> For the complete documentation index, see [llms.txt](https://oklencodes.gitbook.io/untitled/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://oklencodes.gitbook.io/untitled/ctfs/explore-android-box/enumeration.md).

# Enumeration

![](https://2022164620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtzurpgroDJSMn9AFVmQP%2Fuploads%2F2h2e1IErQM1JW5Rgpqxh%2Fimage%201.PNG?alt=media\&token=5c815125-80d7-46da-8265-9b557b993400)

When I first ran the nmap scan i only discovered 2 ports - 2222 -ssh banana studio and port 5555 which was filtered. Which means I could not connect to it. So I widened the ths scan and found port 59777

![](https://2022164620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtzurpgroDJSMn9AFVmQP%2Fuploads%2FWTjPKcYJyv2VzHbL1Q6m%2Fimage%202.PNG?alt=media\&token=0062b8e1-30d4-4489-8e1e-be43a82d40fb)

![](https://2022164620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtzurpgroDJSMn9AFVmQP%2Fuploads%2F4yDo5nRT9ploaDqTbzwd%2Fimage%203.PNG?alt=media\&token=5359b88d-0c41-49df-92b8-e9643e31bd3e)

I googled the port and found there was vulnerability on it. Specifically a script allowing me to read files.

I saved the script to a python file by typing "vi exploit.py" after copying it from the exploit db, then i used cat to see the script in the terminal and see what commands I could find. Which should me a few but i decided to start with "getDeviceInfo" as it could allow me to avoid any unnecessary commands.