> For the complete documentation index, see [llms.txt](https://lyethar.gitbook.io/dvr4/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://lyethar.gitbook.io/dvr4/enumeration/web-services.md).

# Web Services

This is vulnerable to Direcotry traversal. 

```
Argus Surveillance DVR
```

{% embed url="<https://www.exploit-db.com/exploits/45296>" %}

The only port of entry that I could see here is SSH so maybe we could either:

Grab SAM SYSTEM to get a secretsdump

We could also possibly grab those SSH Keys.&#x20;

OK so update:

I am able to grab the flag which probably means that I have some sort of administrative access?

And if so

maybe ill just grab the sam system like i did with one of the lab machines in the pwk.