Raven 1 - Vulnhub CTF Walkthrough

https://www.vulnhub.com/entry/raven-1,256/

1.  Do the usual scan to find the DHCP address.  Once found, do a nmap scan.  

2. I started to look around the web page with Firefox/Burp Suite while running the dirb command. 





3. We see that there is a wordpress installation. We use the wpscan tool to investigate users, plugins, themes, versions.









4. We have two logins for the wordpress installation (michael and steven). Maybe we can try to test passwords against the login page.

Also, to make life easier, we add an host record so we can browse using the DNS name raven.local.

5. We do not get far trying to bruteforce wordpress using wpscan.  I was not going to wait that long anyway.  Then, I tried ssh using the login names.  Success once I used michael:michael.







6. Now, that we are in the machine. Look around the web folder structure to see if we get more creds.






7. We have creds for root for mysql. Maybe steven used the same password. Nope. At least we should be able to log into wordpress now.

8. We have an interactive shell so maybe we can use mysql to find more data.

9.  We have found hashed passwords in the wp_users table.  We can try to find the passwords.







10. We can use hashcat to find the password. Found it. (Of course I closed the terminal before taking a screenshot.)

11. Now, try the found password with the steven login.  Is steven a sudo user?

12.  Well, it looks like steven can sudo python command.  Well, we can use python to get into a shell.





13.  That looks like game over.  I also wanted to list where I found the other flags. 

Vulnhub Walkthrough: Basic Pentesting 1

Walkthrough: Basic Pentesting 1
Author: Agoonie
Date: 2018-03-14

* Target IP (192.168.126.142)
* Full Scan










































Looks like we have ports 21, 22, and 80.  Let's try port 80.  Starting with NIKTO to find some vulns.

Ok. Let try to look up some directories.  Ah there's a secret...


















































Looks like from the page source I should edit my hosts file for DNS resolution.

Ok.  Now we look at the WordPress page.  Let's try the usual credentials.  Welp that works.

HELLLOOOO Dollllllyyy.  With this plugin, we can add a webshell and activate the plugin.  Initially I added it in the beginning of the plugin and it did not work well.  Then, I added it to the end of the plugin and viola.

We have a meterpreter session.  Let's do some exploring.

Ok.  You know the drill.  Let's look at some of the config files.  Let's look at the HOME directory.

Woah. Proftpd backdoored? Uh, I know there is a vuln of that.
ProFTPD Backdoor
















































































Got Root?  Well I guess now we just check for flags if there any.  Looks like this server was hacked and a backdoor was entered.  I did not check if there was a kernel privilege escalation vulnerability but I suspect there is.  I will revisit it later.  I did check John the Ripper for the Marlinspike password.  It is just marlinspike :)