Learnings

-> check for XSS

-> check for template injection

1+1

{{1+1}}

${7*7}

-> password spraying

-> check where user got access (crackmapexec)

c:\users\<user>\.ssh\id_rsa

powershell script if no gui access

• chmod u+s /bin/bash

  • make /bin/bash a suid binary

• run as root: /bin/bash -p

cewl

-> consider flag —lowercase

Root ssh key?

/etc/shadow

/root/

update parameters which are not intended:

• e.g. add param to json

• ruby rails: user[is_admin]=true

• enumeration: get as much information as possible to find the most promising attack vector

  • do not shortcud

  • take notes

• do not forget post exploitation once you have privileged access

• combine information from different machines

• “id_rsa” only for RSA keys

• leak “../.ssh/authorized_keys” to list public keys

• then find respective private keys

• check response heders (curl)

• check ssl certificate if existing

• try different http methods

• directory bruteforce

• check your msfvenom command

  • try “powershell reverse tcp”

  • try “shell reverse tcp”

Update path:

PATH=%PATH%C:\Windows\System32;C:\Windows\System32\WindowsPowerShell\v1.0;

Try basics commands:

whoami

dir

cmd /c dir

powershell -c dir

dir c:/users

dir c://users

dir c:\users

dir c:\\users

certutil -h

curl -h

They are the same and interchangeable!!!

• consider that application runs in docker continaer

  • /etc/passwd might not be the actual users of the box

  • /etc/hostname is the container id