by Muhammad Abdulloh 🐺

Umumiy Malumotlar

| IP address | 10.10.10.2 (tashqi) → 20.20.20.0/24 (ichki-1) → 30.30.30.0/24 (ichki-2) | | --- | --- | | Operatsion Tizim Nomi (Distribution) | Ubuntu Linux (darkweb host) / Debian GNULinux (ichki xostlar) | | Web Server | Apache httpd 2.4.54 (Debian) | | Ochiq Portlar | 22/tcp (SSH), 80/tcp (HTTP) |

<aside> 💡

Tarmok Topologiyasi

● Tashqi tarmoq (Attacker / Kali) → 10.10.10.2 (host nomi: darkweb, ikkinchi interfeys 20.20.20.2) ● Ichki tarmoq 1 (20.20.20.0/24): 20.20.20.2 (darkweb ning ichki interfeysi) va 20.20.20.3 (megalodon xosti, ikkinchi interfeys 30.30.30.3) ● Ichki tarmoq 2 (30.30.30.0/24): 30.30.30.2 (megalodon ning ichki interfeysi) va 30.30.30.3 (ZEUS xosti — FTP, SSH, HTTP, SMB xizmatlari bilan)

</aside>

<aside> 💡

Hisobot

</aside>

Enumeration (Ma’lumot to’plash)

Maqsad IP manzilga to'liq nmap skaneri (-sC -sV -A) ishga tushirildi. Natijada 22/tcp (OpenSSH 9.6p1Ubuntu) va 80/tcp (Werkzeug httpd 3.0.4, Python 3.12.3) portlari ochiq ekanligi aniqlandi

**nmap -sC -sV -A 10.10.10.2**

Brauzerda 80-portga murojaat qilinganda avval ogohlantiruvchi sahifa ('Attention, this isn't a CTF') chiqadi.

Sahifani yopgandan so'ng, laboratoriya haqida ma'lumot beruvchi 'Pivoting and Port-ForwardingLaboratory' sahifasi ko'rinadi — bu laboratoriya Ligolo-ng vositasi yordamida pivoting mavzusiga bag'ishlanganini tasdiqlaydi

Initial Access (Kirish huquqiga erishish)

Sahifa manba kodini (view-source) tekshirganda, KeePassga saqlanishi va keyin o'chirilishi kerak bo'lganizoh ichida, cerbero (SSH) foydalanuvchisi uchun Base32 formatida kodlangan yangi parol topildi.

**echo "JZKECZ2NPJAWOTT2JVTU42SVM5HGU23HJZVFCZ22NJGWOTTNKVTU26SJM5GXUQLHJV5ESZ2NPJEWOTLKIU6Q====" | base32 -d | base64 -d | xxd -r -p**