Last updated
Last updated
Lets start with nmap
Next is Nikto - Nikto is an Open Source (GPL) web server scanner which performs comprehensive tests against web servers:
Next we will enumerate some directories with Dirb - DIRB is a Web Content Scanner. It looks for existing (and/or hidden) Web Objects. It basically works by launching a dictionary based attack against a web server and analyzing the response
This allows us to quickly locate interesting directories such as admin portals:
We also find the find site. This site has a lot of words. I think this is a perfect time for CeWL.
After fuzzing with dirb i came across this information on /to.txt
I'm thinking that fergus might be a username. Also after doing a quick google I came across this exploit:
There are a couple of ruby requirements for this exploit so lets install them now.
Lets give this exploit a try:
With these creds we how have access to the admin portal. After googling "blundit admin portal exploit" I came across this article:
Looks like there is also a Metasploit moduleshell
Lets stablize this shell
Lets begin our enumeration both manually and automated. To automate we will use linenum.sh:
Grep the contents on the application looking for phrases such as auth, password, and key we come across this result for users.php
Lets user hash-identifier to see what we are dealing with here:
This hash can be cracked online. Let use the password to access the system with this user.
Lets locate the user flag now that we have access outside of our php shell.
We can check our sudo permission using sudo -l
After some googling we come across this exploit:
They don't come any easier than this. Looks like our privilege escalation require this one line of code - sudo -u#-1 /bin/bash
HTB Writer Up
