{"id":58,"date":"2021-02-13T19:17:01","date_gmt":"2021-02-13T19:17:01","guid":{"rendered":"https:\/\/areyou1or0.it\/?p=58"},"modified":"2021-02-13T19:17:23","modified_gmt":"2021-02-13T19:17:23","slug":"htb-tenten-walkthrough","status":"publish","type":"post","link":"https:\/\/areyou1or0.it\/index.php\/2021\/02\/13\/htb-tenten-walkthrough\/","title":{"rendered":"HTB – Tenten Walkthrough"},"content":{"rendered":"\n

nmap<\/p>\n\n\n\n

\"Not<\/figure>\n\n\n\n

WPScan – enumerate users<\/p>\n\n\n\n

\"wpscan<\/figure>\n\n\n\n

WPScan – Plugin Vulnerability (IDOR) found<\/p>\n\n\n\n

\"[+]<\/figure>\n\n\n\n

https:\/\/vagmour.eu\/cve-2015-6668-cv-filename-disclosure-on-job-manager-wordpress-plugin\/<\/a><\/p>\n\n\n\n

As the PoC explained in the above URL, I tried to upload CV files first<\/p>\n\n\n\n

\"Request<\/figure>\n\n\n\n

I used the PoC exploit in the blogpost above and modified the exploit a bit as below:<\/p>\n\n\n\n

\"import<\/figure>\n\n\n\n

And found a file with the name HackerAccessGranted<\/p>\n\n\n\n

\"python<\/figure>\n\n\n\n

I downloaded the jpg file and checked for any info hidden in it using the following tools<\/p>\n\n\n\n

strings HackerAccessGranted.jpg | less<\/p>\n\n\n\n

exiftool HackerAccessGranted.jpg<\/p>\n\n\n\n

binwalk HackerAccessGranted.jpg<\/p>\n\n\n\n

steghide –extract -sf HackerAccessGranted.jpg (-sf for source file option)<\/p>\n\n\n\n

\"extracting<\/figure>\n\n\n\n

Look the content of id_rsa file<\/p>\n\n\n\n

\"-BEGIN<\/figure>\n\n\n\n

Since it’s encrypted, we need to decrypt it first to use it<\/p>\n\n\n\n

Turn the file into john crackable form with sshng2john tool<\/p>\n\n\n\n

\"python<\/figure>\n\n\n\n

Then crack the passphrase<\/p>\n\n\n\n

\"john<\/figure>\n\n\n\n

Change the permission of rsa file to 600 and login to takis user with the passphrase cracked<\/p>\n\n\n\n

\"chmod<\/figure>\n\n\n\n

Priv Esc<\/p>\n\n\n\n

\"takis@tenten:\u2014$<\/figure>\n\n\n\n

So takis user can run \/bin\/fuckin as root <\/p>\n\n\n\n

The content of the file can be seen below, it gets arguments and executes them<\/p>\n\n\n\n

\"\/<\/figure>\n\n\n\n

We use sudo \/bin\/fuckin bash and become root<\/p>\n\n\n\n

\"takis@tenten:\u2014$<\/figure>\n","protected":false},"excerpt":{"rendered":"

nmap WPScan – enumerate users WPScan – Plugin Vulnerability (IDOR) found https:\/\/vagmour.eu\/cve-2015-6668-cv-filename-disclosure-on-job-manager-wordpress-plugin\/ As the PoC explained in the above URL, I tried to upload CV files first Since wp saves the uploaded files as \/wp-content\/uplaods\/{year}\/{month}\/{file name} I checked if the I uploaded exist, and yes it’s uploaded Also in HTML code of application page, I… Continue reading HTB – Tenten Walkthrough<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[17],"tags":[],"_links":{"self":[{"href":"https:\/\/areyou1or0.it\/index.php\/wp-json\/wp\/v2\/posts\/58"}],"collection":[{"href":"https:\/\/areyou1or0.it\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/areyou1or0.it\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/areyou1or0.it\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/areyou1or0.it\/index.php\/wp-json\/wp\/v2\/comments?post=58"}],"version-history":[{"count":1,"href":"https:\/\/areyou1or0.it\/index.php\/wp-json\/wp\/v2\/posts\/58\/revisions"}],"predecessor-version":[{"id":59,"href":"https:\/\/areyou1or0.it\/index.php\/wp-json\/wp\/v2\/posts\/58\/revisions\/59"}],"wp:attachment":[{"href":"https:\/\/areyou1or0.it\/index.php\/wp-json\/wp\/v2\/media?parent=58"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/areyou1or0.it\/index.php\/wp-json\/wp\/v2\/categories?post=58"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/areyou1or0.it\/index.php\/wp-json\/wp\/v2\/tags?post=58"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}