DAV

I'm going to do the resolution of Easy Level from Tryhackme which is so easy to do.

Firstly, we've to use the nmap toolkit to discover the open ports in this compromised machine, for it, we'll should run this command which you can see in the picture below:

• nmap -n -Pn 10.10.211.50 -p- - -min-rate 40000 -sS -vvv

Now, as we know that there's open port which is 80, let's go to attack this port with this command you can see in the both pictures below:

• nmap -n -Pn 10.10.211.50 -p 80 -sV -vvv

In addition, we must use the dirsearch command to discover hidden files in the webserver of Apache httpd 2.4.18 ((Ubuntu))  and we've to run this command: dirsearch -u(url or IP) 10.10.211.50 you can see at the bottom of the picture.

We've discovered 3 urls which can be to interesting look at.

Just after, let's go to enter in webpage you can see and we've found out a login panel in the second picture below.

Now we've to try to get the login and password of webdav in the web browser as you can see in the  picture below.

Now, we've just discovered the credentials which are:

1. login: wampp
2. password: xampp

We've to write the credential(login and password) to enter into the directorios of the compromised machine you can see in the picture below.

In addition, as you can see in the picture below we have got enter in the files of machine.

Right now, we've to see in the Internet as we can obtain the machine with our attaker machine you can see in the picture below.

To create the reverse shell we can do it both ways:

1. shell generator
2. msfvenom 

In my case the reverse shell has been created by shell generator as you can see in the pictures below. 

In adition, as we've made the php shell, we should use the ls command to verify has been created successful as you can see in the picture below.

After, we must use the cadaver command to enter inner the web server for it, we have to execute this command: cadaver http://10.10.211.50/webdav/ and just after we have to run ls command to listing files in the web server you can see in the picture below.

Now, we have to execute put command which we'll permit upload scam file in the web server as you can see in the both pictures below.

• put reverse_shll.php

Before execute the suspicious file we have to open port to get it remote access with this comand you can see in th picture below: nc -lvp 4444.

Now if we execute the reverse_shll.php ,we should have what you can see in the both pictures below and we should run the next commands:

1. sript /dev/null -c bash
2. control +z 
3. stty raw -echo;fg
4. reset xterm

IMPORTANT THIS COMMANDS ARE USEFUL BECAUSE WE CAN OBTAIN PERSISTENCY

Now let's go to export the next commands from bash you can see in the picture below:

• export SHELL=BASH
• export Term=xterm

Right now, we've to discover the user flag and root flag, for it, we've to execute the next commands:

• cd /home 
• ls
• cd wampp
• ls 
• ls -la
• ls
• cd /home/merlin
• ls
• cat user.txt (to read user flag)

To sum up, we must execute command sudo -l which we should give information over  privileges root user as you can see in the picture below.

Finally, we've got the root flag with this command which is: sudo cat /root/root.txt

Thank you for reading this article

I hope you like it and learned something new

Good Hack