Attacking Common Services - Easy

HTB Content
1

( You are targeting the inlanefreight.htb domain. Assess the target server and obtain the contents of the flag.txt file. Submit it as the answer. )

ANYONE KNOW ABOUT THAT TOPIC? I uploaded webshell on site but only working two commands dir and whoami . Have anyone any references ?

1 Like
2

have you tried the command more?

3

thanks for response . I have already find answer :slight_smile:

8

I managed to get the flag with a webshell that I uploaded via sqlā€¦ It was limited and messy but it did the job.

1 Like
9

I figured MySQL was the other path.

10

Sent you a PMā€¦ I can most likely do the webshell, but looking for another method that is more in line with the modules in this courseā€¦ a service. Thanks for any help. Stuck on this one.

1 Like
11

Got it, thanks @19delta4u !

1 Like
12

Hello! I`m stuck trying to find the passwordā€¦ I bruteforce but no luckā€¦ rockyou list will never complete in the time I have the pawnboxā€¦

16

Can someone give me some advice, I have entered mysql with the credentials f*** and the pass 9***, but within it I understand that I must upload a file, or how can I do it, I need some advice I am stuck.

24

Iā€™ve seen some people talking about methods out of scope for this module, I would suggest having a look around this module.

Try not to move to SQL injection (from the web), enumerate the system, look at what you can get to within the scope of this lab

There are also some useful links;

https://www.hackingarticles.in/shell-uploading-web-server-phpmyadmin/

1 Like
34

Any suggestions or hint without the sql injection method? Iā€™m in mysql server with the creds I found and digging around the databases. thanks

edit: Iā€™m trying now to work with command injection from browser but somehow I donā€™t know how further can I process

35

Stuck on the cmd=____
Except for dir and whoami nothing means nothing is working ?

Any help regarding this?

37

Everything could be done easier. Using only tools from the learning path without shell uploads.

  1. Enumerate user
  2. Crack the password with well known dictionary
  3. Connect to DB
    4.Use command ā€œselect LOAD_FILE(ā€˜pathtofileā€™)ā€
2 Likes
38

I have access to the db and am executing a search for a file containing the term flag via my reverse shell like this

The command shows me an empty page when calling it via browser. When running the simple dir command within the directoy I see some folders but nothing cotaining the flag.txt.

Please help me. What am I missing?

1 Like
39

I used to solve it by uploading a shell like demonstrated in Attacking SQL Databases and executing my shell commands via curl by just passing the parameters like this:

1 Like
40

Hello SjPn,

May I know what service you did brute-force to, please?
Regards,

41

I do not know the path to the file any hint?

42

i ran ā€œwhere /r c: flag.txtā€ through php I uploaded.

2 Likes
44

Hello SjPn,

Thank you very much for the help.

45

Remember that it is not necessary to load a webshell, as it is very complicated by certain restrictions. I recommend using the MySQL query ā€”> select LOAD_FILE(ā€œPATHā€);
You can guess the route, I hope it helps you.
PATH= admin desktop

2 Likes