> For the complete documentation index, see [llms.txt](https://tjf952.gitbook.io/disboard/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://tjf952.gitbook.io/disboard/writeups/base.md).
# BASE
### Recon
**`nmap-auto 10.10.10.48 all`**
```
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 f6:5c:9b:38:ec:a7:5c:79:1c:1f:18:1c:52:46:f7:0b (RSA)
| 256 65:0c:f7:db:42:03:46:07:f2:12:89:fe:11:20:2c:53 (ECDSA)
|_ 256 b8:65:cd:3f:34:d8:02:6a:e3:18:23:3e:77:dd:87:40 (ED25519)
80/tcp open http Apache httpd 2.4.29 ((Ubuntu))
|_http-server-header: Apache/2.4.29 (Ubuntu)
|_http-title: Site doesn't have a title (text/html).
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
```
The only notable ports are ssh and http, and that the OS is confirmed to be Linux. OpenSSH 7.6p1 is rarely exploitable so the starting point should be examining the http service.
### Enumeration
Opening a browser and heading to shows us a website named "Base".
* : Login page with username and password
* : Contains 3 files: (1) config.php, (2) login.php, (3) login.php.swp
Another method to find available pages is to directory fuzz. Dirbuster, dirb, and dirsearch are great options. Using dirsearch and a big wordlist provided in the "/usr/share/wordlists", the following results were found:
**`python3 dirsearch.py -e txt,html,php,sh -w /home/z3r0/Resources/wordlists/dirb-big.txt -t 10 -u http://10.10.10.48/`**
*
*
*
*
Okay, so there is an "\_uploaded" page, this might come in handy later. With the files found in /login, maybe we can examine some of the code.
### Exploitation
Doing the following strings command, `strings login.php.swp` gives a pretty good look at what is written. the 'excerpt' tab is the important text that is reordered for a better understanding:
{% tabs %}
{% tab title="excerpt" %}
```php
if(!empty($_POST['username']) && !empty($_POST['password'])) {
require('config.php');
if (strcmp($username , $_POST['username']) == 0) {
if (strcmp($password, $_POST['password']) == 0) {
$_SESSION['user_id'] = 1;
header("Location: upload.php");
} else {
print("");
}
} else {
print("");
}
}
```
{% endtab %}
{% tab title="full" %}
{% code title="login.php.swp" %}
```php