As honest Abe Lincoln said, “Give me six hours to chop down a tree and I will spend the first four sharpening the axe.”
For the last six months, I have been playing the part of Hey Blinkin, getting the tools in my toolbox sharpened, honed, configured, and ready as I am inches away from starting the PWK/OSCP course. As soon as some paperwork clears, I’ll be signing up, hopefully to start in mid-July. You may have seen me posting things I’ve learned so far here on my blog. I intend to keep it up, as finding other OSCP adventurer blogs, tips, and tools along my journey has been invaluable. I hope to pay it forward here.
That said, here are a few very sharp tools I’ve come to love (as recently as this evening):
iTerm 2 – http://iterm2.com/ – a better Terminal app for Mac. Highly configurable, integrative, and versatile. Not exactly a pentesting tool, but something anyone doing command line work on a Mac should check out.
Sn1per – https://github.com/1N3/Sn1per – a super-thorough and invasive reconnaissance tool. It is very noisy and not recommended for actual pentesting, but it is great for working on CTF and Vulnhub VMs.
OSINT Framework – http://osintframework.com/ – a hefty, well-organized set of free tools for gathering all kinds of information. Originally geared towards security, it includes a lot of other fields as well. Follow it on GitHub here.
I’ve been working through Metasploit Unleashed in preparation for the PWK course and the ensuing OSCP exam. Looks like I’ll be signing up for that in early July. While you can’t use Metasploit on the OSCP exam, they do teach it in the PWK course itself, and it’s a very powerful tool anyway, so learning it now seemed like a good idea.
I’ve been taking a lot of notes in OneNote as I progress on all things OSCP, but I thought I’d share some of the handier Metasploit tricks that I might find myself using from day to day. Additionally, writing all this out and thinking about it as I do so helps me commit it to memory, so this blog post isn’t an entirely selfless effort.
The arp_sweep auxiliary module comes in handy to find hosts on your network. In the below example, you select the arp_sweep tool, show its options, then set the RHOSTS variable accordingly for you your network range.
msf > use auxiliary/scanner/discovery/arp_sweep
msf auxiliary(arp_sweep) > show options
Module options (auxiliary/scanner/discovery/arp_sweep):
Name Current Setting Required Description
---- --------------- -------- -----------
INTERFACE no The name of the interface
RHOSTS yes The target address range or CIDR identifier
SHOST no Source IP Address
SMAC no Source MAC Address
THREADS 1 yes The number of concurrent threads
TIMEOUT 5 yes The number of seconds to wait for new data
msf auxiliary(arp_sweep) > set RHOSTS 192.168.0.1/24
RHOSTS => 192.168.0.1/24
msf auxiliary(arp_sweep) > run
Running the above will return some output that looks something like this:
[*] 192.168.0.163 appears to be up (UNKNOWN).
[*] 192.168.0.171 appears to be up (UNKNOWN).
[*] 192.168.0.163 appears to be up (UNKNOWN).
[*] Scanned 256 of 256 hosts (100% complete)
[*] Auxiliary module execution completed
If you want to be sneaky when you do this (and why would you need to be sneaky on your home network? 😉 ) you can spoof the source host (you) and the source MAC address so that it doesn’t look like you have been scanning anything. Typically, you might set this to appear to be coming from your router.
msf> set SHOST 192.168.0.1
msf> set SMAC (some random MAC addy, or that of your router)
Scan a Host
Metasploit lets you scan hosts that you discover.
msf> use auxiliary/scanner/portscan/tcp
msf> show options
msf> set RHOSTS 192.168.0.178
You can set THREADS (10) and CONCURRENCY (20) too, to help speed things up without getting too crazy.
You can even use nmap from within Metasploit, and store the results in the database, or import normal nmap results (saved as xml) into the Metasploit database. The advantage of doing this is that you can save your work and results in workspaces in Metasploit. Workspaces let you create projects and keep things organized, which is useful when working on many targets, or with a team.
This evening I am finally catching up on write-ups of the Virtual Machine penetration testing (and subsequent pwnage) I have been working on. This is the second one I finished up and got ready to share, in case anyone finds it useful. The Kioptrix series of VMs are available on vulnhub.com, and you can download them to practice your hacking skills with at any time, for free.
Having already conquered the preceding 4 Kioptrix VMs, I started this one a while ago, but I hadn’t circled back to finish it. I figured it was time to complete the last of the Kioptrix boot2root challenges. This one was difficult!
netdiscover turned up 192.168.0.196 as the IP for this target VM.
On port 80, just a default Apache “It works!” message, and 8080 is a forbidden 403 message. Worth noting that for later.
nikto -host 192.168.0.196
- Nikto v2.1.6
+ Target IP: 192.168.0.196
+ Target Hostname: 192.168.0.196
+ Target Port: 80
+ Start Time: 2017-02-14 21:01:40 (GMT-5)
+ Server: Apache/2.2.21 (FreeBSD) mod_ssl/2.2.21 OpenSSL/0.9.8q DAV/2 PHP/5.3.8
+ Server leaks inodes via ETags, header found with file /, inode: 67014, size: 152, mtime: Sat Mar 29 13:22:52 2014
+ The anti-clickjacking X-Frame-Options header is not present.
+ The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS
+ The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type
+ mod_ssl/2.2.21 appears to be outdated (current is at least 2.8.31) (may depend on server version)
+ PHP/5.3.8 appears to be outdated (current is at least 5.6.9). PHP 5.5.25 and 5.4.41 are also current.
+ OpenSSL/0.9.8q a ppears to be outdated (current is at least 1.0.1j). OpenSSL 1.0.0o and 0.9.8zc are also current.
+ Apache/2.2.21 appears to be outdated (current is at least Apache/2.4.12). Apache 2.0.65 (final release) and 2.2.29 are also current.
+ Allowed HTTP Methods: GET, HEAD, POST, OPTIONS, TRACE
+ OSVDB-877: HTTP TRACE method is active, suggesting the host is vulnerable to XST
+ mod_ssl/2.2.21 OpenSSL/0.9.8q DAV/2 PHP/5.3.8 - mod_ssl 2.8.7 and lower are vulnerable to a remote buffer overflow which may allow a remote shell. http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0082, OSVDB-756.
+ 8345 requests: 0 error(s) and 11 item(s) reported on remote host
+ End Time: 2017-02-14 21:02:52 (GMT-5) (72 seconds)
+ 1 host(s) tested
Summary of Interesting finds: OpenSSL exploit Older Apache Older PHP
Turned up index.html (nothing new) and cgi-bin. Blah.
Tried various wordlists. Nothing turned up with this either.
Nikto did mention this vulnerability, so I took a deeper dive:
+ mod_ssl/2.2.21 OpenSSL/0.9.8q DAV/2 PHP/5.3.8 - mod_ssl 2.8.7 and lower are
vulnerable to a remote buffer overflow which may allow a remote shell.
This is that same old OpenFuck vuln I ran into in Kioptrix 1.1. I was unable to get it to compile then, so I didn’t feel like wasting time on it now.
Source Code to a PHP app
Failing to ever look at the source code of the Apache “It Works!” default page, I kicked myself when I realized I hadn’t done that. In the source code was a handy comment:
I was unable to turn up anything useful in any of the /etc directory files I was able to look at. I started looking up the locations of things in freebsd, since they were likely different than most Linux distros I am used to.
That said, I thought that the Apache config file would be a good place to start, as it might illumincate additional info such as usernames, or locations of password files. I might also find out if anything else is hidden on the website.
According to this page https://www.freebsd.org/doc/handbook/network-apache.html the httpd.conf file is here: /usr/local/etc/apache2x/httpd.conf
I had to figure out that the x in that path should be a 2, since this server is running Apache 2.2
So that worked:
So what was relevant in the httpd.conf file?
Listen 80 Listen 8080
I already knew 80 was listening, and 8080 was reported as open but returning a 403 when trying to visit it in a web browser.
That’s where files are served from in Apache on freebsd, apparently.
This VirtualHost section looked interesting, as it explained the 403 errors I was getting when visiting the :8080 port :
Trying to set up a netcat listener using various methods wasn’t working. I tried various ports and different things from the exploit-db entry (the other URL they mentioned), but had no luck.
Was there already an exploit in Metasploit?
That would be a “yes.” I thought doing it by hand would be more noble and educational, but alas, that proved to be untrue. Except that I learned I was down a rabbit hole. Off to metasploit I went…
That worked pretty well, and I found myself with a command shell.
Looks like I was the www user/group. I set out to escalate them privileges. Looking around for quite some time, I didn’t find anything too great. So I started with looking into OS/Kernel vulnerabilities.
uname -a FreeBSD kioptrix2014 9.0-RELEASE FreeBSD 9.0-RELEASE #0: Tue Jan 3 07:46:30 UTC 2012 [email protected]:/usr/obj/usr/src/sys/GENERIC amd64
FreeBSD 9.0 seemed pretty old. A couple of promising leads turned up when looking for exploits:
So I had 2 exploits to work with, just needed a place I could write files. Turns out the original web directory I was in when I got the reverse shell was perfect:
touch me cat me
Next, I needed to get the exploit file over to the target machine. I wasn’t sure how to do this, so I Googled it. This helped: https://netsec.ws/?p=292. Or so I thought. I couldn’t get it transferred with netcat and I’m still not sure why.
More Googling led me to ‘fetch’ which is installed on the FreeBSD machine.
So I set up a quick web server to serve up the exploit file from my Kali box using Python. From the directory where the exploit file (26368.c) resides:
python -m SimpleHTTPServer 80
Then from the reverse shell on the target machine, fetch the file:
Compile that sucker:
Then run it:
And the flag is in /root/congrats.txt
You should read the congrats.txt file and look into what it says, if you made it this far. There are some opportunities to learn about what you just did in there!
Moria is a relatively new boot2root VM created by Abatchy, and is considered an “intermediate to hard” level challenge. I wasn’t sure I was up for it since I’ve only been doing this for a few months, but much to my delight I conquered this VM and learned a lot in the process. This experience will certainly help as I prepare for the OSCP certification.
While Abatchy says, “No LOTR knowledge is required ;),” I found that my LOTR knowledge came in quite handy.
MacBook running MacOS (Sierra)
VMWare Fusion running:
Kali Linux (latest)
Once the VM was downloaded and running in VMWare, I started through various enumeration techniques that I typically go through when starting to penetration test a box. I’ll omit the irrelevant ones in this write-up.
This tool revealed the IP of this machine on my network:
I used nmap -v -sS -A -T4 192.168.0.131 and nmap –sS –sV -O 192.168.0.131
PORT STATE SERVICE 21/tcp open ftp vsftpd 2.0.8 or later 22/tcp open ssh OpenSSH 6.6.1 (protocol 2.0) 80/tcp open http Apache httpd 2.4.6 ((CentOS) PHP/5.4.16) MAC Address: 00:0C:29:E8:75:4F (VMware) Device type: general purpose Running: Linux 3.X|4.X
So HTTP, FTP, and SSH were running. I started by checking out HTTP and visiting http://192.168.0.131 in a web browser. Here’s what I got:
The image of the West Door of Moria is from LOTR. This door was a trick door in the book and movies, and it required some “outside the box” thinking in order to gain entry. I remembered this from the books, and re-familiarized myself with the details via a Google search:
“On 13 January 3019 the Fellowship of the Ring entered Moria through the Doors, but initially Gandalf could not find out the password to open them. Merry Brandybuck unknowingly gave Gandalf the answer by asking, “What does it mean by speak, friend, and enter?” When Gandalf realized that the correct translation was “Say friend and enter” he sprang up, laughed, and said “Mellon”, which means “friend” in Sindarin, and the Doors opened. Shortly thereafter, the Watcher in the Water attacked the Fellowship and shut the Doors behind them.”
Good info that might come in handy later 😉
Running dirb led to the discovery of a directory at http://192.168.0.131/w/. It contained a link to /h/, and so on. Traversing down the links led to:
The page said “Knock knock” Was this a reference to port knocking? I thought that might be worth checking out later if I could find more info about a sequence.
At this time I was unable to find much more to work with related to the website and HTTP. The usual nikto and other apache/web-related stuff didn’t turn much up. I turned to FTP.
Trying to connect via FTP turned up some interesting info:
220 Welcome Balrog!
Clearly, the Lord of the Rings theme was running deep. I wondered if the password would be “mellon,” since that was what got the LOTR party into the gates of Moria. I couldn’t get that to work, and I wasn’t sure about a username.
Revisiting the website
Poking around the website some more, I DISCOVERED SOMETHING IMPORTANT!!! When I browsed to http://192.168.0.131/w/h/i/s/p/e/r/the_abyss/ It gave me something different the next time. I found that a different quote would appear with each page load. I kept refreshing and collected all of the following:
Knock Knock Is this the end? Too loud! Dain:”Is that human deaf? Why is it not listening?” Nain:”Will the human get the message?” Is this the end? “We will die here..” Ori:”Will anyone hear us?” Nain:”Will the human get the message?” Telchar to Thrain:”That human is slow, don’t give up yet” Maeglin:”The Balrog is not around, hurry!” Balin: “Be quiet, the Balrog will hear you!” Oin:”Stop knocking!” “Eru! Save us!”
A couple of weeks passed at this point, as I went out of town and had other things going on, but it gave me an opportunity to think about Moria and to come back with a fresh perspective.
Tried a bunch of other things, but finally tried doing SSH to the server and was prompted for a login. Based on the FTP connection saying “Welcome Balrog!” I assumed that Balrog was a username. I also assumed that Mellon was the password knowing what I know about the LOTR story. Lastly, I realized I probably needed to try various capitalizations.
Using the login combo of Balrog / Mellon I got this:
Wrong gate? OK. I went back to try FTP with the Balrog/Mellon auth combo and got in:
Silly me. The username was right there in front of me when I had been trying FTP before. Nothing in the directory I logged into turned up, but I was able to cd .. up to /
I could go many places with basic dir navigation, but much was not allowed. For example, could get into /etc but not look at passwd. I couldn’t find anywhere that I could upload anything, and none of the important system files you’d typically check were allowed to be viewed.
I went to /var/www/html and found a directory that dirb would never have discovered:
Viewing that page in my web browser showed a handy table of what appeared to be hashes:
I set off to see what those passkeys could do. They did’t seem to work as-is for SSH or FTP, so I knew they’d need to be operated on somehow.
hash-identifier said they were likely MD5 hashes:
Without a salt I wasn’t sure how I’d use that information.
I tried various things with Hashcat and John the Ripper, but had no luck. I was stumped for a while until I looked under the hood at the source code of that page at http://192.168.0.131/QlVraKW4fbIkXau9zkAPNGzviT3UKntl/
Note: Looking at the HTML source code is something I always forget to do, and it has bitten me more than once!
At the bottom of the source code I found what appeared to be the salts:
So I had the salts for those MD5 hashes, and I had what looked like the format for using them:
This next part took me a lot of reading and learning, as I’d never really run into this before in my rather limited experience, and I had only a basic knowledge of Hashcat and John the Ripper. While it took some time, it turned out to be a great opportunity to learn.
Ultimately, based on what I had read in various seedy places of the Internet’s underbelly, I created a file called hashes.txt with these contents, based on the HTML chart found above, and added the salts to each line (after the $) respectively:
Based on the chart on the documentation page for DYNAMIC, the format mentioned in the source code would work with this:
dynamic_6 | md5(md5($p).$s)
I next tried that on the hashes.txt file:
[email protected]:~/moria# john –format=dynamic_6 hashes.txt Using default input encoding: UTF-8 Loaded 9 password hashes with 9 different salts (dynamic_6 [md5(md5($p).$s) 128/128 AVX 4×3]) Press ‘q’ or Ctrl-C to abort, almost any other key for status magic (Telchar) abcdef (Dain) spanky (Ori) fuckoff (Maeglin) flower (Balin) rainbow (Oin) darkness (Thrain) hunter2 (Fundin)
I had a list of passwords for each user. Only one of these worked for logging in via SSH, and that was Ori’s account.
Bash Shell Obtained
Got a Bash shell with Ori’s login via SSH:
-bash-4.2$ ls -al total 8 drwx—— 3 Ori notBalrog 55 Mar 12 22:57 . drwxr-x—. 4 root notBalrog 32 Mar 14 00:36 .. -rw——- 1 Ori notBalrog 1 Mar 14 00:12 .bash_history -rw-r–r– 1 root root 225 Mar 13 23:53 poem.txt drwx—— 2 Ori notBalrog 57 Mar 12 22:57 .ssh
Starting in Ori’s home directory, I checked out the .ssh directory to see what might be relevant.
It looked like Ori had logged into localhost before, since it showed up as a known_host. Why would he be doing that unless he needed to log in as someone else? Perhaps as root?
root Obtained – All That is Gold Does Not Glitter
Huh…well that last part was easier than I thought it might be. Thanks to Abatchy for providing this challenge. I learned a lot!
These are some notes I find myself referring back to as I work through my studies for the OSCP exam. As I develop more of these, I’ll continue to post them here on my blog so that others might find them useful.
Use Kali Linux for all the following instructions.
Prep: Ensure postgresql is running.
$> /etc/init.d/postgresql start
Set postgres to start on boot so you don’t have to worry about it again:
$> sudo update-rc.d postgresql enable
From the command line, fire up the Metasploit console:
Search for exploits related to what you are interested in: