'VulnHub-LazySysAdmin'

1.Goal

[Description]

Difficulty: Beginner - Intermediate

Boot2root created out of frustration from failing my first OSCP exam attempt.

Aimed at:

1
2
> Teaching newcomers the basics of Linux enumeration
> Myself, I suck with Linux and wanted to learn more about each service whilst creating a playground for others to learn

Special thanks to @RobertWinkel @dooktwit for hosting LazySysAdmin at Sectalks Brisbane BNE0x18

[Lore]

LazySysadmin - The story of a lonely and lazy sysadmin who cries himself to sleep

[Hints]

  • Enumeration is key
  • Try Harder
  • Look in front of you
  • Tweet @togiemcdogie if you need more hints

[Other]

  • What could you of done to speed up the enumeration process?

  • Are there any obvious things that you missed, which you shouldnt of missed?

  • Did you learn anything interesting?

  • What have you added to your enumeration process to prevent you from wasting time?

2.Web

发现靶机IP

Nmap扫描

发现开启SMB服务,用smbclient连接靶机,同时进行目录扫描

1
smbclient //192.168.126.142/share$

看到wordpress,进去下载配置文件

找到Mysql配置信息

目录扫描发现有PHPmyadmin,登录进去之后查看wordpress的表,发现权限不够

仔细看发现是PMA的表没有权限查询,尝试直接登录

不允许远程登录

继续在目录里找有用的信息

在deets.txt下发现密码,不过不知道是什么的密码

todolist.txt

在Wordpress里的文章看到的信息

用户名可能是togie,密码是12345

3.Server

ssh连接

查看用户

当前用户用的是rbash,有限制的bash

不过有sudo权限,可以切换为root