HTB - UnderPass

1
sudo nmap -p- --open --min-rate 5000 -sS -n -vvv -Pn 10.10.11.48 -oG allPorts
2
nmap -sCV -p 22,80 10.10.11.48 -oN targeted

1
version: "3"
2

3
services:
4

5
  radius-mysql:
6
    image: mariadb:10
7
    container_name: radius-mysql
8
    restart: unless-stopped
9
    environment:
10
      - MYSQL_DATABASE=radius
11
      - MYSQL_USER=radius
12
      - MYSQL_PASSWORD=radiusdbpw
13
      - MYSQL_ROOT_PASSWORD=radiusrootdbpw
14
    volumes:
15
      - "./data/mysql:/var/lib/mysql"
16

17
  radius:
18
    container_name: radius
19
    build:
20
      context: .
21
      dockerfile: Dockerfile-freeradius
22
    restart: unless-stopped
23
    depends_on:
24
      - radius-mysql
25
    ports:
26
      - '1812:1812/udp'
27
      - '1813:1813/udp'
28
    environment:
29
      - MYSQL_HOST=radius-mysql
30
      - MYSQL_PORT=3306
31
      - MYSQL_DATABASE=radius
32
      - MYSQL_USER=radius
33
      - MYSQL_PASSWORD=radiusdbpw
34
      # Optional settings
35
      - DEFAULT_CLIENT_SECRET=testing123
36
    volumes:
37
      - ./data/freeradius:/data
38
    # If you want to disable debug output, remove the command parameter
39
    command: -X
40

41
  radius-web:
42
    build: .
43
    container_name: radius-web
44
    restart: unless-stopped
45
    depends_on:
46
      - radius
47
      - radius-mysql
48
    ports:
49
      - '80:80'
50
      - '8000:8000'
51
    environment:
52
      - MYSQL_HOST=radius-mysql
53
      - MYSQL_PORT=3306
54
      - MYSQL_DATABASE=radius
55
      - MYSQL_USER=radius
56
      - MYSQL_PASSWORD=radiusdbpw
57
      # Optional Settings:
58
      - DEFAULT_CLIENT_SECRET=testing123
59
      - DEFAULT_FREERADIUS_SERVER=radius
60
      - MAIL_SMTPADDR=127.0.0.1
61
      - MAIL_PORT=25
62
      - MAIL_FROM=root@daloradius.xdsl.by
63
      - MAIL_AUTH=
64

65
    volumes:
66
      - ./data/daloradius:/data

1
Target: http://10.10.11.48/
2

3
[12:24:00] Starting: daloradius/app/
4

5
[12:25:43] 301 -  326B  - /daloradius/app/common  ->  http://10.10.11.48/daloradius/app/common/
6
[12:28:54] 301 -  325B  - /daloradius/app/users  ->  http://10.10.11.48/daloradius/app/users/
7
[12:28:54] 302 -    0B  - /daloradius/app/users/  ->  home-main.php
8
[12:28:54] 200 -    2KB - /daloradius/app/users/login.php
9

10
Task Completed

1
dirsearch -u "http://10.10.11.48/daloradius/app/" -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -t 50