Basic Pentesting – 1 Walkthrough | Vulnhub

This Walkthrough is on Basic Pentesting: 1 Vulnhub Machine made by Josiah Pierce. It contains multiple remote vulnerabilities and multiple privilege escalation vectors. For more details or for downloading the machine go here.

After the download of the machine and setup, Then started to scan the entire network with nmap by using a ping scan to find a target machine in the network.

My target IP address was “192.168.56.105“, I used nmap to find an open port of the target, and here is what we got:

So we have found 3 open ports that run services FTP, SSH, and HTTP on the target.

I will check with the HTTP service

nothing is interesting on this page, I will go for subdirectories of that target by using dirbuster tool which is already pre-installed on Kali Linux.

After a couple of minutes, I got a valid URL https://192.168.56.105/secret/

after visiting the URL, I observe that all the links referred to the domain called “vtcsec”. But it seems to be down, I think this machine is meant to be “vtcsec” host, So for seeing this blog with full content, I’ll add “vtcsec” on my host file and try again.

well, add the target IP address and the hostname “vtcsec” in the host file which is located at /etc/hosts.

After loaded the page, It looked good now!!!

Then I try to visit my target admin page by using the default username and password “admin: admin”.

boom!!! The username and password were correct, Now we have admin access on WordPress.

So I used Metasploit to generate a plugin that will spawn the shell which helps to get the remote connection of target. The module we used was wp_admin_shell_upload, Here’s an exact option screenshot I used:

After getting the meterpreter session, I tried for the interactive shell by running python script python -c ‘import pty;pty.spawn(“/bin/bash”)’ before executing this script check our target has been installed python by the command “which python”.

Still, I haven’t reached the root, So I went back to meterpreter session.

I check for file permission of etc/passwd, Here got that the file was read and write permission now I can modify the user for root privileges.

Download passwd file on my machine located to /home/vulnhub directory

to generate encrypted password I used openssl and MD-5 based algorithm(-1) “openssl passwd -1 <password>“.

then I got the encrypted password, After that open the passwd file and replace it with a new password of the root user which was generated by openssl.

after modifying the passwd file, then upload back to the target machine.

It asks for a root password, I gave the password as “hello” which was generated by openssl. Yeah, successfully we get root privileges access of the target.

I hope you’ve learned and enjoyed this Walkthrough.

So, You can connect with me on “LinkedIn & Twitter“ for more updates on Infosec.

Disclaimer:

We believe that these Practices will educate everyone about ethical hacking, and We do not promote, encourage, support, or excite any illegal activity or hacking.

We will not be responsible for your illegal actions.