Vulnhub Walkthrough: LazySysAdmin 1

Walkthrough: LazySysAdmin 1

Author: Agoonie

Date: 2017-10-9

1. Target IP

VM is setup with host-only in VMware workstation.  I identified the IP with a simple Nmap ping sweep. 

nmap -sn -v 192.168.126.2-254

2. NMAP Scan/Service ID

Now, on to the full scan to identify open ports and to identify what services are running.

Next, I start to look at interesting ports, usually while the scan is still going.  I took note of ports 80, 139, 445, and 3306.  For port 80, I wanted to start to enumerate files and folder structure for the web application.  I usually use dirb/dirbuster. 

 

With dirb, I see folders for wordpress and phpmyadmin.  I use wpscan to see if I can get any information about the wordpress site being hosted.  Sometimes, you can get users, plugins, themes, etc.

The scan identified an admin user, wordpress version, a theme and some links to look at.  I noted everything and went on to ports 139 and 445.

Bingo.  I am able to see files in the wordpress folder using the SMB service.  If I can connect to it, maybe I can just read and write to it.  Next, put in a web shell, escalate privs and then, game over. 

 

No luck.  I can only read the files. I cannot write to the folder.  Well, let’s read some files.

It looks like the admin put in a password in the deets.txt file.  What else can we find?  Maybe config files in the wordpress folder. 

 

The wp-config.php file might be good.

Looks like we have an account for the wordpress site.  Let’s keep track of more creds and test them out.

 

We have AntiSpam and Hello Dolly.  A quick search for Hello Dolly and you see it is used by hackers to add backdoors to sites.  I assume that means I can just add php code to it. 

 

3. Exploit Execution

It has accepted and saved the php code I added to hello.php  Now, I just start a Metasploit mult handler and browse to hello.php.

4.  Escalating Privileges

We are running as www-data.  How can we escalate?  Let’s start looking around to see if we find anything.

Looks like we have more credentials to take note of.  We found the user togie, which is the admin for the wordpress site.  Maybe I can start to test the creds for his account, togie.  There is ssh running on the server.  Let’s try.

The password 12345 worked for him.  Well, he is the admin, maybe he is a sudo user?

Conclusion:

Well, enumeration was key to root the box.  I did not screen shot the process but I tried every priv escalation root file from exploit-db.com.  Every one of them failed.  In addition, gcc and cc was not present on the box.  I created similar vm’s to compile the code and uploaded the executables.  It did not matter.  Every time I got a credential, I could get to the next step on the vm.  Great boot2root!