< Content-Length: 12 < Connection: close < * Closing connection 0 Unauthorizedadmin@i-0be5e4664c35e2594:~$ curl -u 'test:test' 127.0.0.1:5000 -v * Trying 127.0.0.1:5000... * Connected to 127.0.0.1 (127.0.0.1) port 5000 (#0) * Server auth using Basic with user 'test' > GET / HTTP/1.1 > Host: 127.0.0.1:5000 > Authorization: Basic dGVzdDp0ZXN0 > User-Agent: curl/7.74.0 > Accept: */* > * Mark bundle as not supporting multiuse < HTTP/1.1 200 OK < Server: Werkzeug/2.3.7 Python/3.9.2 < Date: Wed, 27 Dec 2023 10:00:31 GMT < Content-Type: text/html; charset=utf-8 < Content-Length: 12 < Connection: close < * Closing connection 0 Unauthorizedadmin@i-0be5e4664c35e2594:~$ curl -u 'admin:admin' 127.0.0.1:5000 -v * Trying 127.0.0.1:5000... * Connected to 127.0.0.1 (127.0.0.1) port 5000 (#0) * Server auth using Basic with user 'admin' > GET / HTTP/1.1 > Host: 127.0.0.1:5000 > Authorization: Basic YWRtaW46YWRtaW4= > User-Agent: curl/7.74.0 > Accept: */* > * Mark bundle as not supporting multiuse < HTTP/1.1 200 OK < Server: Werkzeug/2.3.7 Python/3.9.2 < Date: Wed, 27 Dec 2023 10:00:47 GMT < Content-Type: text/html; charset=utf-8 < Content-Length: 12 < Connection: close < * Closing connection 0 Unauthorizedadmin@i-0be5e4664c35e2594:~$ curl -u 'test:test' 127.0.0.1:5000 -v
paris/i-0be5e4664c35e2594
by SadServersMore by SadServers
strings: webserver.py: Permission denied admin@i-0eed1c77d78127958:~$ ls -al total 44 drwxr-xr-x 6 admin admin 4096 Sep 24 2023 . drwxr-xr-x 3 root root 4096 Sep 17 2023 .. drwx------ 3 admin admin 4096 Sep 20 2023 .ansible -rw------- 1 admin admin 530 Feb 26 17:43 .bash_history -rw-r--r-- 1 admin admin 220 Aug 4 2021 .bash_logout -rw-r--r-- 1 admin admin 3526 Aug 4 2021 .bashrc drwxr-xr-x 3 admin admin 4096 Sep 20 2023 .config -rw-r--r-- 1 admin admin 807 Aug 4 2021 .profile drwx------ 2 admin admin 4096 Sep 17 2023 .ssh drwxr-xr-x 2 admin root 4096 Sep 24 2023 agent -rwxrwx--- 1 root root 360 Sep 24 2023 webserver.py admin@i-0eed1c77d78127958:~$
paris/i-0eed1c77d78127958 02:26
by SadServers#1) Respect the privacy of others. #2) Think before you type. #3) With great power comes great responsibility. [sudo] password for admin: sudo: a password is required admin@i-01ea60294022f2d7a:~$ curl localhost:5000 Unauthorizedadmin@i-01ea60294022f2d7a:~$ ns localhost:5000 bash: ns: command not found admin@i-01ea60294022f2d7a:~$ nc localhost:5000 nc: missing port number admin@i-01ea60294022f2d7a:~$ GET / bash: GET: command not found admin@i-01ea60294022f2d7a:~$ nc localhost:5000