Add files via upload

This commit is contained in:
ARZ 2021-04-12 04:59:04 +05:00 committed by GitHub
parent f7d3466a7c
commit 53d5051b0a
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23

156
VulnHub/DC-2.md Normal file
View file

@ -0,0 +1,156 @@
# Vulnhub- DC2
Before starting the scan it was told to add a domain name into `/etc/hosts` file
<img src="https://imgur.com/mnRlgX4.png"/>
<img src="https://imgur.com/Q2L8IQf.png"/>
## Rustscan
```bash
rustscan -a 192.168.1.6 -- -A -sC -sV
.----. .-. .-. .----..---. .----. .---. .--. .-. .-.
| {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| |
| .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ |
`-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: https://discord.gg/GFrQsGy :
: https://github.com/RustScan/RustScan :
--------------------------------------
Open 192.168.1.6:80
Open 192.168.1.6:7744
PORT STATE SERVICE REASON VERSION
80/tcp open http syn-ack ttl 64 Apache httpd 2.4.10 ((Debian))
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.4.10 (Debian)
|_http-title: Did not follow redirect to http://dc-2/
|_https-redirect: ERROR: Script execution failed (use -d to debug)
7744/tcp open ssh syn-ack ttl 64 OpenSSH 6.7p1 Debian 5+deb8u7 (protocol 2.0)
| ssh-hostkey:
| 1024 52:51:7b:6e:70:a4:33:7a:d2:4b:e1:0b:5a:0f:9e:d7 (DSA)
| ssh-dss AAAAB3NzaC1kc3MAAACBAMT3xv0ReIK733JHqB5o5t1Knur7MHfTeYoqdn2fxpfdk79iDYAD46e/C1hLs6R0CH1fSWfpJ0x45g77ZaEn/nOaR2UXiod20R6kyrAPyL4UELizECoJ9M
dHSULedr0+4QcXhtUZ+4b76umJhENpOhH+vZjrjMI5uZo+EMjlylxFAAAAFQDzg8StOWpV7J5ZjSfIdcddFgqB/QAAAIA84WMMKmOEkvzgQZLuW5lTTecIrk+UXJyWVZSZFxvFbnt5mUvEzPBMqP
ZIo1h1dkzpEp1Xpk9Vb16LMrQcS6LgH8yhlo5402lUCfP6onxVNvGvP5uhLoQVjzPd65ZKJ7J1VSoz9xOmPkWr2HFuCf6XOBXy8WCxqZxWYTYERTuexgAAAIAI8DjfDmIjv0jUBAPZu0crpPoxvK
4ZvdEy6UbfjK+pZYzkd6qnVLdWrvP9evbWaA5VoDZjWp1301VjX8Y1pqHFVaRUu3OBY7DgidJXA3zLd1BSdPzYfRJSZ1/xN75Yo13wW6XIEsy1kvUNOwA0Nm6zmcQ+SN/aBITwGOIBGrp06w==
| 2048 59:11:d8:af:38:51:8f:41:a7:44:b3:28:03:80:99:42 (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDC92AIbO8wDuOXLMCrnJkTKDLxXzpwFY0EI4urz6cZpmOjGOZYbWz6Ele1sM3WXEWmOWkszLrMbVEFmuYan545oIHnylYX6ZY+eMPjJBRH/V
DukRsNtAA8VRsvIkfCtcG5J9zAQTQDYYprEJljKPYavf4bIW3NZb0v57O01tGylLh23ZSfGpTmQXx+GsWet9vnbCr1+bzf/QeZ7PNK9BeBsLJsvWgLQmuaTdBYeW1b415xOaszWrutHQoaBdud/S
PX1Uvy2PNFUfKIPjdbmAdRxTAvRHHaMTRdrvEhdJWz3wmefXr9e3S3YEu05USTqhMwi6OBxeqkjc+6mdR/PYR9
| 256 df:18:1d:74:26:ce:c1:4f:6f:2f:c1:26:54:31:51:91 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBE329BkKjKxz7Y23cZSshQ76Ge3DFsJsTO89pgaInzX6w5G3h6hU3xDVMD8G8BsW3V0CwXWt1f
TnT3bUc+JhdcE=
| 256 d9:38:5f:99:7c:0d:64:7e:1d:46:f6:e9:7c:c6:37:17 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGyWHwWC3fLufEnM1R2zsvjMZ1TovPCp3mky/2s+wXTH
MAC Address: 08:00:27:90:02:65 (Oracle VirtualBox virtual NIC)
```
## PORT 80 (HTTP)
We see a wordpress site , so to enumerate wordperss there is a tool called `wpscan` which makes your life easier
<img src="https://imgur.com/0sFy6iq.png"/>
We see a flag which hints about making a wordlist with `cewl`
<img src="https://imgur.com/jRBlCtr.png"/>
<img src="https://imgur.com/owY4o5d.png"/>
We found three users using wpscan
<img src="https://imgur.com/qwQR9vO.png"/>
So let's generate a wordlist using `cewl`
<img src="https://imgur.com/jpePUHv.png"/>
Running wpscan again to brute force the three users's password
<img src="https://imgur.com/2aZ39ap.png"/>
And we get two users
<img src="https://imgur.com/JfZU6cl.png"/>
Logged in as jerry and we see second flag page
<img src="https://imgur.com/3uvZiyz.png"/>
<img src="https://imgur.com/GxBMkMP.png"/>
But there wasn't anything I could on wordpress as jerry had only the editor role also `tom` was a regular user on the site but SSH was open on port 7744 maybe we can try credentials there
Tried for jerry but failed
<img src="https://imgur.com/DUdlyPt.png"/>
But tom's credentials worked !
<img src="https://imgur.com/OOhcjqZ.png"/>
<img src="https://imgur.com/5ayttOL.png"/>
Commands were not being run , so I checked the PATH variable
<img src="https://imgur.com/yl7dmGV.png"/>
Doing `ls -la`
<img src="https://imgur.com/PvvI2lr.png"/>
Doing less on `flag3.txt`
<img src="https://imgur.com/MrvfVTb.png"/>
So we cannot run commands like `cd,cat,su,/bin/bash` as we are in a restricted shell, A restricted shell is a shell that block/restricts some of the commands like cd,ls,echo etc or"block" the environment variables like SHELL,PATH,USER.
<img src="https://imgur.com/x1g6CQ0.png"/>
I tried using python,python3,vi,less,awk,find to escape restricted shell but wasn't able to
The binaries we can only run are
<img src="https://imgur.com/ueBfD7G.png"/>
So to escape the restricted shell I tried everything but there was one trick which I haven't tried and that was to open `vi` then,
: set shell =/bin/sh
: shell
<img src="https://imgur.com/VStpbON.png"/>
<img src="https://imgur.com/lviaZcN.png"/>
Still we are in a restricted shell
<img src="https://imgur.com/mbD7a6x.png"/>
<img src="https://imgur.com/qowBSTB.png"/>
<img src="https://imgur.com/IHNNBCq.png"/>
We can switch to jerry by using the password we found from cewl wordlist
<img src="https://imgur.com/EEbqKAO.png"/>
And jerry can run git as root
<img src="https://imgur.com/A73dTDk.png"/>
So on visting GTFOBINS
<img src="https://imgur.com/PyXoHt1.png"/>
<img src="https://imgur.com/ipiIs6s.png"/>
<img src="https://imgur.com/Z6OuVUX.png"/>