Dog
Easy - Linux
Enumeration
Ports
Websites
Classsic Virtual Hosting dog.htb
Possible Usernames: dogBackDropSystem && Anonymous
CMS with name Backdrop
Is available the login addres -->
Hack the WebApp
User Enumeration
With it we can see, that the user dogBackDropSystem is available. Okay, we now search some inforamtion about exploits of Backdrop CMS 1.27.1
Exploit Database
Nice! sooo, now download it and execute the script -->
WebShell
NICE! Now, create a revershell and we put the netcat of lisener on any port -->
I do me TTI treatment -->
script /dev/null -c bash Ctrl+z stty raw -echo; fg reset xterm export TERM=xterm export SHELL=bash stty rows 45 columns 184 ##dimensiones pantalla portatil
Into the web path we can see a archive with name settings.php, and inside it we can read a password:
First Climb
Now, i list the current user into this machine -->
And try to su in there are -->
Root Climb
With it, see the sudo permissions -->
We can see that this user will can bee of all permissions, so...
After investigate, i found a eval funtion with we can do a command execution -->
Last updated