Vulnhub virtual machine; OSCP prep box, included a webserver enumeration of OPTIONS which led to a PUT upload of reverse shell. Priv-escalation required a pivot through chkrootkit and a reverse shell executed by crontab.
Legal Usage: The information provided by executeatwill is to be used for educational purposes only. The website creator and/or editor is in no way responsible for any misuse of the information provided. All the information on this website is meant to help the reader develop penetration testing and vulnerability aptitude to prevent attacks discussed. In no way should you use the information to cause any kind of damage directly or indirectly. Information provided by this website is to be regarded from an “ethical hacker” standpoint. Only preform testing on systems you OWN and/or have expressed written permission. Use information at your own risk.
By continued reading, you acknowledge the aforementioned user risk/responsibilities.
Locate VM on network
1 |
|
Target: 192.168.56.104
Enumeration
Nmap Scan
1 |
|
Investigate HTTP server http://192.168.56.104
source:
blow.jpg
downloaded and check for stegonography
1 |
|
1 |
|
Gobuster HTTP server
1 |
|
/test
directory found and possible other different looking directory.
/test
Directory
lighttpd/1.4.28 identified
Searchsploit
1 |
|
“mod userdir Information Disclosure” looks interesting - download locally and view
Security focus website
This might be worth investigating here in the future.
Checking the webserver OPTIONS of /test
1 |
|
Webserver allows *put*
. We can send quick one liner to it and see if it executes.
RCE
PUT shell.php on webserver
1 |
|
uploaded completed!
File is indeed on remote box now to test code execution.
1 |
|
Reverse shell use standard pentestmonkey reverse shell and URL encoded it. - I did encounter issues with the port which lead me to believe we might be dealing with some type of firewall internally.
1 |
|
We have a partial shell now and just require to upgrade.
Upgrade to tty
1 |
|
cat /etc/passwd
checking for chkrootkit
Priv-Esc
version test
1 |
|
Luckly there is an exploit for verison 0.49 found at: https://www.exploit-db.com/exploits/33899/
Priv-esc is accomplished by writing an update
file within /tmp
which gets executed by the cron.
Root
Create update
file
We need to push this reverse shell via 443 to bypass firewall
1 |
|
next change the chmod
1 |
|
wait for callback on port 443
Bring me the root!
-exec