Gloin - 5huckle/OFFICIALTECHJOURNAL GitHub Wiki

Recon Stage

Information about target

  • IP: 10.0.5.31

image

  • Website: https://10.0.5.31. Uses https instead of http
    • I discovered this using a simple nmap scan of open ports and service info
      • nmap -A -sV -oG openportsgloin.txt --open 10.0.5.31
  • Some hidden directories

image

  • Operating System: Win64? Apache server however it says win64

image

  • A juicy page

image

Gaining a foothold

  • Attempting to use SQLi on the entrance page gave me access to the login successful page

image image

  • Hash of password

image

  • SSH to login using the credentials

Traversing the System

Luckily, I did not need to elevate to root.