http
Looking at page:
At port 80, I found login page and here admin:admin credentail didn't work and also SQLi basic payload didn't gave any error.
At port 33017
It says this port is reversed for future development.
Hidden directory
Port 80:
We can see there is register directory. This means we can register our self.
Registering
Now try to login.
I tried. It is asking for email verification. Let me test using temp mail.
No email was received.
Analysing the website data in the burp suite [Worked]
I will recreate a user and capture the data in the burp suite.
You will get the confirmation that your account has been created.
Now let's try to login.
Just click on the email change button and then submit the same email id and then see the there is one felid named as Confirmed: false You will see this in response felid. Send this request to the repeater.
Let's try adding user[confirmed]=true in the request field and see if we can bypass this. I have add user[confirmed] in this way because the email id in the request is mentioned in the same way.
Value changed.
This means account is verified. Let's login to the account in browser.
We got the filemanager after login. This means our account got verified successfully.
Getting shell.
I can see that website is using ruby as a technology stack.
Let's try if we can get the shell using php file.
Now upload it file manager.
It got uploaded successfully.
When I click on the uploaded file. It gets downloaded. Also, url chagnges to this.
I am also unable to access the page directory on port 80 as well as on port 33017.
Let's test for Cross-Site Scripting.
This lead to download of Passwd file.
I can see there is two user.
Generaly, Root don't have ssh file. Let's check for remi first.
Both didn't work.
None of the above method worked.
Let's try to add our own SSH-KEY.
We will change directory to ssh by visiting below url.
This worked.
Then click on .ssh and then on keys. You will be navigated to below direcotyr and its content looks like this.
I will click on root and this root file will be downloaded. I found that this is SSH file.
I will try connecting to the root user using this.
It is asking for a password. But currently, I don't have it so, I will try to crack it.
It says Key doesn't have password. Let's try another file for connecting to remi.
Same issue for this.
Uploading Own ssh key.
We will upload our own SSH key.
First we will make ssh key.
We make a ssh file. Two file will be created one is named as id_rsa and id_rsa.pub.
We will rename file id_rsa.pub to authorized_keys.
Now place this file in ssh directory. Change directory by visiting below link.
Uplaod file here.
Now connect using private key.
Got shell.
Last updated
Was this helpful?