Please enable JavaScript.
Coggle requires JavaScript to display documents.
kioptrix 3 (gaining root ((root (/root congrats.txt (download))), echo…
kioptrix 3
gaining root
echo $TERM
export TERM=xterm
ht editor opened
from comp..readme lets try sudo ht
now we can open any file with root
ssh with crack cred loneferet
editing shadow
generate new hash
save exit
root
/root congrats.txt
info gathering/scanning/enum
cms exploit found lotusCMS 3.0-'eval()'
website manual enum
we found LotusCMS
dirb
we found useful info
web server scanning
nikto
found /phpmyadmin
scanning ports and services
nmap
Target Discovery
nmap sn or arp scan
Exploiting/gaining access
Local File inclusion
php scripts are not sanitized
PHP LFI vulnerability
index.php?system=../../../../../etc/passwd
success got /etc/passwd
got shell
1
run the exploit
setting up exploit for use
remote code execution
sql injection
/gallery/gallery.php?id=1&sort=phtoid#photos
–dbs
-D gallery and –tables
searching for inject-able parameters over web
-D gallery -T dev_accounts — dump
--tables
-D mysql -T user –dump -C ‘host, user, password’
got hash for root
brute force and cracking pass
hash cat
dic attack on hash
hydra
cracking kryptox cred
success
found pass reusability
1
local enum and scanning
cat /etc/shadow
failed
/home/loneferret
cat comapanypol..redme
very usefull
sudo ht
failed
dirb /ip/gallery/
gconfig.php has hard coded cred
navigate phpadmin and login as root
got credentials for lonferet
success
cat /etc/passwd
optional
