search
Page cover

Ollie (SQLI, Permission)

First, we need to enumerate using nmap.

╭─hnl@hnl ~/Desktop/ctf/tryhackme/ollie  
╰─➤  nmap -A 10.10.20.38 | tee nmap.log
Starting Nmap 7.80 ( https://nmap.org ) at 2022-04-16 14:50 +0630
Nmap scan report for 10.10.20.38
Host is up (0.24s latency).
Not shown: 998 closed ports
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.4 (Ubuntu Linux; protocol 2.0)
80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
| http-robots.txt: 2 disallowed entries 
|_/ /immaolllieeboyyy
|_http-server-header: Apache/2.4.41 (Ubuntu)
| http-title: Ollie :: login
|_Requested resource was http://10.10.20.38/index.php?page=login
|_https-redirect: ERROR: Script execution failed (use -d to debug)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 97.78 seconds

Rustscan result show me all open ports.

When i answer random question on port 1337, i got some credentials.

When I login using this creds on http://10.10.20.38, I successfully login.

After this, we will see the admin dashboard.

Here is the article for poc https://fluidattacks.com/advisories/mercury/. You can read ubuntu version through SQLI.

Check if user have read or write access. You will see all is Y.

Write evil php on the system. We got error, it is still ok.

We can check our RCE is success or not?

Get a shell from victim using mkfifo.

In netcat session, we got reverse shell.

We found user.txt on /home/ollie. The only one we got is permission error.

We can move to ollie user, with the password that we seen in previous task.

Which stable shell, we generate ssh key and write on victim.

Let's login ssh using private key.

Nothing is interesting. So, we will check using pspy64, linpeas.

We can see suspicious process like feedme.

Find this file.

Who own this file?

Inject it.

In netcat session, we got reverse shell.

PreviousInsekube (Kubernetes)NextTech_Supp0rt: 1 (Decoding, SubrionCMS, iconv)

Last updated