Lazy Admin
A VM with a web server in which the admin was pretty lazy and left a few interesting files for us to see...
Last updated
A VM with a web server in which the admin was pretty lazy and left a few interesting files for us to see...
Last updated
This room can be found .
First, we run an nmap scan.
It seems ports 22 & 80 are open. Let's check out port 80.
Seems like a simple Apache default page. Nothing really interesting. Let's enumerate.
I'll use dirsearch for enumeration.
Looking at the results, we see a /content directory, let's take a look at it.
Okay, so we have a SweetRice CMS installed, let's take a peek by running another enumeration scan on the /content directory. This time I'll use gobuster.
It seems we have multiple directories here, let's take a look at the /as one first.
We have a login page, but for now we don't have an account to login with, so let's keep exploring. I want to take a look at the /inc page, it seems interesting.
Well, this seems promising! It appears we have access to quite a lot of files! But what catches my attention is this mysql_backup folder here. If we actually have a MySQL database dump of the website, we might be able to retrieve usernames and passwords.
It turns out we actually have a mysql dump! Let's download and inspect it.
Looking inside the sql dump of the database we find some interesting things.
Well what do we have here? A username (either admin or manager) and an encrypted password. The password is probably encrypted with md5 so I'll use hashcat to decrypt it.
And just like that, we have our password! Let's try and login with these credentials on the /as page.
Lo and behold, we have access to the admin dashboard! Exploring the dashboard, something peeks my interest, and it it the Data -> Data Import tab.
It looks like we can import files here where the mysql_backup folder is located. With this, we might be able to upload a php reverse shell and gain access to the machine. Let's try to upload one now. I'll use the one provided by Kali, which is located here: /usr/share/webshells/php/php-reverse-shell.php.
I'll edit the IP field with mine and use the 4444 port and upload it. When uploading the file, the website didn't seem to accept php files, so I changed the extension to .php5.
We have successfully uploaded our reverse shell! Let's check the mysql_backup folder once again to see our file.
We indeed have our reverse shell here! To gain access to the machine, all we have to do now is use netcat on our host (nc -nlvp 4444) and execute the reverse shell.
All right! We now have access to the machine as the www-data user. Let's explore first, I'l go to the /home directory to check if the user flag is there.
Let's see what we can do with our user by running the sudo -l command.
It looks like we can run sudo without password on a backup Perl script located in itguy's home folder, let's take a look inside the script.
The script seems to call another script called copy.sh, let's take a look inside.
Uh, okay... For some reason this is a reverse shell... Which we can run as sudo? Let's check if we can edit it.
We actually can! Let's replace the IP inside the script with our own and initiate a reverse shell as root! I'll use port 4433 this time.
We have a root shell! Let's retrieve the flag in the /root directory.
And with that, we have our user flag!
And that is the root flag!
