pWnOS 2.0 || VulnHub Walkthrough

Change it to:

Now, the machine is successfully set up to use DHCP, which will automatically assign a host-only IP address. This configuration will enable the attacking machine in VirtualBox (Kali Linux) and the target machine in VMware to join the same network and communicate effectively.

Import the Machine to VMware and Configure the Network for VirtualBox Access

Now, let’s import the machine to VMware. However, a problem arises if we use VMware since our attacking machine is set up on VirtualBox. 

Do we need to reinstall it on VMware?  

Fortunately, I have a solution. Follow these steps to find out how.

Before we start, make sure you already have VMware installed. If not, visit this blog and follow the steps to install it without any cost.

Since we have the 7z file, we can extract it using WinRAR. After extraction, you'll see several files that resemble the previously used pWnOS 2.0 files on VMware.

To add the virtual machine to VMware Workstation, double-click on the VMware virtual machine file among the several files. This will automatically launch and run the VMware Workstation.

There are various settings left to configure, so we need to power off the machine and launch VMware again. 

As you can see, the " pwnOS 2.0 " vulnerable machine is listed in the VMware Manager.

As I previously mentioned, there is no need to reinstall the attacking machine (Kali Linux) on VMware to access the network. Instead, we can change the network settings to use the VirtualBox host-only adapter.

To do this, click on “ Edit virtual machine settings .” 

In the settings window, click on “ Network Adapter .” Check the box that says “ Replicate physical network connection state .” This ensures that the network connection state of your host machine is replicated in the virtual machine. 

Now, click on the “ Configure Adapters ” button under the " Bridged " option.

In the adapter settings, select only the “ VirtualBox Host-Only Ethernet Adapter ” and uncheck any other adapters. 

This setting will bridge the VMware virtual machine’s network connection through the VirtualBox host-only adapter. 

Click OK to save the settings and close the configuration window.

By following these steps, you ensure that both your Kali Linux machine (in VirtualBox) and the pWnOS 2.0 machine (in VMware) are connected to the same host-only network, enabling them to communicate with each other.

Now, you can start your pWnOS virtual machine and begin your penetration testing tasks! 

Finally, you'll notice that our vulnerable machine is ready, with a login prompt awaiting.

Let's dive into the fun!

Enumeration

Identifying the IP address

The initial step in our attack is enumeration, which involves identifying the IP address of our target machine using NetDiscover. To execute this, open a terminal and run " netdiscover -i " followed by specifying the network interface name, which in this case is " eth1 ."

From the scan results, we've obtained our target IP address: " 192.168.95.27 ."

Conduct a network scan to identify open ports

Next, we'll conduct a network scan to identify open ports, a crucial step in the enumeration process. This helps us understand the attack surface and strategize targeted attacks. We'll use the popular N map tool for this task. Run:

In this command, 

• " -sC " is used to perform a script scan using the default set of scripts, 
• while " -sV " enables version detection, allowing us to identify which versions are running on which port.

After completing the network scan, we found two open ports:

• Port 22/TCP: This port is running a Secure Shell (SSH) service, which is used for remote access. This means that with valid credentials, gaining login access to the server will be straightforward.
• Port 80/TCP: This port is running a Hypertext Transfer Protocol (HTTP) service, which is used for web traffic. This enables access to web services running on the machine, potentially revealing website content or applications.

With this information, we can proceed to explore these services for potential vulnerabilities. Let's start by enumerating these ports, which may lead us to gain a foothold on the target system.

Enumerate the HTTP service and directory-busting

Now, let's explore the content of the website running on Port 80. To look at the contents ourselves, open a web browser, and navigate to the target’s IP address in the URL bar at the top of the window.

Upon visiting the webpage, I discovered a web application titled "IsintS." Although it's unclear what the application does, the presence of three buttons— Home , Register , and Login —on the left side suggests it is a user login portal for a web application or service.

The prominent navigation buttons indicate that the web page’s primary function involves user account management. It offers access to a " Home " page, likely the application's main hub, along with options for existing users to log in and new users to register.

Since we don’t have a username and password to log in, our next best option is to register for a new account, which could provide useful access or information. 

But, it is not a good idea. Therefore, our priority is to find clues that might help us gain a foothold on the target system.

To further investigate, we should perform directory busting to uncover hidden or hard-to-access directories and pages on the target URL. 

For this task, we'll use the " gobuster " tool with the following command.

Where, 

• gobuster dir is used to instruct gobuster to perform directory busting. 
• -u is used to specify the target URL we want to explore. 
• -w is used to provide the path to the wordlist containing common directory names to try.

Using a directory-busting tool, we have identified several directories on the website. Among them, the " /blog " directory stands out as potentially suspicious.

Let’s explore this directory to see what it contains. 

Upon visiting the " /blog " directory, we find that it appears to be an internal blog for a company called ISINTS . 

The header links are likely to lead to the company homepage, contact information, blog statistics, and a login page for restricted content or commenting.

The main content area of the blog includes a welcome message, a calendar suggesting regular updates, a search bar, and possibly a list of recent blog posts. It seems to be a platform for ISINTS to share news and updates with its employees.

Since this information doesn’t immediately reveal any vulnerabilities, we should investigate further. Let’s examine the page source for additional clues. 

To do this, right-click on the page and select " View Page Source ." It is also not providing much information. 

Now, let’s check the website information to gather more details. I initially used Wappalyzer , but it didn’t provide much useful information.

Next, we can find more details by inspecting the website's metadata. 

Inspecting the website's metadata

To do this, locate the padlock icon on the left side of the address bar, which indicates the security status of the website. 

Click on this padlock icon to open a small dialog with basic security information. 

Click on the basic security information as it is secure or not, which will lead us to more detail of Connection information.

At the bottom of this dialog, click on " More Information ."

This action will open the " Page Info " dialog box, where you can access detailed information about the page, including the General , Media , Permissions , and Security tabs .

In the " General " tab, I found a Meta tag named " generator " that reveals the web page is generated by " Simple PHP Blog 0.4.0 ." 

Knowing the specific version of the web application can be very useful for identifying known vulnerabilities.

Identifying known vulnerabilities using Searchsploit

To determine if " Simple PHP Blog 0.4.0 " has any known vulnerabilities, let’s use searchsploit , as older versions of web applications often have publicly documented and exploitable vulnerabilities.

From the searchsploit results, I identified five potential exploits. However, for this target, I will not use the XSS vulnerability, as it is more suited for initial information gathering and low-risk testing. 

Our goal is to gain full control of the target system, so we need to focus on more impactful vulnerabilities.

Foothold

From the searchsploit results, we see that there is a remote code execution exploit available for " Simple PHP Blog 0.4.0 " that can be performed using the Metasploit Framework (MSF console) .

Exploiting Simple PHP Blog 0.4.0 using Metasploitable Framework

To proceed, search for the MSF console in the Kali Linux menu and launch it. 

The console will take a moment to initialize, and once it's up, you’ll be presented with the MSF shell .

First, search for available modules related to " Simple PHP Blog 0.4.0 " within the MSF console . 

Here, we find a relevant module. Select the first search result, which is the file upload vulnerability exploit for Simple PHP Blog . 

When we initialize this exploit, it will automatically select a suitable payload for us.  Next, we have to review the available options for the exploit module to understand which parameters need to be configured.  

Here, we have to set the target host (RHOSTS), set the URI (The path to the vulnerable file upload endpoint), and set the local host (L HOST).

After configuring these settings, run the exploit. 

Metasploit will start a reverse TCP handler on your machine, ready to receive a connection from the target. The exploit will attempt to upload and execute PHP files on the target server, providing you with a remote Meterpreter session.

With the Meterpreter session open, you now have command-line access to the target machine, allowing for further post-exploitation activities such as privilege escalation, data extraction, and more.

Post-Exploitation

To interact directly with the target system’s command line, you can use the shell command within Meterpreter. This will give you a more traditional command-line interface. 

After running the shell command, the shell is not properly visible or responsive. So, let’s try running a command to verify if they execute correctly. 

This will help confirm that we have a functional shell and that our commands are being processed by the target system.

Upon running the id command, it provided me detailed of user information. This confirmed that although the shell was functional, it was not displaying correctly. 

To address this issue, I decided to upgrade the shell using Python.

Upon examining the output of the id command, I discovered that the user shell was a basic web server shell. 

To stabilize the shell and gain more control, we needed valid credentials.

Locate the Database Credential

Since the web server had a login and registration system, it implied the presence of a database storing user information. My next step was to locate this database.

Upon navigating back through the initial web directories, I discovered a file named mysqli_connect.php , which appeared promising as it likely contained MySQL database credentials .

Let’s open it.

Inside mysqli_connect.php, I found the username and password for the database.

• Username: root
• Password: root@ISIntS

Access using Secure Shell Service

With this information in hand, let’s utilize the Secure Shell (SSH) service to establish a connection using these credentials. 

Fortunately, the connection attempt was successful, granting me a root shell of the system. This meant further escalation was unnecessary.

Upon thoroughly examining the files and directories, I did not come across any flags. This indicates that the pWnOS vulnerable machine does not contain any flags to discover.

If you have any questions or uncertainties regarding the steps outlined in this video, please feel free to ask in the comments section below.