search

Intentions

Continue back at home (WORK IN PROGRESS)

hashtag
Nmap scan

$ nmap -sC -sV -Pn -oN nmap 10.10.11.220
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-05-20 21:35 +08
Nmap scan report for 10.10.11.220
Host is up (0.043s latency).
Not shown: 998 closed tcp ports (conn-refused)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.1 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 47:d2:00:66:27:5e:e6:9c:80:89:03:b5:8f:9e:60:e5 (ECDSA)
|_  256 c8:d0:ac:8d:29:9b:87:40:5f:1b:b0:a4:1d:53:8f:f1 (ED25519)
80/tcp open  http    nginx 1.18.0 (Ubuntu)
|_http-server-header: nginx/1.18.0 (Ubuntu)
|_http-title: Intentions
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 8.80 seconds

hashtag
Initial Access

hashtag
2nd Order SQLi vulnerability

We will first save the request to get feed for the user to getfeed.

Then, we will save the request to update the content of the user's feed.

Then we will run it using sqlmap.

However, we will encounter an error after running that command.

If we look at the values each time we update, we will notice that all the whitespaces will be removed. For example, food, travel will become food,travel. So we can counter this by converting spaces to comments using --tamper=space2comment.

It is able to detect that the backend database is MySQL.

Next, we will dump all the data in the database.

We will see that there are 4 different tables in the database.

The first table is migrations.

The second table is users.

The third table is gallery_images.

The last table is personal_access_token.

We only cared about the 2 admin users in the userstable.

However, it does not seems the password is crackable. So we will see if there is another way to use this hash.

hashtag
Hidden API path

Further enumeration in the machine, we will see that there is an admin.js file.

After searching for the keyword password, we came across this.

So we try to see if there is any api path at v2 instead and there are.

We can see that POST request failed as they required both the email and hash parameters.

After following the website on how to do a POST request using Curl, we are able to authenticated as steve.

LogoHow do I post a request using Curl?ReqBinchevron-right

So, we will try to authenticate using the v2 api instead.

It turns out we are able to get into steve's account.

From there, we can go to the admin page.

In the admin page, we can see all the users and images that are stored.

We can see that the image editor they used is imagick.

When we try to edit the image, we can see that the image's path.

When we try to edit the image's path, we will get a bad image path.

hashtag
Imagick Vulnerability

LogoExploiting Arbitrary Object Instantiations in PHP without Custom ClassesPT SWARMchevron-right

The above exploit uses RFI to load some PHP objects for RCE. We can try if the website is vulnerable to this attack.

PreviousLinuxNextBroker

Last updated