Basic Pentesting
This is a machine that allows you to practice web app hacking and privilege escalation
Task 1 Web App Testing and Privilege Escalation
In these set of tasks you'll learn the following:
brute forcing
hash cracking
service enumeration
Linux Enumeration
The main goal here is to learn as much as possible. Make sure you are connected to our network using your OpenVPN configuration file.
Credits to Josiah Pierce from Vulnhub.
Answer the questions below
Deploy the machine and connect to our network
No answer needed
Find the services exposed by the machine
root@kali:~# nmap -sV 10.10.172.195
Starting Nmap 7.80 ( https://nmap.org ) at 2021-09-20 07:43 UTC
Nmap scan report for ip-10-10-172-195.eu-west-1.compute.internal (10.10.172.195)
Host is up (0.0010s latency).
Not shown: 994 closed ports
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.4 (Ubuntu Linux; protocol 2.0)
80/tcp open http Apache httpd 2.4.18 ((Ubuntu))
139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
8009/tcp open ajp13 Apache Jserv (Protocol v1.3)
8080/tcp open http Apache Tomcat 9.0.7
MAC Address: 02:EA:B6:B5:03:7F (Unknown)
Service Info: Host: BASIC2; OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 13.35 secondsNo answer needed
What is the name of the hidden directory on the web server(enter name without /)?
Answer format: development
User brute-forcing to find the username & password
after some enum i get this notes
SMB has been configured.
There is Apache struts version 2.5.12 running.
User j is using weak password which can be cracked easily.
run enum4linux
now we have 2 username kay, jan
remember jan has weak password lets brute force jan ssh
after while credentials jan:armando
No answer needed
What is the username?
Answer format: jan
What is the password?
Answer format: armando
What service do you use to access the server(answer in abbreviation in all caps)?
Answer format: ssh
Enumerate the machine to find any vectors for privilege escalation
after some enum ... no way to vertical escalation
lets go for horizontal ... i can access private ssh key for kay
No answer needed
What is the name of the other user you found(all lower case)?
Answer format: kay
If you have found another user, what can you do with this information?
No answer needed
What is the final password you obtain?
try to connect with ssh ... passphrase required
i'll use ssh2hohn to extract it
passphrase beeswax
after login
Answer format: heresareallystrongpasswordthatfollowsthepasswordpolicy$$
Last updated