pWnOS 1.0 || VulnHub Walkthrough

Hello everyone! Welcome to my new video. Today, we're exploring a vulnerable machine called "pWnOS 1.0." This machine is part of the pWnOS series and is classified as an easy-level vulnerable VM, perfect for beginners. 

It’s designed for those passionate about learning how system and application vulnerabilities can lead to system compromise.

To get started, head over to the VulnHub website and download the pWnOS 1.0 image. 

If you're new to VulnHub, be sure to check out our VulnHub playlist for helpful videos that will guide you through the process.

Let's dive in and start our exploration!

Settings Up

Once we've downloaded the image, the next step is setting up the server in Virtual Machine.

The downloaded image is in the form of a zip file , but, as mentioned in the README on the download page, pWnOS is made using VMware Workstation .

Although I've tried to install it on VirtualBox , it will not automatically allocate an IP address. Therefore, it is important to use VMware.

However, a problem arises if we use VMware since we have set up our attacking machine on VirtualBox. 

Do we have to reinstall it on VMware? Here, I have a solution. Follow my steps to get to know.

Before we start the process, make sure you already have VMware installed. If not, visit this blog and follow the steps to install it without any cost.

Since we have the zip file, we can now extract it using WinRAR . 

After extraction, you will see, that we have various files that look like the previously used files of pWnOS 1.0 on VMware.

To add the virtual machine to the VMware Workstation , double-click on the VMware virtual machine file type among the several files. It will automatically launch VMware Workstation and run it.

When VMware asks whether you copied or moved this virtual machine on the first boot, click on " I MOVED it! " Otherwise, the network settings could get messed up.

There are various settings left, so we have to power off the machine and launch VMware again. As you can see, the " pWnOS " vulnerable machine is listed in the VMware Manager .

As I previously mentioned, there is no need to reinstall the attacking machine (Kali Linux) on VMware to access the network. Instead, we can change the network settings to use the VirtualBox host-only adapter.

To do this, click on “ Edit virtual machine settings .”  

In the settings window, click on “ Network Adapter .” 

Check the box that says “ Replicate physical network connection state .” 

This ensures that the network connection state of your host machine is replicated in the virtual machine. 

Now, click on the “ Configure Adapters ” button under the " Bridged " option.

In the adapter settings, select only the “ VirtualBox Host-Only Ethernet Adapter ” and unmark any other adapters. 

This setting will bridge the VMware virtual machine’s network connection through the VirtualBox host-only adapter . Click OK to save the settings and close the configuration window.

By following these steps, you ensure that both your Kali Linux machine (in VirtualBox) and the pwnOS machine (in VMware) are connected to the same host-only network, enabling them to communicate with each other.

Now, you can start your pwnOS virtual machine and begin your penetration testing tasks! 

Finally, you'll notice that our Vulnerable Machine is ready, with a login prompt awaiting.

Let's dive into the fun!

Enumeration

Identifying the IP address

The initial step in our attack is enumeration, which involves identifying the IP address of our target machine using NetDiscover . To execute this, open a terminal and run " netdiscover -i " followed by specifying the network interface name, which in this case is " eth1 ."

From the scan results, we've obtained our target IP address: " 192.168.95.25 ."

Conduct a network scan to identify open ports

Next, we'll conduct a network scan to identify open ports, a crucial step in the enumeration process. This helps us understand the attack surface and strategize targeted attacks. We'll use the popular Nmap tool for this task. Run:

In this command, 

• " -sC " is used to perform a script scan using the default set of scripts, 
• while "-sV" enables version detection, allowing us to identify which versions are running on which port.

After completing the network scan, we identified five open ports:

• Port 22/TCP: This is the standard port for Secure Shell (SSH) , a secure remote login protocol. It allows secure access to the machine's command line for remote administration.
• Port 80/TCP: This is the default port for HTTP, the protocol used for web communication. It enables access to web services running on the machine, potentially revealing website content or applications.
• Port 139 and 445/TCP: These ports are commonly used by Samba, a file-sharing protocol for Windows networks. They facilitate file sharing between Windows machines and the target device. Unauthorized access could expose sensitive data.
• Port 10000/TCP: This is a less common port used by MiniServ , a lightweight web server. If a web server is running on this port, it might provide access to additional services or information.

With this information, we can proceed to explore these services for potential vulnerabilities and exploit them to gain access to the target system. Let's use these ports to further enumerate, which may lead us to gain a foothold on the target system.

Web Enumeration

Now, let's explore the content of the website running on Port 80 . To do this, open a web browser of your choice and navigate to the target’s IP address in the URL bar at the top of the window.

Upon inspection, you’ll find a welcome homepage for pWnOS . At the bottom of the page, there is a " Next " button that leads to a help page. 

Clicking on " Next " takes us to a help page, which contains a form. The form includes an input field for a name and a " Skillz " section with three options to select from: noob , skilled noob , and leet hackxor .

Let's take a closer look. 

Upon entering a name and selecting an option, the page displays a funny message, mocking the choice made for any of the three options.

To investigate further, let's check the page source for any clues. 

However, there doesn't appear to be anything useful there. 

Since we haven't found anything significant, let's move on and enumerate other available ports to continue our investigation.

Enumerating Samba, a file-sharing Protocol

Among the open ports, Ports 139 and 445/TCP are used by Samba , a file-sharing protocol for Windows networks. These ports facilitate file sharing between Windows machines and the target device. In some cases, developers might accidentally leave a share unprotected, allowing unauthorized access.

To check for available shares, use the smbclient tool in the terminal. Run the following command: smbclient -L <target_IP> . 

When prompted for a password, just press Enter to continue without providing a password. This will display various shared resources. 

I noticed a " home " share that looks interesting and might contain useful files. Next, we will attempt to connect to the "home" resource on the target server to retrieve the files and directories. 

Unfortunately, the connection failed due to an access denied error. The same issue occurred with other shares, indicating that they are restricted.

Enumerate the username and password by Brute forcing

Additionally, I tried enumerating usernames and attempted a brute-force attack against these usernames.

Extract the username using the awk command-line utility.

Now, use this for a Bruteforce attack:

However, this approach was unsuccessful as the system is highly secure and does not permit brute-force attacks.

There is only one port left for us to explore.

Enumerating the MiniServ WebMin Httpd server

Port 10000 is used by MiniServ, a lightweight web server . 

Since it is running a web server, it might provide access to additional services or information.  On the web browser, Add the port number after the target's IP address in your web browser's URL bar, followed by a colon.

Upon accessing the web server, you will be prompted to enter a username and password to log in to Webmin . 

Webmin is a free, open-source, web-based control panel for managing Unix-like systems. It allows users to configure operating system internals and control open-source applications through a web browser interface.

The Webmin login panel appears to be an old or outdated version, which could be a security risk. To check for vulnerabilities, we can use Nmap's scripting engine.

Running a Nmap scan with the http-vuln-* script reveals a potential vulnerability ( CVE-2006-3392 ) in Webmin on port 10000. This vulnerability allows unauthorized file disclosure on the target machine.

Since we've identified a potential vulnerability, we should proceed to exploit it to gain a foothold on the target server.

Exploiting (CVE-2006-3392)

To download the exploit file, click on the provided Exploit-DB link. This will redirect you to the page where you can download the exploit. 

Click on the download link to obtain the file.

Once downloaded, it is important to check if there is any modification required.

Next, we need to run the exploit and check its options. To do this, use PHP to execute the exploit file. Open a terminal and run it using php followed by the exploit file.

The exploit will guide us to provide several pieces of information. 

1. First, we have to Enter the target machine's IP address . 
2. Next, we have to specify the port number , in our case, 10000. 
3. Next, we have to specify the connection type, if it is, HTTP or HTTPS . 
4. In the end, we have to mention the path of the file, which we want to access .  Here, I am looking for  /etc/shadow/ .

Upon execution, if you encounter a fatal error related to the curl_init() function, it indicates that the php-curl extension is not installed on our Kali Linux system. To fix this issue, install php-curl .

After installing the required extension, try running the exploit again. If everything is set up correctly, the exploit should work as expected.

With no issues remaining, you can now proceed to use the exploit to gain a foothold on the target system.

Foothold

To gain a foothold, we'll extract the hash file from /etc/shadow  and /etc/passwd , using the unshadow command-line utility.

Cracking Passwords to Gain Initial Access

First, copy the contents of the shadow file obtained during exploitation and paste it into a text editor. Save this file locally.

Next, retrieve the contents of the /etc/passwd file, and save it to another file. 

Both files are ready!

With both files ready, use the unshadow tool to combine them and extract the hashes.

Now that we have a hash file, So, we can able to perform a dictionary attack against the hash file using John The Ripper . 

Upon Successful extraction, we discovered the password " h4ckm3 " for the username " VMware ".

Having valid credentials, let's establish an SSH session using these credentials. 

Attempting to connect via SSH was successful. With the SSH session established, the next step is to locate any flags. 

Upon listing files and directories, no flags were found. But there is a file “ .sudo as admin successful ”, which may be helpful for us. 

But, there is no content hidden, so it is not very helpful for us.

I suspect there may be other users are there, to verify my guess, let’s navigate to the home directory to check if there were other users. 

Yes, there is: Obama , osama , yomana .

Accessing each user's directory, revealed no flags.

Privilege Escalation Using File Disclosure Vulnerability

During privilege escalation, the initial step involves gathering system information to pinpoint potential vulnerabilities or misconfigurations that could grant higher access privileges, ultimately leading to root access.

To begin, we need to examine the permissions assigned to users to assess their privileges on the system. This can be achieved by executing commands like " sudo -l " to view the commands the current user can run with elevated privileges.

In this case, it appears that the user " vmware " does not have permission to use sudo . Let's gather more details by checking the kernel version using the " uname -a " command.

This command provides information about the kernel version, which can be useful for identifying known vulnerabilities.

Although this system is vulnerable to local privilege escalation exploits, we will not be using them for this particular exercise. Instead, we'll focus on another method.

If you look closely, when we previously extracted the target machine’s shadow file using the file disclosure vulnerability, it worked immediately.  However, on the established SSH session, trying to view the shadow file results in a permission-denied error. 

This indicates that the file disclosure vulnerability allows actions with root permissions.

It means that if we can execute a reverse shell script by taking advantage of this vulnerability, potentially giving us root access. 

Craft and deploy a  reverse shell CGI script

Here's how we can craft and deploy a reverse shell CGI script .

Why Craft and Use a CGI Script?  

CGI scripts can be executed by web servers, and placing a reverse shell in such a script allows us to run arbitrary commands on the target system remotely. By downloading and executing the script via the file disclosure vulnerability, we will be able to exploit the system’s ability to run external scripts.

First, we have to locate the Perl reverse shell script . Once we have located the Perl reverse shell script, Copy the Perl reverse shell script and rename it to pshell.cgi .

Now, we have to edit the Script. Open pshell.cgi in a text editor. Update the script to use your Kali Linux host-only IP address. 

This IP address will be where the reverse shell will connect back to. Check and, if necessary, modify the listening port to match the port you will use for the Netcat listener . Save the edited script with the new settings.

This ensures that the reverse shell script will connect back to your Kali Linux system on the correct IP address and port when executed.

Now, we have to send this file to the target system, so we need to start a simple HTTP server using Python. This server listens on port 8000 and allows clients to download files from it.

Now, on the target system shell, which we previously established using SSH, we will use w get to download the pshell.cgi script from the HTTP server . Before that, change the directory to /tmp . Now, run wget to download the script. 

This command fetches the file from the Python HTTP server and saves it to the /tmp directory.

Now, it is important to check, if pshell.cgi has the correct permissions to be executable. If not, we have to set the correct permissions to make the script executable.

Before running the exploit, start a Netcat listener on your Kali Linux system to receive the reverse shell connection. 

This command sets up a listener on port 1234 for incoming connections from the reverse shell script .

Now, use the PHP file disclosure vulnerability to execute the pshell.cgi script on the target system. This will trigger the reverse shell and connect back to your Netcat listener.

The PHP script executes the CGI script on the target system, which triggers a reverse shell connection back to the  Netcat listener . 

This connection provided us with a root shell on the target system.

With a root shell established, inspect the system for flags. 

In this exercise, no flags were found, so we conclude today's tutorial. If you have any doubts or questions, feel free to ask in the comments section. See you in pWnOS 2!