ClamAV_Web

Web

---

Nmap discovered a Web server on the target port 80 The running service is Apache httpd 1.3.33 ((Debian GNU/Linux))

┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/clamav]
└─$ curl -I -X OPTIONS http://$IP/  
HTTP/1.1 200 OK
Date: Sat, 22 Mar 2025 18:29:42 GMT
Server: Apache/1.3.33 (Debian GNU/Linux)
Content-Length: 0
Allow: GET, HEAD, OPTIONS, TRACE
 
 
┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/clamav]
└─$ curl -I http://$IP/        
HTTP/1.1 200 OK
Date: Sat, 22 Mar 2025 18:29:45 GMT
Server: Apache/1.3.33 (Debian GNU/Linux)
Last-Modified: Thu, 22 Jan 2009 01:57:56 GMT
ETag: "660ee-121-4977d2a4"
Accept-Ranges: bytes
Content-Length: 289
Content-Type: text/html; charset=iso-8859-1

Webroot There are binary strings as well as a very suggestive title; Ph33r

Converting the binary string into ASCII reveals ifyoudontpwnmeuran00b

Fuzzing

---

┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/clamav]
└─$ ffuf -c -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt -recursion -u http://$IP/FUZZ -ic
________________________________________________
 :: Method           : GET
 :: URL              : http://192.168.236.42/FUZZ
 :: Wordlist         : FUZZ: /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________
                        [Status: 200, Size: 289, Words: 21, Lines: 12, Duration: 3182ms]
doc                     [Status: 403, Size: 272, Words: 20, Lines: 11, Duration: 18ms]
index                   [Status: 200, Size: 289, Words: 21, Lines: 12, Duration: 3392ms]
:: Progress: [207630/207630] :: Job [1/1] :: 1923 req/sec :: Duration: [0:02:02] :: Errors: 0 ::

N/A