Make-and-Break

Create and exploit a vulnerable Virtual Machine

PROOF of CONCEPT
Linux OS (Ubuntu 18.04.1) will be deployed containing security flaws that will allow an attacker to compromise the system to root level.

Create a username (deathstart) and password (readytograduate) serving on port 10000 by default
Download webmin-1.890.tar.gz from https://sourceforge.net/projects/webadmin/files/webmin/
Extracting the file and running the following commands within the extracted Webmin folder
<sudo ./setup.sh /usr/local/webmin>
Enter password for user deathstart when prompted

In Kali do an nmap scan for the Ubuntu machine, check for open ports and services
Notice that port 10000 is open (a web server) and port 22. We will try to exploit port 10000, an http web server (miniServ 1.890) by using a known flaw, which let us connect remotely to it

We use exploit 2019-15107 Unauthenticated Remote Code Execution in Metasploit to get root access.
Open msfconsole on Kali, search for webmin, and use exploit unix/webapp/webmin_backdoor

Run the exploit and get a shell
We tried to spawn our shell but we were unsuccessful. In addition we can't change directories even though we are "root" but fortunately we can cat files and list directories including the /etc/shadow! file that contains the hashed passwords
We copied the content of the shadow file and passwd file into a shadows.txt and passwd.txt file and we procced to crack the hash using John the Ripper

Type unshadow passwd.txt shadow.txt > password.txt in order to combine both files and use John
We already created our own password list (fullstack.txt) with common passwords, which we will use with John in order to obtain the password
Type john --wordlist=fullstack.txt password.txt in order to crack and reveal the password

Cracking successful, password for deathstart is readytograduate SSH to this user ssh deathstart@192,168.44.132 and type the password readytograduate when prompted