DC-3 Walkthrough

Introduction

Today we're going to do a boot2root pentest walkthrough of the DC-3 machine which was created by DCAU, and is hosted at https://www.vulnhub.com/entry/dc-32,312/ . For our pentest, we'll be using two virtual machines, our Kali Linux attacking machine, and the DC-3 target machine.

Locating the Target

The first thing we'll do is locate the target on our network, using netdiscover:

Looks like 10.0.2.14 is our target.

Scanning and Enumeration

Let's start with a quick nmap scan to see which TCP and UDP ports are open on the target machine.

Looks like there's only TCP port 80 open, so we'll do a more in-depth scan using nmap.

Joomla is an unusual finding on this system, and there may be some unique exploits we can run against it.

Next, we run a Nikto scan against the target's web server.

The discovery of the admin page is very nice if we can find admin credentials somewhere.  Lastly, our Nessus scans revealed more info about the Joomla service.

Finding a Way In

After a quick search online for "Joomla 3.7.0", we found an entry on www.cvedetails.com that gives us some direction.

There's a Metasploit module that gives us remote code execution on systems running Joomla 3.7.0.  We open up our MSF console and navigate to that module, then check the options for the settings need to use it.

The only required setting we need to supply is the remote host IP address, so after we plug that in, we run the module, but....

The module needs to have an admin or super user logged in to work properly.  There's an nmap script that can brute-force credentials for Joomla, so we'll run that next.

Lots of results, but we just need the first account to log in as the administrator and use the Metasploit  module.  We navigate to the web server's admin page and login using the credentials we found.

Now that there's an admin logged into the Joomla app, we can go back to the Metasploit module and run it again.

The module worked, and we have a Meterpreter shell now.

Privilege Escalation

Now that we're on the target system, we want to confirm the OS version the system is running, so we can look for a privilege escalation exploit.

We can confirm from a couple of sources that our target is running Ubuntu 16.04, and after a bit of searching, we find an exploit that matches it.

After downloading the file to our attacking system, the next step is to upload it to the target.  We can use Meterpreter to upload it to the target's /tmp/ directory, where we have write permissions.  After we drop into a regular shell, we use a Python one-liner command to upgrade to a TTY shell, then navigate to the /tmp/ directory where the exploit file is.

To prepare the exploit for use, we unzip and untar the compressed file, then use a script file to compile it.  

Sadly, we see a couple of warning messages while the exploit compiles.  Hopefully it's still usable.

Luckily, the exploit worked, despite the warning messages.  We have root access now.

The last thing for us to do is secure the target's flag, which the documentation indicates is in the /root/ directory.

Summary

After our initial scans, we found that the Joomla service was vulnerable, so we searched online and found a Metasploit module that allows us to gain a remote shell on the target, but we were missing admin access on the Joomla service in order to use it. After brute-forcing admin credentials for Joomla, we had all the pieces to run the Metasploit module and gain a remote shell. Once inside, we confirmed the target's OS version, found a privilege escalation exploit for the OS, uploaded it to the target, and executed it, securing us root access.

Finish