❯ nmap -sV -sC 10.129.231.223
Starting Nmap 7.97 ( https://nmap.org ) at 2025-08-14 17:38 +0900
Nmap scan report for 10.129.240.57
Host is up (0.54s latency).
Not shown: 998 closed tcp ports (conn-refused)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.12 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 3072 97:2a:d2:2c:89:8a:d3:ed:4d:ac:00:d2:1e:87:49:a7 (RSA)
| 256 27:7c:3c:eb:0f:26:e9:62:59:0f:0f:b1:38:c9:ae:2b (ECDSA)
|_ 256 93:88:47:4c:69:af:72:16:09:4c:ba:77:1e:3b:3b:eb (ED25519)
80/tcp open http Apache httpd 2.4.41 ((Ubuntu))
| http-git:
| 10.129.240.57:80/.git/
| Git repository found!
| Repository description: Unnamed repository; edit this file 'description' to name the...
|_ Last commit message: todo: customize url aliases. reference:https://docs.backdro...
|_http-generator: Backdrop CMS 1 (https://backdropcms.org)
| http-robots.txt: 22 disallowed entries (15 shown)
| /core/ /profiles/ /README.md /web.config /admin
| /comment/reply /filter/tips /node/add /search /user/register
|_/user/password /user/login /user/logout /?q=admin /?q=comment/reply
|_http-title: Home | Dog
|_http-server-header: Apache/2.4.41 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 205.94 seconds
nmap결과 10.129.231.223:80/.git/ 경로에 Git repository가 발견되었다고 한다. 확인해보자.
이런 식으로 Directory Indexing이 되는 것을 볼 수 있다.
여기서 index파일을 다운 받아서 한번 보자.
뭐가 엄청 많은데 이중에서 password 의 pass 를 검색했더니
^@^@^@^@^@^@ý^@^@^D^T<84>^@^@<81>í^@^@^@!^@^@^@!^@^@^M^D½&ÁÿXwQºú<93>¯«<98><96>Î~ã^^LØ^@#core/modules/user/user.password.inc^@^@^@^@^@^@^@f¾`X)7<96>>eéó
core/modules/user/user.password.inc 라는 정보를 얻어서 core로 들어가봤다.
그 결과,
