________________SkyTower OS________________
After importing your SkyTower OS into vb, do the same process as usual to get its IP_addr:
1) netdiscover -i eth0,,, enter. 2) Scan that IP_addr using “nmap” command to know which ports are opened there. “nmap -A IP_adrr_of_SkyTower”, enter.
3) Try to open that IP in a web browser. U’ll get into a login page. Try SQL injection there in the field. In the username’s field, type for example bla’, and in the password’s filed bla’. Press enter to see if the server will prompt you an error message. If so, it is vulnerable to SQL injection.
4) Now, try to bypass the credential’s barriers using SQL injection. Type in the username’s  or email’s field: ‘ or 1=1 --   (put the same in the password’s field as well. Note: there is a space before the “or” it is eleven characters all together).
5) Now, while perusing the error line, we see that (inside the single quotes) the equal sing “=“ and the “or” is not present. So, we must find a way to bypass that filter. 
Go back to your login page again, and type a true command there. Example, in the email’s field, type: ‘ || 8>7 # ,,,all together is eleven characters. What that injection does, it sends a mysql query 8 is greater than 7, which is true. It should bypass filtering and authentication. Copy and paste it into the password’s field as well, and click “login”. Boommmm!!! We get there, finding the real credentials.
6) Now, we see that we have to bypass SSH too, while reading in the upcoming page. So, open a new terminal in your kali machine, and type: edit /etc/proxychains.conf,,, enter. Search for “[ProxyList]”, and remove or comment the line which says “socks4 127.0.0.1 9050”, and write there “http Ip_addr_of_skytowerOS Port_of_http-proxy Squid_found_in_nmap_scan”. Eg: http 192.168.blabla 3128,,, and click save, close the file. 
7) Now, let’s use our proxy chain ssh by typing in a terminal: proxychains ssh john@192.168.blabla,,, press enter. (Note, that john is the username found in the step 5 when we injected our SQL command inside the credential’s fields), then type the password.
 Now let’s try to execute the same command as in step 7 along with the “id” option: proxychains ssh john@192.168.blabla ‘id’, press enter. Type that password. Okay!!! See, we are able to execute commands. 
So, do the same thing again, instead of writing between single quotes (id), write: ‘/bin/bash’,,, and enter, and password.
9) Type: /bin/sh -i  ,,, press enter. Type “cd /root”, you won’t be able to get there. So enter the following command:
find / -maxdepth 4 -name *.php -type f 2>/dev/null | xargs grep -C 20 -i pass ,,,and press enter.
10) Now, type these command into the mysql shell:
mysql -uroot -proot -e 'show databases;'
mysql -uroot -proot -e 'use SkyTech; show tables;'
mysql -uroot -proot -e 'use SkyTech; select * from login;'
11) Choose a username, and in a new terminal, type: proxychains ssh saraForExample@192.168.blabla ‘/bin/sh’,,, press enter, and type its appropriate password found in the database. 
Oooooh, unfortunately we can’t access “tty” shell, because it says that “jobs control turned off”. So, let’s try to bypass that barrier:
12) Type: /bin/sh -i ,,, press enter. Type: sudo -l (small L) 
13) Type: ls -la,,, enter. Open the “bashrc” file using “cat” command. Well, the solution is: As you can down the file, there is an “exit” command. This is why we were unable to ssh without sending the “/bin/sh” command. Remove that file (the bashrc) file, or, backup it into another name.
14) Now, repeat the step (11) here, without the “/bin/sh”, type the password. Booooooom!, now you get into a shell command.
15) Type: “sudo -l “,,, “sudo ls /account/../ “, then “sudo ls /account/../root”, Enter. So there, we see a flag.txt file. Use “cat” command to view it. Read the information it gives, cause it is a credential.
16) So, open up another terminal, and type: proxychains IP_addr_ofSkytowerOS,,, enter. Type that password found in step 15. Good job, game over!!!