SAR-1

 SAR-1

- Layout for this exercise:

1 - INTRODUCTION

- The goal of this exercise is to develop a hacking process for the vulnerable machine SAR-1 from the VulnHub pentesting platform.

- SAR-1 can be downloaded from here:

https://www.vulnhub.com/entry/sar-1,425/

- Once downloaded SAR-1 and extracted with VirtualBox:

2 - ENUMERATION

- IP for SAR-1 is 192.168.1.16:

- Scanning with Nmap we discover that port 80 is open:

- Browsing the web server:

- Dirbusting we find robots.txt:

- robots.txt contains hint sar2HTML:

- Checking web page sar2HTML:

3 - EXPLOITATION

- sar2html is a plotting tool for system statistics (sar data), actually there is a Remote Command Execution exploit for version 3.2.1:

- Using the exploit we can execute some commands, for instance "id" and "cat /etc/passwd":

- Also, we can explore directories content with "pwd" and "ls", discovering sarDATA, sarFILE and uPLOAD:

- Now, using Msfvenom let's create a PHP reverse exploit called sar1.php:

- Starting the corresponding Meterpreter listening session:

- Uploading sar1.php to the website:

- The upload is successful and the exploit sar1.php is now at folder /uPLOAD:

- Running the exploit (just clicking sar1.php) a Meterpreter session is opened:

- Getting a shell:

- Looking for content:

4 - CAPTURING THE 1st FLAG

- Reading user.txt:

5 - PRIVILEGE ESCALATION

- As expected, access to root folder is not allowed, so we need Privilege Escalation:

- Looking for cron jobs, we find that the script finally.sh is run every 5 minutes:

- finally.sh executes write.sh:

- Script finally.sh is run with root privileges:

- The strategy for Privilege Escalation will be to remove current write.sh and create a new one that will open a reverse shell connection.

- Removing write.sh:

- Writing a new script write.sh:

- Transferring the new script from Kali to SAR1:

- Opening a listening session at Kali port 4444:

- As a consequence of write.sh being run as part of the cron job finally.sh, after some minutes a reverse root shell is achieved:

6 - CAPTURING THE 2nd FLAG

- Reading root.txt:

DC-9

 DC-9

- Layout for this exercise:

1 - INTRODUCTION

- The goal of this exercise is to develop a hacking process for the vulnerable machine DC-9 from the VulnHub pentesting platform.

- DC-9 can be downloaded from here:

https://www.vulnhub.com/entry/dc-9,412/

- Once downloaded DC-9 and extracted with VirtualBox:

2 - ENUMERATION

- IP for DC-9 is 192.168.1.14:

- Scanning with Nmap, port 22 is filtered and port 80 is open:

- Checking the web server:

- Going to Manage:

3 - EXPLOITATION

- Let's explore the form Search, intercepting with Burp and saving it:

- Forms are prone to Injection Attackts, so let's use the saved item with Sqlmap to find a vulnerable injection point:

- Looking for databases we find Staff and users:

- Dumping all from Staff we find passwords and usernames:

- Same thing with database users:

- Decrypting admin's password:

- Logging with admin:transorbital1:

- The footer message File does not exist suggest that function include is being used, so maybe there is a LFI vulnerability:

- Remembering that SSH service is filtered (see Nmap oputput) and going around some configuration files we find /etc/knockd.conf, what contains an SSH number sequence:

- Using knock command to unblock access to SSH service:

- Hydra helps finding SSH accounts:

- SSH-ing with janitor:Ilovepeepee:

- Looking for interesting files:

- New credentials:

- Again Hydra helps finding new SSH accounts:

- SSH-ing with fredf:B4-Tru3-001:

4 - PRIVILEGE ESCALATION

- Checking fredf's sudoers permissions:

- test is an executable file:

- test takes two files as parameters, appending content of the first to the second:

- Using without parameters:

- The strategy for achieving Privilege Escalation will be to create a new user whitelist with root privileges, and appending its record to /etc/passwd with executable test.

- openssl encrypts whitelist:qwerty:

- Adding username, encrypted password and :0::0::root:/bin/bash so that whitelist has root privileges:

- Appending the encrypted line to /etc/passwd with test:

- Checking that the line has been correctly appended:

- Logging as whitelist:qwerty we have a root shell:

5 - CAPTURING THE FLAG

- Reading theflag.txt: