search

Pebbles

hashtag
Gaining Access

Nmap scan:

$ nmap -p- --min-rate 3000 -Pn 192.168.157.52 
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-16 11:01 +08
Nmap scan report for 192.168.157.52
Host is up (0.17s latency).
Not shown: 65530 filtered tcp ports (no-response)
PORT     STATE SERVICE
21/tcp   open  ftp
22/tcp   open  ssh
80/tcp   open  http
3305/tcp open  odette-ftp
8080/tcp open  http-proxy

FTP doesn't allow for anonymous connections.

hashtag
Web Enum -> SQL Shell

Port 80 shows a login page:

Default creds don't work, so I ran a gobuster scan while moving on. Port 3305 shows a default Apache page:

Ran a gobuster scan on this too while enumerating port 8080, which had Tomcat.

Again we have no credentials. The gobuster scan revealed there was ZoneMinder on both ports:

This version had an SQL Injection exploit:

Here's the exploit:

I proxied the request using Burp and passed it to sqlmap with the --os-shell flag.

This found the limit variable to be vulnerable to SQL Injection and I got a webshell as root. We can then get a reverse shell easily after choosing the 64-bit database management option.

PreviousPaydayNextPelican

Last updated