FinitHicDeo1 - Vulnhub - Level: Medium - Bericht

Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-10-09 21:01 CEST
Nmap scan report for FinitHicDeo1.vln (192.168.2.116)
Host is up (0.00014s latency).
Not shown: 65533 closed tcp ports (reset)
PORT     STATE SERVICE VERSION
80/tcp   open  http    Gunicorn 20.0.1
|_http-title: Site doesn't have a title (text/html; charset=utf-8).
|_http-server-header: gunicorn/20.0.1
3000/tcp open  ppp?
| fingerprint-strings: 
|   GenericLines, NULL:  
|     -->>Welcome to this Amazing Game!!!!
|     ->It is an old code-breaking mind game. Flag is hidden in this format : "flag{carp3_d13m_8462}"
|     ->Reference: https://en.wikipedia.org/wiki/Bulls_and_Cows
|     Users have to guess a flag value. For every character that the user guessed correctly in the correct place, they have a 
|     bulls
|     every character, the user guessed correctly in the wrong place is a 
|     cows
|     every guess, you will see how many 
|     cows
|     bulls
|_    have. nce the user guesses the
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.8
Network Distance: 1 hop

Port gefunden! 80

* Host FinitHicDeo1.vln:80 was resolved.
* IPv6: (none)
* IPv4: 192.168.2.116
*   Trying 192.168.2.116:80...
* Connected to FinitHicDeo1.vln (192.168.2.116) port 80
> HEAD / HTTP/1.1
> Host: FinitHicDeo1.vln
> User-Agent: curl/8.9.1
> Accept: */*
> 
* Request completely sent off
< HTTP/1.1 200 OK
< Server: gunicorn/20.0.1
< Date: Wed, 09 Oct 2024 19:04:50 GMT
< Connection: keep-alive
< Content-Length: 3798
< Content-Type: text/html; charset=utf-8
< Last-Modified: Tue, 08 Dec 2020 18:22:15 GMT
< Cache-Control: public, max-age=43200
< Expires: Thu, 10 Oct 2024 07:04:50 GMT
< ETag: "1607451735.0458326-3798-1942948137"
< 

* Connection #0 to host FinitHicDeo1.vln left intact

+ Target IP:          192.168.2.116
+ Target Hostname:    192.168.2.116
+ Target Port:        80
+ Start Time:         2024-10-09 21:04:49 (GMT2)

+ Server: gunicorn/20.0.1
+ /: Server may leak inodes via ETags, header found with file /, inode: 1607451735.0458326, size: 3798, mtime: 1942948137. See: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1418
+ /: The anti-clickjacking X-Frame-Options header is not present. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
+ /: The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type. See: https://www.netsparker.com/web-vulnerability-scanner/vulnerabilities/missing-content-type-header/
+ No CGI Directories found (use '-C all' to force check all possible dirs)
+ : Server banner changed from 'gunicorn/20.0.1' to 'mitmproxy 5.3.0'.
+ OPTIONS: Allowed HTTP Methods: GET, HEAD, OPTIONS .
    + /#wp-config.php#: #wp-config.php# file found. This file contains the database credentials.
+ 8117 requests: 0 error(s) and 6 item(s) reported on remote host
+ End Time:           2024-10-09 21:16:19 (GMT2) (690 seconds)

+ 1 host(s) tested

FinitHicDeo1.vln [192.168.2.116] 3000 (?) open

  ____                 ___     ____        _ _    ____                      
 / ___|_____      __  ( _ )   | __ ) _   _| | |  / ___| __ _ _ __ ___   ___ 
| |   / _ \ \ /\ / /  / _ \/\ |  _ \| | | | | | | |  _ / _` | '_ ` _ \ / _ \ 
| |__| (_) \ V  V /  | (_>  < | |_) | |_| | | | | |_| | (_| | | | | | |  __/ 
 \____\___/ \_/\_/    \___/\/ |____/ \__,_|_|_|  \____|\__,_|_| |_| |_|\___|

-->>Welcome to this Amazing Game!!!!
->It is an old code-breaking mind game. Flag is hidden in this format : "flag{carp3_d13m_8462}"
->Reference: https://en.wikipedia.org/wiki/Bulls_and_Cows

Users have to guess a flag value. For every character that the user guessed correctly in the correct place, they have a “bulls”. For every character, the user guessed correctly in the wrong place is a “cows”. For every guess, you will see how many “cows” and “bulls” you have. nce the user guesses the correct number, the game is over. However, to simplify this, you can send the same character in one string.

Example:
$ If flag is: acc3p7_y0ur531f
INPUT: 83_aws0m3_n_gud
UTPUT: { User: 83_aws0m3_n_gud || Cow:8 && Bull:0 }
INPUT: acc3p7_y0ur531f
UTPUT: { User: acc3p7_y0ur531f || Cow:0 && Bull:15 }

character in flag: a-z, _, 0-9

commands:
You can see your input logs by :  logs
You can quit the game by       :  exit

Note: Just Play Games at least. ;)

--2024-10-09 21:43:37--  http://192.168.2.116/static/bg.mp3
Verbindungsaufbau zu 192.168.2.116:80 … verbunden.
HTTP-Anforderung gesendet, auf Antwort wird gewartet … 200 OK
Länge: 5990227 (5,7M) [audio/mpeg]
Wird in bg.mp3 gespeichert.

bg.mp3                  100%[=>]   5,71M  --.-KB/s    in 0,08s   

2024-10-09 21:43:37 (73,3 MB/s) - bg.mp3 gespeichert [5990227/5990227]

Hey, there are two challenges for you, one at port 80 and another is at port 3000.

# Challenge 1:
The main server is running on port 8080 and we used Gunicorn to redirect the traffic at port 80.
You need to get the flag from the "/flag" page by exploiting the vulnerability.

# Challenge 2:
Visit 3000 port via nc and pass the coding challenge. :)

$ Troubleshooting:
If you face any error just reboot machine. ;)