Machine Download link: https://dockerlabs.es/maquinas/26/descargar

IP ni brauzerga yozib ko’rsam u virtual host ekan

Endi ip ni nmap qilamiz

22/tcp open  ssh     OpenSSH 9.6p1 Ubuntu 3ubuntu13.4 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 59:4e:10:e2:31:bf:13:43:c9:69:9e:4f:3f:a2:95:a6 (ECDSA)
|_  256 fb:dc:ca:6e:f5:d6:5a:41:25:2b:b2:21:f1:71:16:6c (ED25519)
80/tcp open  http    Apache httpd 2.4.58
|_http-server-header: Apache/2.4.58 (Ubuntu)
|_http-title: Did not follow redirect to http://404-not-found.hl/

Endi uni /etc/hosts fayliga qo’shib brauzerni yangilasam sayt ochildi.

endi subdomain larni gobuster bilan fuzz qilib login qiladigan joyni topdim.

sahifaga curl orqali so’rov yuborsam, saytda comment sifatida hint yozib qo’yilgan ekan

<!-- I believe this login works with LDAP -->

hintda bu login ldap orqali ishlaydi deb yozilgan, LDAP search qilib o’rganib chiqaman.

LDAP - bu Lightweight Directory Access Protocol ya’ni agar veb-sayt login qismida foydalanuvchini tekshirish uchun LDAP so'rovlaridan foydalansa, backenddagi standart so'rov odatda quyidagicha ko'rinishda bo'ladi:

(&(uid=USER_INPUT)(userPassword=PASSWORD_INPUT))

https://share.gemini.google/qVCZ0tQjLcVZ

Tizimga shu orqali bypass qildim.