Sync
Last updated
Last updated
So enumerating rsync: rsync -av --list-only rsync://10.10.80.132/ Now downloading everything from httpd: We notice a site.db so opening it there are 2 users: Analysing the index.php from the same directory: it is a salted md5 hash so using mode 20 and arranging hash in the format:
Now we can crack the password: Now logging in through ftp and putting authorized keys to login with ssh. We get a shell as triss. Then trying to su to jennifer she uses the same password Now we can access the /backup folder which contains passwd and shadow files: Using unshadow and john: We find the password sa user.
Now trying to enumerate files owned by user sa we find /usr/local/bin/backup.sh Adding chmod +s /bin/bash We can see it works: Now trying to run bash as root user: /bin/bash -p
