https://www.youtube.com/watch?v=AMtkX3qWKOU&ab_channel=c3p0d4y

FLAG1

921e4db975bda77543cfe83fbe176d15e09ce7e2

FLAG2

e39c995fbf614c5c38ca7343f59cc310e5880251

FLAG3

73ce6cecfc1109f1e43d379fd9922dcc699af321

Enumeration

rustscan -a 10.150.150.57

PORT   STATE SERVICE REASON
22/tcp open  ssh     syn-ack
53/tcp open  domain  syn-ack
80/tcp open  http    syn-ack

nmap -sC -sV 10.150.150.57 -p 22,53,80

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4 (Ubuntu Linux; protocol 2.0)
53/tcp open  domain  ISC BIND 9.16.1 (Ubuntu Linux)
| dns-nsid: 
|_  bind.version: 9.16.1-Ubuntu
80/tcp open  http    Apache httpd 2.4.41
| http-ls: Volume /
| SIZE  TIME              FILENAME
| 147   2020-06-10 11:25  note.html
|_
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: Index of /
Service Info: Host: 127.0.1.1; OS: Linux; CPE: cpe:/o:linux:linux_kernel

dig axfr @10.150.150.57 mortysserver.com

; <<>> DiG 9.16.1-Ubuntu <<>> axfr @10.150.150.57 mortysserver.com
; (1 server found)
;; global options: +cmd
mortysserver.com.	900	IN	SOA	10.150.150.57. email.mortysserver.com. 1 900 900 604800 900
mortysserver.com.	900	IN	NS	10.150.150.57.
rickscontrolpanel.mortysserver.com. 900	IN A	10.150.150.57
mortysserver.com.	900	IN	SOA	10.150.150.57. email.mortysserver.com. 1 900 900 604800 900
;; Query time: 187 msec
;; SERVER: 10.150.150.57#53(10.150.150.57)
;; WHEN: Sun Jan 30 00:03:38 +08 2022
;; XFR size: 4 records (messages 1, bytes 212)

Exploitation

After adding the following line to our /etc/hosts we can visit the following site

10.150.150.57 mortysserver.com

Original Picture