---
# System prepended metadata

title: 'PGP: Detection'

---

# PGP Writeups: Detection

IP Addr: 192.168.154.97

## Pre-attack Prep

![image](https://hackmd.io/_uploads/SJwRFhYq1e.png)

- 3 Folders
    - enum &rarr; for all records we enumerate
    - files &rarr; for any files we find
    - exploits &rarr;  for any exploits we might need

## Initial Scan

`sudo nmap 192.168.154.97 -p- -Pn -A -T4 -oN enum/97-ports.log`

```shell
22/tcp   open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.11 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 62:36:1a:5c:d3:e3:7b:e1:70:f8:a3:b3:1c:4c:24:38 (RSA)
|   256 ee:25:fc:23:66:05:c0:c1:ec:47:c6:bb:00:c7:4f:53 (ECDSA)
|_  256 83:5c:51:ac:32:e5:3a:21:7c:f6:c2:cd:93:68:58:d8 (ED25519)

5000/tcp open  upnp?
| fingerprint-strings: 
|   GetRequest: 
|     HTTP/1.1 200 OK
|     Content-Type: text/html; charset=utf-8
|     Content-Length: 22939
|     Vary: Accept-Encoding, Cookie
|     Set-Cookie: session=eyJjc3JmX3Rva2VuIjoiZWE4MmRlMThiODAwYzU3YTA4NDM0Y2EzNzk4OWFmMTNhNmY4YTFhMSJ9.Z7xBEA.BcKYHheo3y8WjLIxIEQ7QFuH-T4; HttpOnly; Path=/
|     Date: Mon, 24 Feb 2025 09:51:12 GMT
|     Connection: close
|     <!DOCTYPE html>
|     <html lang="en" data-darkmode="false">
|     <head>
|     <meta charset="utf-8" >
|     <meta name="viewport" content="width=device-width, initial-scale=1.0" >
|     <meta name="description" content="Self hosted website change detection." >
|     <title>Change Detection</title>
|     <link rel="alternate" type="application/rss+xml" title="Changedetection.io 
|     Feed" href="/rss?tag=&amp;token=766c79a538cb617cfcf10f946ff18b94" >
|     <link rel="stylesheet" href="/static/styles/pure-min.css" >
|     <link rel="stylesheet" href="/static/styles/styles.css" >
|     <link rel=
|   RTSPRequest: 
|     <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"
|     "http://www.w3.org/TR/html4/strict.dtd">
|     <html>
|     <head>
|     <meta http-equiv="Content-Type" content="text/html;charset=utf-8">
|     <title>Error response</title>
|     </head>
|     <body>
|     <h1>Error response</h1>
|     <p>Error code: 400</p>
|     <p>Message: Bad request version ('RTSP/1.0').</p>
|     <p>Error code explanation: HTTPStatus.BAD_REQUEST - Bad request syntax or unsupported method.</p>
|     </body>
|_    </html>

Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
```

It appears that we have a webserver running on port 5000

![image](https://hackmd.io/_uploads/B1NVrTtckx.png)

## Webserver

`gobuster dir -u http://192.168.154.97:5000 -w /usr/share/dirb/wordlists/common.txt`

![image](https://hackmd.io/_uploads/BJXZ8aY9ke.png)

### Manual Enumeration

#### Main Page

ChangeDetection.io v0.45.1

#### /backup

Downloads a file to our machine
![image](https://hackmd.io/_uploads/HktwL6Kcyg.png)

#### /import
![image](https://hackmd.io/_uploads/SJAF8atq1x.png)

#### /login
![image](https://hackmd.io/_uploads/rJA4vaY9kl.png)

#### /settings
- We find some interesting things here

API Key &rarr; f7fb037bd530a6579c7a42df63fdd25a

![image](https://hackmd.io/_uploads/B1auD6K9Jg.png)

## Enumeration

![image](https://hackmd.io/_uploads/BJGou6Kc1g.png)
- we find an exploit to do with this service

![image](https://hackmd.io/_uploads/r1Ya_pYcJx.png)

## Exploitation

![image](https://hackmd.io/_uploads/rJesFTYqJl.png)
- we have a few modules missing


Enable virtual environment and install
![image](https://hackmd.io/_uploads/B1Tv9pFcke.png)

![image](https://hackmd.io/_uploads/H1k9cTY9kx.png)

![image](https://hackmd.io/_uploads/HyA55TYckx.png)

Give the necessary arguments
![image](https://hackmd.io/_uploads/ByggIiat51e.png)

Note the new entry at bottom of table
![image](https://hackmd.io/_uploads/S1OPiaY5ke.png)

Click edit, and look in notification body
![image](https://hackmd.io/_uploads/rJByhaY9yx.png)
![image](https://hackmd.io/_uploads/Hy7xhpY91g.png)

Click save
![image](https://hackmd.io/_uploads/rkxWnTtcke.png)

We have root!
![image](https://hackmd.io/_uploads/ryMfnTtq1l.png)
![image](https://hackmd.io/_uploads/SJ_BhpK51e.png)

