sudo netdiscover -r <IP> to scan our network for devices (found 4 hosts - kali, host, vuln machine, vmware)
1. Enumeration
1.1 Enumerate services
1.2 Enum4linux
1.3 Checked http apache webserver at port 443
By right should always check web vulnerabilities last
2. Exploit Action
Here we begin exploiting every attack vector possible : ssh, apache httpd, rpcbind, mysql
2.1. OpenSSH
22/tcp open ssh OpenSSH 3.9p1 (protocol 1.99)
SSH failed to work due to unavailable suitable attack vectors.
2.2 Apache webserver
Searchsploit apache version
Searchsploit hacks
searchsploit -x <path of exploit> : opens the source code of exploit file
searchsploit -u : update searchsploit from expoitdb database
searchsploit -p <path of exploit> : copies exploit to clipboard
searchsploit -m <path of exploit> : copies exploit file to your directory (REMEMBER TO cd or create new dir for this!)
mod_ssl is an optional module for the Apache HTTP Server. It provides strong cryptography for the Apache v1. 3 and v2 webserver via the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) cryptographic protocols by the help of the Open Source SSL/TLS toolkit OpenSSL. This fits our purpose :
# Download the exploit to our makeshift directory
Do always try to read the source code to see requirements for exploit, there's so many things you can learn from reading scripts!
For this we stored it in ~/home/searchsploit_stuff as OpenFuck.c
note the requirements of libssl-dev (apt-get install libssl-dev)
Compile with: gcc -o OpenFuck OpenFuck.c -lcrypto (replace OpenFuck.c with the name of your downloaded exploit .c file)
┌──(kali㉿kali)-[~]
└─$ nmap -T4 -A -p- 192.168.204.129
Starting Nmap 7.91 ( https://nmap.org ) at 2021-12-02 12:57 +08
Nmap scan report for 192.168.204.129
Host is up (0.0021s latency).
Not shown: 65528 closed ports
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 3.9p1 (protocol 1.99)
| ssh-hostkey:
| 1024 8f:3e:8b:1e:58:63:fe:cf:27:a3:18:09:3b:52:cf:72 (RSA1)
| 1024 34:6b:45:3d:ba:ce:ca:b2:53:55:ef:1e:43:70:38:36 (DSA)
|_ 1024 68:4d:8c:bb:b6:5a:bd:79:71:b8:71:47:ea:00:42:61 (RSA)
|_sshv1: Server supports SSHv1
80/tcp open http Apache httpd 2.0.52 ((CentOS))
|_http-server-header: Apache/2.0.52 (CentOS)
|_http-title: Site doesn't have a title (text/html; charset=UTF-8).
111/tcp open rpcbind 2 (RPC #100000)
| rpcinfo:
| program version port/proto service
| 100000 2 111/tcp rpcbind
| 100000 2 111/udp rpcbind
| 100024 1 962/udp status
|_ 100024 1 965/tcp status
443/tcp open ssl/http Apache httpd 2.0.52 ((CentOS))
|_http-server-header: Apache/2.0.52 (CentOS)
|_http-title: Site doesn't have a title (text/html; charset=UTF-8).
| ssl-cert: Subject: commonName=localhost.localdomain/organizationName=SomeOrganization/stateOrProvinceName=SomeState/countryName=--
| Not valid before: 2009-10-08T00:10:47
|_Not valid after: 2010-10-08T00:10:47
|_ssl-date: 2021-12-02T17:58:00+00:00; +13h00m29s from scanner time.
| sslv2:
| SSLv2 supported
| ciphers:
| SSL2_DES_192_EDE3_CBC_WITH_MD5
| SSL2_DES_64_CBC_WITH_MD5
| SSL2_RC2_128_CBC_EXPORT40_WITH_MD5
| SSL2_RC4_64_WITH_MD5
| SSL2_RC4_128_EXPORT40_WITH_MD5
| SSL2_RC4_128_WITH_MD5
|_ SSL2_RC2_128_CBC_WITH_MD5
631/tcp open ipp CUPS 1.1
| http-methods:
|_ Potentially risky methods: PUT
|_http-server-header: CUPS/1.1
|_http-title: 403 Forbidden
965/tcp open status 1 (RPC #100024)
3306/tcp open mysql MySQL (unauthorized)
Host script results:
|_clock-skew: 13h00m28s
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 16.84 seconds
┌──(kali㉿kali)-[~]
└─$ enum4linux 192.168.204.129 130 ⨯
Starting enum4linux v0.8.9 ( http://labs.portcullis.co.uk/application/enum4linux/ ) on Thu Dec 2 13:27:08 2021
==========================
| Target Information |
==========================
Target ........... 192.168.204.129
RID Range ........ 500-550,1000-1050
Username ......... ''
Password ......... ''
Known Usernames .. administrator, guest, krbtgt, domain admins, root, bin, none
=======================================================
| Enumerating Workgroup/Domain on 192.168.204.129 |
=======================================================
[E] Can't find workgroup/domain
===============================================
| Nbtstat Information for 192.168.204.129 |
===============================================
Looking up status of 192.168.204.129
No reply from 192.168.204.129
========================================
| Session Check on 192.168.204.129 |
========================================
Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 437.
[E] Server doesn't allow session using username '', password ''. Aborting remainder of tests.
