lot of these things over here, OK?
And I tried and tried and tried until I found the solution when I solved the CTF, I believe, a couple
of years ago.
And it turns out that we have some kind of parameter tingay going on over here.
I'm going to show you where it resides.
So let me find the thing over there.
So, yep, that's it.
So wrappers, as you can see, it starts with the IP itself.
So filter read string and it just encodes it with Base64 or Arati Tartine like we have seen before.
Right.
Independent CTS.
And it just takes in a resource.
So maybe we can try those things, filter things.
So I'm going to take and see if this works.
I'm going to copy this and I'm going to come back to our Brayne market over there.
I'm going to delete everything over here and just paste the thing over there and say enter.
So now it's it tries to read the ROTC.
It tries to just read the index that BHP by using the raw 13 encryption over here.
So we are seeing the index BHB, but we're not getting, I believe, anything else, like we're not
getting a funny thing over there.
So let me try with this one.
OK, so base64 encoding, I'm going to come over here and just zoom in a little bit so that you can
see it in a better way, what I'm doing.
So rather than taking the whole link, I'm just taking over here.
OK, so it starts with the B column slash slash and I'm pasting over here after the language parameter.
If I hit enter, nothing happens.
Let me just go to the source and see if this works or not.
So what we have here, maybe we can have to try with this one as well, so this is basically the same
thing, but it alters the BHP upper case, lower case.
So maybe it's being blocked by some kind of firewall.
It can bypass that kind of thing.
And we don't get anything back here at all.
And as you can see, we're trying new stuff and we're not getting anything different back now.
It doesn't mean, again, it doesn't have director traversal vulnerability.
Rather, it means that we're going to have to change something over there.
So as you can see, it starts with the it's fine and it's filtering something.
It's converting it to base64, which is good.
But over here we have the index BHB.
So rather than index BHP freeride on the index, we get the message.
So that's weird.
We get something like that.
So we don't know what it is yet.
So I'm just going to leave the page source.
Yeah, we have the HDMI code one more time, but we have a new line over here which breaks.
Teach them a code so we cannot see the website properly.
It looks like it's base64 because we're we were doing it with base64.
So I'm just going to search for Base64 Decode, OK?
I'm just going to do this offline, online rather than using an offline tool within Karley because it's
much more easier this way.
I'm just going to say decode and here you go.
Apparently we have actually found a new thing like a like a new IP command or new thing over here.
And here you go.
We have a new password.
So this password can be a password for anything.
I don't know yet, but we're going to try and see it right like that right here.
OK, so naeemi forever two two seven.
So maybe this is related with movie again.
I don't know it so I'm just going to copy it and take enough note of it because it actually includes
some exclamation points.
We're definitely going to forget about it if we don't take a note of it later on.
So I'm going to just narrow into my notes that text.
OK, so I'm going to go to the bottom of this page.
I'm just going to pasted over here.
So this is a password and we don't know where to use it yet.
But of course, this is a very good lead that will lead us to something.
Definitely.
And here you go.
Let me just close this down and this one as well.
Let me try to go to the regular Web page over here.
Let me just delete everything over there, OK?
And let me try to find if there is an admin page over here, like maybe this password just for admins
and maybe we can search for the robots, not robots.
That should have been the first thing that we have looked into over here.
But I forgot about it, so I don't think anything else is there.
So maybe we can have to go back to our map and get the note that you see over here.
Remember, we had this SNH tingay over here and we can try to look into it.
Maybe we can try to login with that password.
Right.
So let me try and log in as a root over here and copy that.
I don't think it's going to work because it shouldn't be that easy.
Right.
The root password just put it over the Internet.
And as you can see, it doesn't work.
But maybe we can use another user over here.
And remember, we have seen that user.
Maybe it's a user we don't know yet.
Maybe it was a hint.
Maybe it was some kind of false alarm or something like that.
But we know that our Bradley Market Web site has been made by Mamadu.
Right.
So, Mamadu, over here.
So it is there is a great possibility that the user in the server as well.
So I'm going to try that and I'm going to try and see if Mamadu has chosen this Niimi forever.
So let me just try this, Mamadu, and just paste the selection over there and let's see if we can log
in.
Nope, it doesn't work.
Let me try and let me copy and paste one more time to make sure.
Come over here, let me just see if this works or not, and here you go.
We managed to go into the server.
Finally we found our way into the server.
We managed to use DSH and that's it.
So we managed to log into the server.
Now we are done with the website as well.
We're going to see what we can do over here in the next lecture.