┌──(mighty㉿kali)-[~] └─$ sudo nmap -n -Pn -sS -p- --min-rate 10000 10.10.11.20 Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-10-21 18:28 CST Nmap scan report for 10.10.11.20 Host is up (0.48s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http
┌──(mighty㉿kali)-[~] └─$ sudo nmap -sV -Pn -A -p22,80 10.10.11.20 PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.7 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 256 0d:ed:b2:9c:e2:53:fb:d4:c8:c1:19:6e:75:80:d8:64 (ECDSA) |_ 256 0f:b9:a7:51:0e:00:d5:7b:5b:7c:5f:bf:2b:ed:53:a0 (ED25519) 80/tcp open http nginx 1.18.0 (Ubuntu) |_http-server-header: nginx/1.18.0 (Ubuntu) |_http-title: Did not follow redirect to http://editorial.htb
dev@editorial:~$ cd /home dev@editorial:/home$ ls dev prod dev@editorial:/home$ ls -liah total 16K 76438 drwxr-xr-x 4 root root 4.0K Jun 5 14:36 . 2 drwxr-xr-x 18 root root 4.0K Jun 5 14:54 .. 79764 drwxr-x--- 4 dev dev 4.0K Oct 22 06:52 dev 77643 drwxr-x--- 5 prod prod 4.0K Jun 5 14:36 prod
dev 用户路径下存在一个 apps 目录，进入该目录，发现这是一个 git 项目文件夹，.git 目录仍然存在
1 2 3 4 5 6 7 8 9 10 11 12 13
dev@editorial:/home$ cd ~ dev@editorial:~$ ls -liah total 36K 79764 drwxr-x--- 4 dev dev 4.0K Oct 22 06:52 . 76438 drwxr-xr-x 4 root root 4.0K Jun 5 14:36 .. 79704 drwxrwxr-x 3 dev dev 4.0K Jun 5 14:36 apps 80303 lrwxrwxrwx 1 root root 9 Feb 6 2023 .bash_history -> /dev/null 80301 -rw-r--r-- 1 dev dev 220 Jan 6 2022 .bash_logout 80256 -rw-r--r-- 1 dev dev 3.7K Jan 6 2022 .bashrc 79703 drwx------ 2 dev dev 4.0K Jun 5 14:36 .cache 187 -rw------- 1 dev dev 20 Oct 22 06:52 .lesshst 80300 -rw-r--r-- 1 dev dev 807 Jan 6 2022 .profile 83829 -rw-r----- 1 root dev 33 Oct 22 04:06 user.txt
说明这个项目之前使用了 Git 进行版本控制。然而，当运行 git status 时，Git 显示了项目中的文件都已被删除。
dev@editorial:~/apps$ ls -liah total 12K 79704 drwxrwxr-x 3 dev dev 4.0K Jun 5 14:36 . 79764 drwxr-x--- 4 dev dev 4.0K Oct 22 06:52 .. 77696 drwxr-xr-x 8 dev dev 4.0K Oct 22 06:49 .git
dev@editorial:~/apps$ git log --oneline 8ad0f31 (HEAD -> master) fix: bugfix in api port endpoint dfef9f2 change: remove debug and update api port b73481b change(api): downgrading prod to dev 1e84a03 feat: create api to editorial info 3251ec9 feat: create editorial app
dev@editorial:~/apps$ git diff 1e84a03 b73481b diff --git a/app_api/app.py b/app_api/app.py index 61b786f..3373b14 100644 --- a/app_api/app.py +++ b/app_api/app.py @@ -64,7 +64,7 @@ def index(): @app.route(api_route + '/authors/message', methods=['GET']) def api_mail_new_authors(): return jsonify({ - 'template_mail_message': "Welcome to the team! We are thrilled to have you on board and can't wait to see the incredible content you'll bring to the table.\n\nYour login credentials for our internal forum and authors site are:\nUsername: prod\nPassword: 080217_Producti0n_2023!@\nPlease be sure to change your password as soon as possible for security purposes.\n\nDon't hesitate to reach out if you have any questions or ideas - we're always here to support you.\n\nBest regards, " + api_editorial_name + " Team." + 'template_mail_message': "Welcome to the team! We are thrilled to have you on board and can't wait to see the incredible content you'll bring to the table.\n\nYour login credentials for our internal forum and authors site are:\nUsername: dev\nPassword: dev080217_devAPI!@\nPlease be sure to change your password as soon as possible for security purposes.\n\nDon't hesitate to reach out if you have any questions or ideas - we're always here to support you.\n\nBest regards, " + api_editorial_name + " Team." }) # TODO: replace dev credentials when checks pass # -------------------------------
