Lfi

Overview Machine author: Tr1s0n. IP: 10.10.10.x. Chain: forum token, escalation to admin, XXE (file / source read), Redis (session replacement), access to developers., LFI + PHP filter chain (RCE as www-data), PHP-FPM / FastCGI (pivot to victor), prototype pollution in a Node.js API (RCE as root). Reconnaissance 1 nmap -sV -sC -p- 10.10.10.x Open: 22 (SSH), 80 (HTTP). Redis (6379) is local only / password protected. 1 10.10.10.x collect.htb developers.collect.htb The vhost developers.collect.htb is protected by Basic Auth. ...

Overview Windows Server 2019 (Build 10.0.17763). Attacker IP (tun0): 10.10.14.x. Key techniques: LFI/RFI, PHP session poisoning, blacklist bypass, PSCredential lateral movement, malicious CHM, Net-NTLMv2 capture and crack. 1 2 3 4 5 6 7 8 9 10 11 12 nmap -> IIS + PHP +- LFI in ?lang= (blog) +- read the PHP session file (C:\Windows\TEMP\sess_<PHPSESSID>) +- PHP session poisoning: PHP code in the "username" field +- RCE as NT AUTHORITY\IUSR +- download nc64.exe -> reverse shell (IUSR) +- db.php -> MySQL password 36mEAhz/B8xQ~2VM +- password reuse -> PSCredential -> shell as SNIPER\chris (user flag) +- malicious .chm in C:\Docs (opened by the admin) +- Responder captures the admin Net-NTLMv2 +- hashcat -m 5600 -> butterfly!#1 +- PSCredential -> shell as Administrator (root flag) Reconnaissance 1 2 3 4 5 # 1) fast sweep of all ports ports=$(nmap -p- --min-rate=1000 -T4 10.10.10.x | grep ^[0-9] | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//) # 2) service/script scan on open ports only nmap -p$ports -sC -sV 10.10.10.x Result: Windows, IIS, a PHP server. The “Sniper Co.” site has a login page and a blog. ...

Overview Machine author: irogir. Main skills: side-channel enumeration (timing attack), mass assignment, LFI + PHP wrappers, arbitrary file upload (timestamp brute force), git history leak, Axel .axelrc misconfiguration for arbitrary file write as root. Chain: timing attack, user enumeration, password guess, mass assignment (role=1), LFI (image.php), php://filter (source disclosure), arbitrary upload + MD5(time()) brute force, RCE, git log in a backup, password reuse, SSH as aaron, sudo netutils (axel), .axelrc default_filename, overwrite /root/.ssh/authorized_keys, SSH as root. ...