Badbyte

Nmap is a free open source tool, employed to discover hosts and services on a computer network by sending packets and analyzing the retrieved responses. In this task  nmap will be used to enumerate open ports and what services are running on machine. Check out the Nmap room for more on this!

In this task:

1.  First scan which ports are open on the box: nmap -p-  -vv MACHINE_IP
2.  Then after finding the ports number, enumerate what services are running on those port:
   nmap -A -p port1,port2,port3 MACHINE_IP
   

John the Ripper is an Open Source password security auditing and password recovery tool available for many operating systems.

Check out the Crackthehash or Crackthehash2 for more hash cracking.

To crack ssh private key first use ssh2john python script convert private key to hash (It comes with Kali Linux. Run locate ssh2john).

python path/to/ssh2john.py privatekey > privatekey.hash

Then use john to crack the hash.

john privatekey.hash -w=/path/to/wordlist


Crack the passphrase of the private key and SSH into the machine. Make sure to change the file permissions of SSH private key to 600.

According to Wikipedia SSH or Secure Shell is a cryptographic network protocol for operating network services securely over an unsecured network. Typical applications include remote command-line, login, and remote command execution, but any network service can be secured with SSH.

Some important flags that will be used in this task are below.

-L

local_port:remote_address:remote_port

port:local_address:local_port

local_PORT

In the above picture the user from blue server wants to connect to port 80 on the red server but the port is blocked by the firewall. User can connect through ssh and create a tunnel which would allow him to connect to port 80 on the red server. In this case user can use Local port forwarding to connect the port on the red server to his local machine.

To complete this task:

1. Setup Dynamic Port Forwarding using SSH.
   HINT: -i id_rsa -D 1337
   
2. Set up proxychains for the Dynamic Port Forwarding. Ensure you have commented out socks4 127.0.0.1 9050 in your proxychains configuration and add socks5 127.0.0.1 1337 to the end of configuration file (/etc/proxychains.conf).
   The file name may vary depending on the distro you are using.
   
   
3. Run a port scan to enumerate internal ports on the server using proxychains. If you use Nmap your command should look like this proxychains nmap -sT 127.0.0.1 .
4. After finding the port of the webserver, perform Local Port Forwarding to that port using SSH with the -L flag.
   HINT: -i id_rsa -L 80:127.0.0.1:(remote port) (Try using with sudo)
   

Use nmap to scan for the vulnerability in the CMS that is running on the webserver. Nmap has a script that can find vulnerabilities in the CMS which used in this machine.

Now that you have locally forwarded the port, the webserver is running on localhost and you can access it from your browser.

In this task:

1. Scan the internal web server and find vulnerable plugins using Nmap or the popular scanning tool for this CMS.
2. Exploit the vulnerability either using metasploit or following any POC(proof of concept).
3. Get the user flag.
   

 ________________________
< Made with ❤ by BadByte >
 ------------------------
        \   ^__^
         \  (oo)\_______
            (__)\       )\/\
                ||----w |
                ||     ||