search

KIOPTRIX Level 1 (#1)

hashtag
Scanning

We first need to get the target IP. in my case network sittings was bridged so i run sudo netdisover

to catch all ip in my network => kioprix ip is 192.168.1.7

you can use nmap to catch your ip using -sP flag

hashtag
nmap

sudo nmap -sV -p- -O -T4 192.168.1.7

  • -sV determine service/version info

  • -T4 for faster execution

  • -p- scan all ports

  • -O identify Operating System

tarting Nmap 7.91 ( https://nmap.org ) at 2021-07-19 04:06 EDT
Nmap scan report for 192.168.1.7
Host is up (0.0011s latency).
Not shown: 65529 closed ports
PORT     STATE SERVICE     VERSION
22/tcp   open  ssh         OpenSSH 2.9p2 (protocol 1.99)
80/tcp   open  http        Apache httpd 1.3.20 ((Unix)  (Red-Hat/Linux) mod_ssl/2.8.4 OpenSSL/0.9.6b)
111/tcp  open  rpcbind     2 (RPC #100000)
139/tcp  open  netbios-ssn Samba smbd (workgroup: MYGROUP)
443/tcp  open  ssl/https   Apache/1.3.20 (Unix)  (Red-Hat/Linux) mod_ssl/2.8.4 OpenSSL/0.9.6b
1024/tcp open  status      1 (RPC #100024)
Device type: general purpose
Running: Linux 4.X
OS CPE: cpe:/o:linux:linux_kernel:4.4
OS details: Linux 4.4
Network Distance: 2 hops
​
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 39.38 seconds

nmap can't identify SMB version lets do it on our own

  1. Using enum4linuxarrow-up-right enum4linux

  2. Using smbclientarrow-up-right smbclient -L

  3. Using metasploitarrow-up-right

    Now we have the SMB version - Samba 2.2.1a

hashtag
Gaining Access

after some googling i found these exploit

you can use search sploit in terminal too .

hashtag
Method 1: Samba trans2open Overflow (Linux x86)

now fire msfconsole searching for trans2open

  • Gain root access to the machine

hashtag
Method 2: OpenFuck mod_ssl vulnerability

nmap output we find mod_ssl/2.8.4

lets use searchsploit this time

most suitable one is Apache mod_ssl < 2.8.7 OpenSSL - 'OpenFuckV2. | unix/remote//usr/share/exploitdb/exploits/unix/remote/47080.c.c

to copy exploit to current directory

use head to display first 10 line of exploit which contains how to run exploit

now we know how to use Compile with: gcc -o OpenFuck OpenFuck.c -lcrypto

don't forget the requirements sudo apt-get install libssl-dev

What we need:

  1. target -offset value from the list

    From our nmap scan we know the service version is: “Apache httpd 1.3.20 ((Unix) (Red-Hat/Linux) mod_ssl/2.8.4 OpenSSL/0.9.6b)”.

    Looking for Red-Hat and 1.3.20 versions leave us with two options:

    • 0x6a - RedHat Linux 7.2 (apache-1.3.20-16)1

    • 0x6b - RedHat Linux 7.2 (apache-1.3.20-16)2

  2. box - target’s IP - ‘kioptrix’ in our case

  3. port - HTTP port - 443 in our case

  4. Number of connection to open (range of 40-50) - We’ll go with 40

Therefore the complete command we’ll use: ./Openfuck 0x6b kioptrix 443 -c 40:

  • Gain root access to the machine

hashtag
Capture The Flag

Once we have a *shell* using on of the above methods, we need to spawn a TTY shell. /bin/bash -i is used to get active *bash shell*. You can find other options on the post Summary below.

Let’s look at the user’s commands history:

The mail command might be intresting. We can access mail using mail command interacting with it (selecting what message to read) using message number (Use exit to leave the mail)

That’s our flag!

  • Capture the flag

PreviousKIOPTRIX SeriesNextKIOPTRIX Level 1.1 (#2)

Last updated