Enumeration 1 export target=10.129.231.223 1 rustscan -a $target --ulimit 10000 -g 1 nmap -Pn -sC -sV -n -p22,80 -T5 $target Add dog.htb to hosts Nmap says there is are git repo found. Let’s download it. 1 wget -r -np -R "index.html*" http://$target Looking around, I find the mysql password of root 1 BackDropJ2024DS2024 Found another user in the repo: 1 tiffany Web Application (80) Blog, powered by Backdrop CMS ...
Enumeration 1 export target=10.129.48.60 Port Scanning 1 rustscan -a $target --ulimit 10000 -g 1 nmap -Pn -sC -sV -n -p22,80 -T5 $target Initial Foothold PHP version is 8.1.0-dev It has a RCE exploit (www.exploit-db.com/exploits/49933) Persistence 1 ssh-keygen -t ed25519 -f persist -N '' 1 2 3 4 5 6 7 $ mkdir ~/.ssh $ chmod 700 ~/.ssh $ echo "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINxWXXtr3AsLHPThSrbfRuFUTfqCcghxiINCr9pz5rEg burak@kali" > ~/.ssh/authorized_keys $ chmod 600 ~/.ssh/authorized_keys ...