Skip to content

Blackpearl

  1. ffuf give us nothing
  2. dnsrecon -r 127.0.0.0/24 -n 10.0.2.X -d blah
  3. blackpearl.local 127.0.0.1
  4. add this info inside your /etc/hosts
  5. access blackpearl.local and see php page
  6. try ffuf inside this new page
  7. finded /navigate
  8. search google -> navigate cms exploit
  9. find Metasploit
  10. set LHOST
  11. set VHOST (blackpearl.local)
  12. run
  13. shell
  14. user www-data
  15. need to use privilege escalation
  16. spawn tty shell (search google)
  17. run linPEAS to privilege escalation
    1. find SUID binaries
    2. find / -type f -perm -4000 2>/dev/null
  18. GRFObins
    1. suid
    2. use php module
  19. /usr/bin/php7.3 XXXX(CODE_SUID_FROM_GRFOBINS)
  20. DONE