Kioptrix 1.1 (Level 2) Walkthrough

Introduction

Today we're going to do a boot2root pentest walkthrough of Kioptrix 1.1 (Level 2).  We will be utilizing two virtual machines for this pentest: a Kali Linux VM which we will be using as the attacking machine, and the target machine, Kioptrix 1.1 (Level 2), created by Kioptrix, and hosted at https://www.vulnhub.com/entry/kioptrix-level-11-2,23/ .

Discovering the Target

The first thing we do after booting up both VMs is attempt to locate the target machine from the Kali machine with netdiscover.

It looks like the machine at 10.0.2.13 is the one we're looking for.

Scanning and Enumeration

Next, we do a quick scan with Nmap to discover open ports on the target machine.

We'l also do a quick UDP scan.

From here, we can run a more in-depth Nmap scan on the ports we have identified as open.

     We'll also run a Nikto scan against the target's web server, but it doesn't seem to reveal much. The next scan we perform is with Nessus:

The results direct us towards both the unsupported OS version and PHP as strong candidates for attack. The OS on the target system appears to be Linux CentOS 4.5.

Finding a Way In

Searching online for “CentOS 4.5 Exploit” brings us to an exploit info page on exploit-db.com:

This exploit appears to be a privilege escalation exploit that matches the target system's OS version, but it's a Local exploit, which means we will need to upload the exploit file to our target after we've established a remote shell through some other means.

At this point, we take a look at the target machine's webpage:

This is all that's on the target's homepage, but since we know from our scans that this system is running MySQL, we can attempt SQL injection to force a login.

     Using the above SQL injection, we are able to login and are brought to the following page:

     This page appears to have a function where we can ping a machine on the target's network, so we try it out with localhost as the parameter.

The result of this input brings us to a new page called pingit.php, and the syntax of the returned information seems identical to what you would see if you used the ping command from the Linux command line, which makes us curious as to whether the input from the previous page was being fed to the target's command line as a variable for the ping command. We test this idea by going back to the previous page and type localhost ; ls into the field, which yields the following on the next page:

So it looks like after the ping command was resolved, the web app's current directory file contents were listed out by the ls command. Those files appear to be the two PHP pages we've been browsing.

If we can inject commands to the target system through the web app, we can potentially gain a reverse shell on the target by setting up a netcat listener on our attacking machine, then running a reverse shell one-liner command through the web app.

First, we have to set up the netcat listener on our attacking machine:

Then we send the bash one-liner through the web app.

The one-liner command we used was obtained from this useful website:

    pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet

After clicking the submit button, our reverse shell is established.

Privilege Escalation

Now that we have local access to the target system, we can use the CentOS 4.5 privilege escalation exploit to gain root access. The first step in this process is to upload the exploit to the target, so we download the exploit code to our attacking system, then use the Python SimpleHTTPServer on our attacking system to give the target machine a place to download from:

Then, from our reverse shell on the target system, we navigate to the /tmp/ directory, where we have write permissions, then use wget to download our exploit code from our attacking machine:

From here, we can compile the exploit file using gcc.

Then execute the file:

Success! The exploit worked, and we have be elevated to root status.

Summary

After doing our initial scans, we discovered that there were two issues that were listed as highly vulnerable: the outdated OS version, and the outdated PHP version. Searching for an exploit based on the OS version gave us a match, but the exploit was a local type, so we needed to get a shell on the target before we could use it. Then we looked at the web server on the target and discovered that the web page login was vulnerable to SQL injection to login. Once logged in, we tested the web app and discovered that it was vulnerable to command injection, which we used to establish a reverse shell. Finally, having local access, we uploaded the exploit file to the target and used the exploit to gain root access.

Finish