HF2019: Walkthrough
HF2019 is a vulnerable machine available on VulnHub
Lets do it!
Search for Vulnhub hf2019 and download .ova file from https://www.vulnhub.com/
Then import it to Virtual Box and configure,
Then Run both.
ATTACKING
First step of attacking, we need to find the IP address of the hf2019 that is running in vmware
Run arp-scan -l in kali for finding ip address of machine(hf2019).
Now we got ip, that is 10.0.2.5.Next we have to find open ports
Run command nmap -A 10.0.2.5 -Pn
We can see that FTP, SSH, HTTP ports are open.Anonymous FTP login is allowed so try login FTP ftp <target ip address> search for any DATA.Username and password :anonymous
Seems to be website related,so wp-config.php should contain relevant data.
Do get wp-config.php command.Then exit ftp and open the file and look for relevant data.
Found database username and password.we can keep it,But at this point, the credentials didn’t directly help us move forward.
We had seen http port is open so we can access the site using IP address. So copy the IP address and paste it on a browser and look for further clues.
It’s a wordpress site.To find more content about this page download a extension called “wappalyzer”
We got some details on this wesite,but we have to go indepth.
So lets use a tool called wpscan.
In kali run wpscan — url http://10.0.2.5/
The WPScan results confirmed that the site was running WordPress version 5.2.3, which is outdated and potentially vulnerable. It also revealed that there is a plugin named wp-google-maps. This plugin has a known history of vulnerabilities, so lets go that way.
Now move on to using Metasploit framework which helps for developing and executing exploits. The msfconsole -q command launches Metasploit in quiet mode.Once inside, the prompt changes to msf >.
Get Sreeram s m’s stories in your inbox
Join Medium for free to get updates from this writer.
Run command search wp-google-maps inside metasploit.
There we can see a payload named wp-google-map. To use that payload, simply type “use 0” or type
“use auxiliary/admin/http/wp_google_maps_sqlinjection
Type “show options” for viewing what are the things listed in that payload.
The important field here is RHOSTS, which we have to set to our target machine:
type set rhosts 10.0.2.5
Now enter Run or Exploit to start the payload.
Here, we can see username called webmaster and its password. But the password is encrypted in hash. So we have to crack it using john tool .
For that copy the hash protected password and use nano to create and save it in a file.I just named it as “hf19".
We can use John the Ripper with the rockyou.txt wordlist to crack the password hash we saved earlier.
Run command john — wordlist=/usr/share/wordlists/rockyou.txt <file name>
here file name is hf19 which i made.
“kittykat1" is the password and webmaster is the username.
Now we got the username and password.
When we scanned the IP address using nmap, we saw that the ssh port was open.
So we can now try acessing ssh port
Run command ssh webmaster@10.0.2.5
use ls command to list out,and we will get flag.txt file and open it.
We got the user flag. Now we need to find the root flag.
To get root privileges, Type sudo su and type the passoword.
Surprisingly, the user has full sudo rights without restriction.
To get root flag we need to go to root directory. Use cd/root
then do ls ,there we get flag.txt open it
Now we got root flag.
Task completed!!!!!!
Thank you! see you at next hurdle!
