Hello Everyone, this is the final VM from the kioptrix series and to be frank, I enjoyed it the most(I was frustrated though).
Download:https://www.vulnhub.com/entry/kioptrix-level-13-4,25/
As usual getting the IP was the first thing. Netdiscover plays the trick. After getting IP I scanned with nmap.
netdiscover -r 10.0.2.0/24
Here port 80 is open so I scanned it with Nikto.
Nikto -h http://10.0.2.20
I used some default credentials to log in and I found out that the login page was vulnerable to SQL injection. (Try ‘ )
Again on Port 445, I can see samba running(samba is the best low hanging fruit). I searched for nse script available.
locate -r '\.nse
And I was able to find 5 users john,loneferret, nobody,robert, root. I hover back to login page and with the help of john: 'or''=' i was able to log in.
After getting john password, I opt for SSH.
I got the shell but it was limited shell as I was unable to execute normal commands so I tweaked around and found this.
I knew that website is running on MySQL, So I visited /var/www directory and there I found one config file with the credential.
Here I got username as root and password is blank. I used these to log-in MySQL.
Getting root from MySQL was very tricky, it took plethora of time then I came across this blog. I followed the steps.
And at last, I WAS ROOT!! Visit: Azure Skynet Visit: Cosmic Skills Happy Hacking:) | xargs grep categories | grep smb
And I was able to find 5 users john,loneferret, nobody,robert, root. I hover back to login page and with the help of john: ‘or”=’ i was able to log in.
After getting john password, I opt for SSH.
I got the shell but it was limited shell as I was unable to execute normal commands so I tweaked around and found this.
I knew that website is running on MySQL, So I visited /var/www directory and there I found one config file with the credential.
Here I got username as root and password is blank. I used these to log-in MySQL.
Getting root from MySQL was very tricky, it took plethora of time then I came across this blog. I followed the steps.
And at last, I WAS ROOT!!
Visit: Azure Skynet
Visit: Cosmic Skills
Happy Hacking:)