> For the complete documentation index, see [llms.txt](https://oklencodes.gitbook.io/untitled/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://oklencodes.gitbook.io/untitled/cloud/azure/software-development-environments-and-azure-devops-pipeline-abuse.md).

# Software development environments and Azure DevOps pipeline abuse

Starting with Nmap scan 

<figure><img src="https://2022164620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtzurpgroDJSMn9AFVmQP%2Fuploads%2F2tqADwNGGfRfR9xQLSav%2Fimage.png?alt=media&amp;token=3bac592a-af05-437c-af0a-3fa47f4eaad8" alt=""><figcaption></figcaption></figure>

Nmap output shows that web (IIS), WinRM, and Subversion (svnserve) services are running on the box.<br>

On visiting port 80 we see the default IIS installation page

<figure><img src="https://2022164620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtzurpgroDJSMn9AFVmQP%2Fuploads%2FUojn7fWhPKh5sbEuuSyT%2Fimage.png?alt=media&amp;token=fbf0b77a-f489-447f-a783-9c3f5612ee44" alt=""><figcaption></figcaption></figure>

The availability of port 3690 indicates that an SVN repository is available. We can attempt to interact with it and download files using the svn command.

<figure><img src="https://2022164620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtzurpgroDJSMn9AFVmQP%2Fuploads%2FMzY3k7fC1TmEwuTEnko2%2Fimage.png?alt=media&amp;token=938d69ed-9211-45e6-9a1b-35ab16eb662a" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2022164620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtzurpgroDJSMn9AFVmQP%2Fuploads%2FdmJj5Aj08RwF8FVk9zkR%2Fimage.png?alt=media&amp;token=e2480504-ca8b-469a-8b63-5bba18868778" alt=""><figcaption></figcaption></figure>

Using svn log to to get a detailed log description of what “nathen” has been doing

<figure><img src="https://2022164620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtzurpgroDJSMn9AFVmQP%2Fuploads%2F5Y6iNxbQ0RYQm5dkdwHX%2Fimage.png?alt=media&amp;token=d05bb392-5b82-4a4c-b511-fe5c18d3f2c8" alt=""><figcaption></figcaption></figure>

Now using svn checkout to download them all to my local machine

<figure><img src="https://2022164620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtzurpgroDJSMn9AFVmQP%2Fuploads%2F61gIaLyfm8Vw7UuLZ0kH%2Fimage.png?alt=media&amp;token=55447bee-ecb9-4c47-8e79-363ec7b8c971" alt=""><figcaption></figcaption></figure>

Straight away I can see dimension.work.htb assets – So I listed some more directories to see what was immediately accessible. I saw the moved.txt file and opened it<br>

<figure><img src="https://2022164620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtzurpgroDJSMn9AFVmQP%2Fuploads%2FpziFyJmyKVYO1aCJa70S%2Fimage.png?alt=media&amp;token=6c0d3d2e-672f-459e-b295-8aa595cf3e60" alt=""><figcaption></figcaption></figure>

The website did not lead anywhere

<figure><img src="https://2022164620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtzurpgroDJSMn9AFVmQP%2Fuploads%2FgCBCdMRDI1O57tdghruh%2Fimage.png?alt=media&amp;token=354a8bc2-90e3-453a-b5d1-85ce78ee1fa9" alt=""><figcaption></figcaption></figure>

had to add line 10 to “/etc/hosts”<br>

<figure><img src="https://2022164620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtzurpgroDJSMn9AFVmQP%2Fuploads%2FVCQp2pLky6gxxxa6yQfJ%2Fimage.png?alt=media&amp;token=e1c04f71-a926-4dad-a135-ec4b105e343d" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2022164620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtzurpgroDJSMn9AFVmQP%2Fuploads%2FfEl1eYdRwdlSHesPV7a6%2Fimage.png?alt=media&amp;token=6ec0fe01-75d0-41f7-a976-3ee31e56fb96" alt=""><figcaption></figcaption></figure>

And now the web address works.

<figure><img src="https://2022164620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtzurpgroDJSMn9AFVmQP%2Fuploads%2FRtKhQsBzSzCt0Ftk3UOi%2Fimage.png?alt=media&amp;token=00e9d1e8-a84f-4500-9ef4-c7108a11217f" alt=""><figcaption></figcaption></figure>