hey guys hack exploit here back again
with another video and welcome back to
the oscp prep series
we will be taking a look at various hack
the box and walnut boxes in order to
prepare you for oscp
now we already have uh an ongoing series
or playlist on this and you can view all
our previous volume walkthroughs
and hack the box walkthroughs in the
playlist the link to them will be in the
description
and we will also be combining all of
them so that you can find them in one
centralized source
so we are following a set structure of
boxes that
do uh so sort of mimic or are very close
to the ones you'll find uh you know in
the oscp
examination as of the current one right
and the goal is to sort of prepare you
for the labs
by doing the types of boxes you are most
likely to encounter
all right so we've already completed
chaotrix one uh the mr robot uh walnut
box and
now we're moving on to curb tricks we'll
be moving through the entire
kayak trick series and then taking a
look at the various hack the box ones
all right so let's get started so i have
already have objects too running on my
local era network here and um it is a vm
and i'll be posting the link to download
that in the description
uh the local ip is 192.168.1.104 so
let's get started by analyzing
the nmap scan by the way a walkthrough
of all of these boxes
is available on our blog at
hackersploit.org or
hsployed.com so you can find them over
there if you are facing any issues
right so this is our nmap scan right
over here and as you can see we have
various
ports open we have an ssh port now we
have a web server running right over
here so we have both http
and https so airport 80 port 443
we also have an rpc port here um
or rpc bind rather we then have an ipp
port here running cups version 1.1 and a
mysql database that looks like it does
require authentication um
so it looks like open sh 3.9
p1 isn't vulnerable to any particular
vulnerability although it may be a way
to to gain entry
after exploitation our main target first
of all is to take a look at the web
server so let's get started with the web
server
so that is 192.168.1.104 and we'll also
load this up on https
like so and as you can see we get an
error with the https
link here telling us that we have
received an invalid certificate
that could be because of the age of the
virtual machine and the fact that
the ssl certificate may have expired
however if we take a look at the
at the http website here or the link you
can see that we have a remote system
administration login
and this is one of the aspects that we
are targeting first of all so again it's
username password
uh sorry about that and again we can
view the the source here
and uh there we are we have the uh the
form and
so this is the post right over here and
index.php of course uh we have the
username
and the password so very very simple uh
php login
screen here or login system which means
it is interacting with mysql because we
also found
the mysql database so we can try sql
injection here
so we're going to try a few simple uh
you know login bypass tricks
of course one of the first ones is admin
and that we then
add the comment there and we of course
let's use a
single quotation mark there to pass
through and once we log in you can see
that that simple
uh that simple uh sql injection
trick lets us log in or bypass the
entire login system
as the administrator we now have a
welcome to the basic administrative web
console page where it allows us to ping
uh a machine on the network so on some
level this is performing os command
injection now if this is your first time
hearing about command injection you can
watch our independent video
on command injection where i cover all
the various ways of performing it
with different types of filters that
prevent you from from from doing it so
the first thing we want to do is we want
to test out whether this does work so
i'm going to
i'm going to provide an ip here a local
ip on my network just to scan
and if you take a look at the results
they're very interesting you can see it
performs the ping and we get the results
so this is performing
uh os command injection and we know that
this is uh
this is a linux box right so
uh we can now uh we can now end this
statement and then provide additional
statements to be executed
by the system so we can say pwd
and as you can see after the ping is
completed it then
executes our next command which it
prints our current working directory
and we can see that it is in the var
www.html directory which is
the default for apache which also tells
us that this user could be potentially
the apache user the apache system user
which is quite interesting which means
we will have to perform some level of
privilege escalation
so of course our next step is to see if
this can of course
do it on its own so we'll run this one
more time and as you can see
it gives us the command right over here
so let's try a few more commands
so we can say ls and it lists for us the
files within the apache directory which
we have index.php
and the pingit.php file which is what is
being used or to process the command
injection
right over here all right so we can now
use a reverse shell here
of course a bash reverse shell so i'll
open up the reversal cheat sheet
that is found on pen test monkey and
we'll be using this one
right over here so what i'm going to do
is we can set up a netcat listener here
so we'll just open this up and let me
just clear this
and we'll say netcat nvlp one two three
four on port one two three four just so
we can test
and see if this works we'll also be
trying to see if we can get an
interpreter shell so we'll try that out
one second
in fact in the meantime what we can do
is just let us start up the
metasploit here so msf console
and we can now move on here and let us
try and paste that in here so of course
we're ending the statement
uh and then we obviously want to paste
this in
and we are going to be connecting back
to the ip of
what our local ip should be
if config let's run this and you can see
it is 192.168.1.106
all right excellent so we will be using
that um so i'm going to say we'll get
rid of all of this
192.168.1.106
and the port is going to be port 1234
here
like so and we can then hit submit while
we have
the the listener running the netcat
listener and once we open the netcat
listener you can see
we get a bash shell without any job
control which is
uh one of the it's a good reason for us
to try and use our interpreter or to try
and upgrade this
to an interpretive session or a shell um
so what we can try and do now is perform
some enumeration here so some system in
enumeration just to get an idea of what
we're dealing with so
we can try you name a and we can see
it's running linux
version linux kernel version 2.6.9
let's see what os we are currently
running lsb release a
we're running centos version 4.5 and
one second let us just go into this and
we're going to use the exploit
multi handler and we'll set the payload
to we're primarily using linux
so uh 32-bit of course and this is a
shell and we're using reverse tcp
you can also use http if you want we'll
hit enter
show the options here and we'll set the
l host to
182.168.1.106 and we'll leave the l port
at four four four four
and what we will do is hit run now and
uh we will now go back into
our into our little ping
uh functionality here or the the
administration web console
and we will simply just change this port
to 444
and if we submit we go back to
metasploit and you can see we have a
command shell open
so let us just try and get there some
response here so obviously no job
control
what we can do is if i just type in id
you can see we are currently logged in
as the user apache which is a system
account
so cat etsy password let's see what
users we currently have running so we
have apache we have john and harold
which i'm not too sure we are able to
log in as and we also have the root user
so let us just send this to the
background here and
let us of course try and upgrade this if
we can
so sessions uh let's list the sessions
we only have one session
so sessions um and we're gonna say
upgrade
session one and hit enter and let's see
if we can upgrade this shell otherwise
we'll have to use
our our normal shell so there we are
interpreter session
and yeah it looks like we cannot upgrade
this shell
so no problem at all we're just going to
close this
so we'll exit out of that and we can
still use this one over here
so the first thing we need to do or
we've already established is what
versions are or what software is running
uh so you know it's running centos
version 4.5 so let's run a quick search
exploits uh
here so search split and we're going to
say centos
version 4.5 let us try and oops sorry
that is the
uh wrong spelling there centos 4.5 and
i'm going to enter
and we have a few options here that
allow us to perform
privilege escalation we have the first
option and we have the second option
which
is really not for us we are primarily
interested in this one as it
it does suit the version we are talking
about and also the kernel matches here
so 2.6
so anything less than 2.6.19 and greater
than 2.6 here
so we'll use this exploit here so we're
just going to copy that so
copy user share and we're going to say
exploit db
and we'll paste in the directory here so
root desktop
and volnhob and kaioptricks2 we'll paste
that right in this folder here
and let's take a look at this exploit so
the exploit is 9542.c
or dot c and we can see that it was disa
discovered by the google security team
and it gives us options in regards to
the compilation
uh now the the important thing about
this compilation is that it has to be
done
on the system itself as you can see so
with the bash
provided here and then we run the we run
the new c compiler
so the first thing we need to now do is
we need to copy
uh we need to get this exploit onto the
system
um so we are currently in the html
folder or the apache directory
the pre-configured apache directory so
we'll go into the temp folder because
that's
where we'll probably have permissions or
if we try and access the root user sorry
the root user we can see we do not have
any permissions right so
what we'll do is uh if we just print the
current working error
directory we're still in temp so let us
run simple http server here
so python m simple uh
simple http server and then of course
uh http server will run that and by the
default port would be port 8000 and
we'll copy that over
so 954.c that's the file we want so
we're just going to say wget
http uh 182.168
and this is going to be using port 8000
uh the name of the file
is 9542.c so 9542.c
hit enter and we get the file so if we
list the file right over here
excellent so we can say gcc
and we hit output we want to output into
exploit we'll just call it exploit
and the name of the file is 9542.c
and then we also want to exploit it
directly after so we're going to say
exploit and hit enter
and immediately we get the we get a
shell now
and um of course with uh with with the
bar shell
we previously had but now if we type in
id you can see we now have the root user
and we have six we have successfully
gotten root on this box
all right so this was quite a simple box
but one that covers
uh quite a few things really really well
and tries to
basically implement a correct flow of
going about things so uh there's
there's a there's a ton of places where
you can sort of get confused with this
so for example
if i just clear this up you can see that
with the nmap
scan you can start targeting the uh the
ipp port here you can also target the
mysql database here
and i'm sure there is or are quite a few
other ways of targeting this box let me
know what you guys think
again we'll be going through all of
these various boxes just to get you guys
ready or
uh to essentially give you an
introduction into various ctfs
and various vulnerable boxes so uh let
me know if you guys have any questions
or suggestions you can check
out the the walkthrough or the write-up
of this box on our blog at hsploy.com
and we'll be seeing you in the next
video
peace