Lab 9.2 - Exploiting Gloin

Target IP Address

To find the IP I used the script dnslookup.sh which I created in a previous lab.

This showed that the IP of gloin.shire.org is 10.0.5.31

Open Ports

Doing an nmap scan revealed that ports 22 (ssh), 433 (https), and 3389(ms-wbt-server) are open.

Discovered Vulnerability

Went to https://10.0.5.31 and found this webpage with a box to enter a reference code

Used searchsploit and found 4 possible exploits

How you achieved a foothold

Decided to try out exploit 50390

Going to https://10.0.5.31/entance_exam/admin/login.php gives the option to login as admin. If admin' or '1'='1 is entered as the username then it logs in as admin.

This got me into the system but I still didn't have the root password

How you achieved root/Administrative level compromise

Exploit 50398 should give out the admin password

Using the SQL injection https://10.0.5.31/entrance_exam/admin/view_enrollee.php?id=1'+UNION+SELECT+1,2,3,4,5,6,password,username,9,10,11,12,13,14,15+FROM+admin_list; displayed the hashed admin password

The hash looked like md5. Ran hash-identifier to check.

used hashcat to decrypt the password using -m 0 to indicate md5

the output showed the password was Moria2Featon6'

User Flag

![image](h

Root Flag

How might the vulnerabilities be mitigated by the systems administrator and developer?

First, the admin password should be much more complex and not an easily crackable default one. The site should also make use of prepared statements.

Reflection

The biggest trouble I encountered was figuring out where to start after doing the Nmap scan. After I got rolling and searching for exploits I didn't have too much trouble