VulnHub - DC-9

00:34 - Explaining how networking is setup, then nmap 04:00 - Examining why nmap says a port is filtered in Wireshark 07:30 - Exploring the webpage and doing basic SQL Injections in the search functionality 08:10 - Starting GoBuster in the background, #AlwaysHaveReconRunning 10:10 - Explaining SQL Injection 13:55 - Explaining SQL Union Injection 15:15 - Testing Union Injection by doing “UNION SELECT”, then testing it by doing “ORDER BY”. 19:00 - Explaining how to get data out of INFORMATION_SCHEMA 20:55 - Doing GROUP_CONCAT to extract multiple lines from a UNION Statement 27:00 - Using SED to replace “,” with line breaks and extracting a bunch of information out of the database 33:00 - Cracking the hash to see admin’s password is transorbital1 34:41 - Using wfuzz to brute force a login prompt with two FUZZ Variables (some troubleshooting) 43:30 - Fuzzing the MANAGE.PHP script for a filename parameter with wfuzz 48:50 - Exploring the LFI 1:00:00 - Using LFI with /proc/sched_debug to get processes running and discovering KnockD 1:04:30 - The Opening up the SSH Port with port knocking 1:10:00 - Using medusa combo list to test SSH Credentials, then logging chandlerb and running linpeas 1:16:00 - Exploring the MySQL Database, discovering Janitor was created at a different time. Explore his directory to discover new credentials 1:22:00 - Using find to output a list of readable files for other users then finding files that can only be read by single users 1:28:50 - FredF can execute the “test” binary as root. Looking at source, it allows appending lines to a file. 1:30:15 - File Write Method 1: Appending a line to allow joeyt to sudo 1:33:30 - File Write Method 2: Appending line to passwd to create a new user 1:36:50 - Extra content, going over the Source Code to view the LFI Exploit and a pretty funny login bypass bug