🃏HA Jocker CTF

We have developed this lab for the purpose of online penetration practices. Solving this lab is not that tough if you have proper basic knowledge of Penetration testing. Let’s start and learn how to breach it.

1.Reconnaisance

1.1 Nmap

Using nmap to scan and identify open ports and services

  • We find 3 open ports. 22, 80 and 8080 running ssh and 2 web servers respectively

:80

  • We find a static page running on joomla cms

:8080

  • We need authentication to view this.

2. Scanning

2.1 Gobuster

  • Directory bruteforcing using gobuster on port 80

  • We find an interesting file called secret.txt

/secret.txt

  • We get some potential usernames; Batman and Joker

  • Reading the contents of secret.txt, we find some keywords hinting to 100 words of rockyout.txt for password brute-forcing

  • Saving the potential usernames and some of its iterations to user.txt and first 100 words and last 100 words of rockyou to first_100_pass.txt and last_100_pass.txt, respectively.

2.2 Hydra

  • Using the potential credential lists and Hydra to brute-force the login credentials at port 8080

We get the credential joker : hannah

:8080

  • Logging in to :8080 using the obtained credentials

  • We find a basic joomla template

2.3 Nikto

  • Scanning the website for potential vulnerabilities and directories using nikto and passing in the id:password

  • We get two interesting paths /robots.txt and /backup.zip /backup.zip found

  • /robots.txt

  • Usually robots.txt is used to prevent search engine indexing. We can find some more interesting directories through this./administrator looks promising

  • /backup.zip

We can download the backup.zip file, but it is password protected

2.4 Fcrackzip

  • Fcrackzip is a tool used to brute-force the password of a password protected zip file

  • Unziping backup.zip using the password hannah, we get two directories, db and site.This is similar to the directory structure found inside the victim machine.

  • Viewing joomla.sql in the db directory, we get some potential usernames and password hash.

  • Saving the hash to pass_john

2.5 John

  • Using john to crack the password hash

  • We get the credentials admin : abcd1234 which can be used to login to the /administrator to get admin access to the joomla CMS.

3.Gaining Access

3.1 PHP-Reverse Shell

  • Uploading php-reverse shell from /usr/share/webshells/php/php-reverse-shell.php in index.php in template "beez3".(Change the ip to tun0 ip).

  • Save the file and run the reverse-shell by clicking on template-preview

  • Start a netcat listener on the attacker system; capture and stabilize the shell

  • Using the id command, we find that the user www-data is a part of the group lxd

4. Privilege Escalation

4.1 LxD Privilege Escalation

  • Linux Container (LXC) are often considered as a lightweight virtualization technology .Linux daemon (LXD) is the lightweight container hypervisor. LXD is building on top of a container technology called LXC which was used by Docker before.

  • A member of the local “lxd” group can instantly escalate the privileges to root on the host operating system. This is irrespective of whether that user has been granted sudo rights and does not require them to enter their password. You can read more about it here.

  • In order to take escalate the root privilege of the machine you have to create an image for lxd thus you need to

    • Download build-alpine to your attacking machine and transfer the image to the host

    • Import the lxd image to the target, initialize it in a new container and mount it to the /root directory

  • Cloning the alpine image from this github repository and starting an http server to transfer it to the target.

  • Downloading the image from the attacking machine to the target in the /tmp directory.

  • Importing the image to the system as myimage

  • Initializing the image with the name ignite to have root permissions

  • Mounting the / folder of our target to /mnt/root of the image and starting it

  • Executing bash on the image

  • moving to the /mnt/root directory where we mounted our target and finding the final.txt flag

PreviousCyborgNextIce

Last updated