De_ICE-100-Pentest Lab

Description

The CEO expects you to prove that the admins of the box follow all proper accepted security practices, and that you will not be able to obtain access to the box. Prove to him that a full penetration test of their entire corporation would be the best way to ensure his company is actually following best security practices

Languages and Utilities Used

• SSH
• Metasploit
• John the Ripper -Hydra

Environments Used

• Kali Linux

Program walk-through:

Netdiscover:

To begin i must gather info about the host using net discover. However, the 192.168.1.100 address is not showing up in the scans.

Nmap Scans:

However the IP is up and active because my nmap scans detected the address 192.168.1.100 listing the vulnerabilities pictured below.

Port 80 will be my starting point in my user interface investigation. Port 80 is the HTTP port, this means i can input the IP address in a browser serach box and a website will pop up.

Port 80 Investigation:

I will now click on the CLICK HERE link to investigate the website in its entirety for promising information. The link has a section with contact information for various people in the company.

These usernames can be used in brute forcing so we will create a text file of the usernames, in the file i added the first name with the last initial along with the original usernames in to be safe.

Box 1 Metasploit:

Im going to now attempt to login to the SSH service with the usernames using metasploits ssh login. But before the service is useful I must configure the module

In the module input "search ssh_login" | "use 0" | and "show options"
"set BLANK_PASSWORDS true" | set USERS_AS_PASS true | set RHOSTS 192.168.1.100 | set USERS_FILE /root/users.txt | "show options" to confirm the module is correctly configured.

Run the module. After its done compiling input the ssh login to attempt logging in. In my case I met some resistance. So i had to choose a specific session, using " sessions -i 2"

The password for bbanter was found with the ssh login, i will now try so login using his credentials.

SSH:

Attempt login again using ssh bbanter@192.168.1.100. After gaining access use the command "Cat /etc/passwd" it will display whatever is in the directory that it has been directed to

Unizip the rockyou file to allow it to be used with hydra as a passwords list, Uusing the cat rouckyou.txt command I confirm that the correct output is coming from the file

Using hydra i will now look for the password for aadams to further my investigation for the root password.

I will now be using the found password for aadams to login using the "ssh addams@192.168.1.100 command"

I put the hashes in a text file and use john the ripper on the file to find the password

I logged into aadams because the user has sudo privileges, then after logging in. I used the sudo command so that it would prompt me for a password. The password used is the roots password, which allowed me root access.

Showing I have access to the root account permits completion of box 1!