ScriptKiddle Writeup

Recon

Nmap

┌──(root💀kali)-[~/Desktop/HTB/ScriptKiddle]
└─# nmap -sC -sV -oA scan.txt --min-rate=10000 10.10.10.226 

Nmap scan report for 10.10.10.226
Host is up (0.10s latency).
Not shown: 998 closed ports
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.1 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 3c:65:6b:c2:df:b9:9d:62:74:27:a7:b8:a9:d3:25:2c (RSA)
|   256 b9:a1:78:5d:3c:1b:25:e0:3c:ef:67:8d:71:d3:a3:ec (ECDSA)
|_  256 8b:cf:41:82:c6:ac:ef:91:80:37:7c:c9:45:11:e8:43 (ED25519)
5000/tcp open  http    Werkzeug httpd 0.16.1 (Python 3.8.5)
|_http-server-header: Werkzeug/0.16.1 Python/3.8.5
|_http-title: k1d'5 h4ck3r t00l5

Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .

Nmap done: 1 IP address (1 host up) scanned in 14.11 seconds 

So there are two ports are opened 

22 for ssh 

5000 for http

Let's try to create a payload

Select OS as android and give any ip and click generate

It gave a payload and download link for us..

•     payload: android/meterpreter/reverse_tcp
•     LHOST: 10.10.14.4
•     LPORT: 4444
•     template: None
•     download: d5d27822951f.apk
•     expires: 5 mins

Let's search it on google for "msf template exploit"
msfvenom APK Template Command Injection
So, Let's create an apk for generating rev shell.

┌──(root💀kali)-[~/Desktop/HTB/ScriptKiddle]
└─# msfdb start
[+] Starting database
                                                                                                                                                                                  
┌──(root💀kali)-[~/Desktop/HTB/ScriptKiddle]
└─# msfconsole