[Web] Starting Point: Fawn
===

[題目連結](https://app.hackthebox.com/starting-point)

# Question
1. What does the 3-letter acronym FTP stand for?
> file transfer protocol
- <font class=red>用於在電腦網路上在客戶端和伺服器之間進行檔案傳輸的應用層協定</font>

2. What communication model does FTP use, architecturally speaking?
> client–server model
- <font class=red>客戶端/伺服器架構。用在2台電腦間上傳/下載檔案，一台當作客戶端，一台作為伺服器</font>

3. What is the name of one popular GUI FTP program?
> filezilla

4. Which port is the FTP service active on usually?
> 21 tcp

5. What acronym is used for the secure version of FTP?
> SFTP
- <font class=red>SSH檔案傳輸協定。提供比FTP更安全的傳輸</font>
- <font class=red>SSH(Secure Shell): 安全外殼協定。可在不安全的網路中提供安全的傳輸，透過建立安全隧道來連接客戶端與伺服器</font>

6. What is the command we can use to test our connection to the target?
> ping

7. From your scans, what version is FTP running on the target?
> vsftpd 3.0.3
- **說明**
> <font class=green>sudo nmap</font> <font class=purple>-sV</font> <font class=black>10.129.42.53</font>
>
> 
- <font class=red>vsftpd: 在Linux上的一種FTP伺服器軟體</font>

8. From your scans, what OS type is running on the target?
> unix

## Submit root flag
- 目標IP: 10.129.204.187

1. 測試連線狀態
> <font class=green>ping</font> <font class=black>10.129.204.187</font>
>
> 

2. 掃描連接埠
> <font class=green>sudo nmap</font> <font class=purple>-sV</font> <font class=black>10.129.204.187</font>
>
> 

3. 掃描到**連接埠21/tcp ftp協定**
> 

4. 利用ftp連線，連線後需要輸入帳號密碼
> <font class=green>ftp</font> <font class=black>10.129.204.187</font>
>
> 

* 帳號密碼錯誤畫面

5. 測試是否配置錯誤，測試常見重要帳號名稱(admin, anonymous, root, etc.)。測試**anonymous**可成功登入。
> 

6. 查看伺服器中的檔案，發現 **flag.txt**
> <font class=black>ls</font>
>
> 

7. 下載 **flag.txt**
> <font class=black>get flag.txt</font>
>
> 

8. 回到本機，查看 **flag.txt** 的內容\
> <font class=green>cat</font> <font class=black>flag.txt</font>
>
> 

9. 取得 flag
> HTB{035db21c881520061c53e0536e44f815}

<style>
.green{
color: green;
font-weight: bold;
}
.black{
color: black;
font-weight: bold;
}
.purple{
color: purple;
font-weight: bold;
}
.red{
color: red;
font-weight: bold;
}
</style>