TheValley

Recon

A simple Rustscan shows us that there are 3 ports open.

We see that port 22 is for SSH, port 80 is for the web server, and port 37378 is for FTP based on the version scan from NMAP:

Trying to connect to the FTP server results in nothing.

So we start looking on the web server.

We run Gobuster, and find the following directories:

all of which we look around but don't notice anything interesting off the bat (using both ZAP and viewing the source code).

However, we find something interesting when we run Gobuster on one directory lower (on the /static directory).

So we go to `/00` and find that it has a note:

so we navigate to the directory /dev1243224123123 and find a login page

and viewing the source page, we see the login username and password in the dev.js script!

Logging in, it says that the credentials are re-used with FTP. So we take the same credentials and use it for FTP:

and we transfer those files to our computer for further analysis.

We open the files in Wireshark. The first file doesn't yield much. Except that we know that there is a directory at:

Looking further at the other PCAP files we filter for HTTP and finally find a login.

and we just re-use these credentials for SSH: