DC-4 Walkthrough

Introduction

Today we're going to be doing a boot2root pentest walkthrough of the DC-4 machine, created by DCAU, and hosted on https://www.vulnhub.com/entry/dc-4,313/ .  For this walkthrough, we'll be using two virtual machines.  a Kali Linux VM as an attacking system, and the DC-4 VM as the target system.  

Locating the Target

Let's start the pentest by locating the target system on the network by running netdiscover from our attacking system. 

Looks like our target is at 10.0.2.18.

Scanning and Enumeration

We start our scans by finding open ports using nmap.

TCP ports 22 and 80 are open.  Next, we'll nmap again to get more details.

Not much luck here.  We also run Nikto and dirbuster, but without much success.  Time to take a look at what's on the webserver.

Finding a Way In

We first check for SQL injection possibilities on this login page, but it doesn't seem to work.  At this point, we decide it's time to brute force the login using burp suite.

The first part of the attack is to capture an HTTP request with burp suite and send it to the Intruder tab.  From there, we set the password list we will use for the attack and then have burp suite attack the website by sending each iteration of the admin username and a different word from our password list.

After the process is finished, we look at the results of the different passwords, and see that from the length of the response code from the target webserver, "happy" is our match.  We use the paired credentials to login to the admin section of the website, and see that there is a link to command.php, a web-app that lets us list files, gives us disk usage info, or gives us disk free space info.  We try the "list files" function, which gives us output that looks like this.

The syntax here looks like typical Linux commands, so this app may be vulnerable to command injection.  We can test this by capturing an HTTP request in burp suite, and changing the information we're sending like so.

The results of our modified request looks like this.

This shows that this web-app is indeed vulnerable to command injection, and that means we can get a reserve shell on the target system by this method.  The first step to this is to setup a netcat listener on our attacking system.

Then we use burp suite to send another modified HTTP request with the following input.

Which opens up a shell on our attacking system.  We upgrade our shell to a TTY shell using a Python one-liner command, then we set about doing some snooping on the target system.

Privilege Escalation

We manage to find a few items in the directory of a user named jim, which includes this file with old passwords.

Our next step is to upload the passwords file to our attacking system.  This requires us to setup another netcat listener on the attacking machine, then use netcat to upload the file like so.

With this list of jim's old passwords, we can try to brute force jim's SSH login using hydra.

We use jim's credentials to SSH login to the target system.

Looks like we have mail.  The mail command will let use access our personal email.

With this new information, we can switch users to charles and see if he has better privileges on the system.

Charles has root privileges when using the teehee program, but what is teehee?  There is no man or help pages for this program, but we get the real answer when we try to determine which version of teehee the system is running.

So teehee is just a renamed tee program, which means we can use it to append or overwrite information in files that would normally require root access to modify.  So naturally, we'll use it to give charles root access by overwriting the /etc/sudoers file.

Now that we're root, all we have to do is cat out the flag file, and we're done.  Let's try the root directory.

Summary

After initial scans, we found that we didn't have much to go on, aside from the webserver admin login page, which we broke into using brute force with burp suite.  Once logged in, we found that the web-app inside vulnerable to command injection, which we used to gain a foothold on the target.  We managed to find a password list in the file system, which allowed us to brute force SSH credentials for a user, and once logged in as that user, found a document with password information for another user.  That user had elevated privileges when using the tee program, which we used to overwrite the sudoers file, gain root access, then cat out the flag.

Finish