search

DC:6

DC-6 is an easy, oscp preparation machine from vulnhubarrow-up-right. I have enjoyed the process of manual exploitation.

The developer of this machine added some instruction and hints in vulnhub description. First, add the IP in your /etc/hosts file. Another one is a hint for password attack

cat /usr/share/wordlists/rockyou.txt | grep k01 > passwords.txt That should save you a few years. ;-)

hashtag
Network Scanning:

  1. To start attack, we need IP address. So I have used Netdiscover :

netdiscover -i eth0 -r 10.0.2.0/24

Target IP: 10.0.2.8

2. Before attack, its a good strategy to scan all port. Rustscan is a very fast scanner for this job: rustscan -a 10.0.2.8 --range 1-65535

Output:

There are 2 ports open. Nmap port scan can now show some more information:

nmap -sS -sV -O -p 22,80 -v 10.0.2.8

Output:

hashtag
Enumeration:

I have added the IP in my /etc/hosts

3. There is a web service running at port 80. The site says, it's a WordPress site.

Wpscan is perfect to scan this site : wpscan --url http://wordy/ --enumerate

Output:

From the scan output, I can get some username. With the Vulnhub hints, I have a password list also. So scanning with credential shows some more info:

wpscan -U user.txt -P PASS_DC.txt --url http://wordy/

Output: (login credential found)

I can login with this username and password.

4. Now there is nothing interesting. After some exploring, I have found only the 'Active monitor' plugin is running there. Instant googling shows that, this has an exploit available : https://www.exploit-db.com/exploits/45274arrow-up-right

hashtag
Exploitation

5. This plugin has a command injection vulnerability. I need to modify the exploit as my IP and port is different. Another thing is, I have changed the netcat reverse shell command also. Because the default command was not working properly. Exploit: (save it as .html and run)

6. To get a shell, I have started a listener in my machine. Executed the exploit and got a connection

nc -lvnp 4040

upgraded the shell with python:

hashtag
Post Exploitation:

7. After some manual exploration of available files, I have found new user credential : graham - GSo7isUM1D4

8. SSH connection available for graham and I can login

9. To escalate my privilege, I started manual enumeration. Permission check shows - editable .sh file and vulnerable Debian version.

10. Local privilege escalation exploit available for this version: https://www.exploit-db.com/exploits/41240arrow-up-right

11. I can modify backup.sh file. So after modifym excuting it gives me jens access

Executing the script and Jens permission info:

12. Jens can run nmap. In order to get root shell, I have tried to run nmap in interactive mode. But it's not available there.

13. Creating nmap nse to execute bash command:

/tmp is a good option to save new file because sometime there is no restriction to create new file. And I can run my nmap script. After running the command, terminal do not echo back my command so I had to type blindly and got the root flag

This was a very good practice of manual exploitation and privilege escalation. Thanks to @DCAU7

Last updated