Agile

edwards d07867c6267dcb5df0af

edwards:1d7ffjwrx#$d6qn!9nndqgde4

{ "SQL_URI": "mysql+pymysql://superpasstester:VUO8A2c2#3FnLq3*a9DX1U@localhost/superpasstest" }

Creds

Steps:

  1. Enumerate host to find /download which has a fn parameter which is vulnerable to LFI.

  2. Using LFI we can find some files on the system such as /etc/passwd, but no hashes stored there unfortunantly.

  3. Using the LFI we were able to locate a app.py file which contained the following 

    app.config['SECRET_KEY'] = 'MNOHFl8C4WLc3DQTToeeg8ZT7WpADVhqHHXJ50bPZY6ybYKEr76jNvDfsWD'

  4. Using this secret key we can craft our own signed cookies and become any use in the password application.

  5. User 0 and 1 have credentaisl stored in them.

  6. We are able to gain access to user corum on the machine itself. Initial access complete!

  7. After further enumeration on this system we find a process thats running a remote debugger. It seems to be a chrome remote debugging port.

  8. We forward the port to the local machine and attach to the debugger with chrome.

  9. We can access the "test' vault and gain additional credentials to the dev_admin user, these credentials are listed above. Along with some credentials to mysql.

  12. Using CVE-2023-22809 we can modify the activate function from venv which will run any additional commands we add to it as root.

  13. I opted to add a user to /etc/passwd file /echo $newUserHash >> /etc/passwd

Last updated