Htb-trick ctf hackthebox nmap smtp smtp-user-enum zone-transfer vhosts wfuzz feroxbuster employee-management-system sqli sqli-bypass cve-2022-28468 boolean-based-sqli sqlmap file-read lfi directory-traversal mail-poisoning log-poisoning burp burp-repeater fail2ban htb-admirertoo Finally, I’ll find a VirtualBox VM, and break through both VirtualBox encryption and LUKS to find a password that gets root access. I’ll have to look at the source for that plugin to figure out how to decrypt the information and get another user’s SSH key. From there, with access to the WordPress config, I’ll get the MySQL password which gives access to secrets stored via another WordPress plugin. With a shell, I’ll access an internal WordPress site exploiting the Brandfolder plugin to pivot to the next user. I’ll start by enumerating a website to eventually find a file upload page, where I’ll bypass filters to get a webshell. Moderators was a long box with a bunch of web enumerations, some source code analysis, and cracking multiple passwords for a VM. Htb-moderators hackthebox ctf nmap feroxbuster wfuzz fuzz crackstation filter burp burp-repeater upload webshell php-disable-functions wordpress wordpress-brandfolder wordpress-passwords-manager wordpress-plugin source-code crypto virtualbox virtualbox-encryption pyvboxdie-cracker hashcat luks chisel
0 kommentar(er)
