Ctf Download; https://www.vulnhub.com/entry/sickos-12,144/
First of all, we find out which ip the machine has.
In the screenshot below, we see the ip address of the machine.
Then we run the following command using nmap.
Below we see the results.
When we look at the screenshot above, http server is running on port 80. What are we waiting for? Let's go.
Keanu Reeves welcomes us. he's a john wick. he is a neo. he is a 47 ronin.Anyway, this has nothing to do with our topic, let's continue :D
We'll save the image and examine it.
When we examine the image, we see that we cannot obtain any data.
now it's time to do directory exploration
We start searching directories with dirb.
As we saw above, we found 2 results. We will check with Nikto for vulnerability scanning.
Looking at the screenshot above, we couldn't find anything for the home directory. now we will scan the test directory.
Looking at the screenshot, the put method is allowed in the test directory. so it is possible to upload files here. We will try to upload a reverse shell.
i will use this.
https://github.com/pentestmonkey/php-reverse-shell
After downloading it, we have to enter our own ip address there. You can change the port as you want.
We upload the shell with curl.
we have successfully uploaded the shell, let's open a shell connection immediately.
Since I entered 4444 in the port variable in the shell, I have to open the connection with 4444.
When I visited http://192.168.56.102/test/reverse.php from the address bar, the shell connection was opened.
We need to be root.We detect kernel version and operating system version.
We find the appropriate exploit. https://www.exploit-db.com/exploits/37292
we upload the exploit.
we see the exploit failed
We review the crondaily.
When we look here, we see that lighthttpd and chkrootkit services are running on a scheduled basis. We're looking at the chkrootkit version.
We see that the version is 0.49
We found the appropriate exploit.
Finally, after running the code below, we become root.
echo 'chmod 777 /etc/sudoers && echo "www-data ALL=NOPASSWD: ALL" /etc/sudoers && chmod 440 /etc/sudoers' /tmp/update
