[0xdaniii]

Happy to help Smile

[aben48379]

Great! Thank you so much!

[Allotmenteer]

Tried to DM but got a 403 forbidden. Maybe this is because I'm new?

I'd very much appreciate a nudge to gain initial access.

Anyway, so far I have found the following:

Discovered FTP, SSH, SMTP, DNS, POP3, RPCBIND, and IMAP services
Identified the additional HTTP service on port 7777
Enumerated the services and brute forced FTP to identify the "ftp" user creds
Found the following vhosts:

dev
portal
remote
store
careers
blog
pr
securetransfer-dev

Fuzzed the vhost directories and pages, inspected the page source and walked each website in Burp. This has disclosed the following:
blog is vulnerable to CVE-2023-23752. I found a PoC exploit to dump the MySQL database creds and super user login. I'm unable to find the password for this account. I've tried brute forcing using joomla-brute.py but no success.

Registered an account on securetransfer-devand uploaded a few files. Uploaded files are referenced by a unique "uuid". I've tried various LFI payloads in Burp Repeater/Intruder. I suspect the "GET /download.php?file=xxx" may be the injection point but I always receive "File does not exist" when trying to retrieve /etc/passwd.
trilocor.local:7777 Werkzeug "console" directory that requires PIN. I've read some research and it appears that this cannot be exploited without an initial foothold.

In the real world, I would seek advice from a senior tester (hence this request!).

I would very much appreciate some advice and guidance on how to progress as I'm now going around in circles!. Any pointers please?

Many thanks!

[3midjets]

Answered on Discord

[parace]

Good resource, Appreciate it.
Thanks.

[0xMzk]

A thousand thanks! Very kind and helpful Big Grin

[3midjets]

Small bump so everyone knows about this free hint.

[Chrisbliss13]

thanks i appreciate it

[br4c0]

Giving a free (small) hint to everyone who is stuck on either CPTS, CBBH, CDSA and CWEE!

(This is a small nudge on the right direction, don't expect a complete answer. Also don't ask for hints if you are not doing the exam, as the hint is specific for your situation)

.

Except for:

CDSA Incident 2

.

WoW thank you much to post this!

[3midjets]

Small bump so everyone knows about this free hint.