In this article, we are going to tackle an easy box from VulnHub. If you’re not familiar with VulnHub, then read my Articles.
- Learn More:
Settings up
Before getting started, You need an isolated network environment on VirtualBox. The box, we are going to write up is called Jangow01-1.0.1.
1. Download the OVA mirror file from VulnHub.
2. The settings up are quite easy and it is similar to the past.
- Open VirtualBox.
- Click on import, and browse the file from the Download directory.
.png)
3. Check the Network Adapter, and if it is set to a Host-only adapter or not.
.png)
Once you are done with the settings, let’s start the instance VMs.
.png)
The instance is ready, and we are going for the enumeration phase.
Enumeration
Now, switch to Kali Linux. Next, we are going to identify the IP address with the help of netdiscover. Open a terminal and type the following command:
We have discovered the target IP address i.e., “192.168.56.118”.
Let's Perform a network scan to detect what ports are open, which is already known as an essential part of the enumeration process. This offers us the opportunity to better understand the attacking surface, and design targeted attacks. As in most cases, we are going to use the famous Nmap tool.
Network Scanning using Nmap
- -sC: Perform a script scan using the default set of scripts.
- -sV: Enables version detection, which will detect what versions are running on what port.
From the output, we have spotted that we have ports 21, and port 80 open.
- Port 21/TCP runs an FTP service, which means, that if you have a valid credential then it will be easy to gain login access to the server.
- Port 80/TCP running an HTTP service, which indicates that there is some vulnerable website being hosted.
To look at the contents ourselves, we can open a web browser of our choice and navigate to the target's IP address in the URL bar at the top of the window. The URL redirects us to a broken link page:
.png)
We found that directory listing is enabled on the target machine. We found one folder named ‘site/’ in the current directory.
.png)
Foothold
Following the previously shown link brought us to this “Grayscale” site. Looking around, there doesn’t seem to be anything too interesting except for the “Buscar” page found in the top right.
That’s interesting, it looks like it’s performing some kind of post request. It seems like, this website is vulnerable to Local File Inclusion.
Local File Inclusion Vulnerability
.png)
It means we can search for anything from here. Let's see what can we do, with this LFI vulnerability.
Let’s search for the ls command to list the files and directories. Switch to view page source mode by clicking right on the mouse > click on View Page source.
For a better view, switch to view page source by right click on the mouse.
.png)
Let me search again the ls -al command to list all hidden files.
.png)
From the output, we have spotted a WordPress directory existing within it. After visiting the WordPress page, we noticed that this WordPress is in a broken state. This may be happening, because WordPress may not be able to access the database, or maybe the WordPress database may be deleted.
.png)
Let's switch back to the buscar tab, and find out if any other files may exist or not, which may help us to gain an FTP connection.
.png)
I quickly noticed that there’s a “config.php” file that seems to contain something else. Open the file using the cat command and read the contents within it.
.png)
This may contain a username and password which may help us to gain access with the FTP client tool.
Attempting Login Session Retrieval with FTP Client Tool
Let’s try to attempt login access using the FTP client tool using the passwords with the username, but I quickly discovered that this does not work.
.png)
I noticed that there’s a “.backup” file that seems to contain backup database credentials. Read the file using the cat command.
.png)
Let’s again try to attempt to gain access to the server using the FTP client tool.
You can find out the user flag from the jangow01 directory. You can read the flag.txt file by downloading it from the FTP server using the get command.
Exploitation: Way to Find a Reverseshell Connection
We need to find a way to escalate our privileges from the user jangow01 to the super admin role. One way to try this is by checking if a reverse shell connection is possible or not. Let's examine the possible methods one by one.Method 1: Using php-reverse-shell.php
.png)
A reverse shell connection is possible if we push a php-reverse-shell file to the server and execute it.
We can chain this with the LFI vulnerability that we have already identified, in order to upload malicious PHP code to the target system that will be responsible for returning a reverse shell to us. We will then access this PHP file through the LFI and the webserver will execute the PHP code.
We can either create our own PHP code or use one of the many available php-reverse-shell that can be found online through a Google search.
.png)
Firstly, we have to create a “test.php” file using the nano text editor.
Paste the code by pressing ctrl+shift+v. Now, modify the code so it can suit our needs. We are going to change the Listening Host IP, and the Listening port variables to match our settings, and then we will attempt to upload the file.
.png)
But the upload isn’t possible, as the jangow01 user doesn’t have any permission to modify the web directories.
Method 2: Using Netcat
A reverse shell connection can also be possible with the Netcat command.
.png)
Type the following command:
Method 3: Using the Bash Shell script
There is a method that can give us a reverse-shell connection . You find this code by searching on Google.
Modify this code IP address and port.
Take a look closer at the top of the URL bar at the top of the window, when we execute the script it automatically translates the bash script to a string.
There is a way to encode the bash script to an encoded URL string. Visit the URL encoder by searching on Google.
- Visit:
Load the output code to the buscar. Before running this script, you have to create a NetCat listener .
Once this command is run our terminal will appear stuck, however, our Netcat listener has caught a connection.
We got the foothold. The received shell is not fully interactive, however, we can make it a bit better by using Python3.
Finally, we have the fully interactive shell now. Switch the user to jangow01 using the sudo su command and paste the password.
Privilege Escalation
The next step is escalating to the root user in order to gain the highest privileges on the system. Switch to back the user jangow01 directory and list out all hidden files and directories that we have not listed before.
For Privilege Escalation, we are going to use a tool called LinPEAS, which can automate a big part of the enumeration process in the target system.
Privilege Escalation Enumeration with LinPEAS
- Download LinPEAS From Here:
Now, we have to transfer the LinPEAS.sh, file to our target system by using the FTP service.
On the target machine, you can verify by listing the files and directories.
As you can see, this file contains only read and write permission but does not have any execution permission.
After analyzing the output, we found a piece of important information that our target is vulnerable to these exploits.
Local Privilege Escalation Vulnerability in Linux Kernel < 4.13.9 (Ubuntu 16.04 / Fedora 27)
Let’s try to exploit the get_rekt . You can find out the script from the exploit DB database.
- Click here to download:
Upload this file to the server using the FTP service.
Compile the program to compile the exploit using the GCC command-line utility.
On execution, it creates a new file in the current directory. Now execute the output file. On successful execution, we can see that the kernel exploit grants us root.
