This box is from VulnHub and is in the TJ NuLL list of boxes for OSCP preparation. This box involved the following steps: Enumeration HTTP OpenSSL vulnerability Exploit Python decomilation for password extraction The initial Nmap scan result is as below. Nmap scan report for 10.0.0.14 Host is up, received arp-response (0.00034s latency). Scanned at 2022-04-04 02:00:59 EDT for 14s Not shown: 997 closed tcp ports (reset) PORT STATE SERVICE REASON VERSION 22/tcp open ssh syn-ack ttl 64 OpenSSH 7....

This box was downloaded from VulnHub and is also on the list of practice boxes for OSCP preparation. The box involved the following steps: Enumeration HTTP Command Injection abd Bypassing Sanitization Enumerating folders A good Guessing ( Which I failed to do) I always start my enumeration from autorecon. The initial Nmap scan showed only one port (80) open. However all port scan showed one more port and the result is as below....

This box was downloaded from VulnHub and is also on the list of practice boxes for OSCP preparation. The box involved the following steps: Enumeration of port 80 Gobuster for directory enumeration SUID binary exploitation for privilege escalation I always start with an autorecon scan. Initial nmap scan results are as below: Not shown: 997 closed tcp ports (reset) PORT STATE SERVICE REASON VERSION 22/tcp open ssh syn-ack ttl 64 OpenSSH 6....

This box is downloaded from VulnHub and is also on the list of Tj Null OSCP preparation. this box involved the following steps. Metadata of an image Brute Forcing a Webpage UNION SQL Injection PATH exploit for privilege escaltion I am going to start with the autorecon scan of the box. The Nmap scan result is as below. canned at 2022-04-03 06:22:48 EDT for 15s Not shown: 65531 closed tcp ports (reset) PORT STATE SERVICE REASON VERSION 80/tcp open http syn-ack ttl 64 Apache httpd 2....

This box is from the Tj NULL list for OSCP preparation and can be downloaded from vulnhub. This box exploitation involved following steps: Enumerating most common ports Enumeration and Enumeration Looking deep and everywhere Wireshark decryting SSL packets Exploiting init.d write permission to Privelege escalation. I started with the nMap scan. I use autorecon for nmap scan and to my surprise this box had all ports open. So I decided to start with most popular ports....

This box is from VulnHub and is on the TjNUll list for OSCP preparation. Controlling the whole VM included the following steps: Enumeration of port 80 and 8008 Finding hidden directory from HTML comments Enumeration and password bruteforce using WP-Scan ZIP password cracking Gathering informations along the way I am going to start with the initial Nmap scan. I use the autorecon script. The initial Nmap scan shows 3 open ports....

This Derpnstink room is on the TJNull list for OSCP preparation. This room involved the following steps. Enumerating using gobuster Enumerating using wp-scan Exploiting the vulnerable wp plugins for gaining Reverse Shell Looking into wp-config file to find the username and password for database Exploiting Sudo for priv escalation As usual, let’s start with an autorecon scan. The initial Nmap scan result is as below. Nmap scan report for 10....

This machine is from the TJ Null list for the OSCP box. This room involved the following steps. Enumerating HTTP to find the Command Injection Finding a hidden password in source code Bruteforcing with hydra Generating a password list for a user to bruteforce First, as always let’s start with the autorecon scan. Quick Initial Nmap scan results are as below. Scanned at 2022-03-31 03:36:27 EDT for 38s Not shown: 996 closed tcp ports (reset) PORT STATE SERVICE REASON VERSION 21/tcp open ftp syn-ack ttl 64 vsftpd 3....

This room is from the vulnhub and can also be found on Proving Grounds Play. There is only one port open. The attack on the machine involved the following steps. Enumeration of HTTP with gobuster/feroxbuster Exploiting command injection Exploiting SUID binary for Priv Escalation Let us start with the Nmap scan. I always start with an autorecon scan. The initial scan is as follows. Nmap scan report for 10.0.0.6 Host is up, received arp-response (0....

This box is part of the Symfonos series from Vulnhub and is from the list of Tj Null Oscp preparation lists. The initial vector for this box was easy. You find the file on SMB share using anonymous login. Enumerating that file (log) and utilizing the vulnerable FTP server, we can get ssh access. Then we find another webserver, and gaining reverse-shell utilizing the vulnerability of the webserver, we gain root access using MySQL and sudo privilege escalation....