Findingmyfriend: 1 || VulnHub Walkthrough

Hello everyone! Welcome to my new video. Today, we're exploring a vulnerable machine called " Findingmyfriend ". This machine is part of a single series, and in terms of difficulty it is not indicated but you say it is a medium-level vulnerable VM.

This machine is designed to teach you about steganography, cryptography, and more interesting topics in cybersecurity.

To get started, head over to the VulnHub website and download the vulnerable image. If you're new to VulnHub, check out our VulnHub playlist for helpful videos.

Settings Up

Once you've downloaded the image, the next step is setting up the server in VirtualBox. 

The downloaded image is in the form of OVA but when I tried to run it after using the importing appliance, it failed to start. 

So, the process is to extract the OVA file and manually install the VM. First, we'll have to rename the OVA extension to ZIP. 

Since direct renaming isn't possible, open Command Prompt from this directory by typing " cmd " in the Address bar. 

This will open Command Prompt in the same directory. 

Use the " dir " command to list all directories and files and then, utilize the " REN" command to rename.

With the OVA extension changed to ZIP, we can now extract it using WinRAR. After extraction, I discovered several helpful files, including two VMDK files . 

Our next step involves creating a new virtual machine. In VirtualBox, click on " New " to create a new VM. 

Name it " Findingmyfriend ," Select the operating system type as Linux and set the version to Other Linux 64-bit , since we do not know.

Proceed by allocating RAM size for your VM and click " Next ." 

Select the Virtual Hard Disk , or, just click Next .

After clicking " Next ," then " Finish ," the setup is complete. 

Once the import is finished, you'll see the " Findingmyfriend " vulnerable machine listed in the VirtualBox Manager under the VulnHub group.

Click on " Settings ," and go to " Storage ". Remove the " .vdi " image, and Add the 2 " .vmdk " files.

Now, change the Network adapter to " Host-Only ."

It's important to ensure that both your Kali Linux machine (used for attacks) and the vulnerable machine are connected to the same network, so make sure they're both connected via the host-only adapter .

Next, attempt to start the VM to check if it works and, you'll notice that our Vulnerable Machine is ready, with a login prompt awaiting. 

Let's dive into the fun!

Enumeration

Identify the IP Address

The initial step in our attack is enumeration, which involves identifying the IP address of our target machine using Net Discover. To execute this, open a terminal and run " netdiscover -i " followed by specifying the network interface name, which in this case is " eth1 ."

From the scan results, we've obtained our target IP address: " 192.168.95.18 ."

Conduct the Network Scan

Next, we'll conduct a network scan to identify open ports, a crucial step in the enumeration process. This helps us understand the attack surface and strategize targeted attacks. We'll use the popular N map tool for this task. Run the following command:

In this command, 

• "- sC " is used to perform a script scan using the default set of scripts, 
• while "-sV" enables version detection, allowing us to identify which versions are running on which port.

After completing the network scan, we identified 3 open ports:

• Port 21 TCP : This indicates an FTP service is running on the target machine. Accessing this service with valid credentials would allow us to log in successfully.
• Port 22 TCP: This port is hosting an SSH service, which means gaining login access to the server is straightforward with the correct credentials.
• Port 80 TCP: This port is running an HTTP service, suggesting that there is a vulnerable website hosted on the target server.

With this information, we can proceed to explore these services for potential vulnerabilities and exploit them to gain access to the target system. Let's use these ports to further enumerate, which may lead us to gain a foothold on the target system.

Web Enumeration and Directory Busting

Now, let's explore the content of the website running on Port 80. To look at the contents ourselves, open a web browser of your choice, and navigate to the target’s IP address in the URL bar at the top of the window.

Upon inspecting the webpage, I figured out that it is a straightforward site, likely built with HTML and CSS. As I scroll down and read through the content, I discover a conversation between Admin and Rohit. The discussion revolves around Rohit trying to locate his friend, Honey, and includes a clue mentioning another friend named KoKo, who is apparently associated with Honey.

I don't think this provided any clues. To gather more information, let's inspect the webpage's source code by right-clicking on the page. 

Unfortunately, this didn't reveal any useful insights.

To further investigate the target URL, Let’s perform directory busting. This involves using the " gobuster " tool with the following command, aiming to uncover hidden or difficult-to-access directories and pages.

Where, 

• gobuster dir is used to instruct gobuster to perform directory busting. 
• -u is used to specify the target URL we want to explore. 
• -w is used to provide the path to the wordlist containing common directory names to try.

Using a directory discovery tool, we found 2 directory paths. However, the " /friend " directory caught our attention as potentially significant. 

Upon navigating to " /friend," I discovered a conversation between Rohit and KoKo.

In this conversation, KoKo mentioned finding a note left by the developer that appears to be unreadable in its current form. To investigate further, let’s inspect the page source code by right-clicking and selecting " View page source ."

Upon examining the source code, I found the note referenced by KoKo. 

Upon analysis, it seemed to be encoded in base64 format. 

Decode and unveil content using Cyerchef

To decode it and unveil its content, let’s utilize CyberChef. 

Upon decoding, the output seemed to be in hexadecimal form. 

To fully decipher it, let’s proceed with further decryption steps.

The decrypted content revealed a username and password combination, likely for login access. Since the target machine has FTP and SSH services running, so, let’s attempt to establish a session using FTP first.

Foothold

Access the username, Capture using FTP

Upon entering the obtained credentials, I successfully logged in. 

Upon exploring the directories, I located the first flag. So, we need to retrieve the file using the " get " command.

 Once retrieved, it can easily accessed from the /home/kali directory. 

Let’s move on to locate the next flag, as there are a total of 4 flags to find. 

Upon reviewing the files listed on FTP previously, we noticed, that there are two additional files alongside the flag file. 

So, proceeded to retrieve and analyze each of them in search of the second flag.

Upon examining the files, I discovered that the " getme " file was in an unrecognized format, neither text nor any known type. 

To further investigate, open the " note.txt " file. 

It revealed the presence of a hidden file—an image that couldn't be directly opened.

After listing all hidden files and directories, I eventually located the image file we were searching for. 

Using the " get " command, proceed to download it.

Upon downloading, the file was stored in the /home/kali directory, but it was hidden because its filename started with a dot(.) . To make it visible, open the terminal, and rename the file by removing the dot(.).

Now, it is accessible. 

It turned out to be a map image, though it didn't provide any immediate information. To continue our investigation, we need to focus on uncovering clues and exploring other hidden files.

Investigating the Image for clues and hidden files

Investigating the image for clues and hidden files can involve several steps and tools. 

Basic Examination

To start, conduct a basic examination by performing a visual inspection. 

1. Visual Inspection: Open the image with a standard image viewer and look for visible anomalies or patterns. 

Zoom in to check for any embedded text, unusual marks, or objects that seem out of place. After a thorough visual inspection, I did not discover any clues, marks, or embedded text.

2. Metadata Analysis: Analyze the metadata of the image. Use tools like, ExifTool, or FOCA, to extract metadata, which can include information about the camera used, date and time of creation, software used to edit the image, and GPS coordinates.

By examining the metadata, we can uncover additional details that might provide valuable clues.  On the terminal, run exiftool followed by the image file. 

The metadata extracted by ExifTool from the " get.jpg " file does not reveal any immediately obvious clues. However, metadata can sometimes hide additional information or point towards embedded data.

Steganography Analysis using Least Significant Bit (LSB)

The next step involves steganography analysis, specifically using the Least Significant Bit (LSB) method. This technique hides information in the least significant bits of the image. Use tools like Steghide or StegExpose, to detect and extract such data.

For this purpose, we will use Steghide, a tool designed to embed and extract hidden data in images. To view usage information for Steghide commands, use ` steghide --help `. Initially, upon running the command, I discovered that Steghide is not yet installed on Kali Linux. When prompted, type " y " to install it.

The installation process will show the steps of fetching, unpacking, and setting up the Steghide package along with its dependencies, such as libmcrypt4 and libmhash2.

Once installed, I tried to run the help command again.  

It worked correctly and displayed the usage information for Steghide commands. Now, let's attempt to extract data from " get.jpg " using Steghide. 

When running this command, it prompts us for an input passphrase. Since we don't know the passphrase, we need to use a tool like Stegcracker to brute-force it. 

Extracting Hidden Data Using Stegcracker

First, check if Stegcracker is installed by running it. If it's not installed, type " y " to proceed with the installation.

Next, use the Stegcracker --help command to view usage information. 

To crack the password, use the following command, which utilizes the "rockyou.txt"  wordlist.

The output shows that Stegcracker successfully cracked the file with the password " pollito " after trying 975 passwords.

Now, let's extract the hidden data using the cracked passphrase. 

The extracted data is saved to " abcd.txt ".  To view the content, use the cat command. 

The " abcd.txt " file contains text that appears to be Morse code. To decode this, I'll use an online Morse code decoder.

The decoded text reads: " JOHN: BOOGIE WOOGIE ." This appears to be a username and password combination. Using these credentials, we can access the target machine via SSH. 

Escalate to user, John using SSH

After trying lowercase combinations, I successfully logged in.

Now, proceed to list the files and directories on the target system. During this process, I discovered the location of the second flag. Use the  cat  command, to read its contents.

Next, let's move on to finding the third flag.  Among the listed files, there is one named " clue.txt ." This file may provide a clue for the next step. So, let me open the file using the cat command. 

Opening " clue.txt " with the cat command reveals a hint about finding out which college " she " is studying at, with a note that her brother Parth knows the answer. To proceed, I'll check if there is any user named Parth on our target system.

Escalate to user, Parth

We will view the contents of /etc/passwd to obtain a list of user accounts on the system using the cat command. 

This file includes details such as home directories and shells for each user. Upon inspection, I discovered a user named, " parth " located in the /home directory. 

Attempting to access /home/parth directory, resulted in a permission denied error, indicating that the current user, John, does not have sufficient privileges to access it.

To determine the permissions assigned to users and assess their privileges on the system, we can execute commands such as " sudo -l " to view the commands that the current user can run with elevated privileges.

However, it appears that the user, John may not have sudo access to the " findingmyfriend " system. Let's gather more details by examining file capabilities. 

To do this, we'll use “ getcap ” to list file capabilities on the system, specifically looking for any files with elevated permissions.

In this scenario, we discover that the tar binary located at /etc/fonts/tar has a special capability that allows it to read any file on the system, regardless of permissions. 

If you're unfamiliar with " tar ", 

tar stands for " tape archive ." It is a utility used to collect many files into one archive file, often referred to as a tarball , for easier distribution or backup purposes. The tar command can also be used to extract files from an archive, list the contents of an archive, and more.

Escalate to the user, Parth using Tar

Given that tar has the ability to read any file on the system regardless of permissions, we will proceed to create a tar archive of the /etc/shadow file.

Why Create a Tar Archive of the /etc/shadow File? 

The /etc/shadow file stores hashed passwords, crucial for cracking to obtain actual user passwords. By extracting and cracking the hash associated with a privileged user, we can potentially gain access to higher-level permissions on the system.

To do this, run the following command in the terminal. This command uses the special tar binary to create an archive (shadow.tar) containing the /etc/shadow file. 

The -cvf options tell Tar to create an archive ( -c ), be verbose ( -v ), and specify the filename of the archive ( -f shadow.tar ) :

The tar command indicates that it is removing the leading / from the file paths inside the archive, making extraction easier and avoiding absolute paths. 

After creating the archive, list the files and directories to confirm its creation.

Next, we need to transfer the created archive to our local machine. Use the scp tool for this transfer. 

Once the archive is downloaded, extract it to access the hashed passwords.

Since we have the shadow file, which contains hashed passwords, so, it means, we can extract the passwords using brute-forcing. For this purpose, we will use  John the Ripper.

In the terminal, type the following command, specifying the shadow hash file and using a wordlist for the brute-force attack.

At the end of the brute-force attack, I discovered that the password for user " parth " is, " johnneydep ". With this password, we can switch to the user " parth " using the  su  command. It will prompt you to input the password.

Next, run  cd  to change to the /home/parth directory.   We can confirm the change using the pwd command.

Upon listing the files and directory, I find out 3^rd flag. So, let's open it. 

Escalate to user, Honey

Now, there is only one flag left, so let’s look at the clue.

Upon reading the clue, honey.txt, it indicates that the 4^th flag is within user honey’s home directory.

Change the directory to the home directory, and list out all the directories and files within the home directory. 

There is a directory listed in the name of Honey. Navigate to the honey directory and list its files and directories to check for the 4th flag.

It is here, so let’s read the file. 

However, the user Parth does not have the right to read it. 

Privilege Escalation

So, we need to examine the permissions assigned to users to assess their privileges on the system. This can be achieved by executing commands like " sudo -l ", to view the commands the current user can run with elevated privileges.

We've discovered that we have access to a specific script, backup.py, in a directory that we can run as the user Honey without a password. This could potentially help us escalate our privileges or access restricted files.

To gain privileges, let's first inspect the contents of backup.py to understand its function and how we can use it to our advantage. 

This Python script’s purpose is to create a zip archive of the /var/www/findingmyfriend directory and store it at /tmp/website.zip .

Since we have sudo privileges for this script, if there is a way to modify it, we could potentially gain root access. To investigate, we will check the file's attributes.

The lsattr command will show the extended attributes of the “ backup.py ” file.

• The 'i' (immutable) attribute means the file cannot be modified, deleted, or renamed, and no link can be created to this file. 
• The 'e' attribute indicates that the file is using extents for mapping the blocks on disk, a common feature in modern filesystems. 

This means we do not have the right to modify this file, but we can use it to gain privileges. 

Enumerate using Linux Local Privilege Escalation Awesome Script

For a more comprehensive overview, I will use LinPEAS. You already know where to find it and how to install it.

Upon checking the pkexec policy section, I discovered that sudo has a critical vulnerability that can lead to privilege escalation. 

Click on this link, which leads us to the process of privilege escalation. 

By following the process outlined in this article, we can exploit the pkexec utility from the Polkit toolkit to gain root privileges. This involves using two terminal sessions and linking them to authenticate elevated commands without a password.

The pkexec command-line tool allows an authorized user to execute commands as another user, including root, with elevated privileges. Polkit is a framework for defining and handling authorizations, enabling unprivileged processes to communicate with privileged ones.

Here's how to gain root access:

First, in our initial terminal session, determine the PID of the current shell process. This PID will be used to link the pkttyagent to the correct session. The pkttyagent command connects a Polkit authentication agent to a specific terminal session, enabling interactive authentication for privilege escalation attempts.

Use the echo $$ command, to output the PID of the current shell. 

This PID, 1977 will be crucial for linking the authentication agent.

Next, open a new terminal and establish another SSH connection to the target machine using the same user account ( parth ). This creates a second session on the target machine, which is necessary for the next steps.

In the newly opened SSH session , link the session to the PID obtained earlier by running pkttyagent .

The pkttyagent connects a Polkit authentication agent to the session with the specified PID (1977) . This allows the authentication prompts to be handled in the second session.

Switch back to the original terminal session and run, pkexec, to attempt privilege escalation. Pkexec is used to execute commands as another user with elevated privileges. 

The  su -l root  command within  pkexec  attempts to switch to the root user.

The pkttyagent will prompt for authentication in the second session. You will need to choose the identity and enter the password. 

By choosing the identity ( parth ), it will prompt for the password. By entering the password, we authorize the command to run with root privileges.

Upon successful authentication, you will have a root shell in the original terminal session. 

Now that we have root access, we have the right to access any files on the system. Move on to flag 4 and open it. Here is the last flag. 

As mentioned previously, there is no root flag in the root directory. 

If you have any doubts or queries, please leave them in the comments.