PermX

1. Recon

대상 IP에 대해 포트 스캔을 진행한다.

이때, 22, 80 포트가 오픈되어 있으며 http://permx.htb 도메인으로 리다이렉션이 발생.

❯ nmap -sC -sV -T4 10.129.47.92
Starting Nmap 7.97 ( https://nmap.org ) at 2025-06-14 23:50 +0900
Nmap scan report for 10.129.47.92
Host is up (0.21s latency).
Not shown: 998 closed tcp ports (conn-refused)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.10 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   256 e2:5c:5d:8c:47:3e:d8:72:f7:b4:80:03:49:86:6d:ef (ECDSA)
|_  256 1f:41:02:8e:6b:17:18:9c:a0:ac:54:23:e9:71:30:17 (ED25519)
80/tcp open  http    Apache httpd 2.4.52
|_http-server-header: Apache/2.4.52 (Ubuntu)
|_http-title: Did not follow redirect to http://permx.htb
Service Info: Host: 127.0.1.1; OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 62.36 seconds

❯ curl -I http://permx.htb
HTTP/1.1 200 OK
Date: Sat, 14 Jun 2025 14:54:36 GMT
Server: Apache/2.4.52 (Ubuntu)
Last-Modified: Sat, 20 Jan 2024 14:59:26 GMT
ETag: "8d56-60f61d7bd0f80"
Accept-Ranges: bytes
Content-Length: 36182
Vary: Accept-Encoding
Content-Type: text/html

gobuster를 사용하여 하위 경로 탐색을 진행하였을 때 공격 포인트가 없었다.

2. 서브 도메인 탐색

fuff 툴을 사용하여 서브 도메인이 존재하는지 확인을 진행.

결과 값은 subdomain_fuff_result 파일에 저장하도록 했다.

❯ ffuf -u http://permx.htb -H "Host:FUZZ.permx.htb" -w ~/Documents/SecLists/Discovery/DNS/namelist.txt -t 100 > subdomain_fuff_result

        /'___\  /'___\           /'___\
       /\ \__/ /\ \__/  __  __  /\ \__/
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
         \ \_\   \ \_\  \ \____/  \ \_\
          \/_/    \/_/   \/___/    \/_/

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://permx.htb
 :: Wordlist         : FUZZ: /Users/Documents/SecLists/Discovery/DNS/namelist.txt
 :: Header           : Host: FUZZ.permx.htb
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 100
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________

:: Progress: [150779/150779] :: Job [1/1] :: 479 req/sec :: Duration: [0:12:16] :: Errors: 1800 ::

subdomain_fuff_result 파일 내 grep 명령을 통해 Status: 200값을 갖는 서브 도메인 검색을 진행했다.

그 결과 lms.permx.htb 도메인 정보를 얻을 수 있었다.

❯ cat subdomain_fuff_result | grep "Status\:\ 200"
lms                     [Status: 200, Size: 19347, Words: 4910, Lines: 353, Duration: 259ms]
www                     [Status: 200, Size: 36182, Words: 12829, Lines: 587, Duration: 211ms]