Ide

Ide

🔍 Port Scanning & FTP Enumeration

🕵️ First, run an nmap scan:

💻 As you can see, it is running Codiad 2.8.4. I searched for vulnerabilities, but we need login credentials to exploit them. Therefore, I checked the FTP server as an anonymous user first:

📂 As you can see, there is a file inside the FTP directory named ....

🔑 The username is john, but we don’t know the password yet. So, I brute-forced it using Caido: The password is password.

🕵️ Codiad Exploitation

💡 Now that we have the credentials, let’s try the exploit. I downloaded the exploit code from Exploitdb:

⚡ As you can see, I got a shell. You need to run both commands they provided:

⚡ SSH & Privilege Escalation

📌 I then used that password to SSH as user drac:

🛠️ Then, I edited the service file: