KIOPTRIX Level 1.3 (#4)

Scanning

We first need to get the target IP.

nmap -sP 192.168.1.0/24

 $ nmap -sP 192.168.1.0/24 
​
Starting Nmap 7.60 ( https://nmap.org ) at 2020-05-15 08:12 UTC
Nmap scan report for _gateway (192.168.1.1)
Host is up (0.0028s latency).
Nmap scan report for 192.168.1.3
Host is up (0.0021s latency).
Nmap scan report for 192.168.1.6
Host is up (0.076s latency).
Nmap scan report for 192.168.1.8
Host is up (0.0021s latency).
Nmap scan report for 192.168.1.12
Host is up (0.010s latency).
Nmap scan report for avm (192.168.1.14)
Host is up (0.00067s latency).
Nmap scan report for 192.168.1.15
Host is up (0.075s latency).
Nmap scan report for 192.168.1.100
Host is up (0.0024s latency).
Nmap done: 256 IP addresses (8 hosts up) scanned in 3.03 seconds

Target IP is 192.168.1.15

Nmap

Findings : Apache web server is running on port 80, OpenSSH on port 22

Scanning web server with dirb

Nikto Scan

OS Enumeration with enum4linx

filtering user accounts information from above scan

users found : robert, root, john, loneferret

Scan with dirsearch

Filtering the output

There is database.sql on the server http://192.168.1.15/database.sql

The above credits does not work on Member Login page

SQL Vulnerability : By fuzzing inputs of Member Login page, we find that there is an SQL vulnerability on login password field, payload "Name:john and password:' or 1='1 --+ user logged in and auth john/MyNameIsJohn is showed.

SQLMap

The credits are :

Username

Password

john

MyNameIsJohn

robert

ADGAdsafdfwt4gadfga==

With the above credits we can get access to the ssh server, which gives us a restricted shell.

  • Regular User Account Access

Privilege Escalation

In this shell we can run limited amount of commands, otherwise it gives error messages

And if we violate the rules then it kicks us out of shell

But when giving random inputs i get the error for input echo $)

which looks like python error message, and its possible that the above shell is a python script or running within python interpreter, and if this is the case then lets try to run a shell inside it

It shows error, but by placing any supported command it gives an unrestricted shell

Now try to get a root shell

But john is not on the sudoers list.

Enumerating the System

Enumerating the Operating system and kernel version :

Enumerating linux files for SUID, GUID permission bits :

There is nothing interesting file found here, if binaries like sudoers, vim, nmap is listed here then we can use them to escalate privilege.

Search for application and services with root privilege :

As we can see the mysqld is running within root privilege, and by enumerating web root directory we can get the credits for login to mysql

As we can see the username is root and password is blank, now try this to login to mysql

Gaining Root

Method 1 :

The mysql deamon can running with root privilege can be used to get a root shell

Now on shell

Method 2 :

The kernel version is 2.6.24, so we can use the kernel exploit (dirty cow vulnerability) to escalate privilege.

Exploit link : https://www.exploit-db.com/exploits/40839

The above exploit creates a new user 'firefart' with root privilege. Also note that the kioptrix1.4 VM does not have gcc compiler, so compole the binary within 32bit architecture, downlaod it on the vm then execute it. Compilation of binary :

Now download it into vm and run it.

The exploit will asks to setup the password for new user, Now try to get root shell

PreviousKIOPTRIX Level 1.2 (#3)NextPrivilege Escalation

Last updated