<aside> <img src="notion://custom_emoji/11d15c1f-58bd-81a5-831c-000330f98665/3a615c1f-58bd-80f0-bab5-007a09fd9475" alt="notion://custom_emoji/11d15c1f-58bd-81a5-831c-000330f98665/3a615c1f-58bd-80f0-bab5-007a09fd9475" width="40px" />

IP:172.17.0.2

</aside>

IP ni aniq endi Nmap orqali ochiq portlarni ko’ramiz .

image.png

22/tcp   open  ssh     OpenSSH 8.4p1 Debian 5+deb11u4 (protocol 2.0)
| ssh-hostkey: 
|   3072 20:ab:09:61:00:7b:cc:18:48:8e:bf:8d:3d:e4:cd:b5 (RSA)
|   256 42:0c:71:44:7c:13:ba:8f:b7:82:35:f2:b3:f7:b9:ff (ECDSA)
|_  256 85:95:6c:96:ac:a1:f0:3e:1e:0d:c1:c8:b0:6f:bb:1d (ED25519)
5000/tcp open  http    Werkzeug httpd 1.0.1 (Python 3.9.2)
|_http-server-header: Werkzeug/1.0.1 Python/3.9.2
|_http-title: Site doesn't have a title (application/json).

image.png

5000 portda REST API — ilova endpoint kiritilmaganini aytmoqda. Yangi user yaratib ko’ramiz .

image.png

Malumotlar topildi.

image.png

[
  [
    1, 
    "pingu", 
    "your_password"
  ], 
  [
    2, 
    "pingu", 
    "pinguinasio"

Rasmda biz boya yaratgan user ham bor va boshqa tizimni user ham bor ekan . Endi shu login va parol bilan SSH orqali kirib ko’raman .

image.png

Tizimning /home katalogida network.pcap fayl bor ekan uni tizimni o’zida tcpdump yordamida ichini ko’rsam root ning paroli joylashgan ekan .

image.png

08:45:18.935987 IP (tos 0x0, ttl 64, id 1, offset 0, flags [none], proto TCP (6), length 51)
    47da4ccf6c65.20 > 47da4ccf6c65.2222: Flags [S], cksum 0x6152 (correct), seq 0:11, win 8192, length 11
E..3....@.".....................P. .aR..LOGIN root

08:45:18.936203 IP (tos 0x0, ttl 64, id 1, offset 0, flags [none], proto TCP (6), length 54)
    47da4ccf6c65.20 > 47da4ccf6c65.2222: Flags [S], cksum 0xbf9f (correct), seq 0:14, win 8192, length 14
E..6....@.".....................P. .....PASS balulero

Topildi. Root ning paroli balulero .

image.png