HackTheBox - laboratory(CVE-2020-10977)

laboratory

#0 Nmap 收集信息

nmap 10.10.10.26 -p-
根据Nmap的综合扫描来看，有两个域名laboratory.htb和git.laboratory.htb。

─[sg-vip-1]─[10.10.14.33]─[htb-ch1r0n@htb-3c7dulytfv]─[~]
└──╼ [★]$ nmap 10.10.10.216 -p-
Starting Nmap 7.80 ( https://nmap.org ) at 2021-04-16 02:34 UTC
Nmap scan report for laboratory.htb (10.10.10.216)
Host is up (0.0054s latency).
Not shown: 65532 filtered ports
PORT    STATE SERVICE
22/tcp  open  ssh
80/tcp  open  http
443/tcp open  https

Nmap done: 1 IP address (1 host up) scanned in 104.39 seconds
─[sg-vip-1]─[10.10.14.33]─[htb-ch1r0n@htb-3c7dulytfv]─[~]
└──╼ [★]$ nmap 10.10.10.216 -p22,80,443 -A
Starting Nmap 7.80 ( https://nmap.org ) at 2021-04-16 02:38 UTC
Nmap scan report for laboratory.htb (10.10.10.216)
Host is up (0.0026s latency).

PORT    STATE SERVICE  VERSION
22/tcp  open  ssh      OpenSSH 8.2p1 Ubuntu 4ubuntu0.1 (Ubuntu Linux; protocol 2.0)
80/tcp  open  http     Apache httpd 2.4.41
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: Did not