$ nmap -sS -sC -sV -A -p- -Pn --min-rate 5000 10.10.11.20
Starting Nmap 7.95 ( https://nmap.org ) at 2025-06-22 01:20 JST
Nmap scan report for 10.10.11.20
Host is up (0.31s latency).
Not shown: 65533 closed tcp ports (reset)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.7 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 0d:ed:b2:9c:e2:53:fb:d4:c8:c1:19:6e:75:80:d8:64 (ECDSA)
|_ 256 0f:b9:a7:51:0e:00:d5:7b:5b:7c:5f:bf:2b:ed:53:a0 (ED25519)
80/tcp open http nginx 1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://editorial.htb
|_http-server-header: nginx/1.18.0 (Ubuntu)
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.19
Network Distance: 2 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
TRACEROUTE (using port 5900/tcp)
HOP RTT ADDRESS
1 482.97 ms 10.10.16.1
2 224.19 ms 10.10.11.20
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 46.92 seconds
$ curl http://editorial.htb/static/uploads/3f97d88b-ccac-4960-8423-040d03dd90ae | jq
{
"messages": [
{
"promotions": {
"description": "Retrieve a list of all the promotions in our library.",
"endpoint": "/api/latest/metadata/messages/promos",
"methods": "GET"
}
},
{
"coupons": {
"description": "Retrieve the list of coupons to use in our library.",
"endpoint": "/api/latest/metadata/messages/coupons",
"methods": "GET"
}
},
{
"new_authors": {
"description": "Retrieve the welcome message sended to our new authors.",
"endpoint": "/api/latest/metadata/messages/authors",
"methods": "GET"
}
},
{
"platform_use": {
"description": "Retrieve examples of how to use the platform.",
"endpoint": "/api/latest/metadata/messages/how_to_use_platform",
"methods": "GET"
}
}
],
"version": [
{
"changelog": {
"description": "Retrieve a list of all the versions and updates of the api.",
"endpoint": "/api/latest/metadata/changelog",
"methods": "GET"
}
},
{
"latest": {
"description": "Retrieve the last version of api.",
"endpoint": "/api/latest/metadata",
"methods": "GET"
}
}
]
}
$ curl http://editorial.htb/static/uploads/bc199a04-c44c-4ea7-9286-a6672055b70f | jq
{
"template_mail_message": "Welcome to the team! We are thrilled to have you on board and can't wait to see the incredible content you'll bring to the table.\n\nYour login credentials for our internal forum and authors site are:\nUsername: dev\nPassword: dev080217_devAPI!@\nPlease be sure to change your password as soon as possible for security purposes.\n\nDon't hesitate to reach out if you have any questions or ideas - we're always here to support you.\n\nBest regards, Editorial Tiempo Arriba Team."
}
$ ls -l /home/dev/
total 8
drwxrwxr-x 3 dev dev 4096 Jun 5 2024 apps
-rw-r----- 1 root dev 33 Jun 26 10:58 user.txt
(2) appディレクトリの内容を確認するとGitのリポジトリがあることが分かる。
$ cd /home/dev/apps
$ ls -al
total 12
drwxrwxr-x 3 dev dev 4096 Jun 5 2024 .
drwxr-x--- 4 dev dev 4096 Jun 5 2024 ..
drwxr-xr-x 8 dev dev 4096 Jun 26 11:16 .git
$ git log
commit 8ad0f3187e2bda88bba85074635ea942974587e8 (HEAD -> master)
Author: dev-carlos.valderrama <dev-carlos.valderrama@tiempoarriba.htb>
Date: Sun Apr 30 21:04:21 2023 -0500
fix: bugfix in api port endpoint
commit dfef9f20e57d730b7d71967582035925d57ad883
Author: dev-carlos.valderrama <dev-carlos.valderrama@tiempoarriba.htb>
Date: Sun Apr 30 21:01:11 2023 -0500
change: remove debug and update api port
commit b73481bb823d2dfb49c44f4c1e6a7e11912ed8ae
Author: dev-carlos.valderrama <dev-carlos.valderrama@tiempoarriba.htb>
Date: Sun Apr 30 20:55:08 2023 -0500
change(api): downgrading prod to dev
* To use development environment.
commit 1e84a036b2f33c59e2390730699a488c65643d28
Author: dev-carlos.valderrama <dev-carlos.valderrama@tiempoarriba.htb>
Date: Sun Apr 30 20:51:10 2023 -0500
feat: create api to editorial info
* It (will) contains internal info about the editorial, this enable
faster access to information.
commit 3251ec9e8ffdd9b938e83e3b9fbf5fd1efa9bbb8
Author: dev-carlos.valderrama <dev-carlos.valderrama@tiempoarriba.htb>
Date: Sun Apr 30 20:48:43 2023 -0500
feat: create editorial app
:
$ git show b73481bb823d2dfb49c44f4c1e6a7e11912ed8ae
commit b73481bb823d2dfb49c44f4c1e6a7e11912ed8ae
Author: dev-carlos.valderrama <dev-carlos.valderrama@tiempoarriba.htb>
Date: Sun Apr 30 20:55:08 2023 -0500
change(api): downgrading prod to dev
* To use development environment.
diff --git a/app_api/app.py b/app_api/app.py
index 61b786f..3373b14 100644
--- a/app_api/app.py
+++ b/app_api/app.py
@@ -64,7 +64,7 @@ def index():
@app.route(api_route + '/authors/message', methods=['GET'])
def api_mail_new_authors():
return jsonify({
- 'template_mail_message': "Welcome to the team! We are thrilled to have you on board and can't wait to see the incredible content you'll bring to the table.\n\nYour login credentials for our internal forum and authors site are:\nUsername: prod\nPassword: 080217_Producti0n_2023!@\nPlease be sure to change your password as soon as possible for security purposes.\n\nDon't hesitate to reach out if you have any questions or ideas - we're always here to support you.\n\nBest regards, " + api_editorial_name + " Team."
+ 'template_mail_message': "Welcome to the team! We are thrilled to have you on board and can't wait to see the incredible content you'll bring to the table.\n\nYour login credentials for our internal forum and authors site are:\nUsername: dev\nPassword: dev080217_devAPI!@\nPlease be sure to change your password as soon as possible for security purposes.\n\nDon't hesitate to reach out if you have any questions or ideas - we're always here to support you.\n\nBest regards, " + api_editorial_name + " Team."
}) # TODO: replace dev credentials when checks pass
# -------------------------------
$ sudo -l
→パスワード（080217_Producti0n_2023!@）を入力する。
[sudo] password for prod:
Matching Defaults entries for prod on editorial:
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty
User prod may run the following commands on editorial:
(root) /usr/bin/python3 /opt/internal_apps/clone_changes/clone_prod_change.py *
問題（英語訳）：How many TCP ports are listening on Editorial?
問題（日本語訳）：Editorial でリッスンしている TCP ポートはいくつありますか?
答え：2
・Task 2
問題（英語訳）：What is the primary domain name used by the webserver on editorial box?
問題（日本語訳）：編集ボックスのウェブサーバーで使用されるプライマリドメイン名は何ですか?
答え：editorial.htb
・Task 3
問題（英語訳）：What relative endpoint on the webserver can cause the server to generate an outbound HTTP request?
問題（日本語訳）：Web サーバー上のどの相対エンドポイントが、サーバーに送信 HTTP 要求を生成させるのでしょうか?
答え：/upload-cover
・Task 4
問題（英語訳）：What TCP port is serving another webserver listening only on localhost?
問題（日本語訳）：ローカルホストでのみリッスンしている別の Web サーバーにサービスを提供している TCP ポートは何ですか?
答え：5000
・Task 5
問題（英語訳）：Which relative API endpoint returns a template that includes a default username and password?
問題（日本語訳）：デフォルトのユーザー名とパスワードを含むテンプレートを返す相対 API エンドポイントはどれですか?
答え：/api/latest/metadata/messages/authors
・Submit User Flag
問題（英語訳）：Submit the flag located in the dev user's home directory.
問題（日本語訳）：dev ユーザーのホーム ディレクトリにあるフラグを送信します。
答え：35c97cc6e061a58a64ec653a1db732e9
・Task 7
問題（英語訳）：What is the full path to the directory that contains a git repo but all the files have been deleted?
問題（日本語訳）：Git リポジトリが含まれているが、すべてのファイルが削除されているディレクトリへのフル パスは何ですか?
答え：/home/dev/apps
・Task 8
問題（英語訳）：What is the prod user's password on Editorial?
問題（日本語訳）：Editorial の prod ユーザーのパスワードは何ですか?
答え：080217_Producti0n_2023!@
・Task 9
問題（英語訳）：What is the name of the Python script that the prod user can run as root after entering their password?
問題（日本語訳）：prod ユーザーがパスワードを入力した後に root として実行できる Python スクリプトの名前は何ですか?
答え：clone_prod_change.py
・Task 10
問題（英語訳）：What is name of the Python library used by clone_prod_changes.py to interact with Git repos?
問題（日本語訳）：clone_prod_changes.py が Git リポジトリと対話するために使用する Python ライブラリの名前は何ですか?
答え：GitPython
・Task 11
問題（英語訳）：What version of GitPython is installed on Editorial?
問題（日本語訳）：Editorial にはどのバージョンの GitPython がインストールされていますか?
答え：3.1.29
・Task 12
問題（英語訳）：What is the 2022 CVE ID for a command execution vulnerability in this version of GitPython?
問題（日本語訳）：このバージョンの GitPython におけるコマンド実行の脆弱性の 2022 CVE ID は何ですか?
答え：CVE-2022-24439
・Submit Root Flag
問題（英語訳）：Submit the flag located in the root user's home directory.
問題（日本語訳）：ルート ユーザーのホーム ディレクトリにあるフラグを送信します。
答え：4eea673525d248b87391d2436c702d36
※「/root/root.txt」の内容が答え。
