Payday

Gaining Access

Nmap scan:

$ nmap -p- --min-rate 3000 -Pn 192.168.157.39 
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-14 13:42 +08
Nmap scan report for 192.168.157.39
Host is up (0.18s latency).
Not shown: 65527 closed tcp ports (conn-refused)
PORT    STATE SERVICE
22/tcp  open  ssh
80/tcp  open  http
110/tcp open  pop3
139/tcp open  netbios-ssn
143/tcp open  imap
445/tcp open  microsoft-ds
993/tcp open  imaps
995/tcp open  pop3

CS-Cart -> RCE

Port 80 was running InternetShop CS-Cart, which looks really vulnerable:

There are loads of exploits for this:

We can take a look at the authenticated RCE, since we can login using admin:admin.

We can then access admin.php with the same credentials:

Head to 'Template Editor' and upload the file that we want.

Then, just run this:

And we would get a reverse shell:

Privilege Escalation

Weak Creds -> Root

We can su to the user patrick using the password patrick. This user can run sudo for everything:

PreviousNukemNextPebbles

Last updated