Skip to main content

Box Gavel

nmap tìm được 2 port 22 và 80 khai thác 80 mở ra web, không tìm được gì

ffuf thì thu được

lika@learning:~/Downloads/HTB/Broker/CVE-2023-46604$ ffuf -w /usr/share/seclists/Discovery/Web-Content/common.txt \
     -u http://gavel.htb/FUZZ -e .php -o ffuf_gavel.json -of json

        /'___\  /'___\           /'___\
       /\ \__/ /\ \__/  __  __  /\ \__/
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
         \ \_\   \ \_\  \ \____/  \ \_\
          \/_/    \/_/   \/___/    \/_/

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://gavel.htb/FUZZ
 :: Wordlist         : FUZZ: /usr/share/seclists/Discovery/Web-Content/common.txt
 :: Extensions       : .php
 :: Output file      : ffuf_gavel.json
 :: File format      : json
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________

.git/HEAD               [Status: 200, Size: 23, Words: 2, Lines: 2, Duration: 32ms]
.git/config             [Status: 200, Size: 136, Words: 13, Lines: 9, Duration: 32ms]
.git/logs/              [Status: 200, Size: 1128, Words: 77, Lines: 18, Duration: 35ms]
.hta                    [Status: 403, Size: 274, Words: 20, Lines: 10, Duration: 34ms]
.hta.php                [Status: 403, Size: 274, Words: 20, Lines: 10, Duration: 32ms]
.htaccess               [Status: 403, Size: 274, Words: 20, Lines: 10, Duration: 38ms]
.htpasswd               [Status: 403, Size: 274, Words: 20, Lines: 10, Duration: 31ms]
.htpasswd.php           [Status: 403, Size: 274, Words: 20, Lines: 10, Duration: 32ms]
.htaccess.php           [Status: 403, Size: 274, Words: 20, Lines: 10, Duration: 32ms]
.git/index              [Status: 200, Size: 224718, Words: 313, Lines: 355, Duration: 35ms]
.git/logs/.php          [Status: 403, Size: 274, Words: 20, Lines: 10, Duration: 283ms]
admin.php               [Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 34ms]
admin.php               [Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 32ms]
.git                    [Status: 301, Size: 305, Words: 20, Lines: 10, Duration: 3478ms]
assets                  [Status: 301, Size: 307, Words: 20, Lines: 10, Duration: 34ms]
includes                [Status: 301, Size: 309, Words: 20, Lines: 10, Duration: 41ms]
index.php               [Status: 200, Size: 14020, Words: 4623, Lines: 223, Duration: 35ms]
index.php               [Status: 200, Size: 14081, Words: 4627, Lines: 223, Duration: 33ms]
inventory.php           [Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 40ms]
login.php               [Status: 200, Size: 4281, Words: 1817, Lines: 79, Duration: 32ms]
logout.php              [Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 33ms]
register.php            [Status: 200, Size: 4485, Words: 1571, Lines: 85, Duration: 60ms]
rules                   [Status: 301, Size: 306, Words: 20, Lines: 10, Duration: 256ms]
:: Progress: [7659/9492] :: Job [1/1] :: 2 req/sec :: Duration: [0:01:42] :: Errors: 160 ::

Clone git về xài git-dumper

lika@learning:~/Downloads/HTB/Gavel$ git-dumper http://gavel.htb/.git source
[-] Testing http://gavel.htb/.git/HEAD [200]
[-] Testing http://gavel.htb/.git/ [200]
[-] Fetching .git recursively
[-] Fetching http://gavel.htb/.git/ [200]
[-] Fetching http://gavel.htb/.gitignore [404]
[-] http://gavel.htb/.gitignore responded with status code 404
[-] Fetching http://gavel.htb/.git/COMMIT_EDITMSG [200]
[-] Fetching http://gavel.htb/.git/config [200]
[-] Fetching http://gavel.htb/.git/branches/ [200]
[-] Fetching http://gavel.htb/.git/hooks/ [200]
[-] Fetching http://gavel.htb/.git/HEAD [200]