$ nmap -p- --min-rate 5000 10.129.85.248
Starting Nmap 7.93 ( https://nmap.org ) at 2023-05-06 12:14 EDT
Nmap scan report for 10.129.85.248
Host is up (0.0063s latency).
Not shown: 65532 closed tcp ports (conn-refused)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
Blog Enum + Joomla
The page was some type of blog.
In one of the posts, there's a user called floris.
The page source also had a hidden file:
Within it, it had a base64-encoded string. We can pipe the output and decode it:
$ curl http://10.129.85.248/secret.txt | base64 -d
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 17 100 17 0 0 941 0 --:--:-- --:--:-- --:--:-- 944
Curling2018!
Can't use these for now, so let's run a gobuster scan as well.
So this was reading the URL from a file and outputting it elsewhere. The command uses the config command, which one can read more here:
Essentially, we can specify extra tags here, like --output as output and so on.
# --- Example file ---
# this is a comment
url = "example.com"
output = "curlhere.html"
user-agent = "superagent/1.0"
# and fetch another URL too
url = "example.com/docs/manpage.html"
-O
referer = "http://nowhereatall.example.com/"
# --- End of example file ---
This means that we can download any files as root since root is the one who is running the commands by changing the curl configuration file used (which we conveniently have write access over).
This means we can overwrite files like /etc/passwd and add new root users to the machine. First, we would need to get a copy of the /etc/passwd of the machine onto ours, and append this line to it:
This would create a new user within the /etc/passwd file called innocent with a password of password123. Then we need to change the configuration files to this and start a HTT Pserver:
