Vulnhub - Tr0ll.

This Machine was not easy. I had to have a little patience. Cause, when you think you're going to some place, you're not. It got me trolled all the time. Let's start:

After running nmap, i tried to access the stuff on robots.txt, that lead to no where. So, i downloaded lol.pcap in ftp.


After download it,i opened that file in wireshark, a nice tool to run in a network. I saw a package that gave me a tip: supersecret.


After that, i download a binary file in this url. I use strings against it. I found an address. After accessing this url, i saw some folders. One gave me a list of users and another one gave me password. I use hydra to crack it. I did it. But, for my surprise, Pass.txt was the password, not the content of Pass.txt.


After fooling arround in overflowuser, i manage to find to interesting files, after discover that this writable file is managed by root and it runs every two minutes and cleans tmp, i force it to make overflow user a sudoers:


Music that makes fun of heavy metal bands:

Comentários

Postar um comentário

Postagens mais visitadas deste blog

Vulnhub - Pinky's palace.

Imagem
Now i'll start doing something different from now on. Instead of presenting the whole solution, i'll write what really learnt about the machine i'm hacking. Cause that's more important for me than just presenting to you the complete write-up, which you can find in every corner of the internet. Much appreciated. Let's start: in this machine, i learn how to find inside the binary it's functions using objdump. But first i look for the strings - and i found execv, which led me to search for functions inside the binary: -d = means disassemble -M = machine architecture After seeing that, i use gdb and breakpoint it in main; i run it, and did disas spawn : I had to confirm if ASRL is enable, it's not. So all address will stay in their places, won't have any changes! So i build a file with that address in the picture above: You need 72 char and the address: Can you see 000055555555447d0? This is the first address of spawn function. Let's run ...
Leia mais

Vulhub - Bulldog: 1.

Imagem
Another machine really interesting. This is harder than before. I know that is not ok to jump netdiscover, but i already knew ipaddress - when the vm goes on, you're going to see the ipaddress. Let's run nmap, shall we: Starting Nmap 7.25BETA2 ( https://nmap.org ) at 2018-01-07 12:27 EST Nmap scan report for 192.168.0.102 Host is up (0.00015s latency). Not shown: 997 closed ports PORT STATE SERVICE VERSION 23/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.2 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 20:8b:fc:9e:d9:2e:28:22:6b:2e:0e:e3:72:c5:bb:52 (RSA) |_ 256 cd:bd:45:d8:5c:e4:8c:b6:91:e5:39:a9:66:cb:d7:98 (ECDSA) 80/tcp open http WSGIServer 0.1 (Python 2.7.12) |_http-server-header: WSGIServer/0.1 Python/2.7.12 |_http-title: Site doesn't have a title (text/html). 8080/tcp open http WSGIServer 0.1 (Python 2.7.12) |_http-server-header: WSGIServer/0.1 Python/2.7.12 |_http-title: Site doesn't have a title (text/html). MAC Address: 08:...
Leia mais

Vulnhub - Ew-Skuzzy.

Imagem
This vm was awesome. It was cool cause i had to remember some concepts about file inclusion. First of all, this vm took a lot of time: it was difficult and i had to install two tools, one of them was not a requirement at all. Let's begin! # Nmap 7.25BETA2 scan initiated Mon Feb 12 19:17:00 2018 as: nmap -sC -sV -oN nmap.txt 10.0.2.18 Nmap scan report for 10.0.2.18 Host is up (0.00015s latency). Not shown: 997 closed ports PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.1 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 89:c2:ae:12:d6:c5:19:4e:68:4a:28:e9:06:bd:9c:19 (RSA) |_ 256 f0:0c:ae:37:10:d3:6d:a2:85:3a:77:04:06:94:f8:0a (ECDSA) 80/tcp open http nginx |_http-server-header: nginx |_http-title: Welcome! 3260/tcp open iscsi? |_iscsi-info: ERROR: Script execution failed (use -d to debug) MAC Address: 08:00:27:60:88:83 (Oracle VirtualBox virtual NIC) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection perf...
Leia mais