Broken: Gallery Vulnhub Walkthrough

We have another CTF challenges for CTF players that named as “Broken” and it can be download from vulnhub from here. The credit goes “Avraham Cohen” for designing this VM machine for beginners. This is a Linux based CTF challenge where you can use your basic pentest skill for Compromising this VM to escalate the root privilege shell.

Penetration Testing Methodologies

Network Scanning

  • Netdiscover
  • Nmap

Enumeration

Exploiting

  • Brute Force
  • Post enumeration

Privilege escalation

  • Abusing sudo rights

Walkthrough

Network Scanning

Let’s begin with the network scan using netdiscover to identify the host machine IP.

And this gave 192.168.1.107 as Host IP, now we will move toward ports and service scan further.

For deep network scan we always prefer to use nmap aggressive scan and this time also we will go with the same approach, thus will run the below command to enumerate running services and open port.

From its scan result, we found port 22 and 80 is open for SSH and HTTP service respectively.

Enumeration

For more detail we need to start enumeration against the host machine, therefore, we navigate to a web browser for exploring HTTP service.

 We obtained some files as shown in the given below image. Thus, we downloaded and explored each file but didn’t found any remarkable clue for further move.

Considering above file name could be helpful in generating a wordlist for brute force attack, I saved above file names and all relevant hint in two text files and named them “user” & “pwd” as shown below.

Exploiting

Now it was time to use hydra for making brute force attack on port 22 for SSH login thus we run below command in our local machine.

Great!! It works and we have broken: broken as SSH login credential.

With the help of above credential, we logged in and access the low privilege through user broken and notice that he has sudo rights for timedatectl and reboot to be executed with root privilege.

Privilege Escalation

To escalate the root privilege, we went for post enumerating and looked for .bash_history file.

In this file, we noticed some interesting action has been performed by the author which was pointing towards a file name “password-policy.sh” that exist inside /etc/init.d moreover a command to set time-date using “timedatectl” command and much more.

Very fast we open the password-policy.sh that exist inside /etc/init.d and found the command for change the root password into “TodayIsAgoodDay” when met to the specific condition that i.e time-date.

So we run timedatectl command along with sudo permissions and to set date and time and then reboot the machine as followed in the below commands 

Reference: Here

Now we again connect to the host machine via ssh as done previously and then try to access the root shell by switching the user account. As we were hoping the password should be changed into “TodayIsAgoodDay” therefore we use it as for login as root.

Yes, it works, and we have successfully obtained the root shell and with this, the task finished here.

Author: Aarti Singh is a Researcher and Technical Writer at Hacking Articles an Information Security Consultant Social Media Lover and Gadgets. Contact here

dpwwn:2 Vulnhub Walkthrough

Today we will take another CTF challenge dpwwn2 from the series dpwwn. The credit for making this VM machine goes to “Debashish Pal” and it is a boot2root challenge where we have to root the machine and capture the flag dpwwn-02-FLAG.txt to complete the challenge. You can download this VM here.

Security Level: Intermediate

Penetrating Methodology:

Scanning

  • Nmap

Enumeration

  • Dirb
  • WPScan
  • Searchsploit

Exploitation

  • Netcat

Privilege Escalation

  • Exploiting SUID rights

Walkthrough:

Scanning:

Let’s start off with the scanning process. The target VM had by default a static IP as 10.10.10.10. So we put our kali machine in the same network.

Then we used Nmap for port scanning and found port 80, 443 and 2049 are open.

Enumeration:

As we can see port 80 is open, we browsed it and got nothing more than a welcome message.

So our next step, as usual, is to look for the directories which we did with the help of a directory brute-forcing tool dirb. We got a directory name WordPress which means the target system might be hosting a WordPress-site.

We browsed the above-found URL and there was a WordPress-site as expected. But we couldn’t find much on the website itself.

So we took the help of Wpscan (WordPress website scanner) to look for any vulnerabilities present on the website.

In the results, there was no such vulnerability in the WordPress version or in themes installed, but luckily there was one vulnerability in the Plugin (Site Editor 1.1.1) which was vulnerable to LFI.

We looked for its possible exploit in the Searchsploit database and found one exploit available.

We copied the exploit into our root directory.

Looking inside the exploit file, in the proof of concept section, it is clearly shown how we have to execute the exploit for LFI.

Exploitation:

To run the exploit for our target, we simple replaced the host with our target address and used curl to fetch the results.

We successfully were able to fetch the contents of the /etc/passwd which confirmed that the website is actually vulnerable to LFI.

So far we have a target which is vulnerable to LFI. If we are somehow able to implant a reverse shell in the target system, we will be able to execute it using LFI.

If you remember from the nmap scan we have Network File Share (NFS) service running on port 2049 which is basically used to create shared folders in the network.

We looked for any shared directories and found there was one such directory named /home/dpwwn02.

We mounted this directory with our newly created directory /tmp/raj.

Meanwhile, we grabbed a php-reverse shell from /usr/share/webshells/php, changed the listener IP to our and saved it as shell.php.

Then we copied it into the /tmp/raj folder which is mounted to /home/dpwwn02 directory of the target system, which means shell.php is in a shared directory.

To execute the reverse shell in the browser, we replaced /etc/passwd with the location of the shell.php file i.e /home/dpwwn02/shell.php. Simultaneously we started a netcat listener on our kali.

In a few seconds, we got a reverse netcat shell with limited user privileges. It was time to find a way to get to the root shell. We looked for the binaries with SUID permissions and found the find binary has can be executed with root privileges.

Privilege Escalation:

There are multiple ways in which we can take advantage of SUID permission to find binary to do the privilege escalation. We gave wget binary the SUID permission which will help us in downloading the tempered passwd file into the /etc folder of the target system which is otherwise not permissible.

We first copied the contents of /etc/passwd into our kali system.

Then created a password hash using openssl.

In the passwd file which we copied from the target system, we tempered it by adding a new user raj password pass123 and gave it root privileges.

After that, we started a Python one-liner http server on our kali system.

On the target machine, we downloaded the tampered passwd file into the /etc folder. This tempered file has a new user raj with root privileges, so all we had to do now is switch to this new user and get the root flag dpwwn-02-FLAG.txt.

Author: Auqib Wani is a Certified Ethical Hacker, Penetration Tester and a Tech Enthusiast with more than 5 years of experience in the field of Network & Cyber Security. Contact Here

Linux For Pentester: socat Privilege Escalation

Welcome back, to grab knowledge of another command from “Linux for pentester” series. As we know there are many tools that can help the user to transfer data. Similarly, we are going to take advantage of another command i.e. “socat” which is a utility for data transfer between two addresses. So, now we will take this benefit of “socat” in our mission of privilege Escalation.

NOTE: “The main objective of publishing the series of “Linux for pentester” is to introduce the circumstances and any kind of hurdles that can be faced by any pentester while solving CTF challenges or OSCP labs which are based on Linux privilege escalations. Here we do not criticize any kind of misconfiguration that a network or system administrator does for providing higher permissions on any programs/binaries/files & etc.” 

Table of Content

Overview of socat             

  • What is socat
  • Basic parameters of socat
  • The operation achieved by socat

Abusing socat

  • SUDO Lab setups for privilege Escalation
  • Exploiting SUDO

What is socat

Socat is a network utility similar to netcat which supports ipv6, SSL and is available for both Windows and Linux. The first thing you will notice with this tool is that it has a different syntax on what you are used to with netcat or other standard Unix tools.

In other word you can say it is a command-line based utility that inaugurates two bidirectional byte streams and transfers data between them. Because the streams can be built from a large set of different types of data sinks and address type.

It is a utility for data transfer between two addresses which uses the syntax as “socat [options] <address><address>”.

Now we will start working with this most influencing tool by using its help command.

Basic parameters of socat

The most “basic” socat request would be: socat [options] <address><address>but another more existing example would be: socat -d -d – TCP4:www.example.com:80.

Where “-d -d” would be the options, “-“ would be the first address and TCP:www.example.com:80 would be the second address.

The above syntax can be more clearly understand by breaking each component down a bit more. Let’s first start with the address, since the address is the keystone aspect of socat.

Addresses:

As we know socat is comprised with two addresses for executing its result so it is more important to understand that what addresses are in actual and how they work. The address is something that the user provides via the command line. Entreating socat without any addresses results in a note as shown below:

~: socat

2018/09/22 19:12:30 socat[15505] E exactly 2 addresses required (there are 0); use option “-h” for help

Type:

After address, the other component of “socat” is “type” which is used to specify the kind of address that we need. Some of popular selections are TCP4, CREATE, EXEC, STDIN, STDOUT, PIPE, UDP4 etc, where the names are pretty self-understandable.

This is because certain address types have aliases. Similarly “-“ is one such alias which is used to represent STDIO. Another alias is TCP which stands for TCPv4. You can also use its man page to view lists of all other aliases.

Parameters:

Instantly after the type socat comes with zero or more required address parameters for its performance which is separated by:

The number of address parameters depends on the address type. The address type TCP4 requires a server description and a port description.

The operation achieved by socat

To send and receive text messages bidirectional: As we know “Socat” is a command-line based utility that establishes two bidirectional byte streams and transfers data between them. Now, I will start to establish a connection between two machines and will transfer messages between both of them.

For this, we need to start listener at one machine. In below image we have done this for “kali” which is acting as a listener and ready to take all of the commands that are ordered by “ubuntu” as shown below by framing command:

After running listener, our next step is to use socat command on another machine i.e. “ubuntu”. Here we need to specify the “IP” and port of the machine on which we have started the listener.

Now we have succeeded to share text between both terminals as shown in below image.

EXEC command using socat to take shell: socat command also tends the user to take the shell of any machine.  Here in this tutorial, I wish to take the shell of “ubuntu” on “kali” terminal by “EXEC type”.

Now on framing above command, we have successfully established a connection between two of the machine. After running listener on “ubuntu” now we will use socat command on “kali” by specifying the” IP” and “port” of the machine (ubuntu) which will help us to take the shell of ubuntu on kali as per our request.

Now to check whether you have got the shell of the desired machine or not, you can simply write “id”. As in below image you can see, it has directed us as user “raj” which is a user of “ubuntu”. It means we have successfully got the shell.

EXEC command using socat to transfer file: Now we will use another function of “EXEC” to transfer a file, here I want to transfer “passwd” file from “ubuntu” to “kali and again we will follow the same process.

As we switch to kali and run socat command it will result in us by opening “passwd” file of “source machine”.

Working with socat using another type: As we know socat uses the list of “type” like CREATE, EXEC, STDIN, STDOUT, PIPE etc.

Here in the below image, I have a text file named as “test” and now I want my listener machine to execute this file.

By using the above command first I have requested to open “test” file then I have pipe this output as the input for socat command.

As from below image you can see I have used “OPEN” function to which I have requested to create a file

 by the name of “raj” and will append the content of “test” file to this newly created file i.e. “raj”.

So now when I will run listener at “ubuntu” it will execute “raj” file showing the content of

“test” file as per desire.

Abusing socat

Sudo Rights Lab setups for Privilege Escalation

Now we will start our mission for privilege escalation. For this alike another command from “Linux for pentester” series here also first we need to set up our lab of “socat” command with administrative rights.

It can be clearly understood by the below image in which I have set sudo permission to local user (test) who can now run “socat command” as the root user.

To add sudo right open etc/sudoers file and type following as user Privilege specification.

Exploiting Sudo rights

First Method:

Now we will start exploiting socat facility by taking the privilege of sudoer’s permission. For this very first we must have sessions of a victim’s machine then only we can execute this task.

So now we will connect to the target machine with ssh, therefore, type following command to get access through local user login.

As we know “test” user attains sudo user privileges so now we will try to attain root shell of the host’s machine by the help of socat using EXEC options. Then we look for sudo right for “test” user (if given) and found that user “test” can execute the socat command as “root” without a password.

On a new terminal launch socat as a listener and enter the source IP and source port along with socat command to obtain reverse shell of the host machine.

Now we have successfully got the shell of victim’s machine with root privilege as shown in below screenshot.

Second Method:

We have another method to escalate the higher privilege shell i.e. using socat one liner reverse shell command. 

On new terminal start the socat as a listener and obtain root shell of the remote machine.

Conclusion: Hence in this way, we can make use of “socat” command to escalate the privilege of the remote machine.

Author: Komal Singh is a Cyber Security Researcher and Technical Content Writer, she is completely enthusiastic pentester and Security Analyst at Ignite Technologies. Contact Here

WestWild: 1.1: Vulnhub Walkthorugh

Today we are going to take a new CTF challenge WestWild. The credit for making this VM machine goes to “Hashim Alsharef” and it is a boot2root challenge where we have to root the server and capture the flag to complete the challenge. You can download this VM here.

Security Level: Intermediate

Penetrating Methodology:

Scanning

  • Nmap

Enumeration

  • Enum4Linux
  • Smbclient

Exploitation

  • SSH

Privilege Escalation

  • Exploiting Sudo rights

Walkthrough:

Scanning:

Let’s start off with the scanning process. The target VM took the IP address of 192.168.1.104 automatically from our local wifi network.

Then we used Nmap for port enumeration and found port 22, 80,139 and 445 are open.

Enumeration:

We saw port 445 (smb) is open which means there may be a shared directory, so to further enumerate this as well as other ports, we tool help of Enum4Linux tool. From the results, we got some user details and a shared directory named wave.

To confirm our finding of the shared directory we used smbclient with a blank password and we got lucky and were able to list the shared directories.

Inside the wave directory, we got two text files FLAG1.txt & message_from_aveng.txt which we download to our kali system using get command.

We looked into the contents of these text files and found a base64 code inside the FLAG1.txt file. After decoding it we got a username wavex and a password door+open.

Exploitation:

We have got a username and a password, so we tried to SSH the target system and were successfully able to log in.

Now our job was to get to the root shell and in the process of doing so, we found a writable directory westsidesecret. And when we had a look inside the directory we got a script file named ififorget.sh.

Looking inside the script file we found one more username and password avenge:kaizen+80.

Privilege Escalation:

We switched to the user aveng using su command, put in the password. Now to get to the root shell we looked for the sudo permissions and found that this user can run all commands as root.

So we switched to the root shell using sudo su command and finally got the root flag.

Author: Auqib Wani is a Certified Ethical Hacker, Penetration Tester and a Tech Enthusiast with more than 5 years of experience in the field of Network & Cyber Security. Contact Here