0wn!ng LazySysAdmin: 1

By -
Hi,

In this post I am going to write on how I owned LazySysAdmin: 1 machine which is hosted on Vulnhub.

As usual, I start with an arp-scan and discover the target IP address.



Next, starts the port-scan.


I decided to first enumerate the webpage:



Enumeration reveals that wordpress and phpmyadmin is running.



It is clear that the name of the admin is "togie" which may come to use at a later time.

Next, I searched through the website and there are files with directory listing, etc but I had hit a roadblock on web service.

I decided I shall look over to smb ports 139 and 445.

using smbclient and checked if null sessions are enabled and my guess is correct.


There are some interesting files here.

After further digging I have two information points:

1. in wp-config, we see dbusername and password is present.


2. File deets.txt has a clue:


Now, with username "Admin" and password "TogieMYSQL12345^^" I can login to phpmysql as phpmysql password is same as mysql password.


Its a lazyAdmin machine so maybe there is a password re-use?

I tried the same password for wp-admin login and could login:


Given the mysql password as "TogieMYSQL12345^^" I tried "TogieSSH12345^^" for ssh service but it failed.

I remember I had the deets.txt I was able to get from smb share.

With username as "togie" and password "12345" I got ssh shell but it is restricted bash.

So I tweaked my ssh login to escape the rbash:


As you can see user "togie" is in sudo group so a sudo -i makes us root user.

 Going for the flag:


Conclusion:

This boot2root was good but could have been a little more challenging, specially privilege escalation.

Thanks to the author, Togie Mcdogie who put in the efforts to build the machine and to Vulnhub for hosting it.

-n1ghtcr4wl3r

Comments

Post a Comment

Popular posts from this blog

By -
Image
I picked up Sedna and these were the steps: Like any machine, starting with arp-scan to first know the machine IP: arp-scan -l The machine got detected at 192.168.137.152 The next step was to run an nmap scan: From here, I decided that I shall  be concentrating on port 80. First checking the webpage: I decided I shall have a peek at the robots.txt as well: going to /Hackers gave 404 -Not found! Damn! :D Meanwhile in background, I was running gobuster. Doing web enumeration and checking web page sources dint reveal much! I decided to check my gobuster results: Manually enumerating the dirbuster pointed folders, I quickly became clear that builderengine was running. Next, a searchsploit revealed exploit for arbitrary upload in BuilderEngine. Seems BuilderEngine is vulnerable to arbitrary file uploads on the directory: http://IP_Addr/themes/dashboard/assets/plugins/jquery-file-upload/server/php/ I uploaded a simple php reverse shell...
Read more

Pluck w00t!

By -
Image
Time to Pluck! Though a bit late, I decided to give this machine a try! As with all almost every machine I began with arp-scan/netdiscover: Once this is done, next I try to do a port scan on the host. I began with the tcp scan while upd scans taking more time ran in the background. Since port 80 was open, I ran nikto in other window. Post this is done, I move next to check banners on each service. SSH dint give any banner, neither mysql or llmnr protocol so I tried to enumerate the web. Just before I went to check the web service, I looked at the nikto results and they were interesting! Now, this was very interesting, an LFI!! Meanwhile I had also tried fuzzing the admin page on the webservice and it revealed sql injection: Now, I had two vectors so I thought lets begin with the LFI. Doing a /etc/passwd dumped all the contents!! But Trying lfi on other files like apache logs etc was not getting possible (permission issue??) This was when som...
Read more

My Tryst with Exploitation

By -
Hello Everyone! n1ghtcr4wl3r here... I have started preparing for offensive Security Certified Expert (OSCE) and in this post shall be a description as to how I have started honing my skills of binary exploitation. Tulpa has been a great help in commencing this journey and so has been Mike and corelanc0d3r  :) This post shall be an incremental post and I will describe my journey while exploiting a software called vulnserver I will keep adding more content on this post as time goes by. Until then see you next time!
Read more