Lookup offers a treasure trove of learning opportunities for aspiring hackers. This intriguing machine showcases various real-world vulnerabilities, ranging from web application weaknesses to privilege escalation techniques. By exploring and exploiting these vulnerabilities, hackers can sharpen their skills and gain invaluable experience in ethical hacking. Through "Lookup," hackers can master the art of reconnaissance, scanning, and enumeration to uncover hidden services and subdomains. They will learn how to exploit web application vulnerabilities, such as command injection, and understand the significance of secure coding practices. The machine also challenges hackers to automate tasks, demonstrating the power of scripting in penetration testing.

As usual, let's perform a nmap scan against the target system

Here we see the following two ports to be open in the target system:

After attempting multiple approaches of username and password, also with some basic SQL Injection payloads and Queries, we see no other result showing up in the application other than the redirection message.

Now, let's intercept the login request using burp Suite and then save it to the Repeater for further analysis.

In the repeater, we see a different content size (as the in the message) for different users.

And Here we see a elfinder application in front of us.

After a bit of looking around, we know that this version of application is vulnerable.

Version 2.1.47

link: https://www.exploit-db.com/exploits/46481

We can also see this request of the vulnerability being made in their GitHub Page.

This exploit requires Python 2.7 and to be able to accesses the connect.minimal.php to upload files. And the connect.minimal.php was accessible even without requiring us to login again.

The vulnerability lies in the filename, which allows commands to be injected. The exploit creates a PHP web shell into the upload directory while uploading an arbitrary image.

So, for this exploit, let's download any random image and then name it as SecSignal.jpg.

and also download the exploit from the Exploit Database page.

Now, let's run the script.

THAT WAS JUST MAGIC!!!!!!!!!!!!!!!!

Now! You can updated the she using netcat and payload from Revshells
For this box, I tried a multiple one shells, but the one which worked was nc mkfifo. Also, make sure that you URL Encode the payload.

And Here we get the Shell!!!

Let's upgrade the Shell to be a bit more useful than what we have right now, which we can do through python.

First, type in the following command:

Spawning /bin/bash using Python’s PTY module, and connect the controlling shell with its standard I/O.

Then, once you get a shell, press Ctrl + Z which will backend the shell, then update the local terminal line settings with stty and bring the remote shell back.

Now, after we have got the shell and looking around in the system, we see that are having our user.txt flag in the think user's home directory, but are out of luck. Also, we notice a .passwords file in the same directory.

Let's now do some further file path enumeration to find some useful files.

And Here!! We see a very un-common file to be present in the system.

This Tool, looks ups the user id, and then prints out the content from the .passwords file. and since we don't get any output of the file which is obvious as we don't have any /home directory containing the .passwords file. But the think user has one!!!

We can create a id file in the tmp directory and then try to run this file contain the think user's username in it.

Make the file executable:

Now, let's add this path in the PATH of the system.

Now, running the tool gives us the list of passwords!

Now!! Let's take these passwords into our local machine into a file called password and crack the password for the think user using hydra

Now!! We can login to this user using the username and the password that we got!

Now, buy running the sudo -l command, we see that we are able to see the commands that we can use as the root user.

now let's run open the root.txt file using the look command.

That is it!!!!!!!!!