【Hack The Box】Sense - 家studyをつづって

偵察／スキャン

nmapでスキャンした結果、TCP80/443が開いていることがわかりました。

┌──(kali㉿kali)-[~]
└─$ nmap -P0 -sC -sV -A -p- 10.10.10.60 --open 
Starting Nmap 7.92 ( https://nmap.org )
Nmap scan report for 10.10.10.60
Host is up (0.22s latency).
Not shown: 65533 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT    STATE SERVICE  VERSION
80/tcp  open  http     lighttpd 1.4.35
|_http-title: Did not follow redirect to https://10.10.10.60/
|_http-server-header: lighttpd/1.4.35
443/tcp open  ssl/http lighttpd 1.4.35
|_http-title: Login
| ssl-cert: Subject: commonName=Common Name (eg, YOUR name)/organizationName=CompanyName/stateOrProvinceName=Somewhere/countryName=US
| Not valid before: 2017-10-14T19:21:35
|_Not valid after:  2023-04-06T19:21:35
|_ssl-date: TLS randomness does not represent time
|_http-server-header: lighttpd/1.4.35


Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up)

ブラウザでアクセスしてみるとログインページが表示されます。

なお、「pfsense」とはオープンソースのファイアウォールのようです。

www.designet.co.jp

デフォルトのアカウント「admin/pfsense」はログインできませんでした。

dirbでスキャンして検出されたディレクトリからは何も見つけられませんでした。

┌──(kali㉿kali)-[~]
└─$ dirb https://10.10.10.60

-----------------
DIRB v2.22    
By The Dark Raver
-----------------

URL_BASE: https://10.10.10.60/
WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt

-----------------
GENERATED WORDS: 4612                                                          

---- Scanning URL: https://10.10.10.60/ ----
==> DIRECTORY: https://10.10.10.60/classes/                                                                                 
==> DIRECTORY: https://10.10.10.60/css/                                                                                     
+ https://10.10.10.60/favicon.ico (CODE:200|SIZE:1406)                                                                      
==> DIRECTORY: https://10.10.10.60/includes/                                                                                
+ https://10.10.10.60/index.html (CODE:200|SIZE:329)                                                                        
+ https://10.10.10.60/index.php (CODE:200|SIZE:6690)                                                                        
==> DIRECTORY: https://10.10.10.60/installer/                                                                               
==> DIRECTORY: https://10.10.10.60/javascript/                                                                              
==> DIRECTORY: https://10.10.10.60/themes/                                                                                  
==> DIRECTORY: https://10.10.10.60/tree/                                                                                    
==> DIRECTORY: https://10.10.10.60/widgets/                                                                                 
+ https://10.10.10.60/xmlrpc.php (CODE:200|SIZE:384)

gobusterでファイルのスキャンをします。

※-tはThreadsの指定オプション

┌──(kali㉿kali)-[~]
└─$ gobuster dir -k -u https://10.10.10.60/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -s '200,204,301,302,307,403,500' -e -x txt -t 30
===============================================================
Gobuster v3.1.0
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     https://10.10.10.60/
[+] Method:                  GET
[+] Threads:                 30
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.1.0
[+] Extensions:              txt
[+] Expanded:                true
[+] Timeout:                 10s
===============================================================
https://10.10.10.60/themes               (Status: 301) [Size: 0] [--> https://10.10.10.60/themes/]
https://10.10.10.60/css                  (Status: 301) [Size: 0] [--> https://10.10.10.60/css/]   
https://10.10.10.60/includes             (Status: 301) [Size: 0] [--> https://10.10.10.60/includes/]
https://10.10.10.60/javascript           (Status: 301) [Size: 0] [--> https://10.10.10.60/javascript/]
https://10.10.10.60/changelog.txt        (Status: 200) [Size: 271]                                    
https://10.10.10.60/classes              (Status: 301) [Size: 0] [--> https://10.10.10.60/classes/]   
https://10.10.10.60/widgets              (Status: 301) [Size: 0] [--> https://10.10.10.60/widgets/]   
https://10.10.10.60/tree                 (Status: 301) [Size: 0] [--> https://10.10.10.60/tree/]      
https://10.10.10.60/shortcuts            (Status: 301) [Size: 0] [--> https://10.10.10.60/shortcuts/] 
https://10.10.10.60/installer            (Status: 301) [Size: 0] [--> https://10.10.10.60/installer/] 
https://10.10.10.60/wizards              (Status: 301) [Size: 0] [--> https://10.10.10.60/wizards/]   
https://10.10.10.60/csrf                 (Status: 301) [Size: 0] [--> https://10.10.10.60/csrf/]      
https://10.10.10.60/system-users.txt     (Status: 200) [Size: 106]                                    
https://10.10.10.60/filebrowser          (Status: 301) [Size: 0] [--> https://10.10.10.60/filebrowser/]
https://10.10.10.60/%7Echeckout%7E       (Status: 403) [Size: 345]