Table of Contents
Vulhub - Vulnerable By Design
Vulhub is a platform designed to host intentionally vulnerable web applications for educational and testing purposes. It provides a hands-on learning environment for security enthusiasts to practice identifying and exploiting various vulnerabilities in web applications.
The box, I will be writing up from the result is Android 4.
The settings up are quite easy and it is similar to the past videos.
- Firstly, download the ".ova" mirror image.
- Open Virtual Box.
- Click on import, and browse the file from the Download directory.
- On completion, Check if the Network Adapter is set to Host-only adapter, or not.
Once you are done with the settings up, let’s
start the instance VMs.
.png)
The instance is ready, and we have got a UI that asks us to input a password. Our task will be to find the flag and also will unlock the password screen.
Enumeration
The instances are ready and we are on Kali Linux. Let's find out the IP address by using Netdiscover.
We have discovered an IP address, so let's perform a network scan to detect
what ports are open, which is already known as an essential part of the enumeration
process. This offers us the opportunity to better understand the attacking surface
and design targeted attacks. As in most cases, we are going to use the famous
Nmap
tool.
Conducting Network Scans with Nmap
- -sC : Performs a script scan using the default set of scripts.
- -sV : Enables version detection, which will detect what versions are running on what port.
From the network scan, we have spotted 2 open ports.
- Port 5555/TCP seems to be like a Freeciv gaming protocol.
- Port 8080/TCP running an HTTP service, which indicates that there might be a website running.
To look at the contents ourselves, we can open a web browser of our choice and
navigate to the target's IP address along with port 8080 in the URL bar at
the top of the window.
Foothold
Anyone would establish that there is some
kind of verbal tampering involved in using the POST method. We tried but didn’t
find anything useful.
This seems to be like, an information page.
Discovery of Hidden Directories with Gobuster
Let’s brute force the directory and URL using gobuster.
We found nothing from the result.
From the Nmap result, we have discovered
port 5555 is in an open state. After analyzing, I confirmed that the Android
device might be connected through the ADB command-line utility.
Remotely Accessing Android Devices with ADB
If you don’t know, what is ADB?
- Learn More:
ADB - Android Debugging Bridge
ADB (Android Debug Bridge) is a versatile command-line tool that allows developers to communicate with an Android device from a computer. It enables various debugging and diagnostic tasks, such as installing and debugging apps, accessing the device shell, transferring files, and more.
Firstly open a terminal, and check if there ADB command-line utility is already installed or not. If not then install it.
To get to connect the Android device through the network:
On successful execution, you can list the connected devices using ADB devices. As you can see, we have successfully managed to get into the server.
To get interaction with the shell, use the ADB-shell command, where you can perform Linux commands to get the flag.
Privilege Escalation
From the output of the ADB shell command, we have successfully managed to get a shell that seems to be like a normal user account. To switch the user to superuser access then run the su command.
We have successfully managed to escalate to the highest privilege. You can find the root flag to complete the challenge.
Congratulations on the completion of capturing the flag.
Bypassing Android Device Lock Screen Security
Let’s see if we could remove the lock screen password using ADB. So firstly change the directory to the previous directory which is a data directory.
From here change the directory to the system, and list all files and directories.
The keys are stored within the file which contains the ".key" extension.
The key files are removed. Reboot the device to see the magic.
We have successfully managed to bypass the lock screen.
