Vulnhub Harry Potter Aragog - Walkthrough
Tags: vulnhub, writeup
Published: 2022-11-12 15:57:28

Import the Vulnerable machine in your virtual box. Change the Network settings to bridged adapter so that you can access the machine.



Let's get started !


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/z49wpjo0senva4p6zsri.png)

### Inital Scanning

#### Nmap Scan


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/jwh5nuetm49026uv4gl3.png)

We can see that our machine is hosting and the ssh port is open. Let's check out the website.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/3qqy0r9xjxt1ugiemo4l.png)

### Dirbuster

Use dirbuster to find the directories


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/o81coy3op9rvr81140dc.png)


We found '/blog' directory 


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/32xa799asbpfzd2nmcbr.png)

**Note**
Configue the /etc/hosts to access other hyperlinks

By Looking at footer of the website we are able to confirm that it is a wordpress website and we can confirm it using wappalyzer

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/z7cp3ur19i28kc2w9jps.png)

### Metasploit 
#### Scan for vulnerability

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/m8e8hz5no3v3i7ouyug8.png)

we use this module in metasploit to scan for the vulnerability.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/1ku1zu21hwhzlpya61r1.png)

we found a exploit on msf

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/l0cfipt0o9nr74s7nl06.png)

run the exploit with the following options

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/c78i071iyzq4c0mhrv1l.png)

Run the exploit

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/gvvfj1mmdwpowid1uppd.png)

we got the meterpreter shell.

In the home directory we can see two folders

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zea5unjxmgf1h5c2o8t4.png)

Inside hagrid's folder we found the First Horcrux

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/1s340wft6uc3wnbws39l.png)

Here is the first Horcrux

`horcrux_{MTogUmlkRGxFJ3MgRGlBcnkgZEVzdHJvWWVkIEJ5IGhhUnJ5IGluIGNoYU1iRXIgb2YgU2VDcmV0cw==}`

Now we need to privelate the user permission

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xkjw7kbfzyd6f4j883s4.png)


### linpeas

Upload the lipeas.sh to the server

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wwaajv7iv8zid5iyhehy.png)

run linpeas

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/g46skbjcwenkxv1bvnaz.png)

We found the DB login details


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/9hlgzwhcplhcu3xz95er.png)

Login to the database with the credentials

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/mvfrdqgi6240v1okxpk6.png)

we got the user password hash.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/efg95vx5u9qzpafmh0w5.png)

Crack the hash with john the ripper.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/fnixenj8y0g7ft3hsjj4.png)

ssh to hagrid98 with the password

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/q2fnqjdbzs89cwuunhmb.png)

Now its time to escalate to the root user.

Use pspy to find the process running in the backgound here is a guide on how to get started with pspy

`https://vk9-sec.com/how-to-enumerate-services-in-use-with-pspy/`

we found that backup.sh is running in background with interval and it is running as the root user.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/apzpxqhg6ho3fm9ragmi.png)

Re-write the .backup.sh with a reverse shell.

`https://www.revshells.com`

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zmhwxa0sek49nf128moj.png)

run a listener on netcat and after sometime you will get the root shell

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/9bsqsutavkhetmrccdqn.png)

The second Horcrux

`horcrux_{MjogbWFSdm9MbyBHYVVudCdzIHJpTmcgZGVTdHJPeWVkIGJZIERVbWJsZWRPcmU=}`

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/yccj6frhv8tux7dd9qpr.png)


Decode the Horcrux with base64:

1: RidDlE's DiAry dEstroYed By haRry in chaMbEr of SeCrets
2: maRvoLo GaUnt's riNg deStrOyed bY DUmbledOre