The Planets: Earth || Vulnhub Complete Walkthrough

From the Scanning we have discovered the target IP address i.e. 192.168.56.104.

Network Enumeration using Nmap

We have discovered an IP address, so let's Perform a network scan to detect what ports are open is already known as an essential part of the enumeration process. This offers us the opportunity to better understand the attacking surface and design targeted attacks. As in most cases, we are going to use the famous Nmap tool:

• -sC: Performs a script scan using the default set of scripts. It is equivalent to -- script=default. Some of the scripts in this category are considered intrusive and should not be run against a target network without permission. 
• -sV: Enables version detection, which will detect what versions are running on what port.

We spot three open ports: Port 22(OpenSSH 8.6 (protocol 2.0)), Port 80 (Apache httpd 2.4.51 ((Fedora) OpenSSL/1.1.1l mod_wsgi/4.7.1 Python/3.9)), and Port 443 (Apache httpd 2.4.51 ((Fedora) OpenSSL/1.1.1l mod_wsgi/4.7.1 Python/3.9)).

From The SSL Protocol (Port 443), we spotted two hostnames:

Add two hostnames to /etc/hosts file.

Open any Browser as your choice, and then visit the following Link:

If you scroll down, you can be spotted a few encrypted messages that are signed with Message Key:

Directory Busting using Gobuster

Navigating any hidden or hardly accessible directories and pages, and that is through dir busting (Directory Busting). Using gobuster as our tool of choice, we can use the following switches for the script to get the fastest, most accurate results.

• dir : Uses directory/file enumeration mode. 
• -u : The target URL. 
• -w : Path to the wordlist.

We might get lucky and find an admin page that may help us find leverage against the target in combination with the credentials.

If you click on Login, then it will redirect to a Login Page:

We don't have any credentials to get login access, so we have to find out the credentials. After few research, I find out that the second DNS is a Test Site that may give us any clue:

Open Browser and Visit this site:

• Remember: Access this site with SSL (HTTPS)

It seems like this is what was used to encrypt the first few messages we see on the earth.local page. Let’s try to decode the messages on that page using this information.

Decrypting Encrypted Messages with CyberChef

Let's Decrypt the Message using Cyberchef.

• Learn more: 

Visit Cyberchef :

The Messages are in the form of Hexadecimal and we have to decrypt to XOR. Drag and drop From Hex and XOR Operations to Recipe:

Input the decrypt Message one by one and also paste the key that we have found from "testdata.txt".

• Remember: The Key is set to UTF-8.

Foothold

Let’s try to log in with the user terra. The login pannel we have found in previous.

After successful Login we got a CLI command line interface. Let's try with a simple command:

Our assumption was true and we got a Command Output. So let's try to get a Remote command line interface:

We got a Warning, which means we can not get a Remote connection by using the simplest method:

We can bypass this by converting it to its decimal notation. Or, we can encode the command in the base64 format.

Open terminal and input below command:

Now copy this output and switch back to Browser paste with base64 decode command, Before that make sure that Netcat is started.

Now copy the below command and paste to CLI Command Line interface:

The Netcat start to Listening on Port 4444 from a UNKNOWN source.

We have successfully foothold The Planet: Earth but we don't have any Administrator Privileges.

Let's execute the reset_root file again:

Reset successful and the password of root set to Earth. Let's switch back to root user and find out the flags:

Congratulation! we have successfully exploited VulnHub VMs.