Solving PwnLab: init (Vulnhub) Walkthrough

Be better than yesterday

Penetration Tester by trade
OSCE|OSCP|CREST

This video shows how to solve the vulnerable machine PwnLab: init

PwnLab: init is a recommended vulnerable machine hosted on Vulnhub for Offensive Security OSCP preparation

PwnLab: init vulnerable machine can be downloaded from https://www.vulnhub.com/entry/pwnlab-init,158/

Gemini Security Awesome Hacking T-Shirts - Support the channel:
https://www.redbubble.com/people/GeminiSecurity/shop?asc=u

Key Concepts:
- Enumerating software versions with NMap and Burp Suite
- Fuzzing for SQL Injection with Burp Intruder
- Exploiting Local File Inclusion (LFI) Vulnerability
- Using 'dirb' to Brute Force Files and Directories
- Exploiting LFI to Disclose PHP Source Code using PHP Fitlers
- PHP Source Code Review to Identify Vulnerabilities
- Embedding PHP Code into Image Files with Burp
- Exploiting LFI to Execute PHP Code
- Exploiting Linux Binaries that Have SUID set
- Exploiting Linux Binaries that uses Non-Absolute Path
- Exploiting Operating System (OS) Command Injection

Timestamp
00:00 Intro
00:11 Nmap Enumeration
00:23 Identifying Potential Public Exploits
01:05 Investigating Web Server on Port 80
01:26 Fuzzing for SQL Injection with Burp Intruder
01:53 Fuzzing for Local File Inclusion LFI
03:48 Running 'dirb'
04:11 Continue Fuzzing for LFI
04:36 LFI Exploitation Success
05:25 Exploiting LFI to Obtain Code/Command Execution (RCE)
06:20 'dirb' found config.php
06:31 Found MySQL credentials from config.php source code
06:59 Found Web Application Users Encoded Passwords
07:31 Exploit LFI to RCE via File Upload
08:46 Exploited LFI to RCE Successfully
10:05 PHP Reverse Shell Success
10:16 Linux Privilege Escalation WITHOUT Kernel Exploit
11:10 Attempt to Privilege Escalation to user 'mike'
12:27 Escalated Privileges to user 'mike'
13:04 Escalate Privileges from 'mike' to 'root'
13:47 Root

Видео Solving PwnLab: init (Vulnhub) Walkthrough канала Gemini Cyber Security