🛰️GoldenEye

This is an OSCP type vulnerable machine that's themed after the great James Bond film (and even better n64 game) GoldenEye. The goal is to get root and capture the secret GoldenEye codes - flag.txt. It is an Intermediate machine and has a good variety of techniques needed to get root with no exploit development/buffer overflows.

1. Reconnaissance

  • Scanning the network to find vulnerable machine's IP

arp-scan -l      

Interface: enp0s3, type: EN10MB, MAC: 08:00:27:9c:9d:c8, IPv4: 192.168.10.25
Starting arp-scan 1.9.7 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.10.1	52:54:00:12:35:00	QEMU
192.168.10.2	52:54:00:12:35:00	QEMU
192.168.10.3	08:00:27:a6:93:3e	PCS Systemtechnik GmbH
192.168.10.26	08:00:27:3c:e6:8b	PCS Systemtechnik GmbH

  • We find the IP of the vulnerable machine to be 192.168.10.26

2. Scanning

2.1 Nmap

  • Using nmap to find the open ports and their services

nmap -Pn -p- -A 192.168.10.26  

Starting Nmap 7.92 ( https://nmap.org ) at 2022-04-20 09:48 IST
Nmap scan report for 192.168.10.26
Host is up (0.0022s latency).
Not shown: 65531 closed tcp ports (reset)
PORT      STATE SERVICE     VERSION
25/tcp    open  smtp        Postfix smtpd
|_smtp-commands: ubuntu, PIPELINING, SIZE 10240000, VRFY, ETRN, STARTTLS, ENHANCEDSTATUSCODES, 8BITMIME, DSN
|_ssl-date: TLS randomness does not represent time
80/tcp    open  http        Apache httpd 2.4.7 ((Ubuntu))
|_http-title: GoldenEye Primary Admin Server
|_http-server-header: Apache/2.4.7 (Ubuntu)
55006/tcp open  ssl/unknown
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=localhost/organizationName=Dovecot mail server
| Not valid before: 2018-04-24T03:23:52
|_Not valid after:  2028-04-23T03:23:52
55007/tcp open  pop3        Dovecot pop3d
|_pop3-capabilities: USER CAPA UIDL RESP-CODES SASL(PLAIN) TOP STLS PIPELINING AUTH-RESP-CODE
|_ssl-date: TLS randomness does not represent time
MAC Address: 08:00:27:3C:E6:8B (Oracle VirtualBox virtual NIC)
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.9
Network Distance: 1 hop

TRACEROUTE
HOP RTT     ADDRESS
1   2.24 ms 192.168.10.26

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 38.20 seconds

  • We find tcp ports 25 , 80, 55006and 55007 open with smtp, apache web server, a Dovecot mail server and pop3 running respectively.

web-server

  • Browsing over to the webpage

  • Here we are greeted with a super cool home page with a login path /sev-home provided for user login.

  • Viewing the source code of this page,

  • We can see that there is a javascript file terminal.js referenced.... Seems interesting.

  • Navigating to terminal.js , we find a message to Boris in the comments

  • We get 2 potential usernames Boris and Natalya and a url encoded password

  • Decoding the password InvincibleHack3r

InvincibleHack3r

/sev-home

  • Navigating to /sev-home, we get a login page

  • Using the credentials boris : InvincibleHack3 , we can login to the page

  • We can see an ode to the James Bond movie GoldenEye and a reference to their pop3 servers.This might be a hint.

2.2 Brute-forcing pop3 (Natalya)

  • We can use hydra to brute force the password of pop3 server of natalya using the word list /usr/share/wordlists/fasttrack.txt

  • We get the credentials:

natalya : bird

2.3 Dumping mails via pop3 (Natalya)

  • We can use nc to access the pop3 server and login in with the credentials. Using the list command to show all the mails

  • There are two mails sent to Natalya

  • Retrieving the 1st message

  • Nothing much interesting there, other than mention of boris' weak credentials

  • Retrieving the 2nd message

  • Here we get another set of credentials, for their inner domain severnaya-station.com/gnocertdir

xenia : RCP90rulez!

  • Adding severnaya-station.com to our hosts file as specified

  • Accessing http://severnaya-station.com/gnocertdir/login/index.php and logging in using the above credentials.

  • Navigating to the message folder

Navigation > Home > My profile > Messages > Recent conversations

  • We find a message from another potential user, doak

2.4 Brute-forcing pop3 (Doak)

  • Using hydra to brute force the password of pop3 server of doak using the word list /usr/share/wordlists/fasttrack.txt

  • We get the credentials:

doak : goat

2.5 Dumping mails via pop3 (Doak)

  • We can again use nc to access the pop3 server and login in with the credentials. Using the list command to show all the mails

  • There is one mail

  • Retreiving it;

We get doak's login credentilas

dr_doak : 4England!

  • Logging in as dr_doak

Navigating to private files

Navigation > Home > My profile > My private files

  • There is a s3cret.txt for James

  • Viewing s3cret.txt

  • From the message, we can conclude that the sender was able to capture the admin credentials over clear text.

  • We are given another location where we find an image file. Maybe, the credentials are obfuscated in it?

2.6 Reading hidden data from image

  • Downloading the image using wget

  • Steganography is the practice of concealing a message within another message or a physical object.

  • We can use strings to find out any data hidden in the image.

  • We find a base64 encoded string in the file eFdpbnRlcjE5OTV4IQ==

  • Decoding it,

  • We get a potential password for admin

admin : xWinter1995x!

  • Using these credentials, we get access to the admin interface

3. Initial Foothold

3.1 Reverse shell

Here, we are going to get a reverse shell via the spell check functionality

  • Navigating to spell engine

Setting > Site administration > Plugins > text editors > TinyMCE HTML editor

  • Under spell engine, we need to change it to PSpellShell and save it.

  • Navigating to path to aspell

Setting > Site administration > Server > System paths

  • We need to modify the code of Path to aspell to include our reverse shell

  • Using python reverse shell from pentest mokey

  • Pasting the code in Path to a spell (make sure to change IP and port) and saving it as well.

  • Navigating to Site blogs and adding a new entry

Home > Site pages > Site blogs

  • Starting an nc listener to capture our reverse connection

  • Entering some random text in the Blog entry body field and using the spellcheck functionality to trigger our reverse shell script.

  • Stabilizing the shell

4. Privilege Escalation

4.1 Kernal Exploit

  • Checking the version of the kernel using uname -a

  • We see that the system is using an outdated kernel

  • Searching for potential exploits

  • We find an overlayfs privilege escalation exploit 37292

  • Coping it over to our current directory,

  • Checking for an appropriate compiler to compile our exploit in our target system

  • We find out that the target does not have a gcc compiler, instead it has cc

  • So we need to edit the source code of our exploit and change gcc to cc (line 143) in order to run it in our target system.(Even though we are compiling the exploit and then sending it to our target system, the compiled code can also give an error if the compiler is not present.)

  • Compiling the file as exploit and hosting it using python server

  • Downloading the exploit in the temp directory, making it executable and running it.

  • We are root

  • Viewing the flag which is hidden in the /root directory

http://192.168.10.26/006-final/xvf7-flag/

PreviousCrypto BankNextHacker Fest

Last updated