Vulnhub virtual machine; OSCP prep box, included a webserver enumeration of OPTIONS which led to a PUT upload of reverse shell. Priv-escalation required a pivot through chkrootkit and a reverse shell executed by crontab.
Legal Usage: The information provided by executeatwill is to be used for educational purposes only. The website creator and/or editor is in no way responsible for any misuse of the information provided. All the information on this website is meant to help the reader develop penetration testing and vulnerability aptitude to prevent attacks discussed. In no way should you use the information to cause any kind of damage directly or indirectly. Information provided by this website is to be regarded from an “ethical hacker” standpoint. Only preform testing on systems you OWN and/or have expressed written permission. Use information at your own risk.
By continued reading, you acknowledge the aforementioned user risk/responsibilities.
Locate VM on network
Investigate HTTP server http://192.168.56.104
blow.jpg downloaded and check for stegonography
Gobuster HTTP server
/test directory found and possible other different looking directory.
“mod userdir Information Disclosure” looks interesting - download locally and view
Security focus website
This might be worth investigating here in the future.
Checking the webserver OPTIONS of
*put*. We can send quick one liner to it and see if it executes.
PUT shell.php on webserver
File is indeed on remote box now to test code execution.
Reverse shell use standard pentestmonkey reverse shell and URL encoded it. - I did encounter issues with the port which lead me to believe we might be dealing with some type of firewall internally.
We have a partial shell now and just require to upgrade.
Upgrade to tty
checking for chkrootkit
Luckly there is an exploit for verison 0.49 found at: https://www.exploit-db.com/exploits/33899/
Priv-esc is accomplished by writing an
update file within
/tmp which gets executed by the cron.
We need to push this reverse shell via 443 to bypass firewall
next change the
wait for callback on port 443
Bring me the root!