Sumo Walkthrough

Introduction

Today, we're going to be doing a boot2root walkthough of the Sumo machine, created by the SunCSR Team, and hosted on Vulnhub, at https://www.vulnhub.com/entry/sumo-1,480/ .  We'll be using two virtual machines for this walkthrough, our attacking Kali Linux machine, and the target Sumo machine. 

Locating the Target

First, let's locate the target machine on the network using netdiscover:

It seems like 10.0.2.7 is out target.

Scanning and Enumeration

Let's start our scans with a quick Nmap scan to see which TCP ports are open.

Just a couple of open ports.  We'll also run the same sort of scan for UDP ports.

Nothing there.  Let's do an in-depth scan with Nmap on the open ports that we found.

We're able to glean a couple of details from this scan, the web server is Apache 2.2.22, the SSH being used is OpenSSH 5.9p1, and the OS is probably Linux, estimated to be Ubuntu.

Next, we'll run a Nikto scan against the target's web server:

The web server appears to be vulnerable to ‘shellshock’, so that's going to be something we look into after our scans are done.

Finally, we'll use Nessus to scan for vulnerabilities:

Finding a Way In

From the look of the Nessus results, we're confident that Shellshock is something we need to look into as a way to exploit the target, in addition to an exploit associated with the outdated version of Ubuntu the target is running. An unsupported OS version vulnerability probably leads to privilege escalation exploits, so we'll investigate that later. We take note of the CVE number for Shellshock (2014-6271 and 2014-6278) and plug this into Metasploit to look for something we can use:

We recall that our Nikto scan revealed the path to the CGI directory on the web server, so we'll look at the 5th entry on this list, then check what information we need for the module:

Looks like we'll need to supply this module with the target's IP address and the path to a CGI script in order to run it. After setting the variables and the payload, the settings look like this:

We run the exploit and a Meterpreter session opens up for us:

Privilege Escalation

Now that we have a shell on the target system, we can look for an exploit associated with the outdated OS version (Ubuntu 12.04). 

This one fits, so we can download the exploit, then upload the file to the target using the Meterpreter shell:

We then drop from our Meterpreter into a shell, upgrade our shell using a Python one-liner, then navigate to the /tmp/ directory where our exploit code is.

Now to compile the exploit using GCC, then execute the exploit.

Success! We have elevated ourselves to root. Now all that's left is to find the target's flag, which the documentation for this machine says is in the /root/ directory.

And that's it.

Summary

After our initial scans, there were two potentially vulnerable issues presented to us: the outdated OS version (Ubuntu 12.04), and the vulnerability of the target to Shellshock. Using a discovered path to the cgi directory of the web server, we were able to use a Metasploit module to gain a remote shell to the system, which allowed us to upload OS exploitation code to the target and gain root access.

Finish