Bu safar targetimiz Windows ekan, ip malum, endi shunchaki ip ni tekshrish Nmap qilishdan oldin brauzerga yozib ko’ramiz.

IP da sayt ishlamoqda demak 80 port ochiq endi nmap qilishni boshlaymiz.

22/tcp open  ssh     syn-ack ttl 64 OpenSSH 9.6p1 Ubuntu 3ubuntu13.12 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 ac:49:60:90:20:5a:92:7d:7b:4d:13:98:0d:ae:52:6b (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBB34PGrwutLft3Go5wBGl9+RNO412OgIi1T3TMTjL+8Dm8wPSCiRYh2DG1oo4tncIzs1DMPqekNuyHoNmsC7kR0=
|   256 68:cd:ce:ec:58:42:e5:c7:52:46:ca:1f:b6:26:a4:cd (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA+mw3uT61WQXM5KbMe3IT8JdDY9obNoJ7uvCfISNj4i
80/tcp open  http    syn-ack ttl 64 Apache httpd 2.4.58 ((Ubuntu))
|_http-title: TechWorld Noticias
| http-methods: 
|_  Supported Methods: POST OPTIONS HEAD GET
|_http-server-header: Apache/2.4.58 (Ubuntu)

22 va 80 portlar ochiq, endi saytni source kodlarini tahlil qilib ko’raman.

CSS dagi bu kod hech qanday vazifa bajarmaydi, balki bu ssh orqali kirish uchun logindir sinab ko’raman, hydra orqali parolni topaman.

Parol topildi, endi ssh ga kirib flag bo’lsa flagni olaman.

user.txt olindi.

PS C:\Users\pipe> type user.txt
d970977b69a543ce746095e2b660d107

Endi boya saytni source kodida Hidden degan yozuv bor edi, balki saytda yana biror bir malumot bordir.

Saytdagi yozuvlarni windowsdagi userni paroliga o’xshaydi, o’xshaydi, hamma harflarni yig’ib chiqsam, shunday so’z kelib chiqadi.

WinServerRootFakeNews