Double Trouble 1 Walkthrough

Double Trouble: 1 - VulnHub Walkthrough#

This is a detailed walkthrough of the Double Trouble: 1 machine from VulnHub.

Initial Enumeration#

Nmap Scan#

Started with an initial Nmap scan and found two open ports: SSH (22) and HTTP (80).

Gobuster Scan#

After discovering HTTP, I ran a Gobuster scan to look for hidden directories. Gobuster found several directories, and one of them, /secret, contained an image file.

Steganography on Image#

I found an image in the /secret directory, so I used stegseek to perform steganography and retrieve hidden credentials from the image.

Logging into the Website#

Using the credentials obtained, I logged into the website. After enumerating the site, I found no signs of a file upload feature that could allow a reverse shell.

Exploiting qdPM Version 9.1#

Since the website was running qdPM 9.1, I researched known vulnerabilities for this version and found a Remote Code Execution (RCE) vulnerability. I set up a listener to catch the reverse shell.

Privilege Escalation#

After getting a shell as the daemon user, I further enumerated the box. I noticed there was no typical user, which led me to think it might be vulnerable to Dirty COW. However, running sudo -l revealed that the www-data user could execute awk without a password.

Using this, I spawned a root shell and successfully rooted the box.

• Sagar Sehrawat

Adapted from sagar-sehrawat/VulnHub-Machine-Solutions under MIT.