IP: 192.168.127.97

Hashes

Users

janis

paige

terry

walter

Passwords

Creds

admin:secret

=example_value

NMAP

22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0) | ssh-hostkey: | 2048 02715dc8b943ba6ac8ed15c56cb2f5f9 (RSA) | 256 f3e510d416a99e034738baac18245328 (ECDSA) |_ 256 024f99ec856d794388b2b57cf091fe74 (ED25519) 23/tcp open telnet Linux telnetd 25/tcp open smtp Postfix smtpd |_smtp-commands: walla, PIPELINING, SIZE 10240000, VRFY, ETRN, STARTTLS, ENHANCEDSTATUSCODES, 8BITMIME, DSN, SMTPUTF8, CHUNKING | ssl-cert: Subject: commonName=walla | Subject Alternative Name: DNS:walla | Not valid before: 2020-09-17T18:26:36 |Not valid after: 2030-09-15T18:26:36 |ssl-date: TLS randomness does not represent time 53/tcp open tcpwrapped 422/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0) | ssh-hostkey: | 2048 02715dc8b943ba6ac8ed15c56cb2f5f9 (RSA) | 256 f3e510d416a99e034738baac18245328 (ECDSA) | 256 024f99ec856d794388b2b57cf091fe74 (ED25519) 8091/tcp open http lighttpd 1.4.53 |http-title: Site doesn’t have a title (text/html; charset=UTF-8). | http-cookie-flags: | /: | PHPSESSID: | httponly flag not set | http-auth: | HTTP/1.1 401 Unauthorized\x0D | Basic realm=RaspAP |http-server-header: lighttpd/1.4.53 42042/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0) | ssh-hostkey: | 2048 02715dc8b943ba6ac8ed15c56cb2f5f9 (RSA) | 256 f3e510d416a99e034738baac18245328 (ECDSA) | 256 024f99ec856d794388b2b57cf091fe74 (ED25519) Service Info: Host: walla; OS: Linux; CPE: cpe:/o:linux:linux_kernel

Directory Brute Force

N./A

FileBrute Force

N/A

Other

========================================================

Foothdold

http://192.168.127.97:8091/index.php?page=about

with default creds

PrivEsc