search

Basic Pentesting

This is a machine that allows you to practice web app hacking and privilege escalation

hashtag
Task 1 Web App Testing and Privilege Escalation

In these set of tasks you'll learn the following:

  • brute forcing

  • hash cracking

  • service enumeration

  • Linux Enumeration

The main goal here is to learn as much as possible. Make sure you are connected to our network using your OpenVPN configuration filearrow-up-right.

Credits to Josiah Piercearrow-up-right from Vulnhub.

Answer the questions below

Deploy the machine and connect to our network

No answer needed

Find the services exposed by the machine

root@kali:~# nmap -sV 10.10.172.195
Starting Nmap 7.80 ( https://nmap.org ) at 2021-09-20 07:43 UTC
Nmap scan report for ip-10-10-172-195.eu-west-1.compute.internal (10.10.172.195)
Host is up (0.0010s latency).
Not shown: 994 closed ports
PORT     STATE SERVICE     VERSION
22/tcp   open  ssh         OpenSSH 7.2p2 Ubuntu 4ubuntu2.4 (Ubuntu Linux; protocol 2.0)
80/tcp   open  http        Apache httpd 2.4.18 ((Ubuntu))
139/tcp  open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp  open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
8009/tcp open  ajp13       Apache Jserv (Protocol v1.3)
8080/tcp open  http        Apache Tomcat 9.0.7
MAC Address: 02:EA:B6:B5:03:7F (Unknown)
Service Info: Host: BASIC2; OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 13.35 seconds

No answer needed

What is the name of the hidden directory on the web server(enter name without /)?

Answer format: development

User brute-forcing to find the username & password

after some enum i get this notes

  1. SMB has been configured.

  2. There is Apache struts version 2.5.12 running.

  3. User j is using weak password which can be cracked easily.

run enum4linux

now we have 2 username kay, jan

remember jan has weak password lets brute force jan ssh

after while credentials jan:armando

No answer needed

What is the username?

Answer format: jan

What is the password?

Answer format: armando

What service do you use to access the server(answer in abbreviation in all caps)?

Answer format: ssh

Enumerate the machine to find any vectors for privilege escalation

after some enum ... no way to vertical escalation

lets go for horizontal ... i can access private ssh key for kay

No answer needed

What is the name of the other user you found(all lower case)?

Answer format: kay

If you have found another user, what can you do with this information?

No answer needed

What is the final password you obtain?

try to connect with ssh ... passphrase required

i'll use ssh2hohn to extract it

passphrase beeswax

after login

Answer format: heresareallystrongpasswordthatfollowsthepasswordpolicy$$

PreviousSimple CTFNextKenobi

Last updated