BUSCALOVE

First of all, I am going to do this machine from cybersecurity labs called BuscaLove which is easy Level.

For it, let’s go to open Linux terminal and we have to write the command when we can see in the picture below.

cd Descargas

In addition, we have to depress the unzip file whose name’s buscalove.zip you can see in the picture below.

Now we have to deploy the vulnerability machine whose command is sudo bash auto_deploy.sh buscalove.tar we can see in the picture below.

On the other hand, to start the attack at virtual machine, we must verify if the attacker machine is in the same range of IP Address and we have to introduce this command which is ping -c 3 172.18.0.2 we can see in the picture below.

As I,ve just seen the IP Address it’s in the same range of my IP Address we have to introduce the command with nmap tool which is nmap -n -Pn 172.18.0.2 -p- - -min-rate 4000 -vvv( here you can see in this picture the scanner) but I’ve got it 2 ports:

22: open ssh
80: open http

Now, we have to try the attack the open ports with this command which is nmap -n -Pn 172.18.0.2 -p 22,80 -sV -vvv and we have obtained more information such as you can see in the second picture below.

In addition, we are going to introduce this command which is dirsearch -u 172.18.0.2 to discover the directories may be hidden by the website we can see in both pictures below.

Finally, we can observe the webpage has been obtained which is http://172.18.0.2/.wordpress/ you can see in the picture below.

Right now, as we cannot get it enough information, we must use this toolkit which is wfuzz where we’ll be able to find important information with this command:

wfuzz -w /usr/share/wordlist/disbuster/directory-list-lowercase-2.3-medium.txt -u http://172.18.0.2/wordpress/index.php’?’FUZZ=../../../../etc/passwd - -hc 404 - -hl 40

Finally, we can observe the webpage has been obtained which is http://172.18.0.2/.wordpress/ you can see in the picture below.

Moreover, now As we know there’s 2 users whose names are Pedro and Rosa we have to try attack with the hydra toolkit and we must use this command:

hydra -L rosa -P /usr/share/wordlist/rockyou.txt ssh://172.18.0.2 -t 64( this toolkit we’ll be able to discover the password) you can see in the picture below.

To sum up, as we have got the user and password we’re going to enter into the Linux Machine with this command which is ssh rosa@172.18.0.2 and introduce the password as you can see in the picture below.

Although, we’ve got it enter in this machine, we’ll need to become the root user and for it we have to introduce this command sudo -l where you can see that we will be able to execute as if we were a root user with ls or cat command in the picture below.