Hololive THM
Lets start with scanning the network
Let's run a ping sweep on the initial networks
sudo nmap -sn -n 10.200.108.0/24 192.168.100.0/24 -oA ping_sweepWhile looking at the output we may see that that the subnet of 192.168.100.0/24 all hosts are alive this must be some kind of firewall issue
While looking at the 10.200.108.0/24 subnet we can see the following to hosts are alive
Lets get a feel for what these hosts are doing
results
10.200.108.250
what can wee see
Looks like a Ubuntu machine
SSH in enabled
10.200.108.33
What can we see
Ubuntu machine
This looks to be a web server
title name:
holo.livewill add this to our hosts fileApache web server 2.4.29
Looks like it is utilizing WordPress 5.5.3
we have a list of dissallowed entries
Notice the path files
/var/www/wordpresscould be an indication for LFISSH is enabled on the machine
Lets run a full port nmap scan of both targets
we do notice something interesting within a full port scans
10.200.108.33
Looks like we have a mysqlx server running on the web server
10.200.108.250
Looks like we have Node.js Express framework running
10.200.108.33:80 holo.live
When we navigate to holo.live we can see the following
Noticed when we type "holo.live" within the url bar it redirected me to www.holo.live
I want check for any virtual host routing for this we can use wfuzz
Now if we notice in the results we have alot off 200's codes, not all of these are a separate vhost, we want to look for anomalies that stick out
results
Notice the chars, word, and lines value, they are different from the rest of the requests, id say these are our vhosts on the server and we can add these to a hosts file
results that seem interestings
10.200.108.33:80 (www.holo.live)
navigatting to the web page we can see the following
Lets run feroxbuster and see if we can find anything interesting
nothing to interesting
Lets check out these vhosts
dev.holo.live
Looks like they are currently working on an updated website
Lets run feroxbuster and see if we can find anything
we do find an interesting php function
Looking in the page's source we can see the img.php function is used to retrieve images from the /images directory
Lets see if we ca abuse this function, maybe cat out the /etc/passwd file
our browser download the img.php function, but it actually contains the /etc/passwd contents
admin.holo.live
Lets check the robots.txt
Looks like we can utilize that lfi we found earlier and grab some creds
dev.holo.live
looks like we both a set of credentials for the db and a username
for good measures i want to see what the other dissallowed entries can show us
we can see a some what rendered dashboard
we can see the version in the page source
couldnt find anything interesting
Lets see if we can use the credentials we found to login into the admin.holo.live
it works
Not much in the way of functionality here, lets go back to our lfi
if we look at the page source of
we do see somehitng interesting
essentially what this block of php code is telling us
Now by default the admin dash board is not passing any data to the function dashboard.php, but what if
we should gett code execution on the back end
lets try
woohoo we have code execution, Now lets set up a php reverse-shell and see if we can establish a reverse-shell to 10.200.108.33
Lets utilize msfvenon to generate a php reverse-shell
we need to find a directory we can write to
Lets use curl to download our rev.php onto the system
Now we should be able to execute it and gain a reverse-shell on the system
we do get a shell as www-data but it is short lived
Lets see if we can dump the mysql databases
lets list the databases
Lets list the tables in the wordpress database
Lets dump the wp_users table
Looks like we found the user admin and there hashed password
Lets see if we can crackit
looks like a PHPASS hash
lets see if we can crack it using hashcat
Last updated