DC 4

Description ⤵️

💡 DC-4 is another purposely built vulnerable lab with the intent of gaining experience in the world of penetration testing.
Unlike the previous DC releases, this one is designed primarily for beginners/intermediates. There is only one flag, but technically, multiple entry points and just like last time, no clues.
Linux skills and familiarity with the Linux command line are a must, as is some experience with basic penetration testing tools.
For beginners, Google can be of great assistance, but you can always tweet me at @DCAU7 for assistance to get you going again. But take note: I would not give you the answer, instead, I’ll give you an idea about how to move forward.
TECHNICAL INFORMATION
v DC-4 is a VirtualBox VM built on Debian 32 bit, so there should be no issues running it on most PCs.
If there are any issues running this VM in VMware, have a read through of this.
It is currently configured for Bridged Networking, however, this can be changed to suit your requirements. Networking is configured for DHCP.
Installation is simple - download it, unzip it, and then import it into VirtualBox and away you go.
IMPORTANT
While there should be no problems using this VM, by downloading it, you accept full responsibility for any unintentional damage that this VM may cause.
In saying that, there should not be any problems, but I feel the need to throw this out there just in case.
CONTACT
I’m also very interested in hearing how people go about solving these challenges, so if you’re up for writing a , please do so and send me a link, or alternatively, follow me on Twitter, and DM me (you can unfollow after you’ve DM’d me if you’d prefer).
I can be contacted via Twitter - @DCAU7

Let’s find the IP Address first »

IP → 10.0.2.9

Port Scan Results ➡️

OPEN PORTS >
22  SSH
80  HTTP

---

Web Enumeration ⤵️

Lets fire up the burpsuites and see what I can do on this login page →

After login →

{: .nolineno}
admin : happy

Now lets try reverse shell code →

I got in →

Now I have some credentials → 
	
jim : jibril04

charles : ^xHhA&hvim0y

with teehee command works similar like tee so I am going to add a user with root permissions →

commands → **shiva::0:0:::/bin/bash** → with no passwords set

---

Summery Notes →

→ NOTE → tee or teehee -a /etc/passwd

→ Then adding a null user with no password but as a root was very nice move.

If you have any questions or suggestions, please leave a comment below. Thank You !