Connection Write-Up

Introduction

In this write-up, I will guide you through the steps I took to complete the HackMyVM - Connection CTF challenge. The objective is to gain root access to the target machine by exploiting identified vulnerabilities. Checkout the video here (update this).

TL;DR

Reconnaissance

Network/Port Scanning (Nmap)

Command: 

nmap -sV -sC -vv -oA connection 172.16.101.89

Explanation:

  • nmap: Tool used to scan network and ports to discover which services are running.

  • -sV: Perform version detection of services.

  • -sC: Scan using default scripts.

  • -oA: Output in filename "connection".

  • 172.16.101.89: IP address of Connection VM on my network.

Output:

Findings:

After a very long time, we get to see many services running on the box. We see that there is a web server running on port 80, an SMB server on port 139, 445 and an SSH server on port 22 which I am assuming is for better shell access after we find the user password or private key.

Let's check out the web server and in the background we can run gobuster to brute force web directories.

Directory Brute-forcing (Gobuster)

Command:

Note: I have setup an alias to run gobuster inside a docker container.

Alias: alias gobuster='docker run -it --rm --name gobuster -v /home/ayush/Tools/SecLists/:/SecLists ghcr.io/oj/gobuster'

Explanation:

  • dir: Mode of operation indicating directory/file enumeration.

  • -u http://172.16.101.89: Base URL of the target web server to scan.

  • -w /SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt: Path of word list to use.

  • -x php,txt,html: Search for the PHP, HTML and TXT file extensions.

Output:

Findings:

Let's check out the web server and in the background we can run gobuster to brute force web directories.

Visiting Web Page (Port 80)

This is just the normal landing page for an Apache server. On checking the source code, there is nothing extra or interesting. So, let's test the SMB server.

Enumerating Samba Server (enum4linux)

Command:

Explanation:

  • -a: Do all simple enumeration (-U -S -G -P -r -o -n -i).

  • 172.16.101.89: IP of the target samba server to enumerate.

Output:

Findings:

  • A user connection was found.

  • A shared folder share was found.

  • Guest login without credentials is allowed.

Let's try connecting to the share folder as a guest. Use the following command to do so:

Output:

We see that the share folder is the folder that serves the files on the HTTP server. So using the SMB server, we can add a PHP Reverse Shell there and access it from the HTTP server.

User (www-data) Access

Gaining Reverse Shell

So, in another terminal, download the PHP Reverse Shell:

Change the IP Address in the Reverse Shell file to your attacking machine:

After setting up the PHP Reverse Shell, we have to copy it to the html folder in the SMB share. In the terminal where we connected to the SMB server, run the following command to copy the Reverse Shell:

Now, we should be able to run the Reverse Shell by visiting the following URL:

So, lets start our listener with the following command:

After visiting the above URL we will have a reverse shell as shown:

First thing we do, is upgrade the shell.

Privilege Escalation

Let's checkout the sudo permissions we have for www-data. Command:

Output:

It seems the sudo command is not present in the machine. So, next we move on to the OSCP Privilege Escalation Cheatsheet that we refer to, to look for files with SUID or SGID permission.

We check for SETUID capable binaries using the command:

Output:

There is an interesting file here, the /usr/bin/gdb file. On checking GTFOBins we see that /usr/bin/gdb can be used to get root shell with the following command:

And thus we have root.

And finally, we can read the root flag:

PreviousCanto Write-UpNextDejavu Write-Up

Last updated