Today we are going to take another boot2root challenge known as “DC-4”. The credit for making this VM machine goes to “DCAU” and it is another boot2root challenge in which our goal is to get root access to complete the challenge. You can download it from here
Security Level: Beginner
Scanning
Exploiting
Lateral Movement
Privilege Escalation
Let’s start off with scanning the network to find our target.
We found our Targets IP Address 192.168.1.101. Our next step is to scan our targets IP Address with nmap.
From nmap result we found HTTP service is running on port 80. So, we browsed the Targets IP Address in the browser and found an Admin Information Security Login page. We clearly need to find credentials for it. Let’s work on that.
We found that the HTTP service runs on port 80, from nmap results. So, we browse the IP address of Targets in the browser and found the Admin Information Security Login page. Now credentials need to be found for login, Let’s work on this.
We Fired UP!! burpsuite using rockyou.txt to get valid login.
Username- admin
After bruteforcing, we have found the password for Admin i.e
Password- happy
We have successfully logged in as Admin. Under system tools, the hyperlink command looks suspicious here. So, let’s check it out.
Command option looks useful as It displayed some options to Run Command. Here we used list file option which displayed files of the database. We also got a hint from the ls command which executes ls-l, we might make some changes in it.
So, we captured the Webpage request using Burpsuite and Send the request to the repeater. Here we can make the desired changes to the request and check out its response.
Let’s check out subdirectories in the /home directory. We have found 3 users i.e Charles, Jim and Sam.
Exploring the home directory for user Jim, after that, we checked out the backups folder.
We have found a old-passwords.bak file is a backup password file.
Exploring the contents of the file, we found a list of passwords. They might come in handy later.
We thought of checking /etc/passwd is readable or not and found some useful usernames.
We have created a dictionary for users and passwords with the previously discovered credentials. Let’s bruteforce for ssh login using hydra.
So, the credentials found:
Login- jim
Password- jibril04
Lateral Moment
Logging into ssh using the credentials.
Username- jim
Password- jibril04
ssh [email protected]
While enumeration, we found two files and read their contents. But they didn’t give direct clue to move ahead.
when I open mbox, I saw a test mail in this, send by root to jim.
After some time thinking, it suddenly strikes us to check the /var/mail folder. Maybe it might contain something, and our instinct was right. We have found some credentials.
Username- Charles
Password- ^xHhA&hvim0y
Let’s login into charles with password ^xHhA&hvim0y.
After enumeration, we check sudo right for Charles and found that he run the editor teehee as root with no password. After that, we have added raaj in the etc/passwd using echo and teehee as shown.
Logging into raaj as root user and inside the root directory, we have found our FINAL FLAG.
Security Level: Beginner
Penetrating Methodology
Scanning
- Discovering Targets IP
- Network scanning (Nmap)
Exploiting
- Surfing HTTP service port
- HTTP Login credential Bruteforce (Burpsuite)
- Command Injection
- SSH Login Credentials Bruteforce (Hydra)
Lateral Movement
- Logging into SSH and Enumerating Directories
- Obtain credentials in /var/mail directory
Privilege Escalation
- Check Sudo rights
- Adding new user /etc/passwd with sudo
- Access root directory
- Capture the flag
Walkthrough
Scanning
Let’s start off with scanning the network to find our target.
Code:
netdiscoverWe found our Targets IP Address 192.168.1.101. Our next step is to scan our targets IP Address with nmap.
Code:
nmap -A 192.168.1.101Exploiting
From nmap result we found HTTP service is running on port 80. So, we browsed the Targets IP Address in the browser and found an Admin Information Security Login page. We clearly need to find credentials for it. Let’s work on that.
We found that the HTTP service runs on port 80, from nmap results. So, we browse the IP address of Targets in the browser and found the Admin Information Security Login page. Now credentials need to be found for login, Let’s work on this.
We Fired UP!! burpsuite using rockyou.txt to get valid login.
Username- admin
After bruteforcing, we have found the password for Admin i.e
Password- happy
We have successfully logged in as Admin. Under system tools, the hyperlink command looks suspicious here. So, let’s check it out.
Command option looks useful as It displayed some options to Run Command. Here we used list file option which displayed files of the database. We also got a hint from the ls command which executes ls-l, we might make some changes in it.
So, we captured the Webpage request using Burpsuite and Send the request to the repeater. Here we can make the desired changes to the request and check out its response.
Let’s check out subdirectories in the /home directory. We have found 3 users i.e Charles, Jim and Sam.
Exploring the home directory for user Jim, after that, we checked out the backups folder.
We have found a old-passwords.bak file is a backup password file.
Exploring the contents of the file, we found a list of passwords. They might come in handy later.
We thought of checking /etc/passwd is readable or not and found some useful usernames.
We have created a dictionary for users and passwords with the previously discovered credentials. Let’s bruteforce for ssh login using hydra.
Code:
hydra -L users -P passwords 192.168.1.101 sshSo, the credentials found:
Login- jim
Password- jibril04
Lateral Moment
Logging into ssh using the credentials.
Username- jim
Password- jibril04
ssh [email protected]
While enumeration, we found two files and read their contents. But they didn’t give direct clue to move ahead.
Code:
ls
cat test.sh
cat mboxwhen I open mbox, I saw a test mail in this, send by root to jim.
After some time thinking, it suddenly strikes us to check the /var/mail folder. Maybe it might contain something, and our instinct was right. We have found some credentials.
Username- Charles
Password- ^xHhA&hvim0y
Privilege Escalation
Let’s login into charles with password ^xHhA&hvim0y.
Code:
su charlesAfter enumeration, we check sudo right for Charles and found that he run the editor teehee as root with no password. After that, we have added raaj in the etc/passwd using echo and teehee as shown.
Code:
sudo -l
echo "raaj::0:0:::/bin/bash" | sudo teehee -a /etc/passwdLogging into raaj as root user and inside the root directory, we have found our FINAL FLAG.
Code:
su raaj
cd /root
ls
cat flag.txt