> For the complete documentation index, see [llms.txt](https://viperone.gitbook.io/pentest-everything/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://viperone.gitbook.io/pentest-everything/writeups/tryhackme/linux/surfer.md).

# Surfer

## Nmap

```
sudo nmap 10.10.133.231 -p- -sS -sV

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.4 (Ubuntu Linux; protocol 2.0)
80/tcp open  http    Apache httpd 2.4.38 ((Debian))
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
```

## Web Server

The root page for the web server takes us to a login page.

<figure><img src="/files/SHD2kLZWa34ImCjdq1PA" alt=""><figcaption></figcaption></figure>

Trying some standard credentials we are able to gain access with `admin:admin`. After login we are presented with the dashboard for 24X7 System+.

<figure><img src="/files/4hPYER3p3O8gyTBUu1lI" alt=""><figcaption></figcaption></figure>

Inspecting the Admin's profile we take notice that the admin has mentioned a tool they have created that generates reports in pdf.

<figure><img src="/files/80jwvxKOuHNsaG2kRYWo" alt=""><figcaption></figcaption></figure>

Going back to the dashboard we can see the button for exporting to pdf.

<figure><img src="/files/vOfX4X7xts1ZYR52VOme" alt=""><figcaption></figcaption></figure>

Testing the button we observe that by default this prints out the page located on `http://127.0.0.1/server-info.php`.

<figure><img src="/files/tmL00IUxT9rDwZcy6L9g" alt=""><figcaption></figcaption></figure>

Using `feroxbuster` we enumerate for further files and discover the existence of `/internal/admin.php`.

```
 feroxbuster -u http://10.10.133.231/ -w /usr/share/seclists/Discovery/Web-Content/common.txt -s 200 
```

<figure><img src="/files/vFU5XO7lbYU6PWszh43x" alt=""><figcaption></figcaption></figure>

Running curl against the file we are given the message "This page can only be accessed locally."

```
curl http://10.10.133.231/internal/admin.php
```

<figure><img src="/files/dQSmUS5nlDH7yM9QjV4z" alt=""><figcaption></figcaption></figure>

Looking again at the tool for exporting2pdf we view the page source and can see where the tool takes the parameter "value=\<url>".&#x20;

<figure><img src="/files/AX7O66WcR6fFsDG52pdX" alt=""><figcaption></figcaption></figure>

Using the browser's inspector we change the value for `value=` to point to `http://127.0.0.1/internal/admin.php`. As this file can read locally we should, hopefully read the `admin.php` file.

<figure><img src="/files/eI5Uwzm3FOL2beSyvuiO" alt=""><figcaption></figcaption></figure>

After updating the value in the browser inspector and running the tool again we are now able to read the room flag in `admin.php`.

<figure><img src="/files/YyVzlp7RaqLGJ3Ws2qK6" alt=""><figcaption></figcaption></figure>