Web
Nmap discovered a Web server on the target port 80
The running service is Apache httpd 2.4.38
┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/clue]
└─$ curl -I -X OPTIONS http://$IP/
HTTP/1.1 200 OK
Date: Tue, 25 Mar 2025 15:55:25 GMT
Server: Apache/2.4.38 (Debian)
Allow: GET,POST,OPTIONS,HEAD
Content-Length: 0
Content-Type: httpd/unix-directory
┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/clue]
└─$ curl -I http://$IP/
HTTP/1.1 403 Forbidden
Date: Tue, 25 Mar 2025 15:55:29 GMT
Server: Apache/2.4.38 (Debian)
Content-Type: text/html; charset=iso-8859-1/Practice/Clue/2-Enumeration/attachments/{9783F895-8143-48E0-90DA-75C0C0D7F406}.png)
Webroot
403
Fuzzing
┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/clue]
└─$ ffuf -c -w /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt -u http://$IP/FUZZ -ic -e .txt,.html,.php
________________________________________________
:: Method : GET
:: URL : http://192.168.220.240/FUZZ
:: Wordlist : FUZZ: /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt
:: Extensions : .txt .html .php
:: Follow redirects : false
:: Calibration : false
:: Timeout : 10
:: Threads : 40
:: Matcher : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________
.htaccess [Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 22ms]
.htpasswd.php [Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 22ms]
.htpasswd.html [Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 22ms]
.htaccess.php [Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 24ms]
.htpasswd.txt [Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 22ms]
.htpasswd [Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 23ms]
.htaccess.html [Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 24ms]
.htaccess.txt [Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 24ms]
backup [Status: 301, Size: 319, Words: 20, Lines: 10, Duration: 18ms]
server-status [Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 19ms]
:: Progress: [81912/81912] :: Job [1/1] :: 1960 req/sec :: Duration: [0:00:50] :: Errors: 0 ::
┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/clue]
└─$ ffuf -c -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt -recursion -u http://$IP/FUZZ -ic
________________________________________________
:: Method : GET
:: URL : http://192.168.220.240/FUZZ
:: Wordlist : FUZZ: /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt
:: Follow redirects : false
:: Calibration : false
:: Timeout : 10
:: Threads : 40
:: Matcher : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________
[Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 798ms]
backup [Status: 301, Size: 319, Words: 20, Lines: 10, Duration: 18ms]
[INFO] Adding a new job to the queue: http://192.168.220.240/backup/FUZZ
[Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 19ms]
server-status [Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 20ms]
[INFO] Starting queued job on target: http://192.168.220.240/backup/FUZZ
[Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 21ms]
[Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 19ms]
cassandra [Status: 301, Size: 329, Words: 20, Lines: 10, Duration: 18ms]
[INFO] Adding a new job to the queue: http://192.168.220.240/backup/cassandra/FUZZ
[INFO] Starting queued job on target: http://192.168.220.240/backup/cassandra/FUZZ
[Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 19ms]
etc [Status: 301, Size: 333, Words: 20, Lines: 10, Duration: 17ms]
[INFO] Adding a new job to the queue: http://192.168.220.240/backup/cassandra/etc/FUZZ
var [Status: 301, Size: 333, Words: 20, Lines: 10, Duration: 17ms]
[INFO] Adding a new job to the queue: http://192.168.220.240/backup/cassandra/var/FUZZ
usr [Status: 301, Size: 333, Words: 20, Lines: 10, Duration: 19ms]
[INFO] Adding a new job to the queue: http://192.168.220.240/backup/cassandra/usr/FUZZ
[Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 22ms]
[INFO] Starting queued job on target: http://192.168.220.240/backup/cassandra/etc/FUZZ
[Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 20ms]
default [Status: 301, Size: 341, Words: 20, Lines: 10, Duration: 21ms]
[INFO] Adding a new job to the queue: http://192.168.220.240/backup/cassandra/etc/default/FUZZ
security [Status: 301, Size: 342, Words: 20, Lines: 10, Duration: 22ms]
[INFO] Adding a new job to the queue: http://192.168.220.240/backup/cassandra/etc/security/FUZZ
[Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 19ms]
cassandra [Status: 301, Size: 343, Words: 20, Lines: 10, Duration: 25ms]
[INFO] Adding a new job to the queue: http://192.168.220.240/backup/cassandra/etc/cassandra/FUZZ
[INFO] Starting queued job on target: http://192.168.220.240/backup/cassandra/var/FUZZ
[Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 19ms]
log [Status: 301, Size: 337, Words: 20, Lines: 10, Duration: 17ms]
[INFO] Adding a new job to the queue: http://192.168.220.240/backup/cassandra/var/log/FUZZ
lib [Status: 301, Size: 337, Words: 20, Lines: 10, Duration: 18ms]
[INFO] Adding a new job to the queue: http://192.168.220.240/backup/cassandra/var/lib/FUZZ
[Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 20ms]
[INFO] Starting queued job on target: http://192.168.220.240/backup/cassandra/usr/FUZZ
[Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 23ms]
bin [Status: 301, Size: 337, Words: 20, Lines: 10, Duration: 20ms]
[INFO] Adding a new job to the queue: http://192.168.220.240/backup/cassandra/usr/bin/FUZZ
lib [Status: 301, Size: 337, Words: 20, Lines: 10, Duration: 18ms]
[INFO] Adding a new job to the queue: http://192.168.220.240/backup/cassandra/usr/lib/FUZZ
share [Status: 301, Size: 339, Words: 20, Lines: 10, Duration: 19ms]
[INFO] Adding a new job to the queue: http://192.168.220.240/backup/cassandra/usr/share/FUZZ
[Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 17ms]
sbin [Status: 301, Size: 338, Words: 20, Lines: 10, Duration: 19ms]
[INFO] Adding a new job to the queue: http://192.168.220.240/backup/cassandra/usr/sbin/FUZZ
[INFO] Starting queued job on target: http://192.168.220.240/backup/cassandra/etc/default/FUZZ
[Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 19ms]
[Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 22ms]
cassandra [Status: 200, Size: 382, Words: 44, Lines: 8, Duration: 22ms]
[INFO] Starting queued job on target: http://192.168.220.240/backup/cassandra/etc/security/FUZZ
[Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 22ms]
[Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 23ms]
[INFO] Starting queued job on target: http://192.168.220.240/backup/cassandra/etc/cassandra/FUZZ
[Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 19ms]
triggers [Status: 301, Size: 352, Words: 20, Lines: 10, Duration: 19ms]
[INFO] Adding a new job to the queue: http://192.168.220.240/backup/cassandra/etc/cassandra/triggers/FUZZ
[Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 20ms]
[INFO] Starting queued job on target: http://192.168.220.240/backup/cassandra/var/log/FUZZ
[Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 19ms]
[Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 20ms]
cassandra [Status: 301, Size: 347, Words: 20, Lines: 10, Duration: 22ms]
[INFO] Adding a new job to the queue: http://192.168.220.240/backup/cassandra/var/log/cassandra/FUZZ
[INFO] Starting queued job on target: http://192.168.220.240/backup/cassandra/var/lib/FUZZ
[Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 24ms]
[Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 29ms]
cassandra [Status: 301, Size: 347, Words: 20, Lines: 10, Duration: 21ms]
[INFO] Adding a new job to the queue: http://192.168.220.240/backup/cassandra/var/lib/cassandra/FUZZ
[INFO] Starting queued job on target: http://192.168.220.240/backup/cassandra/usr/bin/FUZZ
[Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 29ms]
[Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 30ms]
[INFO] Starting queued job on target: http://192.168.220.240/backup/cassandra/usr/lib/FUZZ
[Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 19ms]
[Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 23ms]
[INFO] Starting queued job on target: http://192.168.220.240/backup/cassandra/usr/share/FUZZ
[Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 19ms]
doc [Status: 301, Size: 343, Words: 20, Lines: 10, Duration: 22ms]
[INFO] Adding a new job to the queue: http://192.168.220.240/backup/cassandra/usr/share/doc/FUZZ
[Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 18ms]
cassandra [Status: 301, Size: 349, Words: 20, Lines: 10, Duration: 18ms]
[INFO] Adding a new job to the queue: http://192.168.220.240/backup/cassandra/usr/share/cassandra/FUZZ
[INFO] Starting queued job on target: http://192.168.220.240/backup/cassandra/usr/sbin/FUZZ
[Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 20ms]
[Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 17ms]
cassandra [Status: 200, Size: 10990, Words: 2451, Lines: 299, Duration: 20ms]
[INFO] Starting queued job on target: http://192.168.220.240/backup/cassandra/etc/cassandra/triggers/FUZZ
[Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 20ms]
[Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 18ms]
[INFO] Starting queued job on target: http://192.168.220.240/backup/cassandra/var/log/cassandra/FUZZ
[Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 22ms]
[Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 20ms]
[INFO] Starting queued job on target: http://192.168.220.240/backup/cassandra/var/lib/cassandra/FUZZ
[Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 20ms]
[Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 21ms]
[INFO] Starting queued job on target: http://192.168.220.240/backup/cassandra/usr/share/doc/FUZZ
[Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 19ms]
[Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 27ms]
cassandra [Status: 301, Size: 353, Words: 20, Lines: 10, Duration: 23ms]
[INFO] Adding a new job to the queue: http://192.168.220.240/backup/cassandra/usr/share/doc/cassandra/FUZZ
[INFO] Starting queued job on target: http://192.168.220.240/backup/cassandra/usr/share/cassandra/FUZZ
[Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 19ms]
lib [Status: 301, Size: 353, Words: 20, Lines: 10, Duration: 18ms]
[INFO] Adding a new job to the queue: http://192.168.220.240/backup/cassandra/usr/share/cassandra/lib/FUZZ
[Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 23ms]
[INFO] Starting queued job on target: http://192.168.220.240/backup/cassandra/usr/share/doc/cassandra/FUZZ
[Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 23ms]
copyright [Status: 200, Size: 403, Words: 47, Lines: 11, Duration: 21ms]
examples [Status: 301, Size: 362, Words: 20, Lines: 10, Duration: 22ms]
[INFO] Adding a new job to the queue: http://192.168.220.240/backup/cassandra/usr/share/doc/cassandra/examples/FUZZ
[Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 54ms]
[INFO] Starting queued job on target: http://192.168.220.240/backup/cassandra/usr/share/cassandra/lib/FUZZ
[Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 18ms]
[Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 18ms]
[INFO] Starting queued job on target: http://192.168.220.240/backup/cassandra/usr/share/doc/cassandra/examples/FUZZ
[Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 19ms]
[Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 19ms]
:: Progress: [207630/207630] :: Job [23/23] :: 2150 req/sec :: Duration: [0:01:49] :: Errors: 0 ::
Based on the results, it would appears that the /backup directory might be mirrored to the backup share in the target Samba server