Create a directory for machine on the Desktop and a directory containing the scans with nmap.
Task 2 - Reconnaissance
suecho"10.10.39.96 vulnversity.thm">>/etc/hostsmkdirthm/vulnversitycdthm/vulnversity# At the end of the room# To clean up the last line from the /etc/hosts filesed-i'$ d'/etc/hosts
I prefer to start recon by pinging the target, this allows us to check connectivity and get OS info.
Sending these three ICMP packets, we see that the Time To Live (TTL) is ~64 secs. this indicates that the target is a *nix system (probably Linux), while Windows systems usually have a TTL of 128 secs.
Now that you have found a form to upload files, we can leverage this to upload and execute our payload, which will lead to compromising the web server.
4.1 - What common file type you'd want to upload to exploit the server is blocked? Try a couple to find out.
.php
We will fuzz the upload form to identify which extensions are not blocked.
To do this, we're going to use BurpSuite.
We're going to use Intruder (used for automating customised attacks).
To begin, make a wordlist with the following extensions:
.php
.php3
.php4
.php5
.phtml
.phtml
Now that we know what extension we can use for our payload, we can progress.
We are going to use a PHP reverse shell as our payload. A reverse shell works by being called on the remote host and forcing this host to make a connection to you. So you'll listen for incoming connections, upload and execute your shell, which will beacon out to you to control!
Now that you have compromised this machine, we will escalate our privileges and become the superuser (root).
In Linux, SUID (set owner userId upon execution) is a special type of file permission given to a file. SUID gives temporary permissions to a user to run the program/file with the permission of the file owner (rather than the user who runs it).
For example, the binary file to change your password has the SUID bit set on it (/usr/bin/passwd). This is because to change your password, it will need to write to the shadowers file that you do not have access to, root does, so it has root privileges to make the right changes.
5.1 - On the system, search for all SUID files. Which file stands out?
We can use the following command to list SUID files:
