Hack the Covfefe VM (CTF Challenge)

Today we are going to take on another challenge known as “covfefe”.IT is a Debian 9 based Boot to root VM, originally created as a CTF for SecTalks_BNE. The author of this VM is “Tim Kent”.   We have to find 3 flags to complete the challenge.

You can download this VM:  https://download.vulnhub.com/covfefe/covfefe.ova

Security Level: Beginner

Penetrating Methodology:

Scanning

  • Netdiscover
  • NMAP

Enumeration

  • Web spidering
  • Directory enumeration

Exploiting

  • Ssh login
  • John

Privilege Escalation

  • Exploiting SUID Executables

Capture the Flag

Walkthrough

Scanning

Let’s start off by scanning the network and identifying host IPs. As illustrated below, we can identify our host IP as 192.168.1.101.

Time to scan the Target’s IP with Nmap.

As you can see in the following screenshot that port 22, 80 and 31337 are open.

Enumeration

Browsing the IP with HTTP port 31337 doesn’t give any result.

Directory enumeration using dirb shows two interesting directories “/.ssh” and “/.robots.txt”. Nmap scan has earlier shown robots.txt as well but to dig dipper we went with dirb.

Further enumeration of robots.txt using curl shows a file “/taxes” among others. And as soon as we open it, we get our first flag.

On browsing 192.168.1.101:31337/.ssh we find ssh private and public key respectively as ‘id_rsa’ and ‘id_rsa.pub’ & authorized_keys.

We get a download prompt while opening ‘authorized_keys’ in the browser so we download it. We downloaded id_rsa too in the same way.

When we open authorized_keys we find a username ‘simon’ for the private key.

Exploiting

Now we use the private key to connect to the VM through ssh. But it is asking for a passphrase here.

We have to change its format, which can be done using a john utility called “ssh2john”. It will convert ‘ id_rsa’  to a hash format recognized by johntheripper. Now let’s use John the Ripper to crack this hash.

We find that passphrase of the key is starwars. Now we use this passphrase along with the key to connect through ssh.

After successful ssh login using our newly acquired passphrase, we search for the SUID binaries.

Here we notice ‘usr/local/bin/read_message” that takes the user input and displays a message. We provide ‘simon’ as a username when asked. There is a hint for username inside the message. It should be ‘Simon’ instead of ‘simon’.

Privilege Escalation

Again when we open ‘read_message’  and provide ‘Simon’ as username,  we get a message with a hint that we can find something in the root. Now when we enter the ‘/root’ folder and list its content we find two files named ‘flag.txt’ and ‘read_message.c’. We can’t access flag.txt yet. Moving on, inside ‘read_message’  we find our second flag.

In above screenshot reading through the source code we find that, when we enter a string it reads the first 5 characters of the string as Simon, if it matches then it runs /usr/local/sbin/message. But the input allocation for this is 20 bytes. So, we have to overflow the stack entering more than 20 bytes of data. We use the first 5 char to be ‘Simon’ followed by 15 ‘A’ and then ‘/bin/sh’ at the 21st byte.

As soon as we provide this string, we spawn a shell as root. Now we can access flag.txt. Finally, we found the third flag.

Author: Nisha Yadav is trained in Certified Ethical hacking and Bug Bounty Hunter. She is currently working at Ignite Technologies as a Security Analyst. Connect with her here

Leave a Reply

Your email address will not be published. Required fields are marked *