# Nineveh

This is my write-up for the machine on Hack The Box called Nineveh located at: [https://app.hackthebox.com/machines/Nineveh](https://app.hackthebox.com/machines/Nineveh).

I started off with a basic nmap scan:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-3ea92c145c65570c60dee1d0476402fabbb6c2d0%2Fimage.png?alt=media)

One of the tags on the machine was for Port Knocking:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-54f17a8dc9267377a31e03105b8696e8f3c9bd60%2Fimage.png?alt=media)

This gave me the idea that I might have to knock a port later on to get into it. While I was doing some research my full nmap scan (`nmap -T4 -A -v -p- -Pn 10.10.10.43 -oN nineveh.nmap`) came back:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-3b382c35637446440c5a351c5ba7072348dbf246%2Fimage.png?alt=media)

It seems to represent the same information that the basic nmap scan had provided. The main page seems to be a default home page that seems standard:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-9551d882a4a6aba3b2a3713133c877fa64fa829c%2Fimage.png?alt=media)

Running **dirsearch** on the IP address led me to the following page:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-09912efab3236334422b0062d7dc04836368838f%2Fimage.png?alt=media)

Looking at the source code, I found the following:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-08b661424817de2339575a34e9980de25381bc8b%2Fimage.png?alt=media)

It seems that there is a username of **amrois**. In addition, I have learned that MySQL has been installed on the server. I then ran **dirsearch** on the **/department** on the folder:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-90330bc5c737b27ecbf8bb200ac2f37e56efcf51%2Fimage.png?alt=media)

I am not able to access either of those sites, since I need to log in to the website first. Using the username **amrois**, I got the following:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-f79234efd94c12d4ab9d557e1963afa7e80371ea%2Fimage.png?alt=media)

However, when I enter the username **admin**, I get the following:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-4784192b8d74f455c8b87d5e802944520b3baa6d%2Fimage.png?alt=media)

It seems that **amrois** might be an MySQL admin username or something else. Running **hydra** on the admin user got me the following:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-a067a57a91fad7878f2181d0c7f8624fabb1c393%2Fimage.png?alt=media)

I was into the website:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-45e74b291f829e4109c24cb5f0052120acbb3378%2Fimage.png?alt=media)

I also saw the following on the main page:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-c3e42dde894fd8165edab9138fbb26ca1465dc15%2Fimage.png?alt=media)

The link looks (at a basic glance) to be vulnerable to File Inclusion:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-6fe7d430c74a5a91bf5f2b1a24d20e54818e2318%2Fimage.png?alt=media)

I accessed the website on port on 443 (HTTPS) and saw the following:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-c720cf67b72e388893306aa4177324f53517cfa8%2Fimage.png?alt=media)

Running **dirsearch** on port 443 gives different results:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-19e8150cd5f3643b0b52446150e1c1dd9bcdf9c2%2Fimage.png?alt=media)

Going to the **/db** folder, I see the following:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-0ac0d87873e29030e6b9c1d12302fafa44cf4787%2Fimage.png?alt=media)

Searching for **phpLiteAdmin** on Exploit Database I see the following:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-89e40479bf98891b50525079c9a92af107e36342%2Fimage.png?alt=media)

I tried to run **hydra** on the password field, and it worked:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-920c965cefb39c1ed0b0f0b87d5f0298d45d5984%2Fimage.png?alt=media)

I then made a new database using the button on left side:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-7e25a8f9cfe07818b906f51bcb59cc24590266e1%2Fimage.png?alt=media)

This is from the following Exploit Database link: [https://www.exploit-db.com/exploits/24044](https://www.exploit-db.com/exploits/24044). I then made the table called "testing":

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-071b7f1ed585ae185643cec740249df703ce9759%2Fimage.png?alt=media)

I viewed [this write-up](https://0xdf.gitlab.io/2020/04/22/htb-nineveh.html) and noticed that they were able to get the contents of **/etc/passwd**, by using LFI. I then followed their request and got the following:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-5ef32d4a0df2122081e45f99ededc00ef7a2b721%2Fimage.png?alt=media)

{% hint style="warning" %}
NOT COMPLETED
{% endhint %}
