Game Zone

Learn to hack into this machine. Understand how to use SQLMap, crack some passwords, reveal services using a reverse SSH tunnel and escalate your privileges to root!

Scanning

nmap

root@ip-10-10-202-12:~# nmap -T4 -A 10.10.42.26

Starting Nmap 7.60 ( https://nmap.org ) at 2021-09-22 13:48 BST
Stats: 0:00:02 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan
SYN Stealth Scan Timing: About 1.00% done; ETC: 13:50 (0:01:39 remaining)
Nmap scan report for ip-10-10-42-26.eu-west-1.compute.internal (10.10.42.26)
Host is up (0.00057s latency).
Not shown: 998 closed ports
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.7 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 61:ea:89:f1:d4:a7:dc:a5:50:f7:6d:89:c3:af:0b:03 (RSA)
|   256 b3:7d:72:46:1e:d3:41:b6:6a:91:15:16:c9:4a:a5:fa (ECDSA)
|_  256 53:67:09:dc:ff:fb:3a:3e:fb:fe:cf:d8:6d:41:27:ab (EdDSA)
80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))
| http-cookie-flags: 
|   /: 
|     PHPSESSID: 
|_      httponly flag not set
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Game Zone
MAC Address: 02:AE:D8:BA:8A:FD (Unknown)
Device type: general purpose
Running: Linux 3.X
OS CPE: cpe:/o:linux:linux_kernel:3.13
OS details: Linux 3.13
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE
HOP RTT     ADDRESS
1   0.57 ms ip-10-10-42-26.eu-west-1.compute.internal (10.10.42.26)

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 16.96 seconds

Enumeration

port 80

login page ... lets go for SQLi

Initial Access

SQLi

Use ' or 1=1 -- - as your username and leave the password blank.

We in let's search for '

this form infected with SQLi lets break into database using SQLmap

backend running mysql

SQLMap

lets capture this request with burpsuite first

save it to text file

lets crack this one and connect using SSH

using john the ripper to crack this hash

credentials agent47:videogamer124

SSH target with this credentials ...

Privilege Escalation

Enumerate Services

0.0.0.0 not routable accessed locally only

let's setup reverse ssh tunneling

now we can access port 10000 on attacker machine

login with credentials agent47:videogamer124

version MiniServ 1.580

Metasploit

Let’s select it and set a reverse shell for our payload:

Now, let’s set up our variables:

We are all set. Let’s exploit.

PreviousTomGhostNextSkynet

Last updated