---
# System prepended metadata

title: Devguru

---

# Devguru

## Reconnaissance 

> nmap -p- -A <ip>
    
```
 Starting Nmap 7.92 ( https://nmap.org ) at 2022-12-15 09:38 EST
mass_dns: warning: Unable to determine any DNS servers. Reverse DNS is disabled. Try using --system-dns or specify valid servers with --dns-servers
Stats: 0:01:07 elapsed; 0 hosts completed (1 up), 1 undergoing Service Scan
Service scan Timing: About 66.67% done; ETC: 09:39 (0:00:33 remaining)
Nmap scan report for 192.168.56.109
Host is up (0.00016s latency).
Not shown: 65532 closed tcp ports (conn-refused)
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 7.6p1 Ubuntu 4 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 2a:46:e8:2b:01:ff:57:58:7a:5f:25:a4:d6:f2:89:8e (RSA)
|   256 08:79:93:9c:e3:b4:a4:be:80:ad:61:9d:d3:88:d2:84 (ECDSA)
|_  256 9c:f9:88:d4:33:77:06:4e:d9:7c:39:17:3e:07:9c:bd (ED25519)
80/tcp   open  http    Apache httpd 2.4.29 ((Ubuntu))
|_http-title: Corp - DevGuru
|_http-generator: DevGuru
| http-git: 
|   192.168.56.109:80/.git/
|     Git repository found!
|     Repository description: Unnamed repository; edit this file 'description' to name the...
|     Last commit message: first commit 
|     Remotes:
|       http://devguru.local:8585/frank/devguru-website.git
|_    Project type: PHP application (guessed from .gitignore)
|_http-server-header: Apache/2.4.29 (Ubuntu)
8585/tcp open  unknown
| fingerprint-strings: 
|   GenericLines: 
|     HTTP/1.1 400 Bad Request
|     Content-Type: text/plain; charset=utf-8
|     Connection: close
|     Request
|   GetRequest: 
|     HTTP/1.0 200 OK
|     Content-Type: text/html; charset=UTF-8
|     Set-Cookie: lang=en-US; Path=/; Max-Age=2147483647
|     Set-Cookie: i_like_gitea=bde7638a350e94a9; Path=/; HttpOnly
|     Set-Cookie: _csrf=7ay93MhApuMqP1k6OLxZzZybac86MTY3MTExODY5NDU5MjU0MDQ3MA; Path=/; Expires=Fri, 16 Dec 2022 15:38:14 GMT; HttpOnly
|     X-Frame-Options: SAMEORIGIN
|     Date: Thu, 15 Dec 2022 15:38:14 GMT
```

### Ports ouverts 
    
20, 80, 8585
    
## .git Port 80 
    
> http://devguru.local:8585/frank/devguru-website.git
    
export git : 

```
bash gitdumper.sh http://192.168.1.3/.git/ ../../Bureau/devguru/    
```
    
Construction du repo : 
```
bash extractor.sh ../../Bureau/devguru/.git ../../Bureau/devguru/git    
```

![](https://i.imgur.com/joYpCkI.png)

    
recherche dans le repo: 
    - adminer.php (config bdd)
    - conf/database.php ()
    
    
![](https://i.imgur.com/1cpg9Ar.png)

    
mot de passe october:SQ66EBYx4GT3byXH
    
Un utilisateur dans la bdd (table backend_user) : 
![](https://i.imgur.com/ndBqo42.png)

    
![](https://i.imgur.com/cQICyI9.png)
    
On change le password avec le mot qu'on veut et on chiffre avec bcrypt. 

On trouve dans le code source un site à l'URL : http://192.168.56.109/backend on l'on va pouvoir se co avec les creds trouvés précédemment : 
    
![](https://i.imgur.com/Mwb95o0.png)

On est sur la version 1.0.1 du CMS october.

    
    