# The Bandit Surfer {% embed url="" %} All banner and comic images are courtesy of TryHackMe -

https://tryhackme.com/

The following post by 0xb0b is licensed under [CC BY 4.0](http://creativecommons.org/licenses/by/4.0/?ref=chooser-v1) ## Getting to SQ4 - The QR Code The QR Code to Side Quest 3 can be found in the Challenge `Task 27 [Day 21] DevSecOps Yule be Poisoned: A Pipeline of Insecure Code!` We look at the merge requests to understand what happened there as part of the challenge.
Within this one merge request we find the user Frostlino, let's have a look at his activity feed.
He deleted a branch there, ok, maybe the QR code could be hidden here.
In the images' directory, we find the defaced image as well as the original.
And lo and behold, the original image contains the QR code for the challenge.
## Breaking Into the Best Festival Company OK, let's start with side quest number 4 and see what we have in front of us. ### Recon We start with a Nmap scan and find only two open ports. SSH is running on port 22 and a web server on port 8000.
The service scan provides us with further important information, including the fact that OpenSSH 8.2p1 is in use and that the web server is a Python `Werkzeug` web server, often associated with `flask` web applications. ```bash ┌──(0xb0b㉿kali)-[~/Documents/tryhackme/sidequest/quest4] └─$ sudo nmap -sV -p 22,8000 10.10.65.23 Starting Nmap 7.94SVN ( https://nmap.org ) at 2023-12-22 10:09 EST Nmap scan report for localhost (10.10.65.23) Host is up (0.036s latency). PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.9 (Ubuntu Linux; protocol 2.0) 8000/tcp open http-alt Werkzeug/3.0.0 Python/3.8.10 1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service : SF-Port8000-TCP:V=7.94SVN%I=7%D=12/22%Time=6585A692%P=x86_64-pc-linux-gnu% SF:r(GetRequest,787,"HTTP/1\.1\x20200\x20OK\r\nServer:\x20Werkzeug/3\.0\.0 SF:\x20Python/3\.8\.10\r\nDate:\x20Fri,\x2022\x20Dec\x202023\x2015:09:02\x SF:20GMT\r\nContent-Type:\x20text/html;\x20charset=utf-8\r\nContent-Length SF::\x201752\r\nConnection:\x20close\r\n\r\n\n\n\n\x20\x20\x20\x20\n\x20\ SF:x20\x20\x20\n\x20\x20\x20\x20The\x20BFG\n\x SF:20\x20\x20\x20