TryHackMe Anthem
nmap
nmap -sV 10.10.13.83
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-02-08 18:24 EST
Nmap scan report for 10.10.13.83
Host is up (0.064s latency).
Not shown: 998 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
80/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
3389/tcp open ms-wbt-server Microsoft Terminal Services
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 54.73 seconds
feroxbuster
feroxbuster -u http://10.10.13.83 --status-codes 200
___ ___ __ __ __ __ __ ___
|__ |__ |__) |__) | / ` / \ \_/ | | \ |__
| |___ | \ | \ | \__, \__/ / \ | |__/ |___
by Ben "epi" Risher ο€ ver: 2.10.1
ββββββββββββββββββββββββββββ¬ββββββββββββββββββββββ
ο― Target Url β http://10.10.13.83
ο Threads β 50
ο Wordlist β /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt
ο Status Codes β [200]
ο₯ Timeout (secs) β 7
撚 User-Agent β feroxbuster/2.10.1
ο Config File β /etc/feroxbuster/ferox-config.toml
ο Extract Links β true
ο HTTP methods β [GET]
ο Recursion Depth β 4
ββββββββββββββββββββββββββββ΄ββββββββββββββββββββββ
ο Press [ENTER] to use the Scan Management Menuβ’
ββββββββββββββββββββββββββββββββββββββββββββββββββ
200 GET 126l 323w 5344c http://10.10.13.83/
200 GET 92l 186w 3414c http://10.10.13.83/search
200 GET 103l 185w 3486c http://10.10.13.83/categories
200 GET 104l 188w 3589c http://10.10.13.83/tags
200 GET 30l 162w 1864c http://10.10.13.83/rss
200 GET 10l 19w 379c http://10.10.13.83/rsd/1073
200 GET 6l 16w 325c http://10.10.13.83/opensearch/1073
200 GET 145l 403w 6207c http://10.10.13.83/archive/a-cheers-to-our-it-department
200 GET 148l 378w 6147c http://10.10.13.83/archive/we-are-hiring
200 GET 18l 19w 829c http://10.10.13.83/wlwmanifest/1073
200 GET 126l 323w 5389c http://10.10.13.83/blog
200 GET 95l 189w 4078c http://10.10.13.83/umbraco
200 GET 92l 186w 3464c http://10.10.13.83/Search
200 GET 29l 34w 1035c http://10.10.13.83/sitemap
200 GET 126l 323w 5389c http://10.10.13.83/Blog
200 GET 1l 1w 3276c http://10.10.13.83/umbraco/Application
200 GET 125l 835w 74454c http://10.10.13.83/media/articulate/default/random-mask.jpg
200 GET 111l 205w 4110c http://10.10.13.83/authors
200 GET 30l 162w 1864c http://10.10.13.83/RSS
200 GET 111l 205w 4110c http://10.10.13.83/authors/more enum
The poem is written by Solomon Grundy
The found email address is JD@anthem.com
So let's assume admin is SD@anthem.com
RDP
And after that things are easy, admin forgot his password in a backup file.
PreviousPWNEDLABS Identify the AWS Account ID from a Public S3 BucketNextTryHackMe AttacktiveDirectory
Last updated