Las Vegas is gearing up for a massive cybersecurity conference, and you've been hired to conduct a penetration test against one of the casinos. The client - Hack Smarter World - is a luxury resort where many of the attendees will be staying. Your objective is to identify all vulnerabilities and elevate your privileges to root (if possible).
As always begin with our detailed nmap scan
you can use rustscan as well
rustscan -b 500 -a 10.1.227.96 --top -- -sC -sV -Pn
nmap -sC -sV -p- -Pn -O -A --min-rate 10000 10.1.220.107
Starting Nmap 7.95 ( <https://nmap.org> ) at 2026-08-24 06:11 EDT
Nmap scan report for 10.1.220.107
Host is up (0.22s latency).
Not shown: 65532 closed tcp ports (reset)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 9.6p1 Ubuntu 3ubuntu13.18 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 0d:7a:09:95:b3:ca:4a:4e:29:8e:2e:b5:86:b4:a4:59 (ECDSA)
|_ 256 3b:82:16:8c:24:cb:32:13:1b:93:f9:ee:5c:14:77:a4 (ED25519)
80/tcp open http Werkzeug httpd 3.1.8 (Python 3.10.18)
| http-title: Hack Smarter World - Guest WiFi & Portal
|_Requested resource was /login
|_http-server-header: Werkzeug/3.1.8 Python/3.10.18
2222/tcp open ssh OpenSSH 8.4p1 Debian 5+deb11u7 (protocol 2.0)
| ssh-hostkey:
| 3072 7d:c5:f5:ba:03:3e:f0:76:5c:9d:47:b6:39:b5:c7:a4 (RSA)
| 256 ed:5d:fa:ea:74:a0:56:b1:39:59:fc:c5:22:1e:5e:bd (ECDSA)
|_ 256 50:31:d9:54:80:42:b8:44:cb:40:66:ea:cf:8f:cf:37 (ED25519)
No exact OS matches for host (If you know what OS is running on it, see <https://nmap.org/submit/> ).
TCP/IP fingerprint:
OS:SCAN(V=7.95%E=4%D=8/24%OT=22%CT=1%CU=30335%PV=Y%DS=3%DC=T%G=Y%TM=6A8C18E
OS:9%P=x86_64-pc-linux-gnu)SEQ(CI=Z)SEQ(SP=101%GCD=1%ISR=110%TI=Z%CI=Z%TS=2
OS:1)SEQ(SP=103%GCD=1%ISR=109%TI=Z%CI=Z%II=I%TS=21)SEQ(SP=105%GCD=1%ISR=10A
OS:%TI=Z%CI=Z%II=I%TS=21)SEQ(SP=105%GCD=1%ISR=10C%TI=Z%CI=Z%II=I%TS=22)OPS(
OS:O1=M510ST11NW7%O2=M510ST11NW7%O3=M510NNT11NW7%O4=M510ST11NW7%O5=M510ST11
OS:NW7%O6=M510ST11)WIN(W1=F4B3%W2=F4B3%W3=F4B3%W4=F4B3%W5=F4B3%W6=F4B3)ECN(
OS:R=Y%DF=Y%T=40%W=F507%O=M510NNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=AS
OS:%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R=
OS:Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=
OS:R%O=%RD=0%Q=)T7(R=N)U1(R=N)U1(R=Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RI
OS:PCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD=S)
Network Distance: 3 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
TRACEROUTE (using port 554/tcp)
HOP RTT ADDRESS
1 217.82 ms 10.200.0.1
2 ...
3 221.34 ms 10.1.220.107
OS and Service detection performed. Please report any incorrect results at <https://nmap.org/submit/> .
Nmap done: 1 IP address (1 host up) scanned in 48.92 seconds
i ran gobuster to scan dir and fuff to fuzzing subdomains but bad luck nothing found juicy so lets dig into the source code first
lets run feroxbuster
200 GET 2l 9w 171c http://10.1.220.107/static/js/app.min.js
lets see
uh huh ,
function initPortal(){console.log("Hack Smarter World WiFi Gateway Active");}document.addEventListener("DOMContentLoaded",initPortal);
//# sourceMappingURL=app.min.js.map
{
"version": 3,
"file": "app.min.js",
"sources": ["src/api/roomVerification.js"],
"sourcesContent": [
"// Front-Desk Kiosk API verification helper\nasync function checkRoomStatus(roomNum) {\n const res = await fetch('/api/v1/rooms/status?status=occupied');\n return await res.json();\n}"
]
}
This means we can view the occupied rooms ?
lets see…
and guess what yes we can…
lets pick one user and try to access the dashboard behind the logic screen
woop woop !
