Discussion about the new easy linux machine Health, good luck everyone !

Nmap scan report for 10.129.12.167
Host is up (0.11s latency).
Not shown: 997 closed tcp ports (reset)
PORT    STATE    SERVICE VERSION
22/tcp  open    ssh    OpenSSH 7.6p1 Ubuntu 4ubuntu0.7 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|  2048 32:b7:f4:d4:2f:45:d3:30:ee:12:3b:03:67:bb:e6:31 (RSA)
|  256 86:e1:5d:8c:29:39:ac:d7:e8:15:e6:49:e2:35:ed:0c (ECDSA)
|_  256 ef:6b:ad:64:d5:e4:5b:3e:66:79:49:f4:ec:4c:23:9f (ED25519)
80/tcp  open    http    Apache httpd 2.4.29 ((Ubuntu))
|_http-server-header: Apache/2.4.29 (Ubuntu)
|_http-title: HTTP Monitoring Tool
3000/tcp filtered ppp
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.92%E=4%D=8/20%OT=22%CT=1%CU=33040%PV=Y%DS=2%DC=T%G=Y%TM=63012F6
OS:8%P=x86_64-pc-linux-gnu)SEQ(SP=FD%GCD=1%ISR=104%TI=Z%CI=Z%II=I%TS=A)SEQ(
OS:SP=FD%GCD=1%ISR=103%TI=Z%CI=Z%TS=A)OPS(O1=M537ST11NW7%O2=M537ST11NW7%O3=
OS:M537NNT11NW7%O4=M537ST11NW7%O5=M537ST11NW7%O6=M537ST11)WIN(W1=FE88%W2=FE
OS:88%W3=FE88%W4=FE88%W5=FE88%W6=FE88)ECN(R=Y%DF=Y%T=40%W=FAF0%O=M537NNSNW7
OS:%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=
OS:Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%
OS:RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T7(R=N)U1(R=Y%DF=N%T
OS:=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD=
OS:S)

Are exploiting webhooks on the site?

idk but i recieve call back from payload or monitor

(August 20, 2022, 07:32 PM)yumi Wrote: idk but i recieve call back from payload or monitor

There is an app.js here:

http://health.htb/js/app.js

Laravel version 8.83.13
PHP version 7.4.30

U can to check ur webhooks here -> http://health.htb/webhook/

looks like Gogs(Go Git Service) on localhost:3000 via ssrf

(August 20, 2022, 07:52 PM)Hacker2222 Wrote:

(August 20, 2022, 07:43 PM)fukingfuck Wrote: looks like Gogs(Go Git Service) on localhost:3000 via ssrf

how to bypass localhost filter ?

302 =)
https://gist.github.com/shreddd/b7991ab491384e3c3331

dont know what to do

(August 20, 2022, 08:14 PM)rdre8 Wrote: Check out the data in base64 for application/json

What do you mean ?