Geisha:1: Vulnhub Walkthrough

Today, I am going to share a writeup for the boot2root challenge of the vulnhub machine “GIESHA”. It was actually an easy box based on the Linux machine and the goal is to get the root shell and then obtain flag under /root).

Download it from here: https://www.vulnhub.com/entry/geisha-1,481/

Table of Content

Recon

·         Netdiscover

·         Nmap

Exploitation

·         Hydra

·         SSH login

Privilege Escalation

·         Abusing SUID

·         Capture the flag

Walkthrough

Recon

Recon is the act of gathering different kinds of information against the targeted victim or system.  We can use various tools, techniques, and websites for the recon. Such as (Nmap, Dirsearch, Dirb etc) let’s start with Nmap tool.

Let’s start off with scanning the network to find our target. We found our Targets IP Address 192.168.1.133.

netdiscover

Our next step is to scan our targets IP Address with nmap. We will start recon by using Nmap scan to find the open ports and the version of our target.

nmap -p- -A 192.168.1.133

Since port 80 is open, Let’s explore the domain or webpage on this target IP address.

Exploitation

Here, I got a many port open, like port number 22 in the nmap scan, Let’s give a try to find the username and password to connect via ssh port of the machine.

Let’s assume the username is geisha now by using hydra tool we can crack the password for this machine which has username geisha.

hydra -l geisha -P /usr/share/wordlists/rockyou.txt 192.168.1.133 ssh

Here , we got the password for the geisha user i.e letmein.

Since we cracked password for the username geisha in the recon part let’s try to login by the port 22 by ssh.

ssh geisha@192.168.1.133

Privilege Escalation

Yes, we are connected to a remote host and our current user is geisha. Now I need to escalate to root from this user.

Here the connection stabilized successfully.

Let’s start the enumeration of this machine. In the same present working directory first will enumerate and see what juicy data is there. Here we got some files with suid permissions. Using below command, we can check the suid permissions in the machine.

find / -perm -u=s -type f 2>/dev/null

So here we got /usr/bin/base32 file which is having suid permissions. let us check privilege escalation by using the base32 file.

Now let’s check /etc/shadow file using /base32 command to read the restricted files.

base32 “/etc/shadow” | base32 --decode

So here got hash password in the /etc/shadow file and tried cracking many times but this hash is non crackable and failed to obtain the password for root.

Let’s try the root login also using ssh and for that we need to copy the private key for the login using ssh. I got the private ssh key for the root, by using below commands.

base32 “/root/.ssh/id_rsa” | base32 --decode

Here we successfully retrieve the ssh key now save this key in your system.

We got root’s ssh private key. Using this private ssh key we will switch the user geisha to root.

nano key

chmod 600 key

ssh -i key root@192.168.1.133

Another method to find the root flag is we can directly read the restricted  file using /base32.

base32 “/root/flag.txt” | base32 --decode

Successfully rooted!!

Here we got our root flag… That explains it all. So that’s for now. See you next time.

HAPPY HACKING!! 😊

Persistence: Accessibility Features

Today we are going to shed some light on a very sticky persistence method. It is so sticky that it has been there from the long time and it is here to stick. This was the last of my puns. You might have guessed it until now. It is Sticky Keys. Let’s dive in.

Table of Content

·         Accessibility Features

·         Configurations Used Practical

·         Enable RDP

·         Metasploit: sticky_keys

·         Empire: debugger

·         Empire: Enable_rdp

·         Logon Backdoor

·         PowerShell: stickeykeys.ps1

·         Detection

·         Mitigation

·         Refrences

Accessibility Features

Windows Accessibility Features are a set of tools that are available in the Windows logon screen (like Sticky Keys). These are designed to be triggered through the pre-configured combination of keys to assist the users. These Windows features became famous when the APT group abused it for backdooring target systems. You need to have administrative privileges to replace the genuine Windows binary of the tool ('sethc.exe' or 'narrator.exe', 'magnify.exe', etc.) with an cmd.exe.

Some of the Accessiblity features and their trigger options and location are:

1. Accessiblity Shortcut Keys

Location: C:\Windows\System32\setc.exe

Trigger: Shift 5 times

2. Utility Manager 

Location: C:\Windows\System32\Utilman.exe

Trigger: Windows key + U

3. On-Screen Keyboard

Location: C:\Windows\System32\osk.exe

Trigger: Click on On screen keyboard button

4. Magnifier

Location: C:\Windows\System32\Magnify.exe

Trigger: Windows Key + =

5. Narrator 

Location: C:\Windows\System32\Narrator.exe

Trigger: Windows Key + Enter

6. Display Switcher

Location: C:\Windows\System32\DisplaySwitch.exe

Trigger: Windows Key + P

7. Manages switching of apps between desktop

Location: C:\Windows\System32\AtBroker.exe

Trigger: Have osk.exe, Magnify.exe, or Narrator.exe open the locked computer. AtBroker.exe will be executed upon locking and unlocking

The Assistive Features or as Microsoft likes to call them Assistive Technology (ATs). All of these are registered in registry under the following registry location:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Accessibility\ATs

Configurations Used Practical

Attacker Machine

OS: Kali Linux

IP Address: 192.168.1.112

Target Machine

OS: Windows 10

IP Address: 192.168.1.106

Enable RDP

Let’s start with enabling RDP on the Target Machine. As most of the attacks that we are going to perform will be targeted on the Accessibility Binaries that are accessible on the login screen when we take the RDP of the system. They are accessible on other locations when we have the access of the machine physically but for the remote based attack, we need the RDP enabled. This can be done using the built-in script in meterpreter. It is based on the Carlos Perez’s getgui script which enables the RDP and creates a user account to log in. Here  we are just enabling the RDP with the -e parameter.

run getgui -e

Metasploit: sticky_keys

Metasploit has a post exploitation module that can create a persistence method to exploit the target by making changes in the Registry. This requires the SYSTEM privilege. So first attack the system. Get a meterpreter session on the target machine then escalate the privileges on the machine and then use this particular post exploitation module to create a persistence backdoor. Usage of this module is pretty simple. You select the module, set the session if and run the module. It adds makes changes in the registry and then we can exploit the machine by pressing Shift key 5 times and triggering the Sticky Key Accessibility Binary which is now running a Command Prompt with elevated privileges.

use post/windows/manage/sticky_keys

set session 1

exploit

After running the post exploitation module we can check the working by connecting the target machine using rdesktop. We were greeted by Login Panel. We pressed the Shift key and instead of the sticky key prompt we got the Command prompt. We can see in the image given below that the command prompt that we got is the one with Administrative Rights.

Empire: debugger

This modules allows the attacker to set the "Image File Execution Options" which is also know as the debugger, Hence the name. It does so for many executables that are accessible before logging in on the RDP connection. If used with the default setting it will trigger a command prompt with SYSTEM privileges throught the RDP without logging on the machine. This module can be configured to target a diffrent binary by providing the path to the Binary option in the module. We also need to set a Listener for the module.

Currently the trigger options that are avalaible in the module are:

1. persistence/debugger/sethc - It will target the Sticky Key binary.

2. persistence/debugger/utilman - It will target the Utility Manager binary.

3. persistence/debuggerr/magnify - It will target the Magnifier binary.

4. persistence/debugger/narrator - It will target the Narrator binary.

5. persistence/debugger/osk - It will target the On-Screen Keyboard binary.

We deicide to use the module with the default permissions. We can see that the debugger module has sethc.exe set to cmd.exe.

usemodule persistence/misc/debugger

execute

Empire: Enable_rdp

Now we need to enable the rdp on the target machine so we can access the machine remotely from our attacker machine. We will be using the enable_rdp module of the PowerShell Empire.

usemodule management/enable_rdp

execute

After enabling the remote desktop on the target machine, we tried to access it through rdesktop.  After getting the login panel, we again pressed the Shift key 5 times as we need to trigger the sticky key binary. As soon as we trigger the setc.exe we see that we get the command prompt with administrative rights instead.

Logon Backdoor

While researching for other tools that attack the Accessibility Features, I found this executable that pretty much sums up the practical that we were doing remotely with Kali Linux. It is pretty simple executable that can be used if you have the physical access of the target system. It provides a simple menu as shown in the image given below. We select the first option that sets the backdoor and it does its job in a matter seconds.

It says that the operation has been completed successfully. So, let’s give it a try. For the purposes of the practical we locked the system and try to trigger the sticky key binary by pressing the shift key 5 times. As we can see that we have the command prompt with administrative privileges as shown in the image given below.

PowerShell: stickeykeys.ps1

Now that we have explored the remote modules from Metasploit and Empire and the executable, its time to discover the PowerShell script for the same. It is a very simple script that can be download from the link given below. To attack the target machine, we need the permission to run scripts on the machine. After getting permission we import the PowerShell script. Then simply running the script as shown in the image will add the backdoor.

Import-Module .\stickykeys.ps1

.\stickykeys.ps1

Time to test the working. Since we have added the backdoor it must have replaced the sethc.exe with the cmd.exe. To test it we will press the shift key 5 times as we did in our previous practicals and as seen in the image given below we have the cmd with administrative access.

This tool can also remove the backdoor and fix the problem but it never solves it as Accessibility features are always there to exploit again.

Import-Module .\stickykeys.ps1

Detection

·         Delete or replace the affected file

·         sfc.exe /scannow

·         Remove the affected registry entry

Mitigation

·         Restrict local administrative access

·         Enable Full Disk Encryption

·         Network Level Authentication for RDP Connection

·         End point monitoring

·         Netflow analysis

Refrences

PowerShell Empire

Oddvar Moe

Katana: Vulnhub Walkthrough

Katana VM is made by SunCSR Team. This VM is a purposely built vulnerable lab with the intent of gaining experience in the world of penetration testing. It is of intermediate level and is very handy in order to brush up your skills as a penetration tester. The ultimate goal of this challenge is to get root and to read the root flag.

Since these labs are available on the Vulnhub Website. We will be downloading the lab file from this link.

Penetration Methodologies

Network Scanning

·         Netdiscover

·         Nmap

Enumeration

·         Browsing HTTP Service

·         Directory Scanning (Dirb)

Exploiting

·         Uploading PHP Reverse Shell

Privilege Escalation

·         Capability

Walkthrough

Network Scanning

Let’s start by scanning the network for targets using Netdiscover.
netdiscover

We found the target IP Address 192.168.1.119. Let’s begin with basic port scanning with NMAP.
nmap -p- -A 192.168.1.11

Enumeration
For more details, we will navigate to a web browser for exploring HTTP service since port 80 is open. It clearly is not enough for a clue to proceed.

Till now we didn’t find any hint to establish our foothold, therefore we chose DIRB for directory brute force attack on port 8088. After a few tries we found URL for an HTML page for upload, Let’s browse it and see what service it has.
dirb http://192.168.1.119:8088/ -X .html

Exploiting

On browsing the page we saw the page consist of file upload option but why does it have two upload options. This is interesting. We went for the second upload option and upload the pentestmonkey’s php reverse shell. Let’s see if we can shell this machine.

After successfully uploading our file, it asked us to wait for 1 minute. The message that made us curious was the shell upload was internally redirected to another directory after being uploaded. Only thing left is to execute our shell.

After a few tries, we changed the changed the port from 8088 to 8715 because the previous hint gave a clue that the file has been internally redirected. So changing port and executing the file got us the shell.

Privilege Escalation

Thus, we explored further and looked for weak service configuration such as SUDO and SUID permission but found nothing related to it. After spending some more time, we saw capability with +ep permission is set on python2.7. We have used this command to remove the file capability.

getcap -r / 2>/dev/null

There we got out shell. Only thing left is to get the root access. We looked for system capabilities and found empty capability (ep) over suid is given python2.7 for www-data that means all privilege is assigned to www-data for that program, therefore taking advantage of this permission we can escalate into high privilege from low privilege shell using the command below.
/usr/bin/python2.7 -c 'import os; os.setuid(0); os.system("/bin/bash")'
*NOTE- For Privilege Escalation through Capabilities. Please refer the link below.
https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/