> For the complete documentation index, see [llms.txt](https://snowyowls-organization.gitbook.io/snowyowl644-hacklog/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://snowyowls-organization.gitbook.io/snowyowl644-hacklog/hackthebox/hackthebox_writeups/retired/easy/busqueda.md). # Busqueda ![](https://i.imgur.com/MFFHLmO.png) * URL : * \#easy * OS : #Linux * Machine Author(s): * Hack Date: 2025-11-06,17:11 ## Enumeration Principle 1. **目に見えるものだけがすべてではない。** あらゆる視点を考慮しろ 2. 見えていることと、見えていないことを区別しろ 3. **常に情報を得る手段は存在する。** 対象をしっかり理解しろ ### Nmap | ポート | サービス | バージョン | その他 | | ------ | ---- | ------------------------------------------------------------ | ------------------------------ | | 22/tcp | SSH | OpenSSH 8.9p1 Ubuntu 3ubuntu0.1 (Ubuntu Linux; protocol 2.0) | ECDSA, ED25519鍵対応 | | 80/tcp | HTTP | Apache httpd 2.4.52 (Ubuntu) | にリダイレクト | ```bash 22/tcp open ssh syn-ack ttl 63 OpenSSH 8.9p1 Ubuntu 3ubuntu0.1 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 256 4f:e3:a6:67:a2:27:f9:11:8d:c3:0e:d7:73:a0:2c:28 (ECDSA) | ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBIzAFurw3qLK4OEzrjFarOhWslRrQ3K/MDVL2opfXQLI+zYXSwqofxsf8v2MEZuIGj6540YrzldnPf8CTFSW2rk= | 256 81:6e:78:76:6b:8a:ea:7d:1b:ab:d4:36:b7:f8:ec:c4 (ED25519) |_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPTtbUicaITwpKjAQWp8Dkq1glFodwroxhLwJo6hRBUK 80/tcp open http syn-ack ttl 63 Apache httpd 2.4.52 | http-methods: |_ Supported Methods: GET HEAD POST OPTIONS |_http-title: Did not follow redirect to http://searcher.htb/ |_http-server-header: Apache/2.4.52 (Ubuntu) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running: Linux 4.X|5.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 OS details: Linux 4.15 - 5.19 TCP/IP fingerprint: OS:SCAN(V=7.95%E=4%D=11/6%OT=22%CT=%CU=37967%PV=Y%DS=2%DC=T%G=N%TM=690C5826 OS:%P=aarch64-unknown-linux-gnu)SEQ(SP=103%GCD=1%ISR=105%TI=Z%CI=Z%II=I%TS= OS:A)OPS(O1=M542ST11NW7%O2=M542ST11NW7%O3=M542NNT11NW7%O4=M542ST11NW7%O5=M5 OS:42ST11NW7%O6=M542ST11)WIN(W1=FE88%W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6=FE8 OS:8)ECN(R=Y%DF=Y%T=40%W=FAF0%O=M542NNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S OS:+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q= OS:)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A% OS:A=Z%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y% OS:DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T= OS:40%CD=S) Uptime guess: 7.403 days (since Wed Oct 29 22:30:42 2025) Network Distance: 2 hops TCP Sequence Prediction: Difficulty=259 (Good luck!) IP ID Sequence Generation: All zeros Service Info: Host: searcher.htb; OS: Linux; CPE: cpe:/o:linux:linux_kernel TRACEROUTE (using port 22/tcp) HOP RTT ADDRESS 1 163.50 ms 10.10.16.1 2 83.40 ms 10.129.228.217 NSE: Script Post-scanning. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 08:11 Completed NSE at 08:11, 0.00s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 08:11 Completed NSE at 08:11, 0.00s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 08:11 Completed NSE at 08:11, 0.00s elapsed Read data files from: /usr/share/nmap OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 17.15 seconds Raw packets sent: 34 (2.306KB) | Rcvd: 19 (1.506KB) ``` ![](https://i.imgur.com/KYhOXbA.png) Searchor 2.4.0は、RCEの脆弱性を抱えてる ### whatweb ```bash ``` ### Feroxbuster ```bash ``` ### Dirsearch ```bash ``` ### FFUF ```bash ``` ### WebSite * * * ### WebSite Screenshot ## Foothold ```bash ``` ```bash ``` ```bash ``` ```bash ``` ```bash ``` ## Lateral Movement <横方向の動きに関する説明をここに書いてください> ```bash ``` ```bash ``` ```bash ``` ```bash ``` ```bash ``` ## Privilege Escalation ```bash ``` ```bash ``` ```bash ``` ```bash ``` ```bash ``` ```bash ``` ```bash ``` ### Notes <このWriteupで特に重要な点や学んだことを追加で記載するセクション>