Tiki

LogoTiki: 1www.vulnhub.com

Locate the machine

netdiscover -i eth1
 Currently scanning: 192.168.12.0/16   |   Screen View: Unique Hosts                                         
                                                                                                             
 9 Captured ARP Req/Rep packets, from 2 hosts.   Total size: 540                                             
 _____________________________________________________________________________
   IP            At MAC Address     Count     Len  MAC Vendor / Hostname      
 -----------------------------------------------------------------------------
 192.168.2.130   00:0c:29:d9:b6:38      8     480  VMware, Inc.                                              
 192.168.2.254   00:50:56:ee:e3:ed      1      60  VMware, Inc.

scanning

Enumerate smb services

We got the username "silky"

We also got some shares

we can try connecting to share with smbclient

So, download the Mail.txt file. Now check its contents and we have the password "51lky571k"

Enumerate HTTP

check robots.txt file

we get tiki cms on main page. visiting tiki CMS robots.txt we do get a few more directories

Running gobuster we get a README file

same results with FFUF

Opening README, we got cms version number tiki 21.1

Vulnerability search

searching vulnerability on searchsploit, we got the hit

download it

Now execute the script

Let's use burp and try to log in.

we got logged in.

Visiting the wiki/credentials page, we get the password silky:Agy8Y7SPJNXQzqA

As ssh was enabled, login with ssh

Check permissions and we can run every command so run sudo -i and we have flag in the root directory.

Now we got the flag

PreviousVulnhubNextHTB

Last updated