I have promised myself to read a book monthly, apart from my regular work, and as for the month of August, I decided to read a book called “Stages of Meditation”. This book was composed by Acharya Kamalashila (A Nalanda Scholar who was invited to Tibet by the King of Tibet; in the 8th century), and His Holiness the Dalai Lama has given many teachings of it. I highly recommend this book to all the friends who are interested in Meditation. This book is written for a Buddhist Practitioner however, it has highlighted many strategies and tips which could benefit even for a non-Buddhist. For example, it has mentioned about the diet you should follow and what kind of environment is suitable for a beginner etc.. At last but not least, I pray that this book will benefit you as much as it did to me.
I browse the IP address: 192.168.56.101 and one an image was there.
Since I didn’t find anything from source code or robots.txt, I used to exiftool and strings as well. It further confirms that I need to shift my area of interest. Therefore, I rechecked the findings we have in nmap.
It is running smb, therefore, let’s dig in.
Click on [+Other Locations]
Connect to server: smb://192.168.56.101/ [Type this entire bold values]
Click on [connect]
From this result, what we can deduce is that there
username:
anonymous
helios
print$.
Subsequently click on Anonymous (because most of the time, anonymous user has either empty password or anonymous as password). In our case, it doesn’t required one (which means it’s empty)
We got few password from the note:
Password:
epidioko
qwerty
baseball
Things become little easy now, because we have three usernames and passwords and let’s explore which does work.
Working Credential:
username: helios
Password: qwerty
Step 03:
Visit: http://192.168.56.101/h3l105/
It’s wonderful that we now found a WordPress website.
Step 04:
I faced many difficulties running wpscan (original ruby based scanner)
I manually download the json files and update it nevertheless, I was not able to enumerate the plugins. Therefore, I had to use the wpscan built on python. (actually, I can manually enumerate the plugins and its corresponding versions however, lets think that it might be useful to other boxes as well)
Bold letters were the exploit. You can find the details here.
Step 05:
I am not sure whether it will work however, I would like to share my plan; to try a nc (netcat) reverse connection.
Despite I tried different ways, I was not able to get a reverse connection. Therefore, I had to try a different plugin (vulnerable plugin) i.e. mail-masta wordpress plugin.
