> For the complete documentation index, see [llms.txt](https://sovietbeast-writeups.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://sovietbeast-writeups.gitbook.io/writeups/hackthebox/linux/pit.md).
# Pit
## Pit
## Credentials
### Plaintext
| User | Password | Note |
| -------- | ------------- | ------------------------------------------------ |
| michelle | michelle | SeedDMS, dms-pit.htb/seeddms51x/seeddms |
| seeddms | ied^ieY6xoquu | /var/www/html/seeddms51x/conf/settings.xml |
| seeddms | seeddms | sqlite /home/www-data/seeddms51x/data/content.db |
### Hashes
| User | Hash | Note |
| -------- | -------------------------------- | --------------- |
| admin | 155dd275b4cb74bd1f80754b61148863 | from seeddms sb |
| michelle | 2345f10bb948c5665ef91f6773b3e455 | same |
| jack | 682d305fdaabc156430c4c6f6f5cc65d | same |
## Enumeration
### nmap
#### TCP Scan
```bash
# Nmap 7.91 scan initiated Sun May 16 10:02:25 2021 as: nmap -p22,80,9090 -sC -sV -oA nmap/detailed 10.129.107.110
Nmap scan report for 10.129.107.110
Host is up (0.11s latency).
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.0 (protocol 2.0)
| ssh-hostkey:
| 3072 6f:c3:40:8f:69:50:69:5a:57:d7:9c:4e:7b:1b:94:96 (RSA)
| 256 c2:6f:f8:ab:a1:20:83:d1:60:ab:cf:63:2d:c8:65:b7 (ECDSA)
|_ 256 6b:65:6c:a6:92:e5:cc:76:17:5a:2f:9a:e7:50:c3:50 (ED25519)
80/tcp open http nginx 1.14.1
|_http-server-header: nginx/1.14.1
|_http-title: Test Page for the Nginx HTTP Server on Red Hat Enterprise Linux
9090/tcp open ssl/zeus-admin?
| fingerprint-strings:
| GetRequest, HTTPOptions:
| HTTP/1.1 400 Bad request
| Content-Type: text/html; charset=utf8
| Transfer-Encoding: chunked
| X-DNS-Prefetch-Control: off
| Referrer-Policy: no-referrer
| X-Content-Type-Options: nosniff
| Cross-Origin-Resource-Policy: same-origin
|
|
|
|
| request
|
|
|
|