The blog

Pwnlab-init is a boot2root vm from vulnhub. The VM and background details can be found here. Once booted, a quick ping sweep via nmap reveals the IP address of the target as 192.168.56.102, and my attacker (Kali linux is on 192.168.56.1).

Running a basic TCP scan of the VM revelled a few services:

# nmap -sT 192.168.56.102

Starting Nmap 7.40 ( https://nmap.org ) at 2017-05-20 21:26 BST

Nmap scan report for 192.168.56.102

Host is up (0.0032s latency).

Not shown: 997 closed ports

PORT     STATE SERVICE

80/tcp   open  http

111/tcp  open  rpcbind

3306/tcp open  mysql

MAC Address: 08:00:27:B8:8C:20 (Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 0.27 seconds

Doing the next part of recon, I fire up Dirbuster to enumerate the webserver, to see if there is anything interesting on the server. I also open a web browser at the index page.

From time to time, I have time to look at and try some CTF (Capture the Flag) VMs to try to get root on. These are purpose built VMs to challenge people to break in. For the Securi-Tay 2017 conference, Pentest Limited released a CTF VM, and even though the solution was posted I decided to give it a go to see how I faired. The VM was aimed at the novice level, so I was in with a chance.

Once the VM was booted in virtualbox, I was presented with the IP address of the VM from inside the console screen. In this case my target was 192.168.56.101. My attacking machine (Kali Linux) was sitting on 192.168.56.1. As this is my virtualbox network, I knew that there shouldn't be anything else on the LAN, so I did a ping sweep to confirm, using nmap. The nmap command is

nmap -sP 192.168.56.1/24

Kaybase.io is a great platform for sharing PGP keys and verifying your identity online. The Linux tools the platform works with, however, don't run with Kali Linux out of the box. The reason is simple: Root (UID: 0) isn't supported. So how do you over come this limitation? In my case, my laptop is only used by me, and no one else.

NB, you should be using a dedicated machine to store your private keys. If not, you do run the risk of administrators being able to try to break in to keys / steal your keystrokes / etc.