Crocodile Machine Checklist
1️⃣ Lab Setup & Scope
- HTB OpenVPN Connected
- Target machine spawned/running
- Target IP identified:
10.129.104.153 - PING check successful
- Legal HTB Lab session verified
2️⃣ Network Discovery
- Target IP confirmed:
10.129.104.153 - Local HTB IP identified
3️⃣ Port Scanning
- All 65535 ports scanned (Rustscan ports: 21, 80)
- Service versions and default scripts detected
4️⃣ Service Enumeration
FTP (Port 21)
- Anonymous login tested & successful
- Directory listing checked
- Sensitive files exfiltrated (
allowed.userlist,allowed.userlist.passwd)
HTTP (Port 80)
- Landing page identified
- Directory bursting performed (Gobuster)
- Hidden portals found (
login.php,dashboard/)
5️⃣ Vulnerability Identification
- Path identified (Information disclosure via FTP + Internal portal found)
6️⃣ Initial Access (Foothold)
- Portal login successful with leaked credentials
- Dashboard access obtained
7️⃣ Post-Exploitation Enumeration
- Flag retrieved from dashboard
8️⃣ Privilege Escalation
- Not Required (Direct access to high-privileged admin portal)
9️⃣ Flags / Proof of Compromise
- Flag found & submitted:
c7110277... - Evidence captured (Screenshots organized)
🔟 Cleanup & Documentation
- Notes completed in Obsidian
- Screenshots organized in
evidence/
🏁 Machine Completion Status
- Pwned ✅
- Flags Submitted to HTB ✅
➡️ Machine SOLVED 🏆