CTF - Billu_B0x Challenge Walkthrough

This is another VM named as Billu_B0x. This is very easy to access and can get root access of the machine.

PENETRATION METHODOLOGY:

NMAP
DIRB
CURL
SSH

EXPLOITATION

First of all we need to run nmap to enumerate ports and services running on the server.

On enumerating target, we get ssh and http are running. On viewing HTTP over browser, we get the following page running.

Now trying to run 'dirb' on the web server using the big.txt dictionary.

On the scan we found phpmy page, we find phpmyadmin is running.

After that viewing the dirb scan, their is '/test', by visiting the directory we found that page.

This page shows that their is post parameter named 'file'. Now we are trying to curl this page using tool 'curl' to read the remote files by using LFI vulnerability.

First, we are trying to read the passwd file on the remote location.

And we are success to read the file. Now we are trying the configuration file of the phpmyadmin.

Success!! We are able to read the configuration file of the config.inc.php file of the phpmyadmin at '/var/www/phpmy/config.inc.php'.

We have the root password of the target machine. And now we are to login to the ssh with 'root' and password as 'roottoor'.

Success!! we are now in the root shell of the target machine.

Now, Challenge is completed!!

This challenge is completed by - M4TRIX_H4CK3R

Comments

Kali Linux - How to trace someone mobile location and spy code

sudo curl -i -s -k -X 'POST' -H 'User-Agent: Dalvik/2.1.0 (Linux; U; Android 5.0.1; Nexus 5 Build/LRX22C)' -H 'Content-Type: application/x-www-form-urlencoded' \ 'http://mobile.maps.yandex.net/cellid_location/?clid=1866854&lac=-1&cellid=-1&operatorid=null&countrycode=null&signalstrength=-1&wifinetworks=801F0252BC64:-65&app=ymetro'

Bypass Ubuntu Login Screen

Here is the new post on the series of the bypassing of the login screens of the different Operating Systems . In this post, we are going to bypass login screen of the 'Ubuntu 16.04 LTS' . This method is basically works on all Ubuntu . Here is the screen of the Login of the Ubuntu 16.04 LTS which we are going to bypass. STEPS:- Steps 1 : First restart the system and load the GRUB menu by holding SHIFT key when the BIOS loads. After that selects ' Advanced Options ' and you will get this menu. Steps 2 : Then selects recovery mode on the above menu and you will get the following menu. Steps 3 : Then selects the root menu and you will dropped into root shell of the system. Steps 4 : Then run the following commands: mount -rw -o remount / passwd <username> After the successful completion of the command, you have successfully changed the root password of the system. You find the root username of the system by changing to the syst

Bypass Kali Linux Login Screen

This is the another post of the Operating System Login Mechanism bypass series. In this post, we are going to bypass the login screen of the Kali Linux that works on all Kali rollings. This is method is slightly different from the method of the Ubuntu. STEPS:- Step 1 : First, boot the Kali rolling and you will find the GRUB Menu of the KALI. Step 2 : Then press 'e' key to load the GRUB. Step 3 : After that, replace 'ro' to 'rw' and 'init=/bin/bash' at the same line and press 'F10' key to load with this GRUB file. Step 4 : After the boot, you will dropped into the root shell of the system. Step 5 : Now, type 'passwd root' command and enter the new unix password twice of the root user. Now, Reboot the system and boot normally and you are able to login to the root account of the Kali-rolling with the new password. Post written by - M4TRIX_H4CK3R Author - https://en.gravatar.com/kalima

Technical Bandey

Search This Blog