> For the complete documentation index, see [llms.txt](https://writeups.adityadindi.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://writeups.adityadindi.com/tryhackme/untitled/source.md).

# Source

![](/files/-McRCiE5JA2L-1r1DrDY)

## Reconnaissance

Initial nmap scan to find open ports , using the flag "treat all hosts as alive" (**-Pn**)

```
nmap -Pn 10.10.184.138
```

![](/files/-McRDyfpv0s4VOWp64BT)

Detailed Nmap Scan : 

Command Breakdown: 

* (**-sV):** Service version
* (**-sC**): Default nmap scripts
* (**-p):** Specifying ports 22,10000
* (**-oN nmap**): Saving it into a file called nmap

```
nmap -sV -sC -p 22,10000 -oN nmap 10.10.184.138
```

![](/files/-McRE9U3Yy2ctO82z9Ah)

## Enumeration

Lets visit the site on port 10000

![](/files/-McREZza9Fg88URLlEr-)

Looks like we should go to `https//<ip>`, lets do that

![](/files/-McRFC-hsNbo5iulPK6e)

Lets go to Advanced and hit Accept Risk and Continue

![](/files/-McRFJCuWAhbqx3fuuw7)

We have a login page. We do not have credentials so lets go to searchsploit and look for exploits on the application and the specific version we see in the nmap scan. I searched for it on searchsploit and got nothing back

![](/files/-McRH6RVT6rZpLIuF8S8)

So I went to Google and looked for exploit and found [this](https://github.com/foxsin34/WebMin-1.890-Exploit-unauthorized-RCE/blob/master/webmin-1.890_exploit.py). Its a python script , lets copy it to our machine and call is `exploit.py`

![](/files/-McRIBS-pJiVTdKfU_Hr)

They show how to use it as well, so lets go ahead and use it.

![](/files/-McRILcUl0xIVJKC3FGH)

In the end they give us the option of sending a command, we sent id and it worked, lets read the user flag and the root flag.

![](/files/-McRIuMblQc_6vjpF8Kr)

We have both the flags.