Repository navigation
Lab 11.1 :)
To get started it is important to find the open ports on 10.0.5.28. After that, you will see that the server uses an HTTP server and through this you will see phpmyadmin. From here I found the version number which is 4.8.1.
Once I got the version number I went to exploitdb and looked up the version number I found for phpmyadmin. doing this presented me with 2 different numbers, one of them is EDB-ID and the other is CVE. CVE is the important one here.
We will be using metasploit in order to compromise nancurinir. We will look inside the Metasploit modules for any phpmyadmin exploits.
This is the command I ran:
It gets a bit tedious after this because you have to look through each in order to find "CVE" I was able to find it in /usr/share/metasploit-framework/modules/exploits/multi/http.phpmyadmin_lfi_rce.rb
To get into the Metasploit console you'll want to use the command msfconsole
Once in the console we can do a lot of things but to start we want to tell metasploit what exploit we want to use and I did so by typing use exploits/multi/http.phpmyadmin_lfi_rce
Once you let it know what exploit you want to use you can do a number of things but you should always check your options to see whats available in that exploit. To do this just type "options" the command line
It's important to set the following settings when using this exploit or it wont work properly and after you set those settings you can run exploit:
Once you run exploit this is what you'll be presented with:
To make sure that you're in the session run session 1
It'll likely tell you that the session is already interactive but you should always do this just to make sure.
You can then run guid
Once you do that run shell and then python3 -c 'import pty; pty.spawn("/bin/bash")' You'll also want to make sure you su gandalf and long in so you can get the needed information
User-Flag:
You need to su root to make more progress but just that command wont work because we don't know the root password but if we use the command sudo su root it'll bypass the need for the root password and it'll just accept gandalfs password
Root-Flag:
Between the 2 methods we used metasploit is much easier to use as it has a more streamlined process the process of learning metasploit was also overall more enjoyable because I found it easier to wrap my head around