As suggested by its name, Basic Pentesting: 1 is a boot2root for beginners.  Its description says that it contains numerous vulnerabilities and priv esc routes, so this walkthrough may be updated as I try to go back and identify them all.  You can find the file here. The VM was created for virtualbox, but I found it to work with VMWare, too. The only time that there seems to be an issue is when you try to power off the target. But if you generate a snapshot of the VM before you start working on it (something I suggest anyway so that you can always return the target to a pristine state), then this is not a problem.

Scanning

First step is to find the target machine.  We’ll accomplish this through arp-scan which broadcasts ARP packets and prints any responses.

As the only hosts running on my lab network are my kali box and the target, our target must be located at 10.10.7.9.

At this point, it’s important to note that the creator suggests adding the host to your /etc/hosts file.  This is important to do.  Add the following line to /etc/hosts (change the IP to match your network)

Next step is to determine what ports are open using nmap.

nmap notifies us that there are 3 listening ports, 21, 22, and 80.

Port :21

There is an ftp server listening on port 21.  nmap informs us that the ftp service is likely ProFTPD 1.3.3c.

Port :22

There is an ssh service listening on port 22.  nmap informs us that is is likely OpenSSH 7.2p2 Ubuntu 4ubuntu2.2.  This is also a pretty good indicator that our target is running Ubuntu.

Port :80

There is an http server listening on port 80.  It is likely Apache httpd 2.4.18.

Visiting the site shows a default Apache page.

Following my standard procedures for web servers, I next started a nikto and dirb scan

nikto

dirb

nikto and dirb both indicate the existence of a secret directory at /secret/. Furthermore, the files and directories discovered by dirb suggest that at /secret/ is a wordpress site.  Visiting the page quickly confirms this, so we will run a scan to enumerate the site.

wpscan

By specifying the -e flag, the tool tries to determine the version of WordPress, any running plugins, installed themes, etc. and return known vulnerabilities for them.  It also identified a user named admin (located at the bottom of the script’s output).

Wpscan can also be used to bruteforce login to wordpress sites, but since admin is a default user, let’s see if we can just log in using admin as the password, too.

Success!

Vulnerability Analysis

FTP

Searchsploit indicates that this version of ProFTPD has been backdoored, and better yet, there is a metasploit module for the exploit.  This will definitely be worth investigating.

SSH

Not much to see here.  There is a vulnerability in this version of OpenSSH that allows username enumeration, but since we are likely to get shell through either FTP or HTTP, I’m marking this as check last.

HTTP

There are no apparent vulnerabilities associated with our version of Apache.  But since we are logged in to the WordPress site, we can leverage our access to get a webshell.  We’ll explore this in the HTTP portion of Exploitation below.

Exploitation

FTP

Using searchsploit earlier, we know that there is a metasploit module to exploit the backdoor built in to this version of ProFTPD.  We can quickly find it using search:

Now that we’ve identified the module, we load it and set the various settings (you can always use show options if you’re unsure of what they are, or want to verify that they are correctly configured)

Our payload is ready.  Execute it with run and wait a few seconds.  Metasploit will establish a connection with the FTP server and execute our payload to generate a shell on the target machine.  Once it is established, we quickly improve the environment with our python one-liner.  And check our current user.

We have root!  At this point, we’ve owned the machine and can do whatever we want to do.  But let’s explore the web shell route.

HTTP

To get a webshell, we go to the theme editor which allows us to directly edit the php code of the various pages in the installed themes.  In order to avoid causing any problems with the site (and, in theory, avoid instant detection), we will edit a page in a theme that is not in use.  Kali has a number of web shells built in at /usr/share/webshells/.  The most feature-filled php shell seems to be qsd-php-backdoor.php.  If we replace the content of one of the .php pages in our unused theme (I am editing 404.php in the Twenty Fifteen theme) with the content of the qsd backdoor, then we should be able to navigate to this page and see our webshell.  EDIT: After completing this machine, I remembered another php web shell that I had run across on another boot2root that is very well done and definitely worth adding to your kit.  It emulates a BASH environment directly in your browser, making it for more useful than qsd in my mind.  It can be found here.

Question is, where is this file located?  Dirb gives us a hint.  Dirb found a directory labeled /secret/wp-content/themes/.  We know the name of our theme, and the name of our page, so it’s fairly simple to guess the rest of the URL:  http://vtcsec/secret/wp-content/themes/twentyfifteen/404.php

We now have a web shell on the target and can run almost any command that we want to as www-data.

Post Exploitation

Improving our environment

An interactive shell is better than a web shell, though, so now that we can run commands on the target, let’s improve our working environment by using it to transfer an msfvenom payload to the target and get a meterpreter shell.

First, generate the payload:

While our payload is generating we need to get metasploit ready to handle the incoming meterpreter connection:

Once generated, we need to transfer the msfvenom payload to the target machine. There are many ways to do this, I generally choose netcat as the simplest. On the kali box, prep our netcat listener to transmit the payload:

In the webshell, enter the following command and execute it. The string will connect to our Kali box and save anything transmitted (our msfvenom payload) to a file in /tmp/ called rshell. It will then change the permissions to allow the payload to be executed, and execute it. We need to ensure that both our metasploit handler and our nc listener on our kali box are listening, as the below string will connect to both of them.

If the command is successful, we should see two things: a successful connection to our nc listener, and an incoming meterpreter connection. The expected output for both is shown below:

Privilege Escalation

Now that we have a meterpreter session on the target, it’s time to do some further reconnaissance.  There is a good tool that can automate some of this for us called linuxprivchecker.py (available here).  We can use meterpreter to upload this file to our target, and then use the shell to execute it:

When the script has completed running, we can background our shell with ctrl+z and download the output for easier viewing.  While we’re at it, let’s grab a few other interesting files.

Looking in wp-config, we can find some database credentials that may come in handy: username(root) password(arootmysqlpass)

One thing that stands out in the output of linuxprivchecker is the fact that /etc/shadow is readable, so let’s grab that as well!

Inside /etc/shadow, we can see a password hash for the user marlinspike.  Let’s use john to try to crack it.

Weak passwords ftw!  We can now log in as this user and stop acting as www-data.  Do this either via SSH or simply using su in our current meterpreter session.

We can check to see what, if any, commands that our new user is allowed to run with sudo:

Seems as if our user is able to run any command with sudo…  Tha means we should be able to switch user to root:

We now have root!

There appear to be some other vulnerabilities present as well.  Linuxprivchecker.py seemed to think that the MySQL service running could be used to priv esc to root, however when I checked it did not appear to be running with root privileges (a requirement for the exploit to work), so I did not try it.  I also noticed that ImageMagick-6 seems to be installed.  This has a lot of vulnerabilities associated with it and would be worth investigating.  But we can sudo su, so I will leave it there for now.