🎊Hacker Fest

The machine was part of a workshop for Hacker Fest 2019 at Prague. Difficulty level of this VM is very “very easy”.

1. Reconnaissance

  • Scanning the network to find vulnerable machine's IP

arp-scan -l
Interface: enp0s3, type: EN10MB, MAC: 08:00:27:2a:1b:5b, IPv4: 192.168.10.11
Starting arp-scan 1.9.7 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.10.1	52:54:00:12:35:00	QEMU
192.168.10.2	52:54:00:12:35:00	QEMU
192.168.10.3	08:00:27:06:a6:81	PCS Systemtechnik GmbH
192.168.10.13	08:00:27:28:f0:0b	PCS Systemtechnik GmbH

  • We find the IP of the vulnerable machine to be 192.168.10.13

2. Scanning

2.1 Nmap

  • Using nmap to find the open ports and their services

nmap -p- -sV 192.168.10.13
Starting Nmap 7.92 ( https://nmap.org ) at 2022-03-17 21:20 IST
Nmap scan report for 192.168.10.13
Host is up (0.42s latency).
Not shown: 65531 closed tcp ports (reset)
PORT      STATE SERVICE  VERSION
21/tcp    open  ftp      vsftpd 3.0.3
22/tcp    open  ssh      OpenSSH 7.4p1 Debian 10+deb9u7 (protocol 2.0)
80/tcp    open  http     Apache httpd 2.4.25 ((Debian))
10000/tcp open  ssl/http MiniServ 1.890 (Webmin httpd)
MAC Address: 08:00:27:28:F0:0B (Oracle VirtualBox virtual NIC)
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

We find 4 open ports, tcp ports 21, 22, 80 and 10000 with ftp, ssh and two web servers running respectively

  • Using Wappalyzer on the webpage running on port 80 we see that it uses WordPress CMS.

3. Initial Foothold

3.1 WPScan

  • Using WPScan to find any vulnerable plugins

  • We find that a wp-google-maps plugin is installed and might be vulnerable

3.2 Metasploit

  • We find a module in metasploit for the plugging: auxiliary/admin/http/wp_google_maps_sqli

  • Using the auxiliary module and setting RHOST to 192.168.10.13

We get a username and a password hash: webmaster $P$BsqOdiLTcye6AS1ofreys4GzRlRvSr1

3.3 Cracking the hash

  • To crack the hash, we save the hash into a file called passwd.txt

  • We are using JohnTheRipper to crack to hash

We get the password kittykat1

  • Using ssh we can login to the machine as webmaster

  • flag.txt

4. Privilege Escalation

  • Using sudo -l we find that webmaster can run ALL commands as root

  • flag.txt

PreviousGoldenEyeNextLampiao

Last updated