Eventually I decided that my payload didn’t seem to be being run. I started with a Bash script that would call a reverse shell, then an ELF from msfvenom, a Python script, etc. I spent a while trying to upload files to the site in the hopes that they might be run. Gobuster didn’t return anything other than /images and /service (which is the upload form above). When I hit “Analyze!”, the page doesn’t refresh, but a message shows up below the button: I can enter an email and clicking sample brings up the file selector. The site is VirusBucket, what appears to be a VirusTotal knock-off:Īll of the links point to this homepage, except for Service, which presents an upload form: The HTTP server on 8080 is Apache Tomcat version 9.0.27. Nmap done: 1 IP address (1 host up) scanned in 7.33 secondsīased on the OpenSSH version, the host is likely running Ubuntu Focal 20.04. Service Info: OS: Linux CPE: cpe:/o:linux:linux_kernel Nmap done: 1 IP address (1 host up) scanned in 8.63 nmap -p 22,8080 -sC -sV 10.10.10.205Ģ2/tcp open ssh OpenSSH 8.2p1 Ubuntu 4 (Ubuntu Linux protocol 2.0)
0 kommentar(er)
