mirror of
https://github.com/AbdullahRizwan101/CTF-Writeups
synced 2024-11-21 11:33:03 +00:00
Add files via upload
This commit is contained in:
ARZ
GitHub
parent
8ab30cc61c
commit
09c30973bc
1 changed files with 152 additions and 0 deletions
152
VulnHub/DC-6.md
Normal file
152
VulnHub/DC-6.md
Normal file
|
|
@ -0,0 +1,152 @@
|
|||
# Vulnhub-DC 6
|
||||
|
||||
## Rustscan
|
||||
|
||||
|
||||
```bash
|
||||
|
||||
|
||||
rustscan -a 192.168.1.11 -- -A -sC -sV
|
||||
.----. .-. .-. .----..---. .----. .---. .--. .-. .-.
|
||||
| {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| |
|
||||
| .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ |
|
||||
`-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-'
|
||||
The Modern Day Port Scanner.
|
||||
________________________________________
|
||||
: https://discord.gg/GFrQsGy :
|
||||
: https://github.com/RustScan/RustScan :
|
||||
--------------------------------------
|
||||
😵 https://admin.tryhackme.com
|
||||
|
||||
[~] The config file is expected to be at "/root/.rustscan.toml"
|
||||
[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers
|
||||
[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'.
|
||||
|
||||
Open 192.168.1.11:22
|
||||
Open 192.168.1.11:80
|
||||
|
||||
|
||||
PORT STATE SERVICE REASON VERSION
|
||||
|
||||
22/tcp open ssh syn-ack ttl 64 OpenSSH 7.4p1 Debian 10+deb9u6 (protocol 2.0)
|
||||
| ssh-hostkey:
|
||||
| 2048 3e:52:ce:ce:01:b6:94:eb:7b:03:7d:be:08:7f:5f:fd (RSA)
|
||||
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDDHiBBFUtpw1T9DZyoXpMp3kg25/RgmGZRFFmZuTfV9SJPxJCvrQXdM6P5GfFLFcgnLlcOBhBbv33N9HvWisycRypK0uLK26bntqfyTAFCdM
|
||||
Xcud7fKNgRBxJdN8onwl4Hly3wzRBJxFWqTdD1RF8viYH4TYIs5+WLpN7KihosjpbwzPpOnbDQZUw7GdHvosV7dFI6IMcF57R4G5LzSgV66GACNGxRn72ypwfOMaVbsoxzCHQCJBvd8ULL0YeAFt
|
||||
NeHoyJ8tL3dZlu71Wt9ePYf7ZreO+en701iDqL6T/iyt3wwTDl7NwpZGj5+GrlyfRSFoNyHqdd0xjPmXyoHynp
|
||||
| 256 3c:83:65:71:dd:73:d7:23:f8:83:0d:e3:46:bc:b5:6f (ECDSA)
|
||||
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBE+jke+7np4l7EWf0wgySSp3MtYFcI6klVOWm7tDjas8eDxc9jYOhR4uK7koa2CkQPDd18XJSt
|
||||
0yNAGQFBb7wzI=
|
||||
| 256 41:89:9e:85:ae:30:5b:e0:8f:a4:68:71:06:b4:15:ee (ED25519)
|
||||
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII1mnJveN8yJySEDhG8wjYqtSKmcYNdX5EVqzxYb92dP
|
||||
80/tcp open http syn-ack ttl 64 Apache httpd 2.4.25 ((Debian))
|
||||
| http-methods:
|
||||
|_ Supported Methods: GET HEAD POST OPTIONS
|
||||
|_http-server-header: Apache/2.4.25 (Debian)
|
||||
|_http-title: Did not follow redirect to http://wordy/
|
||||
|_https-redirect: ERROR: Script execution failed (use -d to debug)
|
||||
MAC Address: 08:00:27:59:AC:2F (Oracle VirtualBox virtual NIC)
|
||||
|
||||
```
|
||||
|
||||
We have two ports open 22 and 80 so we can't do much with SSH since we don't know the username , we will be enumearting port 80
|
||||
|
||||
## PORT 80 (HTTP)
|
||||
|
||||
Going to web server it will shows that it's being reidrected to a domain `wordy`
|
||||
|
||||
<img src="https://imgur.com/Lca4YSD.png"/>
|
||||
|
||||
So let's add the domain to `/etc/hosts`
|
||||
|
||||
<img src="https://imgur.com/yE1Gn40.png"/>
|
||||
|
||||
After adding the domain name , let's refresh the page
|
||||
|
||||
<img src="https://imgur.com/h7LOMQk.png"/>
|
||||
|
||||
Now it loads , since this is a wordpress site we can use `wpscan` to enumerate for users
|
||||
|
||||
<img src="https://imgur.com/vkZVTAc.png"/>
|
||||
|
||||
<img src="https://imgur.com/twpmdJq.png"/>
|
||||
|
||||
And it founds some users , we can also find plugins installed on wordpress with nse (nmap scripting engine)
|
||||
|
||||
<img src="https://imgur.com/Ne32HQx.png"/>
|
||||
|
||||
I tried to find some exploits but they weren't beneficial to us as there was a xss exploit for `akismet` and changing user permissions through `user-role-editor` exploit so in the end we have to brute force the credentials.
|
||||
|
||||
There was a hint given to use regarding brute forcing that we must grep for `k01` so I did that
|
||||
|
||||
<img src="https://imgur.com/N6xAZAs.png"/>
|
||||
|
||||
<img src="https://imgur.com/8kc0AzO.png"/>
|
||||
|
||||
We'll get the password for `mark`
|
||||
|
||||
<img src="https://imgur.com/Yln5koJ.png"/>
|
||||
|
||||
After logging in , we can see that we are not `administrator` so that where `user-role-editor` comes into play.
|
||||
|
||||
<img src="https://imgur.com/Xc5jtfe.png"/>
|
||||
|
||||
I tried to exploit this vulnerability through metasploit but it seems that we needed to load this module , I failed to do this so I approached to exploit this manually
|
||||
|
||||
<img src="https://imgur.com/WMIAkYD.png"/>
|
||||
|
||||
<img src="https://imgur.com/40FyECF.png"/>
|
||||
|
||||
Click on user's update profile button and intercept it
|
||||
|
||||
<img src="https://imgur.com/WGKAebp.png"/>
|
||||
|
||||
Now add `ure_other_roles=administrator` this paramter
|
||||
|
||||
<img src="https://imgur.com/OISjiSZ.png"/>
|
||||
|
||||
<img src="https://imgur.com/1HbNFEk.png"/>
|
||||
|
||||
And now we have become an admin on wordpress site ,cool. Add a php reverse shell in `404.php` template
|
||||
|
||||
<img src="https://imgur.com/2wbJXUi.png"/>
|
||||
|
||||
But it wasn't getting updated
|
||||
|
||||
<img src="https://imgur.com/tJQ8dKw.png"/>
|
||||
|
||||
So last option was to go with `metasploit`
|
||||
|
||||
<img src="https://imgur.com/kwuMbQD.png"/>
|
||||
|
||||
<img src="https://imgur.com/Ws6aIUO.png"/>
|
||||
|
||||
For stabilizing the shell
|
||||
|
||||
<img src="https://imgur.com/4tjJyvu.png"/>
|
||||
|
||||
We see a note in mark's home directory
|
||||
|
||||
<img src="https://imgur.com/4f0YVEx.png"/>
|
||||
|
||||
<img src="https://imgur.com/wKhbJNB.png"/>
|
||||
|
||||
With that password we switched to user `graham`, if we do `sudo -l`
|
||||
|
||||
<img src="https://imgur.com/CDvZ1wg.png"/>
|
||||
|
||||
Edited the script
|
||||
|
||||
<img src="https://imgur.com/R5rnH7e.png"/>
|
||||
|
||||
<img src="https://imgur.com/TRln7NG.png"/>
|
||||
|
||||
<img src="https://imgur.com/w00sUSi.png"/>
|
||||
|
||||
Now it's so much easier here , we can go GTFOBINS to see what we can do with nmap running as sudo
|
||||
|
||||
<img src="https://imgur.com/FteX0CV.png"/>
|
||||
|
||||
<img src="https://imgur.com/8NeABkV.png"/>
|
||||
|
||||
<img src="https://imgur.com/pUaBE0F.png"/>
|
||||
Loading…
Reference in a new issue