Exploit
Uploaded by
rahulvapt22041997Exploit
Uploaded by
rahulvapt22041997Cacti – Web exploit
Cassios - smb
Astronaut
1. Do nmap scan. Only 2 ports are found open in top 1000 ports –
22/tcp and 80/tcp- SSH and HTTP
2. On browsing the web application on port 80/tcp, it displays grav-
admin page in directory listing. On opening the page, it displays the
grav-admin page.
3. I could not find the exact version of grav admin CMS. So tried to
search if there are any exploits available. There are few
authenticated and unauthenticated CVEs. Since I could not get the
credentials, I looked for unauthenticated exploits.
4. Tried with Metasploit exploit, it didn’t work
5.
Backup Buddy
1. Do nmap scan. Only 2 ports are found open in top 1000 ports –
22/tcp and 80/tcp- SSH and HTTP
2. On browsing the web application on port 80/tcp, it displays web
application login page.
3. Below the login form, there is a link redirecting to filemanager
github link, which displays default login for the application
4. On logging in to the application using default credentials, the
application displays a folder information named backup.
5. On looking at the url of the application when browsing the contents,
it is observed that the application is vulnerable to directory traversal
attack.
6. On adding the payload “../../../../../” to the url parameter named “p”,
we can get the main root directory of the web server.
7. Tried to open /etc/passwd and /etc/shadow and could not find
sensitive info and directly tried to check if ssh key is there in .ssh
folder.
8. The ssh keys are found in /home/brian/.ssh folder. Downloaded
id_rsa key for the user brian. Could not find the keys are any other
file in root directory.
9. Once downloaded the ssh private key, tried it to login to the remote
machine, but could not do it, it was asking for a passphrase.
10. The passphrase of the private key can be retrived by
extracting the hash from the key using ssh2john. This will give the
hash.
11. Now use john to check the hash values and retrieve password
from its dictionary.
12. Now we got the passphrase of the ssh key. Now tried to login
using ssh using same private key.
13. Got interactive shell of the machine using python3. Python2 is
not found in the machine. python3 -c 'import pty;
[Link]("/bin/bash")'
AuthBy:
1. Do nmap scan. The nmap automator scan reveals that ftp service
allows anonymous login and when tried to login and look for
sensitive files, none of the files are even readable.’
2. Used nmap to do ftp-brute on the credentials. Nmap takes too much
time and hence used hydra with seclists ftp credentials file.
3. It allows admin:admin and Admin:admin. Both reveal same
information and there are files [Link], .htaccess and .htpasswd.
4. The htpasswd file contains the username and the hash of the
password.
5. Now used john to get the password of the hash.
6. The htpasswd is actually the file belongs to http server and hence
the disclosed credentials should belong to web application on same
remote machine.
7. On analysis of nmap report it is observed that a web server is
running on port 242/tcp.
8. On checking the web application, it discloses nothing and only it
opens the index page which was found during the ftp login using
admin credentials.
9. Also it was observed that the web server and other services and its
version are not vulnerable to any publically available exploits.
10. So, since we have admin access for ftp, it is possible to create
a php file that can provide a remote shell, upload it using ftp and
execute it using a browser.
11. Now put the [Link] file to the web server using the ftp
admin login.
12. Open a netcat listener on port 4444/tcp and now try to open
[Link] file in browser. We can see the reverse shell of the remote
machine.
Hub:
1. Do nmap scan. 4 ports are found open in top 1000 ports – 22/tcp -
SSH and multiple HTTP ports.
2. Tried to browse the web application on port 80/tcp, it displays 403
Forbidden and displayed nginx 1.18.0 version. It does not have any
RCE attack unauthenticated. Before looking to do directory brute
force. I tried to check on other web applications.
3. The web application on port 8082/tcp and 9999/tcp are same except
the application on port 9999/tcp works on HTTPs.
4. When tried to browse the web application, the about page displays
information about web server and provides version details like
Barracuda Embedded Web Server, Fuguhub 8.4, etc.
5. Since the version detail about Fuguhub is disclosed, on checking the
publicly available exploits, it has been found out that there is a RCE
vulnerability in about pages of the CMS admin console.
6. The RCE exploit clearly mentions that the application has lead to
RCE when the highlighted code in the image below is edited with the
exploit code.
7. Only the LocalHost and the port details were changed in the exploit
code and it is saved in the about page.
8. Now on clicking the about page of the application, the RCE access
on the netcat listener configured to listen on port 4444/tcp is
obtained.
[Link]
Remote Mouse Vulnerability
[Link]