Pistas:

• Task 1: Exploit open services on target1.ine.local to gain initial access
• Task 2: Enumerate databases on target1.ine.local to retrieve hidden credentials
• Task 3: Leverage an open service on target2.ine.local to escalate access
• Task 4: Exploit target3.ine.local to obtain Administrator credentials
• Task 5: Pivot from target3.ine.local to target4.ine.local using discovered hashes

Empezamos con un nmap como siempre:

nmap -sSV -T4 target1.ine.local

Solo vemos el puerto 22 y 3306 abiertos.

Nos dicen en la documentacion que el usuario john tiene una password debil, probemos por ssh.

hydra -l john -P /usr/share/metasploit-framework/data/wordlists/common_passwords.txt ssh://target1.ine.local

Tenemos las primeras credenciales:

• User: john
• Password: password1

Vamos a conectarnos por ssh

ssh [email protected]