Inside this Article:
Hello everyone! Welcome to my new video. Today, we're exploring a vulnerable machine called "Lazysysadmin". This machine is part of a single series on VulnHub, rated as Easy in terms of difficulty.
To get started, head over to the VulnHub website and download the vulnerable image for "Lazysysadmin".
If you're new to VulnHub, be sure to check out our VulnHub playlist for helpful videos that will guide you through the process.
Vulhub: Vulnerable by Design
Vulhub provides a collection of pre-built vulnerable docker environments, designed for learning and practicing security vulnerability assessments and penetration testing. Explore various scenarios and improve your cybersecurity skills.
Let's dive in and see how we can exploit this machine!
Settings Up
Once you've downloaded the image, the next step is setting up the server in VirtualBox.
.png)
The downloaded image is in the
form of a
ZIP file
, so the process involves extracting the ZIP file and installing
it by creating a new VM.
First, we need to extract the ZIP file using WinRAR . After extraction, I discovered several helpful files, including the VMDK files .
.png)
Our next step involves creating a new virtual machine.
In VirtualBox, click on " New " to create a new VM.
.png)
Name it " Lazysysadmin " and select the operating system type as Linux . Set the version to " Other Linux 64-bit " since we are unsure of the exact distribution.
.png)
Proceed by allocating RAM for your VM and click " Next ."
.png)
Select " Use an existing virtual hard disk file " and import the VMDK file extracted earlier.
.png)
After clicking "Next," click on "Finish" to complete the setup.
.png)
Once the import is finished, you'll
see the "
Lazysysadmin
" vulnerable machine in the
VirtualBox manager. For
better organization, let me regroup it into the
VulnHub group.
.png)
Now, change the Network adapter to " Host-Only ."
It's important to ensure that both your Kali Linux machine (used for attacks) and the vulnerable machine are connected to the same network, so make sure they're both connected via the host-only adapter.
.png)
Next, attempt to start the VM to check if it works. Finally, you'll notice that our vulnerable machine is ready, with a login prompt awaiting.
.png)
Let's dive into the fun!
Enumeration
Identify the IP address
The initial step in our attack is enumeration, which involves identifying the IP address of our target machine using NetDiscover. To execute this, open a terminal and run "netdiscover -i" followed by specifying the network interface name, which in this case is " eth1."
From the scan results, we've obtained our
target IP address: "
192.168.95.22
."
Conduct a network scan to identify open ports
Next, we'll conduct a network scan to identify open ports, a crucial step in the enumeration process. This helps us understand the attack surface and strategize targeted attacks. We'll use the popular Nmap tool for this task. Run:
In this command,
- " -sC " is used to perform a script scan using the default set of scripts,
- while " -sV " enables version detection, allowing us to identify which versions are running on which port.
After completing the network scan, several
open ports with corresponding services were revealed:
- Port 22 (TCP): Running an SSH Secure Shell service version 6.6.1 on Ubuntu. With valid credentials, we can easily log into the target server.
- Port 80 (TCP): Running an HTTP web server service using Apache httpd version 2.4.7. Additional details include the server title ("Backnode") and the software used to generate the web pages (" Silex v2.2.7 ").
- Ports 139 and 445 (TCP): Running NetBIOS nameservice (Samba) version 4.3.11. These ports are commonly used for file and printer sharing in Windows environments.
- Port 3306 (TCP): Running a MySQL database service. The service is running, but it's unclear whether it's password-protected.
- Port 6667 (TCP): Running an IRC service (chat application) with InspIRCd server. Information about the server and a single connected user is provided.
We should take advantage of these ports to
gain a foothold on the server. Before doing so, let's enumerate these ports
further to find potential clues or vulnerabilities.
Among these open ports, I find SMB ports 139 and 445, and HTTP port 80 quite interesting.
Enumerating SMB Service
Let's enumerate these ports to
find potential clues or vulnerabilities, starting with the
SMB ports.
SMB (Server Message Block) ports are often used for file sharing and can sometimes reveal sensitive information or allow access to files. In some cases, developers might mistakenly leave these ports unprotected, allowing access without a password.
First, let's list the available shares on the SMB server.
This will display various
shared resources. Among
these, I noticed a "
share
$
" share that
looks interesting and might contain useful files.
Next, we will connect to the " share $ " resource on the target server to retrieve the files and directories.
Upon a successful connection, several directories and files are listed, including:
-
wordpress, -
Backnode_files, -
wp, -
deets.txt, -
robots.txt, -
todolist.txt, -
apache, -
index.html, -
info.php,test, and -
old.
Upon careful analysis, it appears these files and directories constitute the default HTTP directory path of the target system. The presence of a directory named " WordPress " suggests that the target server may host a WordPress CMS.
To confirm this assumption, let's explore the content of the website running on Port 80.
Web Enumeration and Directory-busting
Open a web browser of your choice and navigate to the target's IP address in the URL bar at the top of the window.
.png)
Upon exploring the website, it looks like a default page of
BackNode
,
which doesn't provide any clues. However, this does confirm that the SMB file
share, we connected, matches the website's file structure.
To gather more information, we will use a directory-busting tool to enumerate the directories on the web server and compare these with the files and directories listed in the SMB share. This will help us identify any discrepancies or additional information. For this task, I am going to use Gobuster .
After analyzing the output, my assumption was confirmed.
WordPress Database Enumeration
.png)
Now, let's look at the content of the " WordPress " directory.
Continue our enumeration from where we left off with the SMB content. Navigate to the " WordPress " directory and list its contents.
Several WordPress-related files are listed, including "wp-config.php" .
The wp-config.php file is particularly interesting because it typically contains database credentials.
Let's retrieve the "wp-config.php" file using the get command.
This will automatically download and
save it to the
/home/kali
directory.
Now, let's examine the "wp-config.php" file, which often contains database credentials and other sensitive information.
.png)
Upon accessing it, I find the username and password.
- User Name: Admin
- Password: TogieMYSQL12345^^
We can use these credentials to
log in to the
WordPress admin dashboard, where we can manage everything and
potentially gain a foothold on the target system.
Foothold
Previously, while enumerating the File Share using an SMB client, we found the username and password. Let's use these credentials to log in.
In our browser, navigate to the wp-admin page to access the WordPress login area .
WP-admin is the default login page for the WordPress dashboard.
.png)
Enter the retrieved credential.
.png)
Great, we have successfully logged in to the server.
Gain Reverse shell access from WordPress Dashboard
With access to the dashboard, we have various ways to establish a shell connection. Here, I will take advantage of modifying a PHP file in the template.
Navigate to Appearance, where you will see options related to the website's appearance. Then, Click on Editor, to edit the themes.
.png)
The current theme in use is Twenty-fifteen. Select any PHP file to modify; I will choose: 404.php.
.png)
Clear the PHP content of the file and replace it with a PHP reverse shell script. Locate the script on your terminal and open it with a text editor like Mousepad.
.png)
Copy the entire script and paste it into the WordPress editor.
.png)
Before saving, modify the Listening Host and Listening Port.
If you don't know your IP address, use the ifconfig command to check it.
.png)
Save the changes and start a listener using Netcat.
Visit the 404 template page, to trigger the reverse shell connection.
.png)
We have successfully established a shell connection.
Now, let's spawn an interactive shell using Python.
It's time to check for the user flag, typically located in the home directory of the existing user. Navigate to the home directory and list the files and directories to identify the username.
It looks like the username of the target system is " togie ." Change to this directory and look for the flag, but there is no flag here.
This suggests the flag is only in the root directory.
Attempting to access the root directory results in a " Permission denied " error, indicating we lack the necessary rights. Let's escalate our privileges to gain access.
Privilege Escalation
During the privilege escalation process,
our primary goal is to gather system information and identify any
vulnerabilities or misconfigurations that could provide elevated privileges,
ultimately allowing us to gain root access.
Previously, we found the username of the
target system, "
togie
." If we can find the password for this
username, it may help us escalate our privileges further.
There is a file named " deets.txt " that we haven't examined yet. Let's retrieve and analyze it.
Now, let's open it and analyze it.
.png)
Upon analyzing the text, I found the password.
Misconfigured Sudo Permissions
Now that we have both the username and password, let's switch to the user " togie " using the su command.
We
have successfully switched to the user "togie."
Next, we need to examine the permissions assigned to users to assess their privileges on the system. This can be done by executing commands like " sudo -l " to view the commands the current user can run with elevated privileges.
It appears that the user "
togie
"
has permission to run all commands with
sudo
. This means we can access, modify,
or do anything on the system.
Let's check the root flag to complete the session. However, it shows a restricted error again.
To work properly, we need to run the " sudo su " command to switch to the root user and try again.
This time, it worked.
Upon listing the files and directories, I found the flag named " proof.txt ."
If you have any doubts or queries, please
write them in the comment section. See you then.
