[WALKTHROUGH] SkyTower 1

So, I received an update on VulnHub through my RSS feeds...

Seems like got a new boot2root challenge named SkyTower... a challenge used at a local CTF conference it says...

So I decided to try it on...

The vulnerable box was in vdi (VirtualBox) format, and hence I converted it into vmdk (VMware) by following the guide here...

Target IP: 192.168.117.150

Open Port: 80, 3128

Having a filtered port at port 22, the SSH service...

Suspecting this box might only allow SSH from the proxy tunnel Squid service...

Move on to check out their web page...

 A login page found...

Tried with some SQL injection...

This might be vulnerable to SQL injection...

However, from the error message I found that the 'OR' and '=' is missing...

Check out using Curl command for better insider look...

Tested and several attempts but found out nothing...

Check out teh_h3ck's SkyTower blog post and found out using the '*' wildcard could easily unveil everything...

Checking out again using the browser...

Credentials found: john::hereisjohn

SSH as per requested but ended up connection lost...

Try connect through the proxy tunnel...

Login as 'john'...

However, to have a beautiful shell using the python pty is not possible as the box does not have python installed...

Hence, I decided to edit the bashrc file to stop auto kick me out... and re-login as 'john' in a usual way...

Scouting all over 'john' profile but nothing is fruitful... and 'john' is not capable of executing sudo command...

Checking out available users by showing the content of /etc/passwd...

and... we got 'sara' and 'william'...

Heading over to the webpage again and try login as 'sara' and 'william'...

Found the password for both 'sara' and 'william...

Try login as 'sara' based on lady's first rule...

Same connection auto lost happened with 'sara' account...

Changed the bashrc file of sara's...

Login successfully as sara....

Found out the directory traversal vulnerability of sara's sudo command...

Show the flag content and it contains root's passsword...

Completed with root's privilege on the box...

[WALKTHROUGH] Brainpan 1

This is one joyful and also one full of frustration box as it took me quite some times to solve it... but it is very rewarding as well... really thanks to superkojiman on this great challenge that he designed... not sure why he named it as Brainpan, but I will definitely named it as Brainpain, which literally explained everything... :)

This challenge is designed solely based on buffer overflow exploitation and it is a good chance for noobie like me to start off and train on... :)

Kick start with finding the target IP...

Scan for the ports...

Returned only 2 open ports, which are 9999 and 10000...

Let's recon harder and see if we can find something better...

Nothing useful...

Check out their http website...

Scrapped the web page source code but nothing found again...

Let's poke on its 9999 port and see what is going to happen...

Obviously not some easy brute force or dictionary attack can break in...

 Leave it and move on again...

Check if any sub-directory found on the web hosting...

Found a "/bin" directory...

Let's check it out... :)

 Found a "brainpan.exe" file... seems like a Windows executable file...

Grab it down for further probing...

Checked and verified it is a Windows executable file...

Some forensics-fu with 'Strings' command and found the password for port 9999 is "shitstorm"...

Tried log in using the credential found successfully but nothing rewarding so far...

Move the 'brainpan.exe' file over to Windows environment and debug using Immunity Debugger...

At the same end, create a fuzzer script as shown below to fuzz with the "brainpan.exe" file...

Set the target IP address accordingly, here we will set the IP of the windows machine first before we move on back to our Brainpan box...

The script will try feed from 100 bytes and increment of 100 every time until the program crashed... and this is where we begin our buffer overflow exploitation...

Seems like the program crashed after intake of 600 bytes... hence we create a unique 600 bytes to identify the offset of EIP...

Next step is to find the exact offset of EIP using the pattern_offset script in Kali linux...

Since the leftover spaces for shell code is definitely not enough (600-524 = 76 bytes)... We tried to increase it further to 1000 bytes see if the crashed address remained the same...

Well, since the program behave the same if we push in 1000 bytes... so we make changes accordingly...

Push in 524 of  "A" + 4 of "B" to differentiate the memory address + the rest bytes will be filled with "C" temporary...

Tested and everything seems fine...

Next step is to find the memory address for "JMP ESP"...

Finding out the hexcode for instruction "JMP ESP" using the nasm_shell scripts...

Execute the mona scripts in Immunity Debugger...

!mona find -s "\xff\xe4" -m brainpan.exe

Replace the memory address found accordingly...

 At the other hand, create the payload...

 Put the shell code created earlier into our fuzzer scripts...

Padding the shell code with some NOP bytes...

Launch a handler to catch the reverse shell...

Run the exploit and check for the reverse shell...

The attack is successful...

Let's move this back to Linux payload...

Create another new payload using the msfpayload for linux...

Replace the code accordingly... 

Launch the exploit as previous attack and wait for reverse shell...

Now, we got a shell on the target box... apparently this user does not have much privilege on the box... let's see what can this user 'puck' do as sudo with "sudo -l" command...

Only one sudo command which does not require any password... "anansi_util"...
 
This command require at least one argument...

As far as I know, we can launch another shell within the "manual" command...

So here, I try with "manual vi"...

We see a regular manual page for "vi"...

To launch an command within "manual", we pre-pend an "!" in front of it...

Hence, "!/bin/bash" will launch another shell within the "manual"...

Check for the id and we got the root shell instantly... :)

A very nice challenge indeed... sorry as I do not have screenshots from windows machine as I accidentally reverted the machine... :(

[WALKTHROUGH] KIOPTRIX Level 3

Sups h4x0rsss.... :)

Sorry that I intentionally skip on posting my 'walkthrough' on Kioptrix Level 2. In fact, I have already pwned the box but those snapshots taken during my process are stored in another machine... :((

Things are getting complicated lately as I have lost my precious internet connection for several days which cause me having some bad time in updating my blog post. However, worry not much that internet is coming back again soon enough... :))

And, I will be sure to update my Kioptrix Level 2 walkthrough at soonest possible...


Delay no more, here I present to you the Level 3 of Kioptrix series... which I think is pretty easy to complete the challenge. However, I am sure there are some other penetration way... just that I happened to penetrate through the easy one huh...


OK! Let's start with finding the IP address of the target box since it is using DHCP...

Here it is, the IP address of our target box is 192.168.17.142... ( It's pretty easy to differentiate the target IP as we all know that that is the only strange IP wandering around... :p )

Next step is the reconnaissance process... as usual here comes the big help of Nmap...

 

 Results told us that there are only 2 services running on the box, which are the SSH and the HTTP service...

Let's bring it to further aggressive mode and see if we are able to harvest some more information of the target box...

Not fruitful enough...

Not to be disappointed, the reconnaissance process is not ended yet... :p

Let's take a look on their website...

Ahaaa... we found a login page for the website... tried some easy combination "admin::admin", "admin::password", "admin::letmein"...

Of course they leave such stupid careless mistakes here... Tried with mysql injection by assuming the input is not sanitized and they are running MySQL database...

Again another rejection by the box... :(

Looks carefully and we notice that it is "Proudly powered by LotusCMS"! Some Google-fu tells me that Lotus CMS version 3.0 is vulnerable...

So here we bring up the msfconsole and look for lotuscms vulnerability... :))

Simple and straightforward enough that we only have 1 choice for our attacking towards the target box...

Setting up the info required by the exploit framework... and we're ready to GO!

After some MAGIK done by Metasploit, we just got another shell on the target box... :))

Tried running some local escalate exploit but does not work... :(

After banging around the walls, we are still stuck at "www-data" privilege, which is not our ultimate goal... :(

So after poking around the files/documents inside the box, we collected some username from /etc/passwd for cracking purpose... ( You leave me no choice! )

Launching Hydra against SSH service on our target box...

After some times, password surfaced with the username "loneferret"...

Next step to do is SSH into the target box using the credentials found earlier...

However, the user "loneferret" does not have sudo privilege for shell... :(

However, we notice that user "loneferret" is able to execute the ht editor...

After execute the ht editor with sudo privilege...

We can edit the sudoers list in the /etc/sudoers using ht editor with sudo privilege...

Pressing on "F3" will pop up the "Open Windows"... navigate to /etc/sudoers directly by typing in the address bar at the top...

Then, we add in the bash shell command as sudo privilege under user "loneferret"... and press "F2" to save...

Quit the ht editor and check again on the available sudo command for user "loneferret"...

 And, shoot in the MAGIK words "sudo /bin/bash" and we are given a root shell on the target box... :))