DC : 9

Description ⤵️

💡 DC-9 is another purposely built vulnerable lab with the intent of gaining experience in the world of penetration testing.
The ultimate goal of this challenge is to get root and to read the one and only flag.
Linux skills and familiarity with the Linux command line are a must, as is some experience with basic penetration testing tools.
For beginners, Google can be of great assistance, but you can always tweet me at @DCAU7 for assistance to get you going again. But take note: I would not give you the answer, instead, I’ll give you an idea about how to move forward.
TECHNICAL INFORMATION
DC-9 is a VirtualBox VM built on Debian 64 bit, but there should not be any issues running it on most PCs.
DC-9 has been tested successfully on VMWare Player, but if there are any issues running this VM in VMware, have a read through of this.
It is currently configured for Bridged Networking, however, this can be changed to suit your requirements. Networking is configured for DHCP.
Installation is simple - download it, unzip it, and then import it into VirtualBox or VMWare and away you go.
IMPORTANT
While there should be no problems using this VM, by downloading it, you accept full responsibility for any unintentional damage that this VM may cause.
In saying that, there should not be any problems, but I feel the need to throw this out there just in case.
CREDITS
A big thanks goes out to the members of @m0tl3ycr3w.
CONTACT
I’m also very interested in hearing how people go about solving these challenges, so if you’re up for writing a , please do so and send me a link, or alternatively, follow me on Twitter, and DM me (you can unfollow after you’ve DM’d me if you’d prefer).
I can be contacted via Twitter - @DCAU7

Let’s find the IP Address first »

IP : 10.0.2.15

Port Scan Results ➡️

OPEN PORTS >
80   HTTP
Filtered PORT >
22   SSH (I think I have to open it through knocking ports )

---

Web Enumeration ⤵️

I will be enumerating port 80 first and I got to this drupal static site.

Now lets deal with search.php file from burpsuite →

Now save this request as results.txt and used Sqlmap Tool to figure out the sqli type and to extract some data →

lets dig deeper →

command :
sqlmap -r results.txt -D Staff -T Users -

admin : transorbital1

After login with admin credentials I got this page → which says file not exist.

I got LFI on welcome.php page.

Now lets check for knocked ports which will open ssh port on /etc/knockd.conf →

Lets knock the ports →

sudo knock 100.2.16 7469 8475 9842

Now lets check the result with scanning the network again with nmap Tool →

Now lets try hydra for ssh brute-force →

I have saved username , passwords that I got from the sqli →

chandlerb : UrAG0D!

joeyt : Passw0rd

janitor : Ilovepeepee

---

SHELL ➡️

I got some new passwords !

Now use this password to ssh again for any other results →

fredf : B4-Tru3-001

Since this file is reading the content of a file and writing on another file →

So lets append a password inside the /etc/passwd file →

___

Summery Notes ⤵️

→ Very much hurdle came like sqlmap with request , knocking , test.py

---

If you have any questions or suggestions, please leave a comment below. Thank You !