Level 3
About Release
Name: Kioptrix: Level 1.2 (#3)
Date release: 18 Apr 2011
Author: Kioptrix
Series: Kioptrix
Web page: http://www.kioptrix.com/blog/?p=358
Download
KVM3.rar (Size: 442 MB)
Download: http://www.kioptrix.com/dlvm/KVM3.rar
Download (Mirror): https://download.vulnhub.com/kioptrix/KVM3.rar
Description
It's been a while since the last Kioptrix VM challenge. Life keeps getting the way of these things you know.
After the seeing the number of downloads for the last two, and the numerous videos showing ways to beat these challenges. I felt that 1.2 (or just level 3) needed to come out. Thank you to all that downloaded and played the first two. And thank you to the ones that took the time to produce video solutions of them. Greatly appreciated.
As with the other two, this challenge is geared towards the beginner. It is however different. Added a few more steps and a new skill set is required. Still being the realm of the beginner I must add. The same as the others, there’s more then one way to “pwn” this one. There’s easy and not so easy. Remember… the sense of “easy” or “difficult” is always relative to ones own skill level. I never said these things were exceptionally hard or difficult, but we all need to start somewhere. And let me tell you, making these vulnerable VMs is not as easy as it looks…
Important thing with this challenge. Once you find the IP (DHCP Client) edit your hosts file and point it to kioptrix3.com
Under Windows, you would edit C:\Windows\System32\drivers\etc\hosts to look something like this:
Under Linux that would be /etc/hosts
There’s a web application involved, so to have everything nice and properly displayed you really need to this.
Hope you enjoy Kioptrix VM Level 1.2 challenge.
452 Megs
MD5 Hash : d324ffadd8e3efc1f96447eec51901f2
Have fun
Source: http://www.kioptrix.com/blog/?p=358
Recon
HTTP (80)
See it now! redirects us to /gallery where we can see path is used to retrieve certain items from probably database. After trying few payloads it doesn't seem injectable.
If we visit Ligoat Press Room there's a sort feature which seems to add parameters to the query.
SQLi
Injecting a quote (') triggers SQL error, meaning SQLi
Database Accounts
Crack the user hashes:
0d3eccfb887aabd50f243b3f155c0f85
md5
Mast3r
5badcaf789d3d1d09794d8f021f40f0e
md5
starwars
SSH Creds
admin
n0t7t1k4
dreg
Mast3r
loneferret
starwars
Oddly enough none of the users worked on CMS login page, but they are valid ssh credentials! (except admin)
LotusCMS
The CMS which webapp uses is LotusCMS
Quick google search leads us to LotusCMS 3.0 eval() Remote Command Execution
The msf module was unable to get shell:
www-data
Anyway, we don't need to go further into this path as we already have actual user accounts on ssh.
SSH (22)
We have 2 users which we can login as.
Looks like loneferret has sudo access, so we'll discard dreg.
Sudo Binaries
Great, su doesn't exist in given path and ht is wacky program...
Since I couldn't run binary, get help or man page I decided to see strings within program, after piping result to less I got terminal is not fully functional
Fix Terminal
ArchLinux » Networking, Server, and Protection» WARNING: terminal is not fully functional
Setting TERM fixed the issue with the binary.
The program is some sort of editor. The first highlighted letters are actually shortcuts which can be accessed via Alt+KEY.
To open file Alt+F -> Arrow Down -> Open -> Filename
We essentially have a binary with root privileges, meaning we can read/write whatever.
Add New User
Let's add new user to system:
Root
Last updated