Possibly Related Threads…

UnkownWombat · (This post was last modified: 07-27-2024, 07:16 PM by UnkownWombat.)

Let's get started and see what we can do Cool

Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-07-27 12:03 PDT
Nmap scan report for 10.10.11.26
Host is up (0.10s latency).
Not shown: 998 filtered tcp ports (no-response)
PORT    STATE SERVICE VERSION
3000/tcp open  ppp?
| fingerprint-strings: 
|  GenericLines, Help, RTSPRequest: 
|    HTTP/1.1 400 Bad Request
|    Content-Type: text/plain; charset=utf-8
|    Connection: close
|    Request
|  GetRequest: 
|    HTTP/1.0 200 OK
|    Cache-Control: max-age=0, private, must-revalidate, no-transform
|    Content-Type: text/html; charset=utf-8
|    Set-Cookie: i_like_gitea=34d97fb1a9a4c356; Path=/; HttpOnly; SameSite=Lax
|    Set-Cookie: _csrf=KEvmcd1uiJa_zZlFvjDSIdJlwEA6MTcyMjEwNzAyNDkwNTkwNTgwMA; Path=/; Max-Age=86400; HttpOnly; SameSite=Lax
|    X-Frame-Options: SAMEORIGIN
|    Date: Sat, 27 Jul 2024 19:03:44 GMT
|    <!DOCTYPE html>
|    <html lang="en-US" class="theme-arc-green">
|    <head>
|    <meta name="viewport" content="width=device-width, initial-scale=1">
|    <title>Git</title>
|    <link rel="manifest" href="data:application/json;base64,eyJuYW1lIjoiR2l0Iiwic2hvcnRfbmFtZSI6IkdpdCIsInN0YXJ0X3VybCI6Imh0dHA6Ly9naXRlYS5jb21waWxlZC5odGI6MzAwMC8iLCJpY29ucyI6W3sic3JjIjoiaHR0cDovL2dpdGVhLmNvbXBpbGVkLmh0YjozMDAwL2Fzc2V0cy9pbWcvbG9nby5wbmciLCJ0eXBlIjoiaW1hZ2UvcG5nIiwic2l6ZXMiOiI1MTJ4NTEyIn0seyJzcmMiOiJodHRwOi8vZ2l0ZWEuY29tcGlsZWQuaHRiOjMwMDA
|  HTTPOptions: 
|    HTTP/1.0 405 Method Not Allowed
|    Allow: HEAD
|    Allow: GET
|    Cache-Control: max-age=0, private, must-revalidate, no-transform
|    Set-Cookie: i_like_gitea=70af98ddb794e60c; Path=/; HttpOnly; SameSite=Lax
|    Set-Cookie: _csrf=yXzApN3JK6a_43t9UgY2MexBGbI6MTcyMjEwNzAzMDQ5NDg3MDUwMA; Path=/; Max-Age=86400; HttpOnly; SameSite=Lax
|    X-Frame-Options: SAMEORIGIN
|    Date: Sat, 27 Jul 2024 19:03:50 GMT
|_    Content-Length: 0
5000/tcp open  upnp?
| fingerprint-strings: 
|  GetRequest: 
|    HTTP/1.1 200 OK
|    Server: Werkzeug/3.0.3 Python/3.12.3
|    Date: Sat, 27 Jul 2024 19:03:44 GMT
|    Content-Type: text/html; charset=utf-8
|    Content-Length: 5234
|    Connection: close
|    <!DOCTYPE html>
|    <html lang="en">
|    <head>
|    <meta charset="UTF-8">
|    <meta name="viewport" content="width=device-width, initial-scale=1.0">
|    <title>Compiled - Code Compiling Services</title>
|    <!-- Bootstrap CSS -->
|    <link rel="stylesheet" href="https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/css/bootstrap.min.css">
|    <!-- Custom CSS -->
|    <style>
|    your custom CSS here */
|    body {
|    font-family: 'Ubuntu Mono', monospace;
|    background-color: #272822;
|    color: #ddd;
|    .jumbotron {
|    background-color: #1e1e1e;
|    color: #fff;
|    padding: 100px 20px;
|    margin-bottom: 0;
|    .services {
|  RTSPRequest: 
|    <!DOCTYPE HTML>
|    <html lang="en">
|    <head>
|    <meta charset="utf-8">
|    <title>Error response</title>
|    </head>
|    <body>
|    <h1>Error response</h1>
|    <p>Error code: 400</p>
|    <p>Message: Bad request version ('RTSP/1.0').</p>
|    <p>Error code explanation: 400 - Bad request syntax or unsupported method.</p>
|    </body>
|_    </html>
2 services unrecognized despite returning data. If you know the service/version, please submit the following fingerprints at https://nmap.org/cgi-bin/submit.cgi?new-service :
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port3000-TCP:V=7.94SVN%I=7%D=7/27%Time=66A54490%P=aarch64-unknown-linux
SF:-gnu%r(GenericLines,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-T
SF:ype:\x20text/plain;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400
SF:\x20Bad\x20Request")%r(GetRequest,3000,"HTTP/1\.0\x20200\x20OK\r\nCache
SF:-Control:\x20max-age=0,\x20private,\x20must-revalidate,\x20no-transform
SF:\r\nContent-Type:\x20text/html;\x20charset=utf-8\r\nSet-Cookie:\x20i_li
SF:ke_gitea=34d97fb1a9a4c356;\x20Path=/;\x20HttpOnly;\x20SameSite=Lax\r\nS
SF:et-Cookie:\x20_csrf=KEvmcd1uiJa_zZlFvjDSIdJlwEA6MTcyMjEwNzAyNDkwNTkwNTg
SF:wMA;\x20Path=/;\x20Max-Age=86400;\x20HttpOnly;\x20SameSite=Lax\r\nX-Fra
SF:me-Options:\x20SAMEORIGIN\r\nDate:\x20Sat,\x2027\x20Jul\x202024\x2019:0
SF:3:44\x20GMT\r\n\r\n<!DOCTYPE\x20html>\n<html\x20lang=\"en-US\"\x20class
SF:=\"theme-arc-green\">\n<head>\n\t<meta\x20name=\"viewport\"\x20content=
SF:\"width=device-width,\x20initial-scale=1\">\n\t<title>Git</title>\n\t<l
SF:ink\x20rel=\"manifest\"\x20href=\"data:application/json;base64,eyJuYW1l
SF:IjoiR2l0Iiwic2hvcnRfbmFtZSI6IkdpdCIsInN0YXJ0X3VybCI6Imh0dHA6Ly9naXRlYS5
SF:jb21waWxlZC5odGI6MzAwMC8iLCJpY29ucyI6W3sic3JjIjoiaHR0cDovL2dpdGVhLmNvbX
SF:BpbGVkLmh0YjozMDAwL2Fzc2V0cy9pbWcvbG9nby5wbmciLCJ0eXBlIjoiaW1hZ2UvcG5nI
SF:iwic2l6ZXMiOiI1MTJ4NTEyIn0seyJzcmMiOiJodHRwOi8vZ2l0ZWEuY29tcGlsZWQuaHRi
SF:OjMwMDA")%r(Help,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type
SF::\x20text/plain;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x2
SF:0Bad\x20Request")%r(HTTPOptions,197,"HTTP/1\.0\x20405\x20Method\x20Not\
SF:x20Allowed\r\nAllow:\x20HEAD\r\nAllow:\x20GET\r\nCache-Control:\x20max-
SF:age=0,\x20private,\x20must-revalidate,\x20no-transform\r\nSet-Cookie:\x
SF:20i_like_gitea=70af98ddb794e60c;\x20Path=/;\x20HttpOnly;\x20SameSite=La
SF:x\r\nSet-Cookie:\x20_csrf=yXzApN3JK6a_43t9UgY2MexBGbI6MTcyMjEwNzAzMDQ5N
SF:Dg3MDUwMA;\x20Path=/;\x20Max-Age=86400;\x20HttpOnly;\x20SameSite=Lax\r\
SF:nX-Frame-Options:\x20SAMEORIGIN\r\nDate:\x20Sat,\x2027\x20Jul\x202024\x
SF:2019:03:50\x20GMT\r\nContent-Length:\x200\r\n\r\n")%r(RTSPRequest,67,"H
SF:TTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20text/plain;\x20ch
SF:arset=utf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\x20Request");
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port5000-TCP:V=7.94SVN%I=7%D=7/27%Time=66A54490%P=aarch64-unknown-linux
SF:-gnu%r(GetRequest,1521,"HTTP/1\.1\x20200\x20OK\r\nServer:\x20Werkzeug/3
SF:\.0\.3\x20Python/3\.12\.3\r\nDate:\x20Sat,\x2027\x20Jul\x202024\x2019:0
SF:3:44\x20GMT\r\nContent-Type:\x20text/html;\x20charset=utf-8\r\nContent-
SF:Length:\x205234\r\nConnection:\x20close\r\n\r\n<!DOCTYPE\x20html>\n<htm
SF:l\x20lang=\"en\">\n<head>\n\x20\x20\x20\x20<meta\x20charset=\"UTF-8\">\
SF:n\x20\x20\x20\x20<meta\x20name=\"viewport\"\x20content=\"width=device-w
SF:idth,\x20initial-scale=1\.0\">\n\x20\x20\x20\x20<title>Compiled\x20-\x2
SF:0Code\x20Compiling\x20Services</title>\n\x20\x20\x20\x20<!--\x20Bootstr
SF:ap\x20CSS\x20-->\n\x20\x20\x20\x20<link\x20rel=\"stylesheet\"\x20href=\
SF:"https://stackpath\.bootstrapcdn\.com/bootstrap/4\.5\.2/css/bootstrap\.
SF:min\.css\">\n\x20\x20\x20\x20<!--\x20Custom\x20CSS\x20-->\n\x20\x20\x20
SF:\x20<style>\n\x20\x20\x20\x20\x20\x20\x20\x20/\*\x20Add\x20your\x20cust
SF:om\x20CSS\x20here\x20\*/\n\x20\x20\x20\x20\x20\x20\x20\x20body\x20{\n\x
SF:20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20font-family:\x20'Ubuntu\x
SF:20Mono',\x20monospace;\n\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x2
SF:0background-color:\x20#272822;\n\x20\x20\x20\x20\x20\x20\x20\x20\x20\x2
SF:0\x20\x20color:\x20#ddd;\n\x20\x20\x20\x20\x20\x20\x20\x20}\n\x20\x20\x
SF:20\x20\x20\x20\x20\x20\.jumbotron\x20{\n\x20\x20\x20\x20\x20\x20\x20\x2
SF:0\x20\x20\x20\x20background-color:\x20#1e1e1e;\n\x20\x20\x20\x20\x20\x2
SF:0\x20\x20\x20\x20\x20\x20color:\x20#fff;\n\x20\x20\x20\x20\x20\x20\x20\
SF:x20\x20\x20\x20\x20padding:\x20100px\x2020px;\n\x20\x20\x20\x20\x20\x20
SF:\x20\x20\x20\x20\x20\x20margin-bottom:\x200;\n\x20\x20\x20\x20\x20\x20\
SF:x20\x20}\n\x20\x20\x20\x20\x20\x20\x20\x20\.services\x20{\n\x20")%r(RTS
SF:PRequest,16C,"<!DOCTYPE\x20HTML>\n<html\x20lang=\"en\">\n\x20\x20\x20\x
SF:20<head>\n\x20\x20\x20\x20\x20\x20\x20\x20<meta\x20charset=\"utf-8\">\n
SF:\x20\x20\x20\x20\x20\x20\x20\x20<title>Error\x20response</title>\n\x20\
SF:x20\x20\x20</head>\n\x20\x20\x20\x20<body>\n\x20\x20\x20\x20\x20\x20\x2
SF:0\x20<h1>Error\x20response</h1>\n\x20\x20\x20\x20\x20\x20\x20\x20<p>Err
SF:or\x20code:\x20400</p>\n\x20\x20\x20\x20\x20\x20\x20\x20<p>Message:\x20
SF:Bad\x20request\x20version\x20\('RTSP/1\.0'\)\.</p>\n\x20\x20\x20\x20\x2
SF:0\x20\x20\x20<p>Error\x20code\x20explanation:\x20400\x20-\x20Bad\x20req
SF:uest\x20syntax\x20or\x20unsupported\x20method\.</p>\n\x20\x20\x20\x20</
SF:body>\n</html>\n");

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 112.20 seconds

(07-27-2024, 07:07 PM)UnkownWombat Wrote: Let's get started and see what we can do

Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-07-27 12:03 PDT Nmap scan report for 10.10.11.26 Host is up (0.10s latency). Not shown: 998 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 3000/tcp open ppp? | fingerprint-strings: | GenericLines, Help, RTSPRequest: | HTTP/1.1 400 Bad Request | Content-Type: text/plain; charset=utf-8 | Connection: close | Request | GetRequest: | HTTP/1.0 200 OK | Cache-Control: max-age=0, private, must-revalidate, no-transform | Content-Type: text/html; charset=utf-8 | Set-Cookie: i_like_gitea=34d97fb1a9a4c356; Path=/; HttpOnly; SameSite=Lax | Set-Cookie: _csrf=KEvmcd1uiJa_zZlFvjDSIdJlwEA6MTcyMjEwNzAyNDkwNTkwNTgwMA; Path=/; Max-Age=86400; HttpOnly; SameSite=Lax | X-Frame-Options: SAMEORIGIN | Date: Sat, 27 Jul 2024 19:03:44 GMT | <!DOCTYPE html> | <html lang="en-US" class="theme-arc-green"> | <head> | <meta name="viewport" content="width=device-width, initial-scale=1"> | <title>Git</title> | <link rel="manifest" href="data:application/json;base64,eyJuYW1lIjoiR2l0Iiwic2hvcnRfbmFtZSI6IkdpdCIsInN0YXJ0X3VybCI6Imh0dHA6Ly9naXRlYS5jb21waWxlZC5odGI6MzAwMC8iLCJpY29ucyI6W3sic3JjIjoiaHR0cDovL2dpdGVhLmNvbXBpbGVkLmh0YjozMDAwL2Fzc2V0cy9pbWcvbG9nby5wbmciLCJ0eXBlIjoiaW1hZ2UvcG5nIiwic2l6ZXMiOiI1MTJ4NTEyIn0seyJzcmMiOiJodHRwOi8vZ2l0ZWEuY29tcGlsZWQuaHRiOjMwMDA | HTTPOptions: | HTTP/1.0 405 Method Not Allowed | Allow: HEAD | Allow: GET | Cache-Control: max-age=0, private, must-revalidate, no-transform | Set-Cookie: i_like_gitea=70af98ddb794e60c; Path=/; HttpOnly; SameSite=Lax | Set-Cookie: _csrf=yXzApN3JK6a_43t9UgY2MexBGbI6MTcyMjEwNzAzMDQ5NDg3MDUwMA; Path=/; Max-Age=86400; HttpOnly; SameSite=Lax | X-Frame-Options: SAMEORIGIN | Date: Sat, 27 Jul 2024 19:03:50 GMT |_ Content-Length: 0 5000/tcp open upnp? | fingerprint-strings: | GetRequest: | HTTP/1.1 200 OK | Server: Werkzeug/3.0.3 Python/3.12.3 | Date: Sat, 27 Jul 2024 19:03:44 GMT | Content-Type: text/html; charset=utf-8 | Content-Length: 5234 | Connection: close | <!DOCTYPE html> | <html lang="en"> | <head> | <meta charset="UTF-8"> | <meta name="viewport" content="width=device-width, initial-scale=1.0"> | <title>Compiled - Code Compiling Services</title> |  | <link rel="stylesheet" href="https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/css/bootstrap.min.css"> |  | <style> | your custom CSS here */ | body { | font-family: 'Ubuntu Mono', monospace; | background-color: #272822; | color: #ddd; | .jumbotron { | background-color: #1e1e1e; | color: #fff; | padding: 100px 20px; | margin-bottom: 0; | .services { | RTSPRequest: | <!DOCTYPE HTML> | <html lang="en"> | <head> | <meta charset="utf-8"> | <title>Error response</title> | </head> | <body> | <h1>Error response</h1> | <p>Error code: 400</p> | <p>Message: Bad request version ('RTSP/1.0').</p> | <p>Error code explanation: 400 - Bad request syntax or unsupported method.</p> | </body> |_ </html> 2 services unrecognized despite returning data. If you know the service/version, please submit the following fingerprints at https://nmap.org/cgi-bin/submit.cgi?new-service : ==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)============== SF-Port3000-TCP:V=7.94SVN%I=7%D=7/27%Time=66A54490%P=aarch64-unknown-linux SF:-gnu%r(GenericLines,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-T SF:ype:\x20text/plain;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400 SF:\x20Bad\x20Request")%r(GetRequest,3000,"HTTP/1\.0\x20200\x20OK\r\nCache SF:-Control:\x20max-age=0,\x20private,\x20must-revalidate,\x20no-transform SF:\r\nContent-Type:\x20text/html;\x20charset=utf-8\r\nSet-Cookie:\x20i_li SF:ke_gitea=34d97fb1a9a4c356;\x20Path=/;\x20HttpOnly;\x20SameSite=Lax\r\nS SF:et-Cookie:\x20_csrf=KEvmcd1uiJa_zZlFvjDSIdJlwEA6MTcyMjEwNzAyNDkwNTkwNTg SF:wMA;\x20Path=/;\x20Max-Age=86400;\x20HttpOnly;\x20SameSite=Lax\r\nX-Fra SF:me-Options:\x20SAMEORIGIN\r\nDate:\x20Sat,\x2027\x20Jul\x202024\x2019:0 SF:3:44\x20GMT\r\n\r\n<!DOCTYPE\x20html>\n<html\x20lang=\"en-US\"\x20class SF:=\"theme-arc-green\">\n<head>\n\t<meta\x20name=\"viewport\"\x20content= SF:\"width=device-width,\x20initial-scale=1\">\n\t<title>Git</title>\n\t<l SF:ink\x20rel=\"manifest\"\x20href=\"data:application/json;base64,eyJuYW1l SF:IjoiR2l0Iiwic2hvcnRfbmFtZSI6IkdpdCIsInN0YXJ0X3VybCI6Imh0dHA6Ly9naXRlYS5 SF:jb21waWxlZC5odGI6MzAwMC8iLCJpY29ucyI6W3sic3JjIjoiaHR0cDovL2dpdGVhLmNvbX SF:BpbGVkLmh0YjozMDAwL2Fzc2V0cy9pbWcvbG9nby5wbmciLCJ0eXBlIjoiaW1hZ2UvcG5nI SF:iwic2l6ZXMiOiI1MTJ4NTEyIn0seyJzcmMiOiJodHRwOi8vZ2l0ZWEuY29tcGlsZWQuaHRi SF:OjMwMDA")%r(Help,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type SF::\x20text/plain;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x2 SF:0Bad\x20Request")%r(HTTPOptions,197,"HTTP/1\.0\x20405\x20Method\x20Not\ SF:x20Allowed\r\nAllow:\x20HEAD\r\nAllow:\x20GET\r\nCache-Control:\x20max- SF:age=0,\x20private,\x20must-revalidate,\x20no-transform\r\nSet-Cookie:\x SF:20i_like_gitea=70af98ddb794e60c;\x20Path=/;\x20HttpOnly;\x20SameSite=La SF:x\r\nSet-Cookie:\x20_csrf=yXzApN3JK6a_43t9UgY2MexBGbI6MTcyMjEwNzAzMDQ5N SF:Dg3MDUwMA;\x20Path=/;\x20Max-Age=86400;\x20HttpOnly;\x20SameSite=Lax\r\ SF:nX-Frame-Options:\x20SAMEORIGIN\r\nDate:\x20Sat,\x2027\x20Jul\x202024\x SF:2019:03:50\x20GMT\r\nContent-Length:\x200\r\n\r\n")%r(RTSPRequest,67,"H SF:TTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20text/plain;\x20ch SF:arset=utf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\x20Request"); ==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)============== SF-Port5000-TCP:V=7.94SVN%I=7%D=7/27%Time=66A54490%P=aarch64-unknown-linux SF:-gnu%r(GetRequest,1521,"HTTP/1\.1\x20200\x20OK\r\nServer:\x20Werkzeug/3 SF:\.0\.3\x20Python/3\.12\.3\r\nDate:\x20Sat,\x2027\x20Jul\x202024\x2019:0 SF:3:44\x20GMT\r\nContent-Type:\x20text/html;\x20charset=utf-8\r\nContent- SF:Length:\x205234\r\nConnection:\x20close\r\n\r\n<!DOCTYPE\x20html>\n<htm SF:l\x20lang=\"en\">\n<head>\n\x20\x20\x20\x20<meta\x20charset=\"UTF-8\">\ SF:n\x20\x20\x20\x20<meta\x20name=\"viewport\"\x20content=\"width=device-w SF:idth,\x20initial-scale=1\.0\">\n\x20\x20\x20\x20<title>Compiled\x20-\x2 SF:0Code\x20Compiling\x20Services</title>\n\x20\x20\x20\x20\n\x20\x20\x20\x20<link\x20rel=\"stylesheet\"\x20href=\ SF:"https://stackpath\.bootstrapcdn\.com/bootstrap/4\.5\.2/css/bootstrap\. SF:min\.css\">\n\x20\x20\x20\x20\n\x20\x20\x20 SF:\x20<style>\n\x20\x20\x20\x20\x20\x20\x20\x20/\*\x20Add\x20your\x20cust SF:om\x20CSS\x20here\x20\*/\n\x20\x20\x20\x20\x20\x20\x20\x20body\x20{\n\x SF:20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20font-family:\x20'Ubuntu\x SF:20Mono',\x20monospace;\n\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x2 SF:0background-color:\x20#272822;\n\x20\x20\x20\x20\x20\x20\x20\x20\x20\x2 SF:0\x20\x20color:\x20#ddd;\n\x20\x20\x20\x20\x20\x20\x20\x20}\n\x20\x20\x SF:20\x20\x20\x20\x20\x20\.jumbotron\x20{\n\x20\x20\x20\x20\x20\x20\x20\x2 SF:0\x20\x20\x20\x20background-color:\x20#1e1e1e;\n\x20\x20\x20\x20\x20\x2 SF:0\x20\x20\x20\x20\x20\x20color:\x20#fff;\n\x20\x20\x20\x20\x20\x20\x20\ SF:x20\x20\x20\x20\x20padding:\x20100px\x2020px;\n\x20\x20\x20\x20\x20\x20 SF:\x20\x20\x20\x20\x20\x20margin-bottom:\x200;\n\x20\x20\x20\x20\x20\x20\ SF:x20\x20}\n\x20\x20\x20\x20\x20\x20\x20\x20\.services\x20{\n\x20")%r(RTS SF:PRequest,16C,"<!DOCTYPE\x20HTML>\n<html\x20lang=\"en\">\n\x20\x20\x20\x SF:20<head>\n\x20\x20\x20\x20\x20\x20\x20\x20<meta\x20charset=\"utf-8\">\n SF:\x20\x20\x20\x20\x20\x20\x20\x20<title>Error\x20response</title>\n\x20\ SF:x20\x20\x20</head>\n\x20\x20\x20\x20<body>\n\x20\x20\x20\x20\x20\x20\x2 SF:0\x20<h1>Error\x20response</h1>\n\x20\x20\x20\x20\x20\x20\x20\x20<p>Err SF:or\x20code:\x20400</p>\n\x20\x20\x20\x20\x20\x20\x20\x20<p>Message:\x20 SF:Bad\x20request\x20version\x20\('RTSP/1\.0'\)\.</p>\n\x20\x20\x20\x20\x2 SF:0\x20\x20\x20<p>Error\x20code\x20explanation:\x20400\x20-\x20Bad\x20req SF:uest\x20syntax\x20or\x20unsupported\x20method\.</p>\n\x20\x20\x20\x20</ SF:body>\n</html>\n"); Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 112.20 seconds

200      GET      12l      73w      704c http://compiled.htb:3000/api/swagger
200      GET      312l      934w    11383c http://compiled.htb:3000/user/sign_up
200      GET      311l      926w    11113c http://compiled.htb:3000/user/login
200      GET      378l    1782w    18671c http://compiled.htb:3000/explore/repos
200      GET      275l    1255w    13906c http://compiled.htb:3000/
401      GET        1l        1w      50c http://compiled.htb:3000/v2

wtfduw · 07-27-2024, 07:18 PM

I believe we should create a repo on http://IP:3000 and paste the git link to http://IP:5000 to clone an compile the code and start a listener. Tried that tho but didn't get a callback. Tried C# revshell script from revshells.com

UnkownWombat · 07-27-2024, 07:33 PM

That's tempting. I tried with .cpp and didn't get anything back. This API may be of interest:

http://compiled.htb:3000/api/swagger#/admin

There are lots listed on /api/swagger

wtfduw · 07-27-2024, 07:35 PM

(07-27-2024, 07:33 PM)UnkownWombat Wrote: That's tempting. I tried with .cpp and didn't get anything back. This API may be of interest:

http://compiled.htb:3000/api/swagger#/admin

There are lots listed on /api/swagger

Actually there are existing repos for a user named Richard with the source of the compiler. Checking it now.

UnkownWombat · (This post was last modified: 07-27-2024, 07:43 PM by UnkownWombat.)

(07-27-2024, 07:35 PM)wtfduw Wrote:
(07-27-2024, 07:33 PM)UnkownWombat Wrote: That's tempting. I tried with .cpp and didn't get anything back. This API may be of interest:

http://compiled.htb:3000/api/swagger#/admin

There are lots listed on /api/swagger

Actually there are existing repos for a user named Richard with the source of the compiler. Checking it now.

Yep, seems creator of the box took someone's calculator app and then there is compiler source as you said. No really interesting git history as far as I can tell.

from flask import Flask, request, render_template, redirect, url_for
import os

app = Flask(__name__)

# Configuration
REPO_FILE_PATH = r'C:\Users\Richard\source\repos\repos.txt'

@app.route('/', methods=['GET', 'POST'])
def index():
    error = None
    success = None
    if request.method == 'POST':
        repo_url = request.form['repo_url']
        if # Add a sanitization to check for valid Git repository URLs.
            with open(REPO_FILE_PATH, 'a') as f:
                f.write(repo_url + '\n')
            success = 'Your git repository is being cloned for compilation.'
        else:
            error = 'Invalid Git repository URL. It must start with "http://" and end with ".git".'
    return render_template('index.html', error=error, success=success)

if __name__ == '__main__':
    app.run(host='0.0.0.0', port=5000)

wtfduw · 07-27-2024, 07:45 PM

(07-27-2024, 07:38 PM)UnkownWombat Wrote:
(07-27-2024, 07:35 PM)wtfduw Wrote:
(07-27-2024, 07:33 PM)UnkownWombat Wrote: That's tempting. I tried with .cpp and didn't get anything back. This API may be of interest:

http://compiled.htb:3000/api/swagger#/admin

There are lots listed on /api/swagger

Actually there are existing repos for a user named Richard with the source of the compiler. Checking it now.

Yep, seems creator of the box took someone's calculator app and then there is compiler source as you said. No really interesting git history as far as I can tell.

from flask import Flask, request, render_template, redirect, url_for import os app = Flask(__name__) # Configuration REPO_FILE_PATH = r'C:\Users\Richard\source\repos\repos.txt' @app.route('/', methods=['GET', 'POST']) def index(): error = None success = None if request.method == 'POST': repo_url = request.form['repo_url'] if # Add a sanitization to check for valid Git repository URLs. with open(REPO_FILE_PATH, 'a') as f: f.write(repo_url + '\n') success = 'Your git repository is being cloned for compilation.' else: error = 'Invalid Git repository URL. It must start with "http://" and end with ".git".' return render_template('index.html', error=error, success=success) if __name__ == '__main__': app.run(host='0.0.0.0', port=5000)

Ype thought of tampering with the URL, but with the filters + We dont know what's happening with repos.txt, can't really think of something

UnkownWombat · (This post was last modified: 07-27-2024, 08:00 PM by UnkownWombat.)

(07-27-2024, 07:45 PM)wtfduw Wrote:
(07-27-2024, 07:38 PM)UnkownWombat Wrote:
(07-27-2024, 07:35 PM)wtfduw Wrote:
(07-27-2024, 07:33 PM)UnkownWombat Wrote: That's tempting. I tried with .cpp and didn't get anything back. This API may be of interest:

http://compiled.htb:3000/api/swagger#/admin

There are lots listed on /api/swagger

Actually there are existing repos for a user named Richard with the source of the compiler. Checking it now.

Yep, seems creator of the box took someone's calculator app and then there is compiler source as you said. No really interesting git history as far as I can tell.

from flask import Flask, request, render_template, redirect, url_for import os app = Flask(__name__) # Configuration REPO_FILE_PATH = r'C:\Users\Richard\source\repos\repos.txt' @app.route('/', methods=['GET', 'POST']) def index(): error = None success = None if request.method == 'POST': repo_url = request.form['repo_url'] if # Add a sanitization to check for valid Git repository URLs. with open(REPO_FILE_PATH, 'a') as f: f.write(repo_url + '\n') success = 'Your git repository is being cloned for compilation.' else: error = 'Invalid Git repository URL. It must start with "http://" and end with ".git".' return render_template('index.html', error=error, success=success) if __name__ == '__main__': app.run(host='0.0.0.0', port=5000)

Ype thought of tampering with the URL, but with the filters + We dont know what's happening with repos.txt, can't really think of something

Same problem here atm. Was thinking path traversal or some form of RCE but also struggling rn.

Might be: https://github.com/amalmurali47/git_rce

Sqweez · 07-27-2024, 08:00 PM

you can listen using responder and place like http://<ip>/asd.git and get the NTLM hash from COMPILED/Richard, But hash password isnt in rockyou

wtfduw · 07-27-2024, 08:58 PM

Any luck? I got nothing yet

UnkownWombat · 07-27-2024, 09:05 PM

(07-27-2024, 08:58 PM)wtfduw Wrote: Any luck? I got nothing yet

No not yet ;/ i spent a ton of time trying to get the git rce to work but i cant seem to get it working

Possibly Related Threads…
Thread		Author	Replies	Views	Last Post
	[FREE] 300+ Writeups PDF HackTheBox/HTB premium retired	Tamarisk	360	90,850	03-28-2026, 09:28 AM Last Post: catsweet
	[FREE] HTB-ProLabs APTLABS Just Flags	kewlsunny	23	4,317	03-28-2026, 03:30 AM Last Post: lulaladrow
	[MEGALEAK] HackTheBox ProLabs, Fortress, Endgame - Alchemy, 250 Flags, leak htb-bot	htb-bot	87	9,480	03-27-2026, 07:22 PM Last Post: stn
	HTB Eloquia User and Root Flags - Insane Box	69646B	13	2,303	03-27-2026, 06:14 PM Last Post: vlxw
	HTB - ALL Challenges you Stuck in	osamy7593	2	2,601	03-27-2026, 04:24 PM Last Post: catsweet