pentestPromedium

Atkomst Nekad (Access Denied)

undutmaning

English summary: Multi-step challenge requiring OSINT from a psychological report to discover username and password patterns, bcrypt hash cracking from a Roundcube mail server backup, SSH access to an internal network, and exploitation of phpMyAdmin 4.8.1 LFI vulnerability (CVE-2018-12613) to read t

bcrypt busybox credential_reuse cve-2018-12613 directory_traversal internal_network lfi osint password_cracking phpmyadmin pokemon_wordlist psychological_profile roundcube sql_backup ssh

bcrypt_hash_crackingcredential_reuse_exploitationcve_2018_12613_exploitationinternal_network_enumerationphpmyadmin_lfipsychological_profile_analysisssh_accesstargeted_wordlist_generation

$ ls tags/ techniques/

bcrypt busybox credential_reuse cve-2018-12613 directory_traversal internal_network lfi osint password_cracking phpmyadmin pokemon_wordlist psychological_profile roundcube sql_backup ssh

bcrypt_hash_crackingcredential_reuse_exploitationcve_2018_12613_exploitationinternal_network_enumerationphpmyadmin_lfipsychological_profile_analysisssh_accesstargeted_wordlist_generation

Analysis

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat.

$ python3 exploit.py --target 192.168.1.1 --port 8080
[*] Connecting to target...
[+] Shell obtained!

Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.

Permission denied (requires tier.pro)

Sign in to access full writeups

$sign in

$ cat writeup.md…

Sign in to access full writeups

Sign in to access full writeups

Similar writeups