Hello everyone! Welcome all of my viewers, to this brand-new walkthrough. In today's tutorial, we will be dealing with a vulnerable machine(i.e., Gaara), categorized as "easy" in terms of difficulty.

To begin, you'll need to download the vulnerable image from the VulnHub website. If you're not familiar with VulnHub yet, feel free to check my blog.

After you've successfully downloaded the image, it's time to set up the server using VirtualBox, which is a straightforward process.

Settings Up

1. Launch VirtualBox and go to the "File" menu, and select "Import Appliance". 

2. Import the downloaded ".ova" file. Browse your computer to locate the download file and click "Next." 

5. Review the appliance details and settings. You can keep the default settings or make adjustments based on your needs. Click "Finish" to begin importing.

6. Once the import is done, the “ Gaara ” vulnerable machine will appear in the VirtualBox Manager. Select the virtual machine and click "Settings", and change the network adapter to "Host-only adapter".

Make sure that both your Kali Linux Machine, which is used for performing attacks , and your vulnerable machine must be connected to the same network .

Once the setup is done, it's time to start the Virtual Machines. You'll notice that our Vulnerable Machine is all set, and we now have a login prompt waiting for us. 

Let's dive into the fun!

Enumeration

Enumeration is the first step of our attack, aimed at identifying the IP Address of our Target Machine using NetDiscover. To do this, open a terminal, and execute the following command:

From the scan result, we have obtained our target IP address, which is, " 192.168.95.112 ."

Conducting Network Scans with Nmap

Next, we perform a network scan to detect what ports are open. Scanning the Network is an essential part of the enumeration process. This allows us to understand the attack surface and plan targeted attacks. For this purpose, we'll use the popular Nmap tool. Use the following command, 

Where, 

• -A determines the target's OS, identifies service versions on open ports, and runs predefined scripts for advanced scanning tasks.

From the Network scanning, we have spotted two open ports.

• Port 22/TCP running an SSH service, indicating that with valid credentials, gaining login access to the server will be straightforward
• Port 80/TCP running an HTTP service, suggesting a vulnerable website is being hosted.

Web Enumeration

Now, let's explore the content of the website running on Port 80. To look at the contents ourselves, open a web browser of your choice, and navigate to the target's IP address in the URL bar at the top of the window.

Upon visiting the webpage, we noticed it only contains an image; there are no significant contents.

Performing Directory Enumeration with Gobuster

To further enumerate the target URL, we need to perform directory busting to discover hidden or hard-to-access directories and pages. We'll use " gobuster " as our tool of choice, using the following command.

Where, 

• DIR is used to specify the mode of enumeration,
• -u is used to specify the target URL, and 
• -w is used to specify the path of the wordlist.

As a result of the directory busting, results in finding 2 webpages. One of them returned a 403 status code, meaning we can't access it. So, we proceed to visit the second one.

Although the Cryoserver webpage seems blank at first, upon scrolling down, we discovered three lines of words.

After scrolling to the end of the webpage, we find 3 lines of words that appear to be webpages. Let's examine each one individually to check for any useful information.

Upon analyzing each word, we discover a string of words on the “ /iamGaara ” webpage, we come across a string of words that appear to be encoded.

Decoding Encrypted Text Using CyberChef

Now, Let’s try to decode it using CyberChef. If you don’t know, what is it, then watch this video now.

Paste the encoded word in the input section, and on the “operation section”, type “ from the base ”, and then drag each of them to get the result.

Upon attempting to decode the encoded text using CyberChef, we successfully deciphered the text, which read: " gaara: ismyname ". The word " gaara " appears to be a username.

Bruteforcing SSH Login Passwords with Hydra

Since we have the SSH service running on port 22 and now have a valid username, our next step is to perform a brute-force attack to find the password. We'll use " Hydra " for this, along with the rockyou.txt wordlist. Type the following command:

Upon successful brute-forcing, we obtain the password associated with the " gaara " username.

Now, that we have a valid username and its corresponding password, we can use an SSH client tool to log into the server, giving us a foothold to proceed further with our attack.

Foothold

Now that we have a valid username and password, we can establish a foothold on the server by logging in via an SSH client tool .

Establishing SSH Connection with Username and Password Authentication

Firstly, open a terminal and, type the following command:

Upon clicking enter, the SSH client will attempt to connect to the SSH server . If the username is valid, it will prompt us to input the password for that username.

Type "Yes", to proceed without host authenticity confirmation. Now, we have to input the password for the username.

Now, we have successfully gained a foothold on the server. The next objective is to find the user flag. Execute the " ls " command to list files and directories. Once located, use the "cat" command followed by the user flag filename to view its content.

As you can see, we have successfully obtained the user flag. Now, our main focus is to acquire the root flag. 

Upon navigating to the root directory to obtain the root flag, we need root permission. It appears to be like that, we lack the necessary permissions to access the root directory. Therefore, let's proceed with Privilege Escalation to elevate our privileges and gain access to the root flag.

Privilege Escalation

During privilege escalation , the first step is to gather information about the system and identify potential vulnerabilities or misconfigurations that could allow us to elevate our privileges to gain access to the root level.

Firstly, Enumerate User Permissions to check, the user's privileges and rights on the system. This can be done by running commands like " sudo -l " or " id " to see what commands the current user can run with elevated privileges.

Let me run the “ id ” command to find out the user and group names, and numeric IDs like UID , or group ID of the current user or any other user on the server. 

Upon running the "id" command, we discovered that both the UID and group belong to the user "gaara".

Now, let's determine the rights and privileges of the current user by executing the " sudo -l " command. On execution, we have found out that the user, “ gaara ” does not have any sudo privilege.

Now, our only option is to search for a way to escalate privileges, and we might find a hint to guide us. After realizing that there is another text file in the same directory, I believe this could be a clue left by the creator. Let's investigate it further.

Inside this file, there is an encoded text. Let's use CyberChef to decode it. 

After decoding, we obtain a directory path, which appears to be a hint for privilege escalation .

Next, let's navigate to this directory, and here, we'll have to list all files, including hidden ones, using the command " ls -al " command. 

Among the results, we found another text file named the " .supersecret.txt " file. Let's open it using the "cat" command. 

Inside this, we see an encoded text that appears to be written in Brainfuck language. To decode it, we need to visit the official site by searching on Google. 

Once there, we can paste the text and execute the decoding process. The resulting decoded text reveals the message: " It is not easy to find something! Try harder ".

Now, our best option is to use LinPEAS . As mentioned earlier, LinPEAS is a powerful tool used to extract various information, including SUID binaries , vulnerabilities , and more, which can aid in privilege escalation.

SUID Binary Privilege Escalation via GDB Debugger

To get started, you need to download LinPEAS from its GitHub repository.

Once you have LinPEAS , initiate a Python3 HTTP server. 

Then, switch back to the target server and use the "wget" command to download LinPEAS from the IP address of the machine running the Python3 HTTP server . 

If you are unsure about the IP address of your host-only adapter, you can use the " ifconfig " command to find it.

After successfully downloading LinPEAS on the attack server, we can use the " ls -al " command to check if the file exists. 

However, upon running the command, we encounter a "permission error." This indicates that the linpeas.sh file does not have the necessary execution permissions. To resolve this, we need to give execution permission to the “linpeas.sh” file. We can achieve this by using the " chmod +x linpeas.sh " command. 

Once the execution permission is granted, we can run the “ linpeas.sh ” file again. This time, it should execute without any issues.

Upon analyzing the LinPEAS output, I discovered that the server is vulnerable to SUID check , which allows for easy privilege escalation , exploitation , and write permissions . I noticed that the gdb file has root permission, presenting an opportunity to gain root privileges.

After conducting some research on Google, I found a GitHub page containing a SUID binary backdoor code. 

Apologies for the oversight with the "./" in the gdb file, but after trying again, we successfully gained root privileges. You can verify this by running the " whoami " command, which should now show us as the root user

To access the root flag, we'll need to navigate to the root directory. Use "ls" to check if the root.txt file exists. Upon finding it, use the "cat" command to view its content.

Congratulations! We've successfully completed this CTF challenge . If you have any doubts or questions about this video, feel free to write them in the comment section.