[rnoc]

For the people that have troubles with the ssh password......

you need to keep in mind that when you dump the db, that the DB uses tables so it will write the entrys like "entry1entry2" instead of DHRF "Entry1|Entry2"
So in short the dumped version of the database is writing usernamepassword instead of username|password.

DHRF stands for Dumb Human Readable Format.

[chickensaladsand]

- in the source code we find the location of the sqlite db and we can use the above exploit to read it
- decode the hex and get the password for emily 'abigchonkyboi123'
- then ssh into the box to get user.txt
- transport `linpeas.sh` and `pspy64` to start recon on the box
- also check default locations and check for suid bins
- pspy64 && linpeas
- see that whenever a file is uploaded /usr/sbin/malwarescan.sh is run

#!/bin/bash

blacklist=("Executable script" "Microsoft executable")

/usr/bin/inotifywait -m -e create /var/www/pilgrimage.htb/shrunk/ | while read FILE; do
filename="/var/www/pilgrimage.htb/shrunk/$(/usr/bin/echo "$FILE" | /usr/bin/tail -n 1 | /usr/bin/sed -n -e 's/^.*CREATE //p')"
binout="$(/usr/local/bin/binwalk -e "$filename")"
        for banned in "${blacklist[@]}"; do
if [[ "$binout" == *"$banned"* ]]; then
/usr/bin/rm "$filename"
break
fi
done
done

- this script is run by root so any thing run by this script would automatically be root
- we see that binwalk is stored in /local and checking its version its vuln to rce
- download the PoC using searchsploit and create you malicious image
- cp the image into the /var/www/pilgrimage/shrunk folder and upload a new file to trigger the script
- at the same time start a netcat shell and catch the reverse shell from the rce
- get root.txt

Great! Thanks for the concise guide. I didn't need to upload a new file to trigger the final exploit, as soon as I used scp to transfer the exploit image to the inotifywait directory, the reverse shell triggered and my netcat listener picked up the shell.

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: he post combolist in database forum

[w3soul]

Writeup - https://www.youtube.com/watch?v=zN5HILuAVnI

Enjoy!

[nullvoid]

- in the source code we find the location of the sqlite db and we can use the above exploit to read it
- decode the hex and get the password for emily 'abigchonkyboi123'
- then ssh into the box to get user.txt
- transport `linpeas.sh` and `pspy64` to start recon on the box
- also check default locations and check for suid bins
- pspy64 && linpeas
- see that whenever a file is uploaded /usr/sbin/malwarescan.sh is run

#!/bin/bash

blacklist=("Executable script" "Microsoft executable")

/usr/bin/inotifywait -m -e create /var/www/pilgrimage.htb/shrunk/ | while read FILE; do
filename="/var/www/pilgrimage.htb/shrunk/$(/usr/bin/echo "$FILE" | /usr/bin/tail -n 1 | /usr/bin/sed -n -e 's/^.*CREATE //p')"
binout="$(/usr/local/bin/binwalk -e "$filename")"
        for banned in "${blacklist[@]}"; do
if [[ "$binout" == *"$banned"* ]]; then
/usr/bin/rm "$filename"
break
fi
done
done

- this script is run by root so any thing run by this script would automatically be root
- we see that binwalk is stored in /local and checking its version its vuln to rce
- download the PoC using searchsploit and create you malicious image
- cp the image into the /var/www/pilgrimage/shrunk folder and upload a new file to trigger the script
- at the same time start a netcat shell and catch the reverse shell from the rce
- get root.txt

Great! Thanks for the concise guide. I didn't need to upload a new file to trigger the final exploit, as soon as I used scp to transfer the exploit image to the inotifywait directory, the reverse shell triggered and my netcat listener picked up the shell.

gg m8

[Addka72424]

The last non-spam response in the topic was more than a month ago. I close the topic as irrelevant to prevent spam. If this is not the case, please send a pm and I will open the topic for discussion again.