> For the complete documentation index, see [llms.txt](https://bunring.gitbook.io/ctf-writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://bunring.gitbook.io/ctf-writeups/try-hack-me/2024/clocky.md). # Clocky {% embed url="" %} ## Recon Let's sstart with a nmap scan ``` ┌──(kali㉿kali)-[~] └─$ nmap -p- -T4 10.10.24.33 Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-04-01 02:00 EDT Nmap scan report for clocky.thm (10.10.24.33) Host is up (0.17s latency). Not shown: 65531 closed tcp ports (conn-refused) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 8000/tcp open http-alt 8080/tcp open http-proxy Nmap done: 1 IP address (1 host up) scanned in 430.93 seconds ``` {% code overflow="wrap" %} ``` ┌──(kali㉿kali)-[~] └─$ nmap -sC -sV -p 22,80,8000,8080 -T4 10.10.24.33 Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-04-01 02:35 EDT Nmap scan report for clocky.thm (10.10.24.33) Host is up (0.16s latency). PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.9 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 3072 d9:42:e0:c0:d0:a9:8a:c3:82:65:ab:1e:5c:9c:0d:ef (RSA) | 256 ff:b6:27:d5:8f:80:2a:87:67:25:ef:93:a0:6b:5b:59 (ECDSA) |_ 256 e1:2f:4a:f5:6d:f1:c4:bc:89:78:29:72:0c:ec:32:d2 (ED25519) 80/tcp open http Apache httpd 2.4.41 |_http-server-header: Apache/2.4.41 (Ubuntu) |_http-title: 403 Forbidden 8000/tcp open http nginx 1.18.0 (Ubuntu) |_http-title: 403 Forbidden | http-robots.txt: 3 disallowed entries |_/*.sql$ /*.zip$ /*.bak$ |_http-server-header: nginx/1.18.0 (Ubuntu) 8080/tcp open http-proxy Werkzeug/2.2.3 Python/3.8.10 |_http-title: Clocky | fingerprint-strings: | GetRequest: | HTTP/1.1 200 OK | Server: Werkzeug/2.2.3 Python/3.8.10 | Date: Mon, 01 Apr 2024 06:35:09 GMT | Content-Type: text/html; charset=utf-8 | Content-Length: 6206 | Connection: close | |