---
description: https://tryhackme.com/room/surfer
---

# Surfer

## Nmap

```
sudo nmap 10.10.133.231 -p- -sS -sV

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.4 (Ubuntu Linux; protocol 2.0)
80/tcp open  http    Apache httpd 2.4.38 ((Debian))
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
```

## Web Server

The root page for the web server takes us to a login page.

<figure><img src="https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2FXdh0BPt38vKbCswUmriw%2Fimage.png?alt=media&#x26;token=e5ede5d0-64d8-4173-aadf-5c6e0977f0cd" alt=""><figcaption></figcaption></figure>

Trying some standard credentials we are able to gain access with `admin:admin`. After login we are presented with the dashboard for 24X7 System+.

<figure><img src="https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2FyfskpIoVOYF9z3e6cCTN%2Fimage.png?alt=media&#x26;token=dde79560-6076-4dc7-b938-cfa1d098b088" alt=""><figcaption></figcaption></figure>

Inspecting the Admin's profile we take notice that the admin has mentioned a tool they have created that generates reports in pdf.

<figure><img src="https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2FkjKwkCVwaQncdOINyBj2%2Fimage.png?alt=media&#x26;token=f439dc22-4972-46d6-a3d0-cf2d2b86f6bf" alt=""><figcaption></figcaption></figure>

Going back to the dashboard we can see the button for exporting to pdf.

<figure><img src="https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2F3yEMkG9g9tpyuw0ADHsW%2Fimage.png?alt=media&#x26;token=633f4fd2-16f3-4924-83c1-eb7cacda152f" alt=""><figcaption></figcaption></figure>

Testing the button we observe that by default this prints out the page located on `http://127.0.0.1/server-info.php`.

<figure><img src="https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2FV3FhKEu1oye1WuYaUdLZ%2Fimage.png?alt=media&#x26;token=4ad89aff-584f-4882-9a9d-2a6e2a451a6a" alt=""><figcaption></figcaption></figure>

Using `feroxbuster` we enumerate for further files and discover the existence of `/internal/admin.php`.

```
 feroxbuster -u http://10.10.133.231/ -w /usr/share/seclists/Discovery/Web-Content/common.txt -s 200 
```

<figure><img src="https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2FN814YrVbC7GCeCANCE1q%2Fimage.png?alt=media&#x26;token=e8115bd0-daf3-48e0-bfbd-69ea6ca2139a" alt=""><figcaption></figcaption></figure>

Running curl against the file we are given the message "This page can only be accessed locally."

```
curl http://10.10.133.231/internal/admin.php
```

<figure><img src="https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2FYVCT7WFGpRDlkyvNzT2b%2Fimage.png?alt=media&#x26;token=432a22e6-77af-4ff5-97d3-7ef4319e9b4e" alt=""><figcaption></figcaption></figure>

Looking again at the tool for exporting2pdf we view the page source and can see where the tool takes the parameter "value=\<url>".&#x20;

<figure><img src="https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2FgMnkWambSgYAAKoLV5yj%2Fimage.png?alt=media&#x26;token=b1518aad-aa12-4401-9556-3be71081799d" alt=""><figcaption></figcaption></figure>

Using the browser's inspector we change the value for `value=` to point to `http://127.0.0.1/internal/admin.php`. As this file can read locally we should, hopefully read the `admin.php` file.

<figure><img src="https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2FWTLn6EePSzLF6jinJ7dv%2Fimage.png?alt=media&#x26;token=68f6f7a1-e5bb-4a7f-bff1-6dfaa2938c1b" alt=""><figcaption></figcaption></figure>

After updating the value in the browser inspector and running the tool again we are now able to read the room flag in `admin.php`.

<figure><img src="https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2F9QeG58avwz2Tvfiw8rbd%2Fimage.png?alt=media&#x26;token=e2e2da4a-3b66-4213-bc11-d273b4ab4fc3" alt=""><figcaption></figcaption></figure>
