VMW- FristiLeaks: 1.3. base64 encode/decode, search webapp

Walkthru @ 1. https://highon.coffee/blog/fristileaks-walkthrough/

2. https://www.scattiscattanti.com/walkthroughs/fristi/  ….using Metasploit
3. https://reversebrain.wordpress.com/2016/11/24/vulnhub-fristileaks-1-3/ ….show how to convert the base64 encoding using cat, check if the coding is a picture of text..but didn’t work

1. Scan showed port 80 with Apache httpd 2.2.15 ((CentOS) DAV/2 PHP/5.3.3)
2. Looked thru website or nikto or dirb didn’t show much except a few dir in robot.txt which didn’t have any text except a picture
1. So created a custom dictionary to use with dirb to see If there are any webapp that cant be seen
2.  use cewl www.drchaos.com -w drchaospasswords.txt to create custom dictionary based on the website text. Since there were pictures so add words/text from the picture to the list and than run the dirb http://1.2.3.4 drchaospasswords.txt again. This time found a dir called /firsti

3. Checked the comments in the source gets you username while the base64 enccoding/decoding gives you pwd. This could be done using echo cmd but didn’t work at this time.

1. Username: eezeepz & Password: keKkeKKeKKeKkEkkEk
2. You now have ability to upload a picture fie (lets try to add 112.php.gif) which is a PHP reverse shell file.
3. Modify the PHP reverse file to change the ip and ports of attacks
4. Once uploaded, go to the URL Http://ip/fristi/uploads/112.php.gif after you have started nc -np 1234 which will give you reverse shell access. We can only upload gif like files. PHP file type is not allowed to b uploaded
5. Got access to shell now. Look around. Look notes.txt. The batch file runs as cron job so add

echo "/usr/bin/../../bin/chmod -R 777 /home/admin" > /tmp/runthis OR

echo "/home/chmod -R 777 /home/admin" > /tmp/runthis

to get access to /home/admin. In it we have encoded pwd. Run a  python script to decode the pwd. Didn’t usecryptedpass.txt although it can be decoded.

6. Spawn tty. Su to fristigod. Than su -fristigod  which will log you in under /var/fristigod. Looking around in bash_history appears we can sudo . use SUID binary for privilege escalation

>sudo -u fristi .secret_admin_stuff/doCom /bin/sh

>sh-4.1# id

>id

>uid=0(root) gid=100(users) groups=100(users),502(fristigod)