Introduction
Complete Walkthrough of Basic Pentesting -2 Mission available on Vulnhub . We will discuss how to tackle this various types of vulnarable machines and try to exploit them in a safe and authorized environment. You can download zip file of that machine via this link. Observe the details given for the machine and then check up prerequisites.
Prerequisites:
Before we begin, make sure you have the following:
- Any Virtual Environment
- Any Linux virtual machine
- Basic Pentesting 2(.ova) downloaded from VulnHub
- Basic knowledge of Linux terminal commands
Steps for downloading:
Click on the link that i have specified above, you will be redirected to the downloading interface.
After downloading go to that specific path where it get downloaded, Right click on .ova file there you need to select which virtual environment you are using for your target machine.
You will be redirected to vm environment, there a settings section will be poped out. You can leave it with default settings and click on finish.
Before booting the system we need to configure the network settings. So here there will be 2 cases:
case 1:
If you are using your linux os in vm environment, then you need to use NAT Network beacause your linux os machine and target machine should have same the configuration of network.
For that you need to create a NAT Network in your vm environment by selecting network in your vm go for NAT Network section and cilvk on create option and select target machine and go for settings there you will find network setting, there you need to select adapter attached to NAT Network.
case 2:
If you are using your linux os as your main booting system, then you need to use Host only Adapter for your target machine as your linux is adapter and target machine is taking network from your adapter.
For that you need to create Host only Adapter in your vm environment by selecting network in your vm go for Host only Adapter section and cilvk on create option and select target machine and go for settings there you will find network setting, there you need to select adapter attached to Host only Adapter.
Start the both machines and wait until they get completely booted.After booting it will look like this:
After setting up all the things, go for your linux machine, check your linux ip configurations by using ifconfig and check for the ip address of your target machine by scanning the entire subnet of your network using Command : namp -sn 10.0.2.0/24
I got 4 hosts up, then i scanned every host with os detection, i get to know my target ip address is 10.0.2.8, then i checked for any open ports and more details of that ports by using nmap -A -sV -T4 10.0.2.8
After scanning i got some open ports :
- Port 22/tcp SSH (Openssh 7.2p2 Ubantu0
- Port 80/tcp HTTP (Apache httpd2.4.18(ubantu))
- Port 139/tcp netbios-ssn (Samba smbd 3.X — 4.X)
- Port 445/tcp netbios-ssn (Samba smbd 4.3.11-Ubantu)
Now we will first check for port 80 which is http in my web browser.
We not got much information here. So, we wil check if there are any hidden sub doamins in this website using a tool called dirb.Dirb is an inbuilt tool in most of the linux systems used for checking hidden sub domains for a website.
we found a /development/ hidden subdomain in that webiste.
Let’s have a look into it :
We found 2 new files, let’s have a look into both of them.
After reading the conversation i get to know that person “j” have weak credentials. The person “k” said he can crack the j person’s hash easily. So by this conversation we have understood that we need to target the j person’s account.
Get Naveennese’s stories in your inbox
Join Medium for free to get updates from this writer.
But the main problem is we don’t the real user names of them.So we need to find them for that we need to go back and check if we haves missed any clue while scanning, as we got smb server is running open on netbios protocol.
For finding usernames in smb server we will use tool called enum4linux which is inbuilt in most of linux systems.
We will run this tool on target machine’s ip address by using command : enum4linux 10.0.2.8
Here we go we got their usernames jan and kay.
As we got information that jan’s credentials are weak, we will try to find jan’s password for ssh by using tool called Hydra. Hydra is mainly used for brute forcing the credentials using millions of credentials stored in a text file named rockyou.txt which is inbuilt in most of the linux system, but by default it will be gunzipped you need to gunzip for it ti use, so for that locate rockyou.txt.gz then by going to that directory and run gunzip rockyou.txt.gz this will make it ready to use. So by ruuning the command below you can get the password of jan.
Command : hydra -l jan -P /usr/share/wordlists/rockyou.txt 10.0.2.8 ssh
Where l is username speciification (if uswername is known)
P is passsword text conainting set of passowrds to be used for brute forcing
After taking some time it will give credentials of jan to be used in ssh. Here we go we got credentails of jan.
Now let’s try to do login target ssh service with these credentials.
Command : ssh jan@10.0.2.8
We successfully get into the target system terminal by using ssh credentials of jan.
Now we will try to explore directories and files that may help us to gain ifnormation to gain root access.
So first we need to find where we are and try is there any files available if yes then check is they are infermative, similarly explore by going up directories.
Atlast we found that kay’s private ssh key(id_rsa) by going into kay’s home diretory and listing all hidden files with their permissions. There we found private ssh key of kay. To crack that key there might nit be tools in terget system so we will import to our machinie and try to crack the hash.
So we will copy the entire id_rsa text into one of our file and convert that ssh to john format by using tool called ssh2john.
Then by using john we will crack the hash.
i created a file named ssh_To_john.txt and copied entire id_rsa into it and using tool ss2john i made it into john format.
By using tool called John the ripper and i tried to crack the hash using word list rockyou.txt.
Here we go we cracked the kay’s ssh key too. So we will try to login into kay’s terminal using these credentials via ssh.After getting into kay’s terminal we will try to explore system and find any intresting things like previously we don’t have permission to access some files.
We found some intresting passpharse in kay’s pass.bak file after exploring his files.
Now we will try this passphrase to access root.
Boom! We got root access of target machine.So, root have supreme rights to do anything in system.
We tried to explore the final flag as it would be in root’s home diretories.We got happy hacking like message from flag.txt.
We started gathering information of target system by scannig target system’s ip with the help of tools like nmap then we gathered which ports are open and tried to collect information from http web and found usernames then tried to crack hashes by linux inbuilt tools like ssh2john, john the ripper. Then entered into their terminals done some privilage escalation methods to find how to acces the root.
This is the standard way of expoliting system mainly includes reconnaissance, scanning, enumeration and exploitation.
Thanks for reading !
Disclaimer:
We believe that these Practices will educate everyone about ethical hacking, and We do not promote, encourage, support, or excite any illegal activity or hacking.
We will not be responsible for your illegal actions.
