【TryHackMe】Probe：Walkthrough

# 概要

TryHackMe「Probe」のWalkthroughです。

https://tryhackme.com/r/room/probe

# Task1

## **Q1**.*What is the version of the Apache server?*

`nmap`でポートスキャンを実行します。

```
$ nmap -Pn -sC -A -T4 -sV -p- 10.10.204.48
PORT      STATE    SERVICE                 VERSION
22/tcp    open     ssh                     OpenSSH 8.2p1 Ubuntu 4ubuntu0.7 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 fc:24:1e:72:bb:59:c6:da:0a:be:1e:45:ab:2e:3f:e4 (RSA)
|   256 98:a6:b2:82:44:25:12:a8:97:a5:5a:24:32:a8:22:1d (ECDSA)
|_  256 93:dc:e8:46:91:f9:29:f7:67:f0:04:bf:0a:02:4e:f8 (ED25519)
80/tcp    open     http                    lighttpd 1.4.55
|_http-server-header: lighttpd/1.4.55
|_http-title: 403 Forbidden
443/tcp   open     ssl/http                Apache httpd 2.4.41
| ssl-cert: Subject: commonName=dev.probe.thm/organizationName=Tester/stateOrProvinceName=Some-State/countryName=US
| Not valid before: 2023-07-18T10:57:05
|_Not valid after:  2024-07-17T10:57:05
|_ssl-date: TLS randomness does not represent time
|_http-title: 403 Forbidden
|_http-server-header: Apache/2.4.41 (Ubuntu)
| tls-alpn: 
|_  http/1.1
1338/tcp  open     ftp                     vsftpd 2.0.8 or later
1443/tcp  open     ssl/http                Apache httpd 2.4.41 ((Ubuntu))
|_ssl-date: TLS randomness does not represent time
|_http-title: PHP 7.4.3-4ubuntu2.19 - phpinfo()
| tls-alpn: 
|_  http/1.1
|_http-server-header: Apache/2.4.41 (Ubuntu)
| ssl-cert: Subject: commonName=dev.probe.thm/organizationName=Tester/stateOrProvinceName=Some-State/countryName=US
| Not valid before: 2023-07-18T10:57:05
|_Not valid after:  2024-07-17T10:57:05
1883/tcp  open     mosquitto version 1.6.9
| mqtt-subscribe: 
|   Topics and their most recent payloads: 
|     $SYS/broker/heap/maximum: 52808
|     $SYS/broker/load/bytes/sent/15min: 0.27
|     $SYS/broker/uptime: 1936 seconds
|     $SYS/broker/bytes/sent: 4
|     $SYS/broker/load/messages/sent/15min: 0.07
|     $SYS/broker/load/sockets/15min: 0.11
|     $SYS/broker/messages/sent: 1
|     $SYS/broker/load/connections/15min: 0.07
|     $SYS/broker/load/connections/5min: 0.20
|     $SYS/broker/load/messages/received/5min: 0.20
|     $SYS/broker/bytes/received: 18
|     $SYS/broker/load/messages/received/1min: 0.53
|     $SYS/broker/load/messages/received/15min: 0.07
|     $SYS/broker/version: mosquitto version 1.6.9
|     $SYS/broker/load/sockets/5min: 0.24
|     $SYS/broker/load/messages/sent/1min: 0.53
|     $SYS/broker/load/messages/sent/5min: 0.20
|     $SYS/broker/load/bytes/sent/5min: 0.70
|     $SYS/broker/load/bytes/received/1min: 9.49
|     $SYS/broker/store/messages/bytes: 181
|     $SYS/broker/messages/received: 1
|     $SYS/broker/load/sockets/1min: 0.53
|     $SYS/broker/load/connections/1min: 0.53
|     $SYS/broker/load/bytes/received/5min: 3.17
|     $SYS/broker/load/bytes/sent/1min: 2.11
|_    $SYS/broker/load/bytes/received/15min: 1.15
8000/tcp  open     http                    Apache httpd 2.4.41 ((Ubuntu))
|_http-title: Site doesn't have a title (text/html; charset=UTF-8).
|_http-open-proxy: Proxy might be redirecting requests
|_http-server-header: Apache/2.4.41 (Ubuntu)
9007/tcp  open     http                    Apache httpd 2.4.41
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: 400 Bad Request
27361/tcp filtered unknown
Service Info: Hosts: ip-10-10-204-48.eu-west-1.compute.internal, myblog.thm; OS: Linux; CPE: cpe:/o:linux:linux_kernel
```

Apacheのバージョンがわかりました。

```
443/tcp  open  ssl/http Apache httpd 2.4.41
|_ssl-date: TLS randomness does not represent time
| tls-alpn: 
|_  http/1.1
|_http-title: 403 Forbidden
|_http-server-header: Apache/2.4.41 (Ubuntu)
| ssl-cert: Subject: commonName=dev.probe.thm/organizationName=Tester/stateOrProvinceName=Some-State/countryName=US
| Not valid before: 2023-07-18T10:57:05
|_Not valid after:  2024-07-17T10:57:05
```

**A**.**2.4.41**

## **Q2**.*What is the port number of the FTP service?*

FTPのポートとバージョンがわかりました。

```
1338/tcp  open     ftp                     vsftpd 2.0.8 or later
```

**A**.**1338**

## **Q3**.*What is the FQDN for the website hosted using a self-signed certificate and contains critical server information as the homepage?*

ポートスキャンの結果から`commonName`がわかりました。

```
443/tcp  open  ssl/http Apache httpd 2.4.41
|_ssl-date: TLS randomness does not represent time
| tls-alpn: 
|_  http/1.1
|_http-title: 403 Forbidden
|_http-server-header: Apache/2.4.41 (Ubuntu)
| ssl-cert: Subject: commonName=dev.probe.thm/organizationName=Tester/stateOrProvinceName=Some-State/countryName=US
| Not valid before: 2023-07-18T10:57:05
|_Not valid after:  2024-07-17T10:57:05
```

**A**.**dev.probe.thm**

## **Q4**.*What is the email address associated with the SSL certificate used to sign the website mentioned in Q3?*

`1443`ポートにアクセスし、証明書の内容を確認することでEmailアドレスがわかりました。

![ssl cert email.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/4eb34a3f-ed39-36f6-d459-4630e4454788.png)

**A**.**probe@&#xFFF0;probe.thm**

## **Q5**.*What is the value of the PHP Extension Build on the server?*

`1443`ポートへアクセスすると`phpinfo()`の内容が表示されるので確認します。

![q5.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/cc4ac1d3-d5bb-2861-5c3b-fcc4e3b39638.png)

**A**.**API20190902,NTS**

## **Q6**.*What is the banner for the FTP service?*

`ftpコマンド`で`1338`ポートへ接続するとバナーが表示されました。

```
$ ftp -P 1338 10.10.204.48
Connected to 10.10.204.48.
220 THM{WELCOME_101113}
```

**A**.**THM{WELCOME_101113}**

## **Q7**.*What software is used for managing the database on the server?*

`nikto`でアプリケーションをスキャンすると`/phpmyadmin`を発見しました。

```
$ nikto -host https://myblog.thm:9007/

(省略)

+ /phpmyadmin/changelog.php: Uncommon header 'x-ob_mode' found, with contents: 1.
```

**A**.**phpmyadmin**

## **Q8**.*What is the Content Management System (CMS) hosted on the server?*

`9007`ポートへアクセスし、HTMLヘッダーを確認すると`wp-`などがあるのでWordpressだとわかりました。

![wordpress.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/11363518-d7de-8a17-9216-173020dbe4a6.png)

**A**.**Wordpress**

## **Q9**.*What is the version number of the CMS hosted on the server?*

HTMLヘッダーからバージョンがわかりました。

![q9.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/cb1956ca-9443-8859-3943-62c146d9b9f8.png)

**A**.**6.2.2**

## **Q10**.*What is the username for the admin panel of the CMS?*

`wpscan`でユーザー名を列挙できました。

```
$ sudo wpscan --url https://myblog.thm:9007 --enumerate u --disable-tls-checks

(省略)

[i] User(s) Identified:

[+] joomla
 | Found By: Rss Generator (Passive Detection)
 | Confirmed By:
 |  Author Id Brute Forcing - Author Pattern (Aggressive Detection)
 |  Login Error Messages (Aggressive Detection)
```

**A**.**joomla**

## **Q11**.*During vulnerability scanning, OSVDB-3092 detects a file that may be used to identify the blogging site software. What is the name of the file?*

`9007`ポートへのniktoスキャン結果からファイルの名前が判明しました。

```
$ nikto -h https://10.10.31.114:9007 -ssl -C all

(省略)

+ OSVDB-3092: /license.txt: License file found may identify site software.
```

**A**.**license.txt**

## **Q12**.*What is the name of the software being used on the standard HTTP port?*

`80`ポートのスキャン結果からソフトウェア情報がわかりました。

```
80/tcp    open     http                    lighttpd 1.4.55
|_http-server-header: lighttpd/1.4.55
|_http-title: 403 Forbidden
```

**A**.**lighttpd**

## **Q13**.*What is the flag value associated with the web page hosted on port 8000?*

`8000`ポート宛てにディレクトリスキャンを行います。

```
$ dirsearch -u http://10.10.204.48:8000/
[13:01:03] 301 -  323B  - /contactus  ->  http://10.10.204.48:8000/contactus/
[13:01:22] 301 -  324B  - /javascript  ->  http://10.10.204.48:8000/javascript/
[13:01:39] 301 -  324B  - /phpmyadmin  ->  http://10.10.204.48:8000/phpmyadmin/
[13:01:41] 200 -    3KB - /phpmyadmin/doc/html/index.html
[13:01:41] 200 -    3KB - /phpmyadmin/
[13:01:41] 200 -    3KB - /phpmyadmin/index.php
```

`/contactus`へアクセスするとフラグを入手できます。

![q13.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/b478d387-8506-0f8c-b2aa-dd20b65bd9f1.png)

**A**.**THM{CONTACT_US_1100}**