❯ ffuf -u "http://popcorn.htb" -H "Host: http://FUZZ.popcorn.htb" -w ~/Documents/SecLists/Discovery/DNS/namelist.txt -t 500
/'___\ /'___\ /'___\
/\ \__/ /\ \__/ __ __ /\ \__/
\ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
\ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
\ \_\ \ \_\ \ \____/ \ \_\
\/_/ \/_/ \/___/ \/_/
v2.1.0-dev
________________________________________________
:: Method : GET
:: URL : http://popcorn.htb
:: Wordlist : FUZZ: /Users/aarin/Documents/SecLists/Discovery/DNS/namelist.txt
:: Header : Host: http://FUZZ.popcorn.htb
:: Follow redirects : false
:: Calibration : false
:: Timeout : 10
:: Threads : 500
:: Matcher : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________
aaanalytics [Status: 301, Size: 293, Words: 20, Lines: 10, Duration: 1739ms]
9 [Status: 301, Size: 293, Words: 20, Lines: 10, Duration: 1739ms]
2 [Status: 301, Size: 293, Words: 20, Lines: 10, Duration: 1738ms]
18 [Status: 301, Size: 293, Words: 20, Lines: 10, Duration: 1739ms]
13 [Status: 301, Size: 293, Words: 20, Lines: 10, Duration: 1739ms]
6 [Status: 301, Size: 293, Words: 20, Lines: 10, Duration: 1739ms]
11 [Status: 301, Size: 293, Words: 20, Lines: 10, Duration: 1739ms]
abstracts [Status: 301, Size: 293, Words: 20, Lines: 10, Duration: 1738ms]
aaademo [Status: 301, Size: 293, Words: 20, Lines: 10, Duration: 1738ms]
...
subdomain은 없는거 같음.
❯ ffuf -u "http://popcorn.htb/FUZZ" -w ~/Documents/SecLists/Discovery/Web-Content/common.txt -t 600
/'___\ /'___\ /'___\
/\ \__/ /\ \__/ __ __ /\ \__/
\ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
\ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
\ \_\ \ \_\ \ \____/ \ \_\
\/_/ \/_/ \/___/ \/_/
v2.1.0-dev
________________________________________________
:: Method : GET
:: URL : http://popcorn.htb/FUZZ
:: Wordlist : FUZZ: /Users/aarin/Documents/SecLists/Discovery/Web-Content/common.txt
:: Follow redirects : false
:: Calibration : false
:: Timeout : 10
:: Threads : 600
:: Matcher : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________
.hta [Status: 403, Size: 283, Words: 21, Lines: 11, Duration: 3263ms]
.htaccess [Status: 403, Size: 288, Words: 21, Lines: 11, Duration: 3263ms]
.htpasswd [Status: 403, Size: 288, Words: 21, Lines: 11, Duration: 4297ms]
cgi-bin/ [Status: 403, Size: 287, Words: 21, Lines: 11, Duration: 327ms]
index [Status: 200, Size: 177, Words: 22, Lines: 5, Duration: 415ms]
index.html [Status: 200, Size: 177, Words: 22, Lines: 5, Duration: 414ms]
torrent [Status: 301, Size: 312, Words: 20, Lines: 10, Duration: 282ms]
test [Status: 200, Size: 47410, Words: 2478, Lines: 655, Duration: 302ms]
:: Progress: [4746/4746] :: Job [1/1] :: 128 req/sec :: Duration: [0:00:33] :: Errors: 55 ::
하위 도메인에서 index, index.html, test , torrent가 나왔다. 확인해보니 index, index.html은 popcorn.htb에 접속했을 때의 화면이고 test에 접속했을때에 php 버전이 나왔다.
php 버전은 5버전과 ubuntu6.10을 쓰고 있다.
관련 CVE를 찾아본 결과 ubuntu6 관련된 대부분의 취약점은 BOF였다.
이제 torrent를 확인해보자.
업로드 기능이랑 로그인 기능이 바로 눈에 들어온다. 여길 중점적으로 보도록 하자.
upload 기능을 쓰려면 우선적으로 로그인부터 해야한다.