Inside this Article:
Hello everyone! Welcome to my new video. Today, we're exploring a vulnerable machine called " Corpvision ". This machine is part of a single series and is categorized as " Beginner to Intermediate " in terms of difficulty.
To get started, head
over to the VulnHub website and download the vulnerable image. If you're new to
VulnHub, check out our VulnHub playlist for helpful videos.
Settings Up
Once you've downloaded
the image, the next step is setting up the server in VirtualBox. This process
is quite simple and involves importing the OVA file into VirtualBox using the
"
import appliance
" feature.
Importing the OVA file into VirtualBox is a straightforward process. Unfortunately, When the virtual box attempts to import the virtual machine, an issue arises, leading to automatic aborts importing. Let's troubleshoot this.
To resolve the problem, we'll need to extract the OVA file and manually install the VM. Here, we'll rename the OVA extension to ZIP.
.png)
Since direct renaming isn't possible, open Command Prompt from this directory by typing " cmd " in the Address bar.
.png)
This will open Command Prompt in the same directory. Use the " dir " command to list all directories and files. Then, to rename, utilize the " REN " command.
.png)
With the OVA extension changed to ZIP, we can now extract it using WinRAR .
.png)
After extraction, I discovered several helpful files, including two VMDK files .
.png)
Our next step involves creating a new virtual machine. Launch VirtualBox.
.png)
In VirtualBox, click on " New " to create a new VM.
.png)
Name it " Corpvision 1 " Select the operating system type as Linux and set the version to Other Linux 64-bit, since we do not know.
.png)
Proceed by allocating RAM size for your VM and click " Next ."
.png)
Select " Use an existing virtual hard disk file " and import the VMDK file extracted earlier.
.png)
After clicking " Next ," then " Finish ," the setup is complete.
.png)
Once the import is finished, you'll see the " Corpvision " vulnerable machine listed in the VirtualBox Manager under the VulnHub group.
.png)
Now, go to Settings, then Storage, and add the second additional VMDK file.
.png)
Now, change the Network adapter to " Host-Only ."
.png)
It's important to ensure that both your Kali Linux machine (used for attacks) and the vulnerable machine are connected to the same network, so make sure they're both connected via the host-only adapter.
Next, attempt to start the VM to check if it works.
.png)
Finally, you'll notice that our Vulnerable Machine is ready, with a login prompt awaiting. Let's dive into the fun!
Enumeration
Identify the IP address
The initial step in our attack is enumeration, which involves identifying the IP address of our target machine using Net Discover. To execute this, open a terminal and run " netdiscover -i " followed by specifying the network interface name, which in this case is " eth1 ."
From the scan results, we've obtained our target
IP address: "
192.168.95.17
."
Conduct the Network Scan using Nmap
Next, we'll conduct a network scan to identify open ports, a crucial step in the enumeration process. This helps us understand the attack surface and strategize targeted attacks. We'll use the popular Nmap tool for this task. Run " nmap -sC -sV followed by specifying the IP address ".
In this command,
- "- sC " is used to perform a script scan using the default set of scripts,
- while "- sV " enables version detection, allowing us to identify which versions are running on which port.
After completing the
network scan, we found 2 open ports:
- The Port 22 TCP runs an SSH service, indicating that with valid credentials, gaining login access to the server will be straightforward,
- and Port 80 TCP runs an HTTP service, suggesting a vulnerable website is hosted on the target server.
Web Enumeration and Directory Busting
Now, let's explore the content of the
website running on Port 80. To look at the contents ourselves, open a web
browser of your choice, and navigate to the target’s IP address in the URL bar
at the top of the window.
.png)
Upon visiting the webpage, I discovered that it uses a Bootstrap responsive design, which I confirmed using the Wappalyzer tool.
.png)
However, the visible content on the page doesn't provide any valuable information. To explore further, we can inspect the page's source code by right-clicking on the page.
.png)
But, this too doesn't reveal anything useful.
To continue our investigation of the target URL, we will perform directory busting to uncover hidden or hard-to-access directories and pages. For this task, we'll use the " gobuster " tool with the following command.
Where,
- gobuster dir is used to instruct gobuster to perform directory busting.
- -u is used to specify the target URL we want to explore.
- -w is used to provide the path to the wordlist containing common directory names to try.
Using a directory-busting tool, we have identified various directories. One directory, " static ," appears suspicious upon initial inspection.
.png)
Upon exploring the "/static " web directory, we find that it contains files and directories with some level of access permissions.
.png)
However, this exploration hasn't provided any immediate
clues for gaining a foothold.
Enumerate the Web Vulnerability with Acunetix
To expedite our investigation, we'll use an automated web vulnerability scanner. Previously, I created several videos on this topic, which you might find helpful if you're interested.
Exploring Web Vulnerability Scanners
Discover the latest in web vulnerability scanners. This guide provides an overview of various tools available for detecting and addressing security vulnerabilities in web applications, helping you protect your online assets effectively.
For this task, I will use Acunetix, a web vulnerability scanner known for its simplicity and effectiveness.
Installing Acunetix on Kali Linux with Docker
Learn how to install Acunetix on Kali Linux using Docker. This guide provides detailed instructions to help you set up and use Acunetix for comprehensive web vulnerability scanning on your Kali Linux system.
To start the Acunetix services, open a terminal and type:
service acunetix start.
Next, open a browser and navigate to the Acunetix default webpage, which runs on port 3443.
.png)
Add the target URL for scanning and save it.
.png)
Target saved successfully, now, click on " Scan ".
.png)
Select the " Full scan " option to ensure a comprehensive check.
.png)
From the Acunetix scan results, I found two severe vulnerabilities: Cross-Site Scripting (XSS) and Server-Side Template Injection (SSTI) .
.png)
While the XSS vulnerability is not particularly useful in this context, the SSTI vulnerability might allow us to gain a reverse shell.
.png)
Let's proceed with exploiting this vulnerability to gain further access.
Exploitation
To exploit the Server-Side Template Injection (SSTI) vulnerability, it's important to understand how this vulnerability works.
SSTI happens when user input is embedded into a server-side template in an unsafe manner, which allows an attacker to execute arbitrary code on the server.
In this scenario, the vulnerability is found in the Name field of the contact form located at http://192.168.95.17/contact .
.png)
This means that any data entered into the Name field can potentially be used to inject and run code on the server due to improper handling of the template input.
Illustrating how an SSTI vulnerability works and verifying it?
Here's a common scenario illustrating how an SSTI (Server-Side Template Injection) vulnerability might work:
First, let's visit the page where the vulnerability is found in the Name field of the contact form located.
.png)
Since the Name field can potentially be used to inject and run code, we can test for the vulnerability by injecting
{{7*7}}
into the Name field and add any additional information to the other fields.
Now, let's confirm the vulnerability.
.png)
When the form is submitted, the website processes the input, and the server-side template engine executes the code.
.png)
If the server evaluates the expression
{{7*7}}
and returns
49
, this confirms that the vulnerability exists.
To confirm the vulnerability, we injected
{{7*7}}
into the Name field and observed that the server evaluated the expression to 49. Since the output is 49, we can confirm that the Name field is indeed vulnerable to SSTI. This vulnerability can potentially be exploited to read sensitive information from the server, such as the contents of files.
Foothold
Next, it's time to exploit the vulnerability to gain Foothold. To exploit this vulnerability, you need to determine the template engine being used.
Common template engines include Jinja2 (Python), Twig (PHP), and others.
Given the response format, which looks
like HTML with Python-like syntax for expressions, it’s likely a Python-based
engine like Jinja2.
Gain Foothold using Python-based engine Jinja2
To proceed, we need to inject payloads to
gain a reverse shell. For this purpose, I will use Burp Suite to analyze the
behavior of the injection payload on the target.
First, launch Burp Suite from the Kali menu, and configure the browser's proxy settings using FoxyProxy .
.png)
Access the proxy tab, and activate intercept mode to capture target requests.
.png)
Switch the proxy to Burp Suite
within the
FoxyProxy
extension.
.png)
Now, reload the page to intercept the requested data, and send the captured request to Burp Suite's repeater tool.
.png)
Upon reloading the page, it will capture the requested data.
.png)
It’s time to send the captured request to the repeater tool in Burp Suite.
.png)
Upon sending the request, we got the result of the request in the response section, which means it is working.
.png)
Next, let's inject a payload to execute code via SSTI . To confirm the vulnerability and test code execution, try injecting the following command:
This payload will execute the
id
command
on the server. Replace the Name field data with the payload.
.png)
|
| Request data in Repeater |
In the response, you can see the current
user information, which is
www-data
, confirming that code execution
is possible.
.png)
Since this is working, let's proceed with gaining a reverse shell.
Gain Reverseshell
To achieve this, we need to inject a payload that sends a shell back to our attacking machine. For this purpose, I will use a Python reverse shell script.
We need to replace the IP address in the script with our Kali machine’s Host-only IP address and paste this payload into Burp Suite, as shown.
.png)
Before sending the request, we need to set up a listener using Netcat.
Now, click on " Send " to check if we get a reverse shell .
.png)
Unfortunately, it did not work. I suspect this is because the request is automatically decoded from the URL form when sent. So, let's encode it and try again.
.png)
Still, it is not working. There is another way to send the request, using the curl command-line utility. Let me craft the curl command.
After modifying and trying a few commands, finally it worked:
If you are unable to craft the curl command, consider using AI tools like ChatGPT .
On the Listening terminal, we can finally see the reverse shell.
Since we have the reverse shell, let’s make it interactive. Let's check if Python is available on our target.
Yes, it is.
Now, change the terminal type to `xterm`.
Great, it's working well. Next, let's see if we can access the user flag.
Unfortunately, we
don't have sufficient privileges. Let's see if we can switch to the user
"Steven".
However, after trying various methods, I couldn't find any clues or execute any shell commands effectively.
.png)
I encourage you all to try your luck and find a way to obtain the root flag and the user flag.
Remember, brute force attacks are not possible because the target does not allow SSH connections from any other IP address. Additionally, local privilege escalation is not working because the GCC compiler does not have sufficient permissions. Keep these points in mind.
If you find a solution, please send a video or a copy of the output to my email or Instagram. See you then. If you have any doubts or queries, write to me in the comment section.
