seekorswim My Security Blog

Pegasus: 1

06 May 2019 | Walkthroughs
vulnhub kernel exploit overlayfs gdb pwndbg printf global offset table nfs suid
VulnHub URL: https://www.vulnhub.com/entry/pegasus-1,109/
Hostname: pegasus
IP Address: 10.183.0.210


Information Gathering/Recon


The IP address is obtained via DHCP at boot. In my case, the IP is 10.183.0.210.


Service Enumeration/Scanning


root@kali:~/Walkthroughs/pegasus# nmap -Pn -sT -sV -sC -A -oA pegasus -p 1-65535 10.183.0.210
Starting Nmap 7.70 ( https://nmap.org ) at 2019-05-06 15:45 EDT
Nmap scan report for pegasus.homenet.dom (10.183.0.210)
Host is up (0.0011s latency).
Not shown: 65531 closed ports
PORT      STATE SERVICE VERSION
22/tcp    open  ssh      OpenSSH 5.9p1 Debian 5ubuntu1.4 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   1024 77:89:5b:52:ed:a5:58:6e:8e:09:f3:9e:f1:b0:d9:98 (DSA)
|   2048 d6:62:f5:12:31:36:ed:08:2c:1a:5e:9f:3c:aa:1f:d2 (RSA)
|_  256 c5:f0:be:e5:c0:9c:28:6e:23:5c:48:38:8b:4a:c4:43 (ECDSA)
111/tcp   open  rpcbind 2-4 (RPC #100000)
| rpcinfo:
|   program version   port/proto  service
|   100000  2,3,4        111/tcp  rpcbind
|   100000  2,3,4        111/udp  rpcbind
|   100024  1          35622/udp  status
|_  100024  1          58473/tcp  status
8088/tcp  open  http    nginx 1.1.19
|_http-server-header: nginx/1.1.19
|_http-title: Pegasus Technologies - Under Construction
58473/tcp open  status  1 (RPC #100024)
MAC Address: 08:00:27:88:F8:40 (Oracle VirtualBox virtual NIC)
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.9
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE
HOP RTT     ADDRESS
1   1.14 ms pegasus.homenet.dom (10.183.0.210)

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 19.48 seconds

Read more...

IMF: 1

02 May 2019 | Walkthroughs
vulnhub base64 sqli qr code waf bypass port knock ltrace gdb gdb-peda
VulnHub URL: https://www.vulnhub.com/entry/imf-1,162/
Hostname: imf
IP Address: 10.183.0.188


Information Gathering/Recon


The IP address is obtained via DHCP at boot. In my case, the IP is 10.183.0.188.


Service Enumeration/Scanning


root@kali:~/Walkthroughs/imf# nmap -Pn -sT -sV -sC -A -oA imf -p 1-65535 10.183.0.188
Starting Nmap 7.70 ( https://nmap.org ) at 2019-05-02 16:13 EDT
Nmap scan report for imf.homenet.dom (10.183.0.188)
Host is up (0.0014s latency).
Not shown: 65534 filtered ports
PORT   STATE SERVICE VERSION
80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: IMF - Homepage
MAC Address: 08:00:27:A1:F5:E7 (Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.10 - 4.11, Linux 3.16 - 4.6, Linux 3.2 - 4.9, Linux 4.4
Network Distance: 1 hop

TRACEROUTE
HOP RTT     ADDRESS
1   1.39 ms imf.homenet.dom (10.183.0.188)

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 116.36 seconds

Read more...

Mr-Robot: 1

02 May 2019 | Walkthroughs
vulnhub wordpress wpscan nmap interactive mode suid john
VulnHub URL: https://www.vulnhub.com/entry/mr-robot-1,151/
Hostname: linux
IP Address: 10.183.0.204


Information Gathering/Recon


The IP address is obtained via DHCP at boot. In my case, the IP is 10.183.0.204.


Service Enumeration/Scanning


root@kali:~/Walkthroughs/mrrobot# nmap -Pn -sT -sV -sC -A -oA mrrobot -p 1-65535 10.183.0.204
Starting Nmap 7.70 ( https://nmap.org ) at 2019-05-01 21:24 EDT
Nmap scan report for linux.homenet.dom (10.183.0.204)
Host is up (0.0028s latency).
Not shown: 65532 filtered ports
PORT    STATE  SERVICE  VERSION
22/tcp  closed ssh
80/tcp  open   http     Apache httpd
|_http-server-header: Apache
|_http-title: Site doesn't have a title (text/html).
443/tcp open   ssl/http Apache httpd
|_http-server-header: Apache
|_http-title: Site doesn't have a title (text/html).
| ssl-cert: Subject: commonName=www.example.com
| Not valid before: 2015-09-16T10:45:03
|_Not valid after:  2025-09-13T10:45:03
MAC Address: 08:00:27:9B:2D:C0 (Oracle VirtualBox virtual NIC)
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.10 - 4.11
Network Distance: 1 hop

TRACEROUTE
HOP RTT     ADDRESS
1   2.80 ms linux.homenet.dom (10.183.0.204)

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 123.37 seconds

Read more...