【Hack The Box】BoardLight

偵察／スキャン

nmapでスキャンします。

-p-でスキャンし、確認できたTCP/22およびTCP/80に詳細なスキャンを行います。

┌──(kali㉿kali)-[~/htb/boardlight]
└─$ nmap -sC -sV -A -O -p22,80 10.10.11.11                                                                                                                 
Starting Nmap 7.94SVN ( https://nmap.org )
Nmap scan report for board.htb (10.10.11.11)
Host is up (0.20s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.11 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 06:2d:3b:85:10:59:ff:73:66:27:7f:0e:ae:03:ea:f4 (RSA)
|   256 59:03:dc:52:87:3a:35:99:34:44:74:33:78:31:35:fb (ECDSA)
|_  256 ab:13:38:e4:3e:e0:24:b4:69:38:a9:63:82:38:dd:f4 (ED25519)
80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
|_http-title: Site doesn't have a title (text/html; charset=UTF-8).
|_http-server-header: Apache/2.4.41 (Ubuntu)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Aggressive OS guesses: Linux 5.0 (97%), Linux 4.15 - 5.8 (96%), Linux 5.3 - 5.4 (95%), Linux 2.6.32 (95%), Linux 5.0 - 5.5 (95%), Linux 3.1 (95%), Linux 3.2 (95%), AXIS 210A or 211 Network Camera (Linux 2.6.17) (95%), ASUS RT-N56U WAP (Linux 3.4) (93%), Linux 3.16 (93%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using port 22/tcp)
HOP RTT       ADDRESS
1   199.38 ms 10.10.14.1
2   205.19 ms board.htb (10.10.11.11)

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .

TCP/80の調査

サイト内にドメインが記載されています。/etc/hostsにboard.htbを登録します。

ページ内のボタンは機能していないようでした。

ディレクトリの列挙では「crm.board.htb」が見つかります。

┌──(kali㉿kali)-[~/htb/boardlight]
└─$ gobuster vhost -u http://board.htb --domain board.htb --append-domain -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-110000.txt
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:             http://board.htb
[+] Method:          GET
[+] Threads:         10
[+] Wordlist:        /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-110000.txt
[+] User Agent:      gobuster/3.6
[+] Timeout:         10s
[+] Append Domain:   true
===============================================================
Starting gobuster in VHOST enumeration mode
===============================================================
Found: crm.board.htb Status: 200 [Size: 6360]
Progress: 114441 / 114442 (100.00%)
===============================================================
Finished
===============================================================

crm.borad.htbを開くと、Dolibarrログインページが表示されます。