> For the complete documentation index, see [llms.txt](https://bunring.gitbook.io/ctf-writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://bunring.gitbook.io/ctf-writeups/try-hack-me/2025/the-sticker-shop.md). # The Sticker Shop {% embed url="" %} ## Recon We begin with an Nmap scan and discover two open ports: port `22`, which hosts an `SSH` service, and port `8080`, running a Python `Werkzeug` server featuring a cat sticker shop. {% code overflow="wrap" %} ```bash ┌──(kali㉿kali)-[~] └─$ nmap -p- stickershop.thm -T4 Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-02-11 11:38 IST Nmap scan report for stickershop.thm (10.10.42.251) Host is up (0.15s latency). Not shown: 65506 closed tcp ports (conn-refused), 27 filtered tcp ports (no-response) PORT STATE SERVICE 22/tcp open ssh 8080/tcp open http-proxy Nmap done: 1 IP address (1 host up) scanned in 823.41 seconds ┌──(kali㉿kali)-[~] └─$ nmap -sC -sV -p 22,8080 stickershop.thm -T4 Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-02-11 11:55 IST Nmap scan report for stickershop.thm (10.10.42.251) Host is up (0.15s latency). PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.9 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 3072 b2:54:8c:e2:d7:67:ab:8f:90:b3:6f:52:c2:73:37:69 (RSA) | 256 14:29:ec:36:95:e5:64:49:39:3f:b4:ec:ca:5f:ee:78 (ECDSA) |_ 256 19:eb:1f:c9:67:92:01:61:0c:14:fe:71:4b:0d:50:40 (ED25519) 8080/tcp open http-proxy Werkzeug/3.0.1 Python/3.8.10 |_http-server-header: Werkzeug/3.0.1 Python/3.8.10 |_http-title: Cat Sticker Shop | fingerprint-strings: | GetRequest: | HTTP/1.1 200 OK | Server: Werkzeug/3.0.1 Python/3.8.10 | Date: Tue, 11 Feb 2025 06:25:12 GMT | Content-Type: text/html; charset=utf-8 | Content-Length: 1655 | Connection: close | | | | Cat Sticker Shop |