Funbox Easy Enum

Description ⤵️

💡 Boot2root in 6 steps for script-kiddies.
Timeframe to root this box: 20 mins to never ever. It is on you.

HINTS:

Enum without sense, costs you too many time:

1. Use “Daisys best friend” for information gathering.
2. Visit “Karla at home”.
3. John and Hydra loves only rockyou.txt
4. Enum/reduce the users to brute force with or brute force the rest of your life.
   This works better with VirtualBox rather than VMware
   

Let’s find the IP Address first »

IP : 10.0.2.18

Port Scan Results ➡️

OPEN PORTS >
22  SSH
80  HTTP

---

Web Enumeration ⤵️

Lets look into directory traversal files / folders →

I uploaded the php_reverse_shell code →

---

SHELL ➡️

Now lets check /etc/passwd →

Now I have to crack the password → so lets use hashcat →

command → 
hashcat -m 500 pass.hash /usr/share/wordlists/rockyou.txt

oracle : hiphop

Lets recon more on web →

Lets check →

phpmyadmin : tgbzhnujm!

Now I tried this password for karla →

And I got in →

It time for root !!

I got one more user credentials →

---

Another Way to root →

Now lets brute force the password for user goat which contains the shadow.bak file →

I got result after 15-20 min →

goat : thebest

---

If you have any questions or suggestions, please leave a comment below. Thank You !