Pylington: 1 || VulnHub Complete Walkthrough

Edit your Listening Host IP address and Listening Port. If you don’t know your IP then you can find it by running the ifconfig command.

Before running the program, make sure you have enabled the listening port using NetCat from a new terminal.

Now click on run. 

Upon running the program, the security automatically detects it as a malicious program. 

Try again by removing the quotation mark, but it will also not work.

After analyzing the instructions once again, I found a hint. If we run an exec along with the malicious program, then there will be a chance of bypassing the server.

exec is a functionality of an operating system that runs an executable file in the context of an already existing process, replacing the previous executable. This act is also referred to as an overlay. It is especially important in Unix-like systems, although it exists elsewhere. (Source: Wiki)

So cut the lines of codes and paste them to standard input,  and in the program section write a simple program, call it through exec, and then click on run. 

As you can notice, I got a reverse shell. Let’s make it a fully interactive shell. 

Let me find out the user flag. Usually, the user flag is stored within the /home directory of the user directory.

Let me change the directory to the home directory. 

There is only one directory listed, which means the username is py. So, now change the directory to py and list the files and directories.

And here is the user flag. Let me read it using the cat command. 

The permission was denied, which means we must have to switch to the user, py, to access the user flag. But, we don't have any password to switch the user py. 

Maybe there is a password is stored within the password.txt file. Still, we can’t access it. 

Let’s analyze other files and directories.

Establishing Secure and Persistent Access with SSH Tool

After analyzing the listed files and directories, I found that typing.cc contains some helpful information that may help us log into the user py.

Because the .cc is a default extension generated after compiling a program using the GNU GCC compiler.

Let me have a look at this file using the cat command. 

Let me analyze this program code.

After analyzing, I found that the typing is an application, programmed to access the “password.txt” file. So, let me run the program. Now type the text and hit enter to get the password. 

Now, we have the password and the username, so, we can perform an SSH connection using the SSH client tool.

As we are now logged in with the user py we can easily read the user flag. 

Now we have user access but do not have the highest privilege access.

Privilege Escalation

Upon analyzing the files and directory, we found that the secret_staff directory contains another application. 

Let me read the .cc file.

These lines of code say to input lines of text which will be stored on a string container named a line, which will then be saved to this directory.

There is an “if” statement, which verifies whether the directory name is written properly or not. It seems to be like, there will be a chance of Path Traversal vulnerability.

Path Traversal Privilege Escalation via Backup Utility

A path traversal vulnerability allows an attacker to access files on the server to which they should not have access. They do this by tricking either the web server or the web application running on it into returning files that exist outside of the web root folder.

So, let’s test this Python program, to prove my assumption. 

Let me verify if the line of text is written to the /etc/passwd file. 

It means we can generate a new user having the highest privilege with the help of this vulnerability. So we have to generate a salted hash using OpenSSL.

• Here technoscience is the username and the respective password is the password for the same user.

Now copy this hash to a text editor and create a new user with root privilege:

Now, Copy the root text in the passwd file. 

Instead of the root, edit it to the given username. Instead of x just add the generated salted hash. 

Now, copy this newly created text and paste it in the backup program. 

As you can notice, a new user added to the passwd file.

Let’s switch to the newly created user using the su command.