🤠Lampiao

Would you like to keep hacking in your own lab? Try this brand new vulnerable machine! Get root!

1. Reconnaissance

Scanning the network to find vulnerable machine's IP

sudo arp-scan -l
Interface: eth0, type: EN10MB, MAC: 08:00:27:bb:5e:c1, IPv4: 192.168.10.17
Starting arp-scan 1.9.7 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.10.1	52:54:00:12:35:00	QEMU
192.168.10.2	52:54:00:12:35:00	QEMU
192.168.10.3	08:00:27:4f:a3:78	PCS Systemtechnik GmbH
192.168.10.15	08:00:27:cb:94:c3	PCS Systemtechnik GmbH

  • We find the IP of the vulnerable machine to be 192.168.10.15

2. Scanning

  • Using nmap to find the open ports and their services

sudo nmap -Pn -sV -O -p- 192.168.10.15
Starting Nmap 7.92 ( https://nmap.org ) at 2022-03-23 10:10 EDT
Nmap scan report for 192.168.10.15
Host is up (0.0016s latency).
Not shown: 65532 closed tcp ports (reset)
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.7 (Ubuntu Linux; protocol 2.0)
80/tcp   open  http?
1898/tcp open  http    Apache httpd 2.4.7 ((Ubuntu))
MAC Address: 08:00:27:CB:94:C3 (Oracle VirtualBox virtual NIC)
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.9
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 79.44 seconds

  • We find 3 open ports, tcp ports 22, 80 and 1898 with a ssh and two web servers running respectively

3. Initial Foothold

3.1 Port 80

  • Nothing of interest here

3.2 Port 1898

  • We see a static website running on Drupal CMS

  • We find two potential usernames tiago and eder from this site. Adding this to user.txt

  • Using cewl to get all the words from the website to a list called pass.txt for brute forcing

3.3 Brute forcing ssh login

  • Using hydra to try and brute force ssh login credentials with the created user.txt and pass.txt

We get the credentials tiago : Virgulino

  • Connecting as user tiago via ssh

  • tiago does not have any sudo vectors.

4. Privilege Escalation

4.1 Linux exploit suggester

  • Hosting a python server in the directory of the downloaded script

  • Pulling the script from the attacker machine to the target machine in the /tmp directory as this directory provides read, write and execute permission for all the users

  • Executing the script

4.2 DirtyCow2

  • Use exploit dirtycow2 and downloading it to the attacker machine from ext-url: https://www.exploit-db.com/download/40847

  • Hosting a python server in the downloaded directory and pulling the file from the target machine

  • Looking at the source code, the developer has specified the commands for executing their script in EDB-Note section

  • We are root. Moving into the /root directory, we get the flag

PreviousHacker FestNextNode

Last updated