❯ nmap -sVC 10.129.97.127
Starting Nmap 7.95 ( https://nmap.org ) at 2025-06-04 01:24 KST
Nmap scan report for 10.129.97.127
Host is up (0.24s latency).
Not shown: 998 closed tcp ports (reset)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 9.6p1 Ubuntu 3ubuntu13.11 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 62:ff:f6:d4:57:88:05:ad:f4:d3:de:5b:9b:f8:50:f1 (ECDSA)
|_ 256 4c:ce:7d:5c:fb:2d:a0:9e:9f:bd:f5:5c:5e:61:50:8a (ED25519)
80/tcp open http nginx 1.24.0 (Ubuntu)
|_http-server-header: nginx/1.24.0 (Ubuntu)
|_http-title: Did not follow redirect to http://planning.htb/
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 20.54 seconds
일단 열려있는 포트를 확인해보니 80이 열려있다. 브라우저로 접근했더니, planning.htb 라는 도메인이 표시된다. 도메인과 IP 를 /etc/hosts 에서 맞춰주자.
❯ cat /etc/hosts
127.0.0.1 localhost
127.0.1.1 kali
10.129.97.127 planning.htb
/etc/hosts 에서 IP와 도메인 매칭 작업을 하는 이유는?
해당 페이지를 계속 둘러보고 하위 디렉토리 브루트포싱 해봐도 별 도움될 만한 것이 보이지 않는다. 그렇다면 어떤 서브도메인이 있는지 확인해보자.
ffuf 라는 gobuster, dirbuster의 나름 상위급?인 fuzzing 툴이 있어 이를 사용하여 subdomain brute force를 실행했다.
❯ ffuf -u http://planning.htb -H "Host: FUZZ.planning.htb" -w /usr/share/seclists/Discovery/DNS/namelist.txt -fs 178 -t 200
/'___\\ /'___\\ /'___\\
/\\ \\__/ /\\ \\__/ __ __ /\\ \\__/
\\ \\ ,__\\\\ \\ ,__\\/\\ \\/\\ \\ \\ \\ ,__\\
\\ \\ \\_/ \\ \\ \\_/\\ \\ \\_\\ \\ \\ \\ \\_/
\\ \\_\\ \\ \\_\\ \\ \\____/ \\ \\_\\
\\/_/ \\/_/ \\/___/ \\/_/
v2.1.0-dev
________________________________________________
:: Method : GET
:: URL : <http://planning.htb>
:: Wordlist : FUZZ: /usr/share/seclists/Discovery/DNS/namelist.txt
:: Header : Host: FUZZ.planning.htb
:: Follow redirects : false
:: Calibration : false
:: Timeout : 10
:: Threads : 200
:: Matcher : Response status: 200-299,301,302,307,401,403,405,500
:: Filter : Response size: 178
________________________________________________
grafana [Status: 302, Size: 29, Words: 2, Lines: 3, Duration: 237ms]
:: Progress: [151265/151265] :: Job [1/1] :: 850 req/sec :: Duration: [0:03:12] :: Errors: 0 ::