Bilu B0x Vulnerable VM

Goal: Break into VM using web application. From there escalate privileges to gain root access

Phase 1 | Reconnaissance

find the target using netdiscover with the -r flag to specify the range

TARGET: 192 .168.56.7

map the target using NMAP with the services flag (-sV), the OS flag (-O) and -n (skip DNS resolution)

SSH and HTTP services running on a Linux 3.2 box.

Phase 2 | Scanning

Browser shows a login portal with nothing in the source code of interest.

scan directories using dirb

?found file parameter error on /test

Phase 3 | Enumeration

included my own parameter as an LFI, in a POST Request using curl, which successfully pulled the /etc/passwd file

since I was able to curl the passwd file, I went straight for the juice. PHP config files hold credentials, which is exactly what I need. Once I found the config, I found the credentials.

Phase 3 | Gaining Access

With these credentials in hand, I SSH into the box

confirmed root

Phase 4 | Maintaining Access

added a backdoor using netcat :)