Recon

• Target : 192.168.1.138

simple network map scan:

nmap -sS -sV -T5 192.168.1.138 -p-

Notes:

• Open ports 80, 8080, 22
• Versions : OpenSSH 7.9p1 , Apache httpd 2.4.38

Starting with a simple look on the browser:

Followed with Fuzzing on the target:

The fuzzing reveals a/backend path that redirect us to /backend/backend/auth/signin

→ Exposed Admin panel for OctoberCMC