Pasindu's Blog

Crocodile - Complete Walkthrough

1 min read

HTB

HTB: Crocodile

Machine IP: 10.129.49.130
Difficulty: Easy
OS: Linux

Tools Used

  • nmap - Port and service enumeration
  • rustscan - Fast port discovery
  • ftp - File transfer protocol client
  • Web browser - Login interface access

Step 1: Reconnaissance - Initial Port Scan

FTP Service Discovery

Initial scan focused on port 21 (FTP)

Result:

Key findings:

  • Anonymous FTP login allowed (vulnerability)
  • Two interesting files discovered:
    • allowed.userlist (33 bytes)
    • allowed.userlist.passwd (62 bytes)

Step 2: FTP Exploitation - Anonymous Access

Connect to FTP Server

Download Sensitive Files

File Contents

cat allowed.userlist

cat allowed.userlist.passwd

Step 3: Web Application Discovery

Full Port Scan

rustscan -a 10.129.49.130

Open ports discovered:

  • Port 21 (FTP)
  • Port 80 (HTTP)

HTTP Service Enumeration

sudo nmap 10.129.49.130 -sV -p 80

Result:

Step 4: Web Login & Flag Capture

Login Page Discovery

Navigate to http://10.129.49.130/login.php

Using credentials discovered from FTP:

  • Username: admin (from allowed.userlist)
  • Password: rKXM59ESxesUFHAd (from allowed.userlist.passwd)

Dashboard Access

After successful login, redirected to /dashboard/index.php Flag obtained: c7110277ac44d78b6a9fff2232434d16

Step 5: Machine Owned

Flags

FlagValue
User/Rootc7110277ac44d78b6a9fff2232434d16

Note: This machine appears to have a single flag accessible after web login.

Attack Chain Summary

Port Scan (21,80)
       ↓
Anonymous FTP Access
       ↓
Download allowed.userlist & allowed.userlist.passwd
       ↓
Extract Credentials (admin / rKXM59ESxesUFHAd)
       ↓
Web Login (login.php)
       ↓
Dashboard Access → Flag Captured

Graph View