DAV: Tryhackme

Dav is a nice room from the Library on Tryhackme and it is part of our cybersecurity training. boot2root machine for FIT and bsides guatemala CTF.

Given Task : Read user.txt and root.txt this is our task for this box, We have to get user flag and root flag.

Stage 1:

Enumeration: after scanning i noticed only one port was open port 80

Above scan Explanation

• sC: perform a script scan
• sV: this switch tells Nmap to perform version detection of the services running on the open ports

Since port 80 is open, we will check with the web.

Visiting the Open port 80 shows a configuration page which is Apache Ubuntu Default page

Port 80

After checking the entire website, we got no information on it. Since we are working on DAV it is only natural to check if the websitte is hosting on webdav or not.

“IP/webdav”

Login Dialog box

The website is hosting on webdav and has requested login details, I didn’t have any credentials. As an Ethical Hacker two things first comes to mind to get the credentials which dirb or using the internet.

using dirb to crawl through the website to find any hidden Directory.

dirb the target

Internet is always resourceful for information. i searched for default credentials first to test the website login.

Dafault Credentials on the internet.

username:- wampp

password:- camp

After getting the credentials we are not finished, a lot to accomplish after getting access.

Logged into Target

the directory passwd.dav has some details inside. with the Username and hash

User name with hash

STAGE 2

Back Door Access

Get Lanre Komolafe’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

The game is getting more interesting, I will be creating a back door using a tool called “cadaver” to upload a file/virus into the server to gain full access with the help of reverse shell.

Cadaver

I have access to the cadaver by inputing the username and password. i can now use it transfer a file but before we do that we have to get a reserve shell.

cadaver http://IP/webdav/

Using a Reserve shell so that the server connects to my own system.

Reverse shell Generator

I have generated a reserve shell, Once the shell has been uploaded to the server it will give me access on my system.

Uploaded the Shell into the server

The server with Shell uploaded

It has been uploaded on the server successfully, so if the admin comes to the server and clicks on the shell i would be notified on my system with the help of netcat

nc -lvnp 9001

nc -lvnp 9001

Boom we’re in!!

Currently listening with the help Nc, the port # used in the shell is 9001.

nc -lvnp (Listening)

I have completely infiltrated the server and gained acess. Firstly i have to look for the “user flag and i can do that by going through the server.

ls to list the directory

cd to open directory

Task 1 — Find the user flag

We got user shell & flag of user.txt. Let’s check the content of the user.txt using the cat command.

To complete the final task is to try to get privilege escalation and get the root flag.

ls - l command is a powerhouse. transforms your plain file list into a detailed directory listing, showing file permissions, number of links, owner, group, size, and time of last modification

Task 2 — Find root.txt

We got our root flag and completed this box successfully.

Thank You for Reading

Consistence is the key never stop Learning